by Danielle Collazo, Featured Contributor
When an organization receives a tip about internal non-compliance, the situation has to be addressed. Executing an internal investigation can be a lengthy, cross-departmental process and should be attended to with regard to timeliness, sensitivity, confidentially, and coordination. The risks of internal investigations include negative media publicity, overlooking accomplices and/or tampering with evidence, as well as monetary losses.
Cost containment is a critical part of the internal investigation process. According to an article in the New York Times (2012), an internal investigation into phone hacking and bribery payments cost News Corporation $104 million in 2011, although that figure pales in comparison to Siemens AG’s $1 billion internal investigation, which included a $800 million settlement with the SEC for violations of the FCPA. Keep in mind that these fees are accounted for in earnings reports and affect reported revenue and could have additional indirect fiscal consequences (e.g., disappointed shareholders, customer attrition). Jaclyn Jaeger of Compliance Week assessed that an SEC probe into a case involving Wal-Mart bribing BRIC nation leaders cost the company, on average, $604,000 per day for FY:2013. The simplest way to avoid unnecessary costs is to conduct the investigation properly the first time around.
Although an internal investigation is burdensome to any corporation, it can have a far less negative impact than if the issue escalates to a civil or criminal case, wherein federal agencies take control of the investigation. An article by Josh Howard, a white collar crime defense lawyer, discussed that of the 8,634 fraud cases in 2012, only 26 of those corporations received sentences for fraud, while the remainder entered into settlement agreements. This low number is attributed to the majority of organizations executing independent investigations that were determined by a judge to have been handled properly. While discouraging unethical/illegal activity through a corporate culture that promotes compliance is the best way to avoid an internal investigation all together, in order to mitigate the risks associated with internal investigations, following a thorough assessment of the situation, these are the recommended steps to take when launching an internal investigation.
1. Creating the appropriate team: within a large organization, the lead investigator will most likely be a senior HR employee or outside legal counsel, with support from senior-level employees with in-depth knowledge of the situation at hand. Another option for the chain of command is for HR teams to train business unit managers to conduct investigations which can leave the HR team to decide on disciplinary action; however, this can also lead to the manager protecting themselves if they were at all involved in the activity under investigation. The selection of team members for the investigation is a critical step in the investigation process due to risk of confidentiality, bias, and destruction of evidence. It is a good idea to have each person involved in the investigation sign a confidentially agreement to ensure information is confined to those with a need to know.
2. Understanding the company’s legal policies: in order to proceed with the investigation, reviewing the company’s legal policy as well as statutes and laws related to the investigation can minimize the risk of stakeholder lawsuits in the future and ensure that all relative evidence can be included if legal action must be taken. Conduct investigations within “civil standard of proof” and consult legal counsel when necessary.
It is recommended that corporate lawyers provide warnings to employees about how the statements made could be used during corporate interviews, although this is not required by law. Disclosure of this information protects all parties (company, individual, law firm). In certain instances, failure to provide such information to employees can lead to legal action against law firms, discreditation of evidence against individuals obtained by these firms, and confusion among individuals being interviewed. Since standardization in the judicial system on this issue is absent, and disclosure regarding representation of law firms remains at the judge’s discretion, it is best for corporations to err on the side of caution and provide full disclosure of the company’s rights to use employee statements.
3. Synergize interviews: the risk of an employee tampering with evidence could make or break an investigation; therefore, the employee(s) under investigation should be kept away from their workspace until all necessary evidence is collected. Another risk factor to consider when the defendant is made aware of the investigation is that he/she may contact co-conspirators to “get their stories straight.” To avoid this, the employee can be placed in a holding area (such as an empty office in the HR department) without the ability to communicate with co-conspirators (no cell phone/computer access) until the interviewer is prepared to speak with them. In the event that the activity involves multiple employee interviews, each person should be held in a separate waiting area. At the same time the interviewer is gathering information, the evidence collection team should be gathering hard evidence from the employee’s workspace, in a discrete manner, and the IT team should seize computer data.
4. Gathering evidence: the HR director should plan to collect evidence based on retrieving first what is easiest to destroy and the most critical pieces to the case, in compliance with the company’s privacy policies (e.g., can your company legally seize personal email and cell phone records). HR should then contact the appropriate parties (e.g., IT department, accounting, etc.) to pull all records needed for review, all papers in the person(s)’ office(s) under investigation, work phone records, and a forensic copy of the hard drive as well. According to Barry Pollack of Miller & Chevalier’s White Collar & Internal Investigations Group, the government tends to pursue investigations “because they have concerns about after-the-fact destruction of evidence,” so this step is critical to avoid federal agencies taking the case over.
At this point, an independent party, such as a forensic accountant or attorney, that has not been involved in aforementioned process reviews the evidence and determines what action should be taken. Once a decision is made, the corporation is responsible for disclosing the findings to stakeholders and appropriate government agencies.
Keeping the Investigation Internal
It is in the best interest of the corporation and its stakeholders to contain the investigation internally. Josh Howard identified the following four failures for internal investigations that are likely to result in the case moving to federal courts:
- Ignoring a complaint or questionable activity and not taking any steps to investigate the matter
- Not protecting the attorney-client privilege within the investigation (i.e., talking to media, or external sources about it)
- Not using independent investigators, as internal investigators “are not sufficiently insulated from corporate politics.” Whether the corporation uses outside counsel to conduct the investigation or determine the outcome, having independent parties involved in the process is critical
- Not disclosing the investigation to clients, shareholders, and government officials as necessary. Leaks are practically inevitable, and stakeholders will appreciate full disclose from the company as opposed to hearing rumors and tidbits of information from external sources.
Internal investigations are not limited to fraud violations. Harassment, discrimination, and retaliation, among other illegal acts, also warrant formal investigations. Excessive internal investigations can be avoided by establishing a strong ethics and compliance policy that is highly regarded by leaders of the organization, as well as by developing a transparent reporting system. In the event that a complaint is filed or a whistleblower comes forward, companies should respond promptly and conduct a thorough, well-documented investigation led by appropriate parties in order to minimize the associated risks.