Standard Issues in Corporate Investigations: What GCs Should Know

Introduction

Investigations are a fact of life at any large corporation. An unavoidable cost of doing business, they potentially enable companies to identify wrongdoing in its initial stages, curtail damage to the enterprise, identify how or why investments or acquisitions may not have performed as expected, position the company to cooperate productively with regulators, and protect companies against potentially spiraling risks. While it is impossible to know how prevalent internal corporate investigations are, Duff & Phelps, a large provider of investigative services, can attest that a typical multinational company may have dozens of probes under way at any given time. The majority never reach public view.

Investigations and the allegations they address tend to arise primarily from three sources. First, many stem from individual employees’ temptations to enrich themselves, or from their struggles to contend with myriad financial, career and personal pressures. Examples of this type of wrongdoing include stealing, self-dealing (such as insider trading) and smaller-scale fraud or bribery. Second, some types of wrongdoing can often be traced to incentive structures tied to sales or profits, or internal pressures to meet the expectations of shareholders, analysts and other external constituencies. These tend to be the source of more elaborate schemes, raising complex legal and business issues. Third, many investigations arise from failures to comply with regulatory requirements imposed by state, federal or foreign entities whether intentional or not. While professional investigative firms can play an important role in scrutinizing all three types of wrongdoing, external support is especially crucial in the latter two categories. 

The regulatory enforcement landscape changed significantly early in the new millennium, in the wake of the WorldCom, Enron and Tyco scandals (among others) and the 2007-2008 financial crisis. Federal statutes such as Sarbanes-Oxley and Dodd-Frank have bolstered protections and incentives for whistleblowers beyond those already available in the form of qui tam actions under the federal False Claims Act. Meanwhile, funding for regulatory agencies has not kept pace with an increasingly complex, fast-paced economy. As such, regulators have increasingly relied on whistleblowers to identify potential corporate wrongdoing. Rather than prosecutors or enforcement attorneys firing the opening salvos in an investigation, the initial source of information may be a relatively low-level employee.

Whistleblowers may be incentivized by a significant payout and facilitated by attorneys who will take on this work on a contingent fee basis, often requiring little to no financial commitment by the whistleblower. For corporations, whistleblower-driven investigations can be particularly unnerving. Informants may wield inside knowledge and have expansive access to data. Furthermore, the government often assumes that the whistleblower’s claims are valid until proven wrong.  

By some measures, the number of whistleblower tips has been skyrocketing. The SEC, for example, received over 4,200 tips in 2016, up more than 40% compared to 2012. The SEC paid out $136 million to 37 whistleblowers from 2011-2016, as a share of penalties recovered. In July 2017, it proposed a record-breaking $61 million payout to two informants.  

The current frequency and character of government probes compels companies to conduct a greater number of internal investigations. Self-policing is an effective insurance policy. If an internal matter comes to the attention of regulators or prosecutors and the general counsel’s (GC’s) office is asked: “Were you aware of this and did you investigate it?” the best response is always “yes”. Moreover, if a company shows that it has proactively investigated allegations and has cooperated with enforcement authorities, it may generally anticipate more favorable treatment relating to eventual fines or other remedial actions (as discussed below).  

Duff & Phelps has decades of experience investigating corporate wrongdoing and associated controversies, including theft, broken deals, post-acquisition disputes and a wide range of financial, accounting and other frauds. We have scrutinized cases involving a broad array of regulatory and criminal authorities, including the SEC, DOJ, FINRA, IRS, and FTC, along with state regulators and prosecutors, as well as enforcement authorities around the world. Our professionals include former officials and agents from the SEC, FBI and CIA who provide invaluable insight into how government investigators think and the investigative processes they employ. As a global firm offering a broad array of independent advisory services, we serve more than 5,000 clients each year, including over 50% of the S&P 500, 80% of the Am Law 100 and 70% of the world’s top-tier hedge funds and private equity funds.

Informed by our collective experience and knowledge, this article summarizes key issues to consider when managing corporate investigations. We stress that each investigation, situation and corporation is unique. No single playbook could substitute for the judgement of the GC’s office or for the expert advice of outside counsel and other advisors.  

Key Issues in Managing Corporate Investigations

While misconduct and investigations are unavoidable, a GC can expect a better outcome if her organisation has investigative plans and procedures in place, is proactive in confronting any suspicions of wrongdoing, and if the investigative team avoids common pitfalls. The following sections discuss key factors that GCs should consider in developing internal compliance measures and their own best practices for investigations.

Encourage employees to speak up
It is not possible for the GC or other executives to identify at the outset whether and where misconduct is occurring across a large, complex organisation. This fact, coupled with the incentives afforded to whistleblowers who may be the first to identify misconduct, means that it is imperative for companies to build a culture that encourages employees to speak up internally when they suspect wrongdoing.

There are several measures that can help create such a culture. For starters, the company’s compliance policies should set the right “tone at the top” by encouraging employees to report their concerns and by providing clear guidance on how to submit such reports. The company should also take care to ensure that whistleblowers are treated with respect. While the law prohibits discouraging a tipster from filing a report with law enforcement, companies can diminish the odds of escalation by stressing that the tip is welcomed and demonstrating that allegations will be taken seriously. In further support of this principle, the company should have a well-articulated and enforced policy against retaliation, so that tipsters feel comfortable reporting suspicions internally without fear of retribution. In addition to being good compliance policy, this is a critical legal issue given that employment law assigns criminal penalties for retaliating against whistleblowers.

Companies with a strong compliance program often provide anonymous reporting options - for example, a hotline or anonymous email address. Anonymous reports should be treated with the same gravity as those from a known accuser. It’s often helpful to engage a third party to administer a hotline or an anonymous email address, rather than the company, to further assuage employees’ concerns about reporting directly to their employer. A company policy directing employees to report suspicions directly to the GC can have a chilling effect, especially in cases in which senior managers or executives might be the subject of the report. Having an independent intermediary field reports can help to alleviate the pressures that exist in these situations.

In cases involving identified accusers, it is important to ensure that employees are made aware of their rights. For example, the GC should provide an “Upjohn warning” - advising the employee that: (i) company counsel represents the company and not the employee; and therefore (ii) conversations with company counsel are not privileged with respect to the employee. Also, the employee should be informed that they have a right to representation, and possibly be encouraged to obtain representation in the event they might be implicated in the alleged misconduct or otherwise have concerns about their own exposure.

Begin investigations immediately
Companies often ask our experts: “How do we know we need an investigation?” The short answer: if you think you may need one, then you need one. The GC needs to be vigilant for triggers signalling that an inquiry is warranted.  

Aside from tips from employees, investigations often are triggered by concerns expressed by the board of directors, CFO or CEO, or from managers or other mid-level supervisory personnel who suspect misconduct. Suspicions may arise when expenses spike in a department, performance shifts dramatically in a business unit (e.g., spikes in revenues and profits and the end of a reporting period), or a major contract or transaction unexpectedly succeeds or fails. Surprising behaviour – such as employees refusing vacation or living beyond what their compensation would allow - may also raise red flags. Alternatively, the GC may find out that a government agency is investigating the company’s competitors as part of an industry “sweep”, as often happens, for example, in FCPA and money laundering enforcement.

In these circumstances, it is best to conduct a preemptory investigation and address the issues proactively if wrongdoing is discovered. Sometimes companies delay the commencement of an investigation because they don’t want to acknowledge the possibility that serious wrongdoing has occurred and might reflect poorly on management. Investigations shouldn’t be viewed as a penalty or an admission of guilt. They should be viewed as a good risk management practice. 

The time to launch an investigation is when you first think you may need one, not when you absolutely know you need one. Remember, it’s better to know all the bad news up front.

Establish an incident management team 
An effective investigation tends to require a diverse pool of skills and perspectives and the incident management team should be carefully selected to gather the necessary talent. At a minimum, the team should generally include legal, the head of the relevant business unit and representatives from IT and HR. The team also should be independent of the business units and individuals affected and should be properly resourced and supported by senior management.

As discussed in the following section, depending on the nature of the investigation, the team should also engage various specialists, including external legal advisors, forensic accountants, IT experts and public relations professionals.

Consider hiring independent, outside investigative support
For many companies, it is tempting to conduct investigations entirely in-house, motivated by a desire to minimise costs. With rare exceptions, this is not a prudent approach. In-house investigations may be less thorough and objective; they may cause additional harm; and they may expose the company or employees to conflict-of-interest accusations. Managers who lack experience in conducting rigorous inquiries risk alienating employees, missing key issues or tipping off witnesses or suspects. In one case in which we were involved, managers sought to cut costs by using off-the-shelf software to copy and search emails, rather than following the rigorous protocols employed by experts. This approach led to corruption of the data and raised chain-of-custody issues. It also ultimately increased the cost and time needed to complete the investigation.

Duff & Phelps is sometimes called upon to take over an investigation that proved too complex or expansive for in-house staff. In our experience, conducting a well-organised and thorough investigation from the start is critical to getting it right, particularly when interviewing sources and handling data. A witness or accused who has been repeatedly contacted before a professional interview takes place will have time to cover tracks, reducing the likelihood of obtaining a firsthand, unfiltered and accurate account.

Seeking to engage the company’s regular outside auditors to conduct or consult on an investigation is also not advisable, as this approach poses numerous conflict and independence issues. Auditors are inevitably concerned about being blamed. If accounting issues are involved, the auditor is likely to be sued. Auditors may seek to protect themselves, and will typically contact their lawyers immediately upon learning of an investigation, potentially slowing the process, adding costs and yielding an inferior outcome. Public companies have certain obligations under the federal securities laws to inform their independent auditor of potential illegal acts, but informing them is different than relying on them to contribute to your own investigation.  

In situations where a company’s senior executives are the targets of a whistleblower report or other allegation, the responsibility for conducting an internal investigation will shift to the independent members of the board of directors (in most cases the audit committee). In an even more complicated case where the directors might also be implicated (for example, by having approved a contract or transaction from which the alleged misconduct arises), it might be necessary for a company to appoint new directors to comprise an independent committee. In either case, a board committee typically will engage separate counsel to advise it, and will engage other investigative experts as the situation requires.

Outside investigative consultants should be evaluated with any eye toward the anticipated scope and complexity of the investigation. In addition to having a stellar reputation and a strong track record, the firm also should have a thorough understanding of the company’s business, industry and risk profile. The firm should be able to provide all the required investigative resources, including forensic accountants/fraud examiners, computer forensic experts (for both electronic and structured data), economists, and, in cases involving international operations, individuals with expertise in areas including, for example: counterparty and third-party due diligence; local business customs, practices, and regulatory schemes; and asset tracing. The consulting firm will ideally also have a local presence in jurisdictions where the business in question operates.  

Some investigative firms rely on subcontractors to supplement their expertise, geographic coverage or language capabilities. This can complicate proceedings and increase costs. If too many separate entities are employed, there is a risk of both overlap and gaps in responsibilities. At first blush, it may seem that a large global firm might be more expensive, but cobbling together an investigative team comprised of several smaller firms with fewer resources or limited geographic or subject matter reach likely will require even greater expenditures in the long run.  

Develop a strategy for the investigation 
Working with outside investigators and attorneys, the GC should maintain an ongoing summary of key issues, and should agree on a strategy for conducting the investigation. The strategy is highly sensitive, requiring careful consideration of possible scenarios to ensure its efficacy. It should define a timeline and expectations for future reporting and meetings for the incident management team. Issues to address could include:

• Scope of the investigation 
  • What appears to have happened, and when?
  • Does this appear to be an isolated case, or could it be more widespread?
  • What leads us to believe it is isolated or widespread?
• Evidence gathering
  • What initial evidence supports or refutes the allegations?
  • What additional evidence should be gathered, how do we gather it and how do we record efforts to gather evidence and log the chain of custody? 
  • Should we seize laptops and mobile devices?
  • Could relevant evidence be destroyed, and how should it be protected? (Typically, the GC would issue a record-retention order, and the advisor’s technology team would image hard drives and mobile devices as soon as possible.)
  • When should the relevant individuals be interviewed, and in what order?
  • How should we triage and review the evidence? (The email review hierarchy should prioritise communications most useful to the investigation.)
  • What geographic or specialised issues arise from the circumstances surrounding the investigation? For example, if the investigation encompasses overseas operations, how should translations be handled, and what terms (including code words and terms of art in foreign languages or dialects) should be included in the digital search?
• Risk and liability analysis
  • What potential legal offences do the accusations raise for both the accused and the company?
  • Are the accused personnel senior enough to be viewed as speaking for the company?
  • What other risks (reputational, business, financial, cost etc.) does the company face, and how should they be managed?
  • How do we handle outside stakeholders, such as companies that may have been complicit in or harmed by the wrongdoing?
  • How do we handle potential ongoing or future misconduct, balancing the need to stop wrongdoing with the needs of the investigation?
  • Are notes or records of discussions with employees privileged?
  • Whether and when do we notify insurers?
  • Whether and when do we inform authorities? (See below for a more detailed discussion of this issue.)
• Personnel issues
  • How do we proceed with the tipster? For example, do we ensure that no action is taken to dissuade him/her from approaching the authorities?
  • Who might be implicated among employees, management and the board? 
  • Do we offer independent legal advisors to witnesses and suspects?
  • Whether, when and how do we suspend employees, lock them out of the premises and network, and deactivate their security passes?

Maintain a flexible approach in the investigation
When embarking on an investigation, it is impossible to know where it will lead or how narrow or expansive any potential wrongdoing might be. Effective investigations follow the facts wherever they lead. Sometimes companies become so focused on one issue, complaint or counterparty under suspicion that they miss other red flags along the way. It is not uncommon that new concerns or areas of focus will arise as an investigation proceeds, or that the investigators will initially see only one aspect of a more pervasive problem. It is critical to regularly assess whether the matter at hand is part of a larger phenomenon. Seasoned, professional investigators will strike a careful balance between taking an excessively broad approach (sometimes referred to as “boiling the ocean”) and maintaining an exceedingly narrow focus that risks missing critical issues and findings.

Always assume you will litigate
Some investigations are planned from the outset with a view toward litigation – for example, a post-acquisition review of suspected accounting fraud by a target company, where the purchaser anticipates bringing an action against the sellers. Other investigations might not involve litigation as an objective or an inevitable consequence, but instead involve circumstances in which the company or the board could be sued by shareholders or regulators. In many cases, it will be prudent to ensure that the investigative team includes subject-matter experts who are qualified and prepared to testify in court. As a matter of policy, some outside investigation firms don’t testify in court. Working with them can waste the company’s time and money conducting duplicative investigations to prepare for litigation. Additionally, some investigators or employees may not have the skills needed to be effective witnesses, potentially exposing the company to additional risks. 

A company and its counsel should take special precautions in situations where an investigative consulting firm is both assisting counsel in the investigation and offering testifying experts for an anticipated trial. If not handled carefully, this can potentially raise conflicts, given that it is unwise (or impermissible) for the same individual to be both an advocate and an independent expert. Large consulting or advisory firms can serve both advocacy and expert roles, but care should be taken to establish a Chinese Wall between professionals working on the two separate elements of the representation. The work product of the investigative team can be used by the testifying expert, creating efficiencies. However, communications with counsel about work product may not be used by the expert without jeopardising privilege. 

Be mindful of containment and confidentiality
People are at the heart of any investigation. While this observation might seem to be self-evident, it is also essential for the investigative team to bear this fact in mind as the investigation proceeds. Reputations, careers and livelihoods are at stake. There may be legal or other repercussions for the company if confidentiality is mishandled.

Investigators should take care to balance the need to gather information with a desire to maintain as low-profile an inquiry as possible. A carefully managed investigation helps to maintain an element of surprise when approaching witnesses and suspects. Moreover, the accused party’s privacy must be respected as much as possible, given that initial suspicions may ultimately prove to be unfounded. On the other hand, if there is a government investigation, the GC may want employees and managers to understand what is happening and why, in order to obtain the broadest possible inputs and perspectives to assist her in preparing for interactions with regulators.  

When deciding whether to suspend employees, the company should consider how a suspension could change the employee’s relationship with the company. For example, how might it affect their willingness or obligation to speak with investigators? Could it pose liability for the company in the event the employee is later exonerated? On the other hand, might it send a helpful message to regulators, shareholders, customers and other external constituencies, that the matter is being dealt with seriously?

Consider informing the government 
The issue of when to bring suspected wrongdoing to the attention of the authorities is a critical one. The company’s decision should always be informed by the advice of counsel. While companies tend to prefer handling matters discreetly, we note that enforcement agencies typically advise that they should be informed as soon as a company becomes aware of credible evidence of wrongdoing. If prosecution or settlement negotiations ensue, how and when regulators initially learned about the matter at hand is always a key consideration. Companies caught waiting for regulators to discover infractions on their own or through whistleblowers often face harsher sanctions or, at the least, find themselves in a weakened negotiating posture.

When dealing with enforcement authorities, the company should be aware of the potential advantages of displaying confidence-building measures. Regulators’ resources are limited in proportion to the mandates they execute. A company may be treated more favourably if it convinces enforcement officials or prosecutors that it is conducting a detailed investigation, that it has a credible team in place and that it is fully cooperating with them. This approach also increases the possibility that company will retain some degree of control over the investigation.  

If a company is later charged and settles an enforcement action or prosecution, having taken the initiative to conduct a thorough internal investigation can be beneficial, including the potential for cooperation credit in setting a fine under U.S. Sentencing Guidelines. If the company enters into a deferred prosecution agreement, the company may avoid appointment of an independent monitor altogether or negotiate a narrower scope of the monitor’s duties and authority.

Prepare and update investigation policies in advance
While each situation is unique, the GC is likely to benefit from a written investigation playbook, which can serve as a general guideline for conducting investigations. The playbook should be regularly updated in accordance with lessons learned and new laws. At a minimum, the playbook should address the relevant practices described in this article.

Conclusion

Investigations into suspicions of wrongdoing are a routine but consequential matter for any corporation. The risks are substantial, particularly given the whistleblower provisions in Sarbanes-Oxley and Dodd-Frank, and given the generally more aggressive post-financial crisis regulatory environment. Through Duff & Phelps’ extensive experience helping companies and boards deal with suspected wrongdoing, we have found that companies can minimise the consequences of misconduct by encouraging employees to speak up, being proactive in addressing allegations, ensuring that investigations are handled by experienced professionals and, in accordance with the law, engaging constructively with enforcement authorities.