Conducting an internal investigation: A primer

Well, it has finally happened.
A senior manager in your company just dropped by your office to explain to you a “troubling” situation that came to her attention recently. After providing some sketchy details about a “significant” contract and a few secondhand statements overheard during a happy hour after a client meeting, the manager leaves your office looking less burdened than when she came in.
You recognize that what you’ve heard – while less than conclusive and not yet backed up by tangible evidence – has the potential to be a real problem for the company.
Troubling questions begin swirling through your mind. Was it a single transaction or event, or many? Could there be a bad apple in the organization, or a barrel full? Did the issue just arise, or has it been ongoing? Did it surface earlier and get ignored by someone in a position of authority?
Given today’s scandal-ridden corporate environment, your first thought might be, “How soon can I find a new job?”
However, after a moment’s reflection you realize you are about to enter the world of corporate internal investigations. This article provides a practical overview of some important considerations and decisions which come into play when companies confront matters suggesting the need for an internal investigation.
This is the first of a two-part series. This part will assess when an internal investigation should be conducted, who should conduct it, and what the objectives should be.
The second part will appear in the July issue of New England In-House and will focus on fact finding, reporting, and developing an appropriate response.

When is an internal investigation appropriate?
The need for conducting an internal investigation may arise in any number of situations.
For example, you might obtain information suggesting that (i) a violation of accounting rules or policies may have occurred or be occurring; (ii) the company or an employee may have violated the law; (iii) the company’s code of conduct or other important company policy has been breached; (iv) a government or other regulatory investigation might or will involve the company; or (v) the company has incorrectly or improperly billed the government for goods or services. The list could go on and on (and grows almost daily as new reports of corporate scandals emerge), but an issue can arise from many different types of situations.
Additionally, for attorneys “appearing and practicing” before the Securities and Exchange Commission on behalf of issuers, rules adopted pursuant to the Sarbanes-Oxley Act of 2002 create specific obligations to report up-the-ladder to the chief legal officer, chief executive officer and board of directors under certain circumstances.
These reporting obligations are triggered when an attorney subject to the rule is confronted with credible “evidence of a material violation by the issuer or by any officer, director, employee, or agent of the issuer.”
While the SEC’s rules don’t apply for every organization, they are a good guide to matters that might trigger an internal investigation. The rules create a framework for the response of a chief legal officer to reports of material violations, including instituting an appropriate level of investigation and – unless the CLO reasonably believes (after appropriate investigation) that no material violation has occurred – taking all reasonable steps to cause the company to adopt an appropriate response to the issue.
Under the SEC’s rules, a “material violation” means (i) a material violation of an applicable federal or state securities law, (ii) a material breach of fiduciary duty arising under federal or state law, or (iii) a similar material violation of any federal or state law.
“Evidence of a material violation” means evidence “based upon which it would be unreasonable, under the circumstances, for a prudent and competent attorney not to conclude that it is reasonably likely that a material violation has occurred, is ongoing, or is about to occur.”
The rules indicate that a “reasonably likely” violation means more than just a possibility, but it does not have to be probable – i.e., it doesn’t need to be more likely than not.

Who should do the investigating?
You also have to consider who should conduct the investigation, and who should at least be aware of it. This can have very important implications in the context of a publicly traded company, but should also be carefully considered in the context of privately held and not-for-profit organizations.
If the matter involves accounting, accounting controls, financial reporting, or auditing, the complaint should be expeditiously reported to the audit committee of the board of directors (assuming one exists, as with all publicly traded entities) and in all likelihood to the full board of directors so they are aware of and can monitor the situation and the appropriateness of any response.
Typically, some or all of the most senior executives of the company should also be aware that the investigation is taking place. Who should be involved, and to what extent, ultimately depends on the facts and circumstances, so one should reflect carefully.
It is good practice to have the lawyers representing the corporation conduct the investigation. First, counsel better understand the legal framework in which facts developed in the investigation may be applied, and the potential liabilities which could arise. Referring the matter to counsel may also help maintain confidentiality.
Although the company may later choose to waive any protections provided of the attorney/client privilege or work product doctrine, it is better to have the choice rather than no protection at all – particularly if litigation ensues.
A related question is whether in-house or outside counsel should conduct the investigation. While this is sometimes a simple resource constraint question, there are many considerations, such as expertise and experience, actual and perceived independence (of in-house and external counsel), the “non-legal” roles that are sometimes played by in-house counsel, the strength with which privilege or other protections may attach to the investigative work, and so on.
In any event, in-house counsel is likely to play an important coordinating role and is often in a better position to understand the inner workings of the company.
Issues arising in investigations often have financial (and financial reporting) implications that are not obvious to some, or even most, lawyers. These can span issues such as revenue recognition and timing, expensing, reserve accounting, tax, contingent liabilities, and a host of others.
Thus it is often prudent to involve someone from the accounting side of the organization in some or all of the process so that financial and accounting ramifications are not inadvertently overlooked.
Experts or other third parties are often retained to assist with an investigation, to provide additional resources, specialized subject matter expertise in areas like accounting and forensics, or technological expertise for data restoration and database building. Whatever the reason, it is important to clearly document that third parties are retained to assist attorneys in the rendering of legal advice, so that their work can be protected as much as possible from forced disclosure.
For example, it may help to have third parties retained by outside counsel (if they are conducting the investigation) to make the nature of the relationship clear.

What are the objectives?
Internal investigations have several important objectives. The organization must first understand the nature, scope, and significance of the matter under investigation.
However, bear in mind that an investigation is not an end in itself. A thorough understanding of the facts is critical to the development of an appropriate response, both from a remedial and preventative standpoint.
Facts developed through an investigation will also facilitate the assessment of any potential legal or financial exposure the organization may have, and with the development of appropriate defenses to such claims.
Also, governmental investigations, litigation, insurance claims, employment issues and a wide variety of other matters can come into play during or in the aftermath of an investigation. Accordingly, it is crucial at every stage of the process not to lose sight of the interrelationships and collateral effects of these kinds of concerns and activities.
The results of an internal investigation can be used to assess and improve a company’s internal control structure. For example, was the potential problem identified thanks to the company’s internal controls? Was it reported through channels designated by company policies and procedures?
Were the company’s paper and electronic records properly maintained and accessible? Did they yield timely, relevant and useful information? Did the chain of command respond appropriately, efficiently and effectively once an issue was raised?
The answers to questions like these may point to ways of detecting or even preventing future problems. Like the adage says – an ounce of prevention is worth a pound of cure.
Gerry Haines has been the chief legal officer of publicly traded companies for more than a decade, providing strategic leadership and advice on a wide variety of business and legal matters. He most recently served as executive vice president of strategic affairs and chief legal officer of Enterasys Networks, Inc. Gerry is also a director of the New England Corporate Counsel Association, a professional network of in-house counsel which provides monthly legal seminars, continuing legal education, resource sharing, and networking for members. Gerry can be contacted at [email protected].