Corporate Internal Investigations: A Beginner’s Guide

Internal investigations and regulatory inquiries are a major source of concern for corporate legal staff—and the COVID-19 pandemic isn’t helping matters any.

That’s according to the Norton Rose Fulbright Litigation Trends Survey 2020, which found that, compared with other types of legal disputes, investigations and regulatory matters were the second-highest cause for concern. Additionally, almost half of respondents—45 percent—reported that they expect COVID-19 issues to drive an increase in their volume of disputes throughout 2021.

An investigation isn’t bound by court rules or procedures—in fact, there’s no one way to handle every potential complaint.

Not every complaint leads to an investigation: sometimes a company may decide that a claim is so unsubstantiated, or its allegations so minor, that it does not warrant further inquiry. But the comparison to litigation matters is useful because a corporate internal investigation involves an ediscovery-like fact-finding exercise that includes both reviewing documents and interviewing witnesses.

Handling complaints effectively with comprehensive internal investigations can have numerous benefits, such as:

  • preventing the reoccurrence of problem behaviors through personnel actions, additional training, or changes in policy;
  • avoiding criminal or civil liability for the organization or its officers;
  • helping the company prepare for a formal governmental investigation, a litigation matter, or an appropriate settlement; and
  • maintaining the business’s reputation and protecting against bad publicity.

Let’s take a closer look at how a corporate internal investigation unfolds and what you should do at each stage.

5 steps and best practices for effective internal investigations

Once a company or its corporate legal department decides to begin an employee investigation, there are five key stages to completing the inquiry. We’ll break down those five stages in more detail along with best practices for each step along the way.

1. Planning: Setting the scope of the investigation

Carefully defining the scope helps with keeping an investigation on schedule and within budget. If an investigation is too broad, it can drag on for months or even years, costing the company entirely too much. On the other hand, a too narrowly scoped investigation can miss real issues, such as related violations or whether supervisors or high-level officers or board members were aware of the situation.

It’s not uncommon for an investigation to uncover multiple issues. Looking at a concern too narrowly can cause a company to completely miss evidence of other misconduct.

Best practice: Once you’ve determined the scope of the investigation, set a realistic but not generous timeframe for your investigation. If you don’t have an expected end date, an investigation might linger on, continually turning over new evidentiary stones and looking for needles in haystacks. Keep it focused and prompt by knowing from the outset when you’ll wrap it up, and you’ll have a better chance of avoiding “scope creep.”

Scoping and planning out an investigation includes an assessment of available evidence, including financial records, employment records, internal communications, and so on. Be mindful of data privacy issues, especially those that might occur in different jurisdictions or across borders. It’s also worth remembering that scope is an ongoing question: while you need a rough idea of the extent of an investigation to complete the next two steps, those steps may also inform the intended scope, necessitating adjustments.

Best practice: Don’t assume you know what happened until you’ve investigated a matter. It can be easy to overlook evidence or downplay its significance if you’ve assumed—consciously or otherwise—that you know how the matter is going to end.

2. Preserving evidence

Any information that is potentially relevant to the claim—that is, anything that will help you get to the bottom of the accusation—must be protected from alteration or destruction.

Best practice: Suspend your normal retention and information-disposal procedures and place a legal hold on any evidence that is relevant to your investigation, just as you would do in eDiscovery if you were notified of a pending or anticipated litigation matter.

While you’re preserving evidence, cast a wide net so you don’t miss anything. Include these items:

  • emails, text messages, and other communications, both internal and external;
  • files and documents, both electronic and hard copy, for any involved employees;
  • meeting notes; and
  • corporate records such as personnel files, timesheets, accounting records, and so on.

Using technology that can assist in the preservation of data is key here. Both automated document retention and destruction policies as well as intention user deletion can have a significant negative impact on your efforts to collect evidence. Legal Hold solutions are able to not only notify data custodians of their obligation to preserve evidence but also to preserve content that might otherwise be deleted.

Not only will you need this information for your corporate internal investigation, but government agencies and private litigants will also demand this information if the matter proceeds to a regulatory inquiry or a litigation matter.

3. Deciding who should conduct the investigation

There are two separate questions regarding who should be in charge of an investigation. First, should the company have its in-house counsel handle the inquiry or involve outside counsel? And if the company retains outside counsel, can it use its usual firm or should it look for an unassociated firm or one that specializes in the particular conduct alleged?

Companies often want to keep investigations in house to keep both costs and disruption to a minimum. For smaller and less-concerning investigations, this is likely fine. But for serious allegations or those that involve someone in a relatively high position within the company, it’s a better idea to hand the matter over to outside counsel that do not routinely represent the firm. Regular counsel are more likely to be—or at least to be seen as—sympathetic to a longstanding client or to have conflicts of interest.

Best practice: Be mindful of conflicts of interest, both real and perceived. If in-house counsel or regular outside counsel are friends with a supervisor or high-ranking employee who is accused of wrongdoing, you should hire a different firm to manage the investigation. Even if counsel truly are impartial, it may not look that way to an outsider.

Attorney-client privilege is also more easily protected with outside counsel, simply because it is easier to establish that the company has retained counsel for legal advice and not for a business purpose. In that same vein, outside counsel, rather than the company, should hire any necessary experts, to make it clear that those experts are also aiding in legal preparation rather than in a business activity.

Best practice: Outside counsel are also likely to be more experienced with various types of alleged wrongdoing, especially if you select counsel who specialize in the sort of complaint you’ve received.

4. Fact-finding: Reviewing evidence

Once you have your investigation planned out, you’ve preserved relevant evidence, and you’ve decided who will be in charge of the matter, it’s time to get into the real work of investigating: assembling and interpreting the facts.

First, you’ll want to collect all of the relevant information you’ve identified. Note that as you review that evidence, it will likely point you toward additional information that may be useful. You don’t want to go down every rabbit hole, nor should you ignore related information.

To make it easier to manage the volume of documentary evidence you’re likely to encounter, leverage your existing eDiscovery tools. Document review can be the most time-consuming and expensive part of most investigations, but automated eDiscovery technology can dramatically lighten the load by weeding out clearly irrelevant documents and helping more substantive information float to the top of the pile.

eDiscovery solutions that employ automatic classification of content can substantially light the review process by sifting junk out of the potentially relevant pile.

Best practice: Don’t blow your budget on document review. As in eDiscovery, reviewing documents can be the most expensive part of an investigation. Use your eDiscovery technology to quickly eliminate irrelevant documents and focus on those that are most helpful.

5. Reporting the investigation’s findings

Your investigation isn’t complete just because the fact-finding portion is done: you still need to decide how you will report your findings and what the company is going to do about any founded allegations.

Your report should include:

  • a statement about the initial allegation;
  • a discussion of how the investigation proceeded;
  • details about what the investigation found;
  • a review of the relevant laws, regulations, or company policy and how that authority applies to the discovered facts;
  • a recommendation regarding the company’s response; and
  • a summary of required next steps in terms of disclosures and regulatory inquiry or litigation management.

You must also decide, at the conclusion of an investigation, how the company will use the new information it has gained. Your responses could include disciplinary action for the involved employee(s), additional training and education to avoid any reoccurrence of the misconduct, or a change in your corporate policies and procedures.

Best practice: Make sure you’re hearing about allegations and complaints before they blow up into lawsuits and federal investigations. Implement an anonymous employee hotline and be sure you’re not penalizing people who are vocal about problems or issues they see.

Final thoughts

Effective internal investigations are the key to minimizing risk 

As long as there is employee misconduct—which is to say, forever—companies will need to be prepared to investigate allegations of wrongdoing if they hope to minimize the damage to their reputation, their bottom line, and ultimately their very existence. While corporate internal investigations are complicated and infinitely variable, there are common stages that must be completed in an effective investigation and best practices that will steer you on the right path regardless of the specific details of a claim.

Learn more about Legal Hold solutions from IPRO.