Successful internal investigations can be extremely valuable corporate governance tools. The effective identification, investigation and remediation of risks that arise within a business are integral to mitigating the legal, commercial and reputational harm they threaten. David Hamilton, partner and business crime and regulatory specialist at Howard Kennedy, explores the essential building blocks of a successful internal investigation.
Although not normally in the public eye, corporate internal investigations have come under scrutiny following several high-profile controversies. Over the past year, we have seen a very public internal probe into Coutts’ debanking of Nigel Farage and its extraordinary fallout that led to NatWest CEO Dame Alison Rose’s resignation. The press has also reported at length on the Red Bull F1 team’s investigation of misconduct allegations against its team boss, Christian Horner, in which he was cleared, and the Post Office’s review and exoneration of its CEO Nick Read amid bullying claims by a whistleblower.
These recent examples highlight the legal, commercial and reputational risks businesses can face in the context of internal probes, particularly those involving sensitive misconduct allegations. It is vital that companies have protocols in place to manage internal probes and effectively mitigate risk. While each investigation is unique, and methodologies will depend on myriad case-specific factors, businesses need to carefully consider these three points (at least) at the outset to ensure they get it right from the outset.
Triage
Having a clear, preferably written, framework for assessing, processing and escalating issues is fundamental to a successful investigation. This begins with the initial triage, which routinely involves:
- Considering any evidence on a preliminary basis
- Identifying and assessing the nature and seriousness of potential harm to the business, employees and broader stakeholders (including, for example, whether it potentially involves breaches of applicable laws and regulations)
- Deciding whether further investigation is necessary
Who conducts the triage will inevitably depend on the nature of the issue and how it was identified — via a whistleblower, an employee complaint, a communication from a business partner or competitor or a regulatory enquiry or knock on the door. HR, compliance, legal, risk or regulatory relations (particularly in the financial services sector), may all have a role to play. Whoever does conduct the triage will need to be sufficiently independent of the issue to ensure subsequent investigations are defensible.
How Can Outside Counsel Sidestep Ethical Pitfalls in Internal Investigations of Antitrust Wrongdoing?
DOJ has sharpened focus on individual accountability — and on health care. This signals an uptick in internal investigations involving outside counsel, who must traverse the potential pitfalls.
Read moreDetailsWho runs the investigation?
Having determined that the issue requires further investigation, the question arises as to who should run it. Again, much will depend on the issues in focus, but the overarching aim must be the effective deployment of individuals with the right subject matter expertise and skills.
In cases where internal resources are insufficient, or where the triage has identified potential regulatory or criminal exposures (whether at corporate or individual levels), companies are increasingly turning to external counsel. The advantages of doing so are potentially significant.
First, external advisers may provide specific matter expertise, strategic experience and benefits of scale. Second, retaining external legal advisers may also help to bolster claims to legal privilege protections if required, although as noted below, this is not entirely straightforward. Third, appointing external experts to run the investigation can be a powerful way to demonstrate the probe’s independence and integrity, mitigating against accusations that the company marked its own homework.
Companies should, however, take care that their choice of firm does not create a reputational own-goal.
While retaining the company’s regular ‘business as usual’ adviser may offer some advantages, leveraging in-depth knowledge of the business and close relationships with key decision-makers, there is a risk that the firm could be seen as too beholden. Certainly, conflict issues can quickly emerge in cases where the regular firm was involved in setting up, or advising on, compliance systems and controls that are now under review.
This is not simply a question of public opinion. Depending on the subject matter, there may also be regulatory or law enforcement expectations to consider. Can authorities have confidence that the company’s review is independent and rigorous and give it appropriate credit?
As a practical example, having recently completed a substantial internal investigation for a financial services client, our firm engaged with the Financial Conduct Authority (FCA). The first two questions we received asked whether the investigation had been conducted in an independent and forensically sound manner and whether we had experienced any pushback from the client’s management. Happily, we were able to answer yes and no, respectively. It was nevertheless telling that the FCA was primarily concerned with establishing the investigation’s independence and integrity at the outset of its enquiries.
In cases where regulators are involved, the importance of securing confidence in your investigation methodology can hardly be overstated. Strategically, it demonstrates that the company is a good corporate citizen intent on doing the right thing, potentially mitigating against further interventions. Even in the event further investigations are considered necessary, a robust, independent and rigorous internal investigation can help drive efficiencies by providing the regulator with a launching pad for its own enquiries, avoiding reinvention of the wheel (with all its associated time and cost implications).
Independence and integrity should therefore be the watchwords as companies consider who is best placed to drive the investigation forward.
Maximizing legal privilege protections
It may not always be necessary to cover internal investigations with legal privilege, but in particularly sensitive cases, the importance of maintaining such protections is vital. Once established, legal privilege constitutes a substantive right to withhold all protected communications from third parties, including prosecuting authorities or regulators or other parties in the context of civil litigation.
Therefore, before embarking on an internal investigation that calls for legal privilege protections, companies need to be thinking about how the investigation can be structured and staffed to ensure they apply. In the UK, this is particularly important because of the English courts’ narrow approach to legal privilege in the context of corporations. Legal advice privilege, for example, only applies to communications between a lawyer and the person or defined group tasked with seeking and receiving legal advice. Even then, the communication must be made in a legal context and its dominant purpose is to obtain or give legal advice.
The first step is to identify who the “client” is for the purposes of the investigation. The person, or group of people, tasked with seeking and receiving legal advice should be memorialized, ideally in the letter of engagement with the law firm conducting the investigation as well as internally. The constitution of the group will differ from case to case. However, each member must be independent of the issues under review, avoiding conflicts of interest that compromise the investigation’s integrity. This can lead to tricky situations, particularly in smaller companies where the pool of individuals to choose from may be very limited; in one case we advised on, the company brought in a non-executive director specifically to ensure independent internal oversight of the investigation.
In practice, it will often be necessary to have a core “client” group to protect communications of legal advice and a broader investigation team that is brought into the circle of trust — subject to confidentiality protocols and clear confidential reporting lines — but is not privy to legal advice. Members of the broader investigation team may include IT security, HR, compliance, legal, risk, internal audit or data protection — people whose skills and knowledge are vital to identifying and forensically securing relevant data as well as navigating corporate processes and structures.
Even with the client group locked down, it remains a challenge to claim legal privilege over aspects of internal investigations. Most notably, witness interviews where conversations and notes of conversations with current and former employees, company officers and other parties — even notes taken by lawyers — are unlikely to attract legal advice privilege because they are not communications between a lawyer and client.
While the other type of legal privilege — litigation privilege — is broader, protecting confidential communications between a client, lawyer or third party created for the dominant purpose of conducting or avoiding actual or reasonably contemplated litigation, the “litigation” must be adversarial. This can be problematic in the context of internal investigations, particularly if they are conducted prior to the authorities having been notified or having conducted any substantive investigations of their own (still less provided any indication that they have a case against the company).
If recent case law, including the Serious Fraud Office’s now-discontinued action against mining company ENRC, tells us anything it is that legal privilege claims are inherently fact-specific. Nevertheless, a good principle to follow is to mark all investigation communications as privileged with a contemporaneous note memorializing the rationale for the claim. Such evidence may be critical in subsequent litigation where privilege claims are challenged, demonstrating what was in the parties’ contemplation at the relevant time. It is far easier to adduce that kind of evidence than rely upon after-the-fact witness statements. There is no guarantee that the claim will succeed, but this approach will put the company in the best possible position.
Looking ahead
Internal investigations can be fraught, and it is all too easy for companies and their advisers to launch into the process without taking stock and plotting a measured and proportionate way forward. Having a clear methodology at the outset, even one that is developed at pace, is crucial toward ensuring the success of the investigation. Time spent assessing the issue, implementing a risk-appropriate response, identifying the right investigation team and ensuring the best structure to maximize legal protections will never be wasted.
David Hamilton is a partner at Howard Kennedy in London. He is a white-collar and regulatory lawyer with significant experience advising on bribery, fraud, money laundering and market manipulation matters, especially financial services enforcement and compliance. David has nearly 15 years' experience representing individuals and corporates in the context of internal investigations and actions brought by domestic and international regulatory and law enforcement bodies, including the FCA, SFO, HMRC, the European Commission and the DOJ. 
