Checklist for a Corporate Internal Investigation
A Corporate Internal Investigation Should Be a Structured Process Executed with the Oversight of Experienced Outside Counsel
Checklist for
Internal Investigations Team Lead
Former U.S. Secret Service Special Agent
When the need for a corporate internal investigation arises, there is no room for error. While the investigation must be efficient, it must also be unquestionably comprehensive. All individuals involved must have a clear understanding of their role, and they must understand the importance of the attorney-client privilege and what they need to do to protect it.
All internal audits must be custom-tailored to the circumstances at hand. This applies to all aspects of an investigation—from the issues that require scrutiny to the data sources examined. With that said, there are some general principles that companies should follow in most cases, and checklists can provide the structure needed to ensure that an investigation serves its intended purpose effectively.
10-Point Checklist for Initiating a Corporate Internal Investigation
Although many circumstances necessitating a corporate internal investigation require immediate action, companies and their counsel must be careful to take all necessary preparatory steps. Early miscues can not only frustrate the purpose of an investigation, but potentially increase the company’s risk exposure as well. With this in mind, here are 10 key steps to take before initiating a corporate internal investigation:
1. Engagement Agreement for the Investigation
The company and its outside counsel should ensure that their engagement agreement covers the firm advising the company during corporate internal investigations. If the engagement agreement does not cover investigations, then the parties should amend or supplement it accordingly.
2. Documenting the Legal Purpose of the Investigation
When conducting a corporate internal investigation, it is imperative to secure the protections of the attorney-client privilege. As the privilege applies only to communications seeking or providing legal advice, the company and its counsel should be sure to carefully document the legal purpose of the investigation.
3. Identify the Internal Investigation Team
Only carefully selected internal personnel should play a role in the investigative process. Working with its outside counsel, the company’s leadership should identify appropriate internal personnel to assist in the investigative process. Typically, these individuals will include executives, in-house lawyers, record custodians and IT systems managers, and individuals who have relevant subject matter expertise.
4. Instruct All Team Members Regarding the Attorney-Client Privilege
Preserving the attorney-client privilege requires conscious effort on the part of all parties involved. With this in mind, all team members should receive instruction regarding their role in preserving the privilege and the mistakes they need to avoid in order to not inadvertently waive the privilege on the company’s behalf.
5. Establish Investigation Protocols and Procedures
Along with implementing appropriate controls to preserve the attorney-client privilege, the company’s leadership should work with outside counsel to establish other necessary investigation protocols and procedures. Generally, these protocols and procedures will need to address matters including (but not limited to):
- Chain of command and communication channels during the investigation
- Restricting access to information obtained during the investigation
- Documenting the investigative process
- Assigning roles and responsibilities, and documenting completion of steps to avoid duplication
- Escalation of issues uncovered during the investigation that require immediate attention
6. Establish the Scope of the Investigation
Defining the scope of a corporate internal investigation is extremely important. While it is imperative that the scope is sufficiently broad to allow for the discovery of all relevant information, the scope must not be so broad that the process becomes inefficient. Several factors will inform the scope of a corporate internal investigation, including the specific concerns underlying the investigation and their potential legal implications.
7. Establish the Timeline
To ensure that the company’s leadership team has the information it needs in time to act strategically, the investigation should be conducted according to a strict pre-determined timeline. Oftentimes, it will make sense to work backward from the necessary completion date to determine how quickly each step in the process needs to be performed.
8. Identify All Relevant Internal Data Sources
To ensure access to all relevant information, the company’s counsel will need to work with its internal investigation team to identify all relevant internal data sources. These sources may include desktops and mobile devices, servers, file cabinets, and individual employees (among others).
9. Identify All Relevant External Data Sources
Companies and their counsel must identify all relevant external data sources as well. These may include data storage vendors, shredding companies, and various other third-party service providers.
10. Institute a Legal Hold
Instituting a legal hold involves implementing logical and policy-based safeguards to ensure the preservation of all electronic and hardcopy files that are relevant (or potentially relevant) to a corporate internal investigation. Companies must implement their legal holds on an organization-wide scale; and, in some cases, they may need to undertake focused efforts to preserve specific records or communications before sending out company-wide notices informing employees of the need to preserve files on their desktops and mobile devices. Companies (or their counsel) must communicate with relevant external vendors as well.
Put our highly experienced team on your side
Dr. Nick Oberheiden
Founder
Attorney-at-Law
Lynette S. Byrd
Former DOJ Trial Attorney
Partner
Brian J. Kuester
Former U.S. Attorney
Hon. Kevin McCarthy
55th Speaker, U.S. House of Representatives (ret.)
Government Consultant
Mike Pompeo
Of Counsel
Former U.S. Secretary of State
John W. Sellers
Former Senior DOJ Trial Attorney
Linda Julin McNamara
Federal Appeals Attorney
Nicholas B. Johnson
Former Prosecutor
Roger Bach
Former Special Agent (DOJ)
Chris J. Quick
Former Special Agent (FBI & IRS-CI)
Michael S. Koslow
Former Supervisory Special Agent (DOD-OIG)
Ray Yuen
Former Supervisory Special Agent (FBI)
10-Point Checklist for Conducting a Corporate Internal Investigation
As we said in the introduction, a corporate internal investigation should be a structured process. Each step in the process should serve a discrete purpose and facilitate an efficient and comprehensive outcome. Here are 10 critical steps companies and their counsel should take when conducting a corporate internal investigation:
1. Collect All Relevant Documents
Even with a legal hold in place, it is imperative to collect all relevant documents as soon as possible. This is important not only for the timeliness of the investigation, but also to mitigate against the risk of employees deleting or destroying relevant records, whether intentionally or inadvertently.
2. Identify All Privileged Documents
While collecting documents during a corporate internal investigation does not afford these documents the protection of the attorney-client privilege, some documents may be protected under a pre-existing privilege. When collecting documents during an internal investigation, any privileged documents should be identified as such so that they can be redacted or withheld if necessary.
3. Interview Relevant Internal Personnel
Along with collecting records, it may also be necessary to interview certain internal personnel. These personnel will potentially fall into one of two categories: (i) they have personal knowledge that is relevant to the subject matter of the investigation; or, (ii) they are implicated in the investigation. Interviewing personnel in the latter category requires a very different approach, and all interviews should be conducted by outside counsel in most cases.
4. Maintain Compliance with Investigation Protocols and Procedures
Throughout the investigative process, the company’s leadership and outside counsel should take proactive steps to maintain compliance with the company’s established investigation protocols and procedures. This includes issuing formal and informal reminders as necessary, and revising the company’s protocols and procedures if the dynamics of the investigation change.
All individuals involved in the investigative process should be instructed to limit dissemination of investigation-related information. Unless otherwise authorized, communications regarding the existence, status, and subject matter of the investigation should be limited to the investigation team and outside counsel, and all communications should be disseminated on a need-to-know basis.
6. Maintain Awareness of External Risks
While proceeding through the investigative process, it is important to maintain awareness of any external risks. For example, if the investigation relates to a federal inquiry or enforcement proceeding, the company’s leadership and outside counsel should maintain parallel tracks focused on the internal investigation and the government’s actions, respectively.
7. Maintain Close Communication with Outside Counsel
The company’s leadership (including those leading the company’s internal investigation team) should maintain close communication with outside counsel throughout the investigative process. Appropriate internal personnel should run all legal concerns by the company’s counsel, and the company’s executives should consult with counsel before making any decisions that have legal implications.
8. Determine When to Close the Investigation
Closing a corporate investigation should be a discrete and identified event. At this point, internal members of the investigation team should be able to fully resume their normal job duties, and policies and procedures implemented specifically for purposes of conducting the investigation should generally be retired.
9. Assess Legal Risks and Necessary Remedial Action
Using the information uncovered during the investigation, the company’s legal counsel will provide an assessment of the company’s risks and recommend necessary remedial action (if any). The company’s leadership team can then use this legal advice to make informed decisions about their next steps, as well as to make any necessary decisions about defense strategies in pending litigation or enforcement proceedings.
Finally, the company and its counsel should appropriately store all documentation related to the investigation. This includes retaining all files that may be necessary to defend the company, as well as separately storing files that are subject to the attorney-client privilege.
Speak with a Senior Corporate Internal Investigation Attorney at Oberheiden P.C.
Oberheiden P.C.’s attorneys are highly experienced in advising companies during internal investigations. To speak with a senior corporate internal investigation attorney in confidence, please call 888-680-1745 or request an appointment online today.
