Internal investigations are suddenly big business. Everyone is doing them, from corporate pariahs like Enron, WorldCom, Aldelphia, and Tyco, to corporate giants like Xerox, AOL, and Oracle.
If you are an in-house attorney, how do you know whether to launch an internal investigation? How do you make sure your investigation solves the problem without creating new ones? Here are some questions you should ask before proceeding.
Should I Start an Internal Investigation? Usually you will have no choice. Many events outside your control can trigger an investigation -- a question from your auditors, negative press, a regulatory inquiry or subpoena, a hostile question from a securities analyst, the discovery of accounting irregularities, or even an anonymous tip about wrongdoing.
Last year's Sarbanes-Oxley Act is the main culprit. Under Sarbanes-Oxley, public companies must adopt procedures for investigating complaints by whistleblowers. Audit committees must establish procedures for receiving and investigating complaints and are expressly empowered to retain outside lawyers and consultants for this purpose. CEO's and CFO's must personally certify the accuracy of their company's financial statements and the adequacy of internal controls; as a practical matter, they will need to investigate all suggestions of fraud before providing the required certifications. And attorneys who participate in preparing SEC filings must report evidence of wrongdoing and also ensure that appropriate remedial action has been taken in each case. Sarbanes-Oxley virtually mandates internal investigations in these situations.
Sometimes internal investigations make good sense even if they are not required. In a shareholder derivative lawsuit, for example, a company may move for dismissal based on the results of an independent investigation and recommendation of dismissal by a committee of disinterested directors. And an investigation may be useful if your company faces an enforcement action by the SEC or Department of Justice, as those agencies have promised leniency to corporate defendants that voluntarily police themselves.
That said, internal investigations are time-consuming, expensive, divisive, and potentially damaging to morale. They have a life of their own. They may produce evidence requiring costly remedial measures. And they may create a roadmap for litigation by shareholders, competitors, or government attorneys.
What Should I Hope to Accomplish? Three things. First, your investigation should resolve the immediate problem. A thorough investigation can put an end to meritless allegations. It also will help you address and resolve instances of misconduct.
Second, your investigation should reduce your exposure. A good investigation can help take the sting out of even serious wrongdoing. The SEC, for example, has promised to "credit self-policing, self-reporting, remediation and cooperation" in deciding whether to commence enforcement proceedings and/or in deciding what sanctions to pursue. And recent Department of Justice guidelines "encourage corporations, as part of their compliance programs, to conduct internal investigations and to disclose their findings to the appropriate authorities." (If you intend to take advantage of these provisions, make sure you comply with the requirements outlined in the SEC's and DOJ's releases.) More generally, an internal investigation may identify and correct systemic weaknesses and, ultimately, reduce your company's exposure to scandals and litigation going forward.
Third, an investigation should help you spin the inevitable publicity. It may be the best way to get in front of the story and get started on the long road to restoring investor confidence.
Who Should Conduct The Investigation? Your lawyers. They are best suited to the tasks of collecting evidence and marshaling arguments, and are better able to invoke the attorney-client and work product privileges. So you really have just two choices: in-house counsel, under the direction of management; or outside counsel, under the direction of a board committee.
The choice depends largely on whether senior management is likely to be implicated in the alleged misconduct. Where the allegations do not involve senior management, in-house lawyers will be less expensive and disruptive. They also have superior knowledge of their company and its employees.
When the allegations may reach senior management, however, outside counsel will be better able to project objectivity and thoroughness, deflect allegations of a coverup, and preserve applicable privileges.
How Do I Select A Committee of Independent Directors? If you choose an investigation directed by the board, you'll need to appoint a committee of disinterested directors.
An extensive body of law has developed in Delaware regarding director independence. Independent directors must have no financial stake in the outcome of the matter and must not be dominated or controlled by management or influential shareholders. This means, among other things, that the directors should not be employees or consultants of the company. Their lawyers and advisors also should have had no prior relationship with the company and should have no expectation of receiving further work.
Sarbanes-Oxley adds a new twist to these rules. Under Sarbanes-Oxley, the stock exchanges were required to tighten their definitions of independence. The stock exchanges now say that material business relationships between a director's employer, such as a law firm or consulting firm, and the company will compromise the director's independence.
New ways to run afoul of director independence rules crop up all the time. Last June, a Delaware court rejected the independence of Oracle's special litigation committee because of ties between committee members and corporate directors and officers to Stanford University. According to the court, "this was a social atmosphere painted in too much vivid Stanford Cardinal red for the SLC members to have reasonably ignored it."
Another common obstacle to director independence is litigation. Delaware law says the mere fact a director is a named defendant in litigation does not disqualify him from investigating the matters that are the subject of the action. "Specific allegations" of misconduct by the director, however, are disqualifying. You should carefully review the involvement of each director in the matters to be investigated before deciding on your committee.
How Do I Manage An Investigation by A Board Committee? Set it up correctly and then leave it alone. Once disinterested directors have been identified, the board of directors should delegate to the committee full authority to act for the company in the matter under investigation. The committee should be responsible for determining the scope of the investigation, hiring counsel and other consultants, establishing budgets, and reviewing invoices. The committee must also preserve its independence by not discussing its work with management. The committee should actively direct the investigation, weigh the evidence, reach reasoned conclusions, and recommend remedial action. Outside counsel should meet regularly with the committee and present it with alternatives, such as potential witnesses to interview and additional topics or transactions to review, with the final decisions remaining in the directors' hands.
How Do I Preserve The Attorney-Client and Work Product Privileges? Preserving the privilege is easy; not waiving it is what's hard. Your company will face pressure from all sides to disclose the substance of the investigation. For example, you may decide to submit the report to the court in a pending shareholder derivative action; the court may then allow discovery into the evidence supporting it. If you're facing a government inquiry, you will almost certainly be asked to waive the privilege. The Department of Justice says it will consider a company's "willingness to cooperate in the investigation of its agents, including, if necessary, the waiver of corporate attorney-client and work product protection" when deciding whether to bring criminal charges. The SEC has taken a similar position.
Management often has reasons to decide to waive the privilege. New managers, for example, may waive the privilege (and blame the wrongdoing on prior management). Your auditors will almost certainly ask to review materials collected during the investigation; sharing them with your auditors will waive the privilege. And, if your company goes into bankruptcy, the trustee or debtor in possession may waive the privilege in support of claims against former management or professionals.
You should decide early on whether you will need (or want) to share your investigation with third parties. Don't make the mistake of assuming the investigation will be privileged, only to realize later that it must be disclosed for all to see.
Do I Want A Written Report? Only if you need one. A written report draws attention like manure draws flies. Everyone -- the SEC, the Justice Department, and plaintiff attorneys -- will want to see it, and most will want to criticize it. The better alternative is the "oral report plus." Deliver an oral report supplemented by binders of relevant documents, and then memorialize the report and its conclusions in summary minutes. You'll only need a written report if you intend to turn it over to a court in pending litigation, you intend to share it with the SEC or Department of Justice, or, in limited circumstances, you intend to make its contents public (think Enron and WorldCom).
With all the pressures to conduct internal investigations, you'll almost certainly get your chance. Think it through before you start. Begin with the end in mind. And things will turn out fine.