New England Biz Law Update
(Editor’s note: This is the second part of a two-part article. The first article, which appeared in the May 2007 issue of New England In-House, focused on when an internal investigation is appropriate and who should conduct it. This part addresses fact finding, reporting and developing an appropriate response.)
Investigative fact finding
Investigative fact finding stands on two primary pillars: document review and interviews. While preliminary interviews may be necessary to understand the basic nature of the matter under investigation, gathering and reviewing relevant documentation should generally precede detailed interviews.
This way more relevant questions can be asked, promoting efficiency and minimizing the risk of overly broad investigations involving distraction, dead ends and wasted time. Of course, as information is developed and assembled, the scope of an investigation may change – sometimes dramatically. However, these judgments can only be made as information becomes available.
Another key consideration is document and data preservation. Corporations often have document retention/destruction policies. E-mail archives and backups are routinely overwritten or eliminated in due course. In-house counsel should consider whether automated policies should be temporarily suspended.
In addition, it is often advisable to notify some (or sometimes all) employees that all documentation should be preserved until further notice. Document preservation issues are especially important in contexts where the matter under review is, or might be, the subject of a government investigation. If relevant documents are altered or destroyed, individuals and organizations can face very significant criminal penalties.
Interviews with employees and sometimes third parties are another key activity in the fact gathering process. Important information is often obtained or lost based on how well prepared an interviewer was before the first question was asked, making document review and even the order of interviews very important.
Before interviewing employees, counsel should convey the following points clearly: (i) The employee is expected to cooperate fully and provide truthful information; (ii) the employee is expected to keep the interview and other information about the investigation confidential; (iii) whether to disclose information in the future is the company’s decision, not the employee’s; (iv) the investigation and the interview are being conducted by counsel for the purpose of providing legal advice to the company; and (v) counsel represents the company, not the employee.
The Securities and Exchange Commission felt it was important to remind lawyers of this last point, stating in §205.3(a) of its up-the-ladder reporting rules that “[a]n attorney appearing and practicing before the Commission in the representation of an issuer owes his or her professional and ethical duties to the issuer as an organization. That the attorney may work with and advise the issuer’s officers, directors, or employees in the course of representing the issuer does not make such individuals the attorney’s clients.”
Notes and memoranda of interviews should be clearly marked as privileged and confidential, and make it clear that they contain the mental impressions of attorneys representing the company. Doing so will increase the likelihood of the documents being protected by the work product doctrine.
Reporting the results
After completing an investigation (and perhaps along the way if it is an extended process), it will be necessary to report on the results to the board of directors or its committees, some of executive management, and reporting attorneys under the SEC’s up-the-ladder reporting rules.
It may also be necessary or desirable to report on the results to third parties such as the company’s outside auditors, governmental bodies, self-regulatory organizations, or even the public. Whether, how much, and in what form to report to these constituencies is a fact-specific and highly complex determination that should be considered carefully with legal counsel.
One important consideration is whether a report should be oral or written, and there are pros and cons to each approach. Written reports are clear, less susceptible to varying interpretation, often reflect careful consideration of wording and analysis, and are easier to disseminate to people. They are also more vulnerable to inadvertent disclosure in whole or in part, cannot be as effectively updated if important new information or conclusions arise, and are often the subject of hard-fought battles over discovery or privilege waivers, both intentional and accidental.
Oral reports are easier to keep confidential, are flexible and easily tailored to the audience, can often be delivered more quickly, and can be easily adjusted to incorporate new information and conclusions. They can also be less complete or refined, more susceptible to differing interpretations, and fade more readily over time.
Regardless of the delivery method, all recipients at the company should be reminded that the communication is delivered under the protections of the attorney-client privilege and attorney work product doctrine, and should be kept absolutely confidential. While any such protections might be waived later, it is always better not to do it accidentally.
Finally, one must consider any mandatory or desirable third party disclosure. For example, public companies must be mindful of financial reporting deadlines and the obligation to update incorrect or misleading prior disclosures. Additionally, a company must consider issues such as the terms, conditions and reporting requirements of loans, investment arrangements and other relationships that could drive third party reporting. The timeliness and accuracy of information, particularly in matters with current or past financial implications, can be important in all of these areas.
Developing an appropriate response
Sometimes even the best companies and internal control systems can’t prevent individuals within the organization from doing something wrong, whether from inadvertence, negligence, or downright wrongful intent. However, a company’s ability to identify, investigate and respond to potential misconduct can be a very important matter, particularly when dealing with the government.
The SEC has given useful guidance about how it evaluates the response of companies to misconduct within the organization. In SEC Release 34-44969 (involving an enforcement proceeding against the former controller of a public company’s subsidiary), the SEC listed factors it would consider in evaluating a company’s conduct, including:
1. The nature of the misconduct (mistake, negligence, deliberate);
2. How the misconduct arose (pressure to achieve results, lawless tone, absence of controls);
3. Where in the organization the misconduct occurred (how high in the organization, was it isolated, sanctioned, ignored);
4. How long the conduct lasted (one time, one quarter, several reporting periods, did it occur before the company went public, did it facilitate going public);
5. How much harm was inflicted upon investors and other constituencies;
6. How was the misconduct detected and who uncovered it;
7. How long after discovery did it take to implement an effective response;
8. What did the company do when it learned of the misconduct (was it stopped, are the responsible persons still with the company or in the same positions, was disclosure prompt and effective, did the company cooperate with regulatory and enforcement bodies, was there appropriate recompense to those adversely affected);
9. What processes did the company follow to resolve these issues and “ferret out” necessary information, and were the audit committee and board of directors fully informed (and when);
10. Did the company commit to learn the truth, fully and expeditiously, with a thorough review of the “nature, extent, origins and consequences of the conduct and related behavior” (including evaluating the independence of those conducting the review and any limitations in its scope);
11. Did the company promptly make the results of its review available to the SEC, with sufficient documentation reflecting the company’s response to the situation, and did it promote employee cooperation and provide relevant information that was not directly requested;
12. What assurances are there that the conduct is unlikely to recur; and
13. Is the company the same company in which the misconduct occurred, or has it changed through a merger or bankruptcy reorganization.
This analysis determines what, if any credit the SEC may give for corporate self-policing, self-reporting, remediation, and cooperation, in turn influencing whether a company may be sanctioned through enforcement or other proceedings.
Importantly, the SEC’s guidance highlights practical issues to be considered in any internal investigation, even for entities not subject to the SEC’s rules. Thinking about these questions is instructive when considering whether and how to conduct an internal review, and in developing an appropriate response.
Conclusion
In short, internal investigations are a complex area with many and sometimes divergent considerations. There is no “best” way to conduct them, and what is the best or worst approach may change as the situation develops.
However, knowing and periodically revisiting of some of the important considerations will increase the odds of a successful conclusion that balances the risks, time, costs and various strategic and tactical issues encountered along the way.
Gerry Haines has been the chief legal officer of publicly traded companies for more than a decade, providing strategic leadership and advice on a wide variety of business and legal matters. He most recently served as executive vice president of strategic affairs and chief legal officer of Enterasys Networks, Inc. Gerry is also a director of the New England Corporate Counsel Association, a professional network of in-house counsel which provides monthly legal seminars, continuing legal education, resource sharing, and networking for members. Gerry can be contacted at [email protected].
