Internal investigations as a tool of corporate governance

It is important to ensure that the investigations team is independent from those under investigation.  It goes without saying that the team should exclude any person who has been accused of wrongdoing.  The business will need to give careful thought to the professional relationships of any investigation subjects and to identify and manage any potential conflicts of interest.

As a rule of thumb it is best to keep the investigations team as small as possible but inevitably investigations can involve a lot of stakeholders, such as IT, HR, Communications, Legal, Compliance and Internal Audit.

Confidentiality is often key to a robust investigation process and will be supported by clear communications protocols.  It can also help to protect against risk of a whistleblower alleging or suffering detriment, since the Employment Rights Act 1996 provides whistleblowers with unlimited damages where they can show they have suffered detriment as a result of blowing the whistle.  Investigations should be managed keeping in mind the need for discretion, minimising business interruption and ensuring sufficient objectivity or detachment.

You should also consider what independence means when appointing any external advisers, whether external lawyers, forensic accounting teams or other experts.  The reality is that most companies turn to their trusted advisors to conduct sensitive or material investigations.  They understand the business and its ethos and can move quickly and effectively to support the business.  But views about what amounts to independence differ and may be challenged.  The company will want to ensure that the investigation is appropriately described, rigorous, that the work product is objective and that the mandate that underpins the investigation supports those outcomes.

Ask yourself:

• do we have the right people?
• are they independent and trusted individuals?
• is the person overseeing the investigation sufficiently senior and independent?
• have we made confidentiality obligations and lines of communication clear?
• which external advisers do we need?
• have we given our external advisers a clear mandate?

Be clear from the outset about who the output of the work is for and who it may be shared with.  In the report itself, it is important to avoid overstatements, exaggeration, speculation or rushed judgements.  If the report is being prepared by non-lawyers, they should avoid drawing legal conclusions about the conduct under investigation.  It is quite common for companies to have to give auditors access to extracts from investigation reports or sometimes to the reports themselves.  If you do need to share investigation work product with auditors, finance providers or others, this should be on strict terms (see privilege, pillar 5 below).

Establishing a clearly defined scope of work at the outset will help to direct the work, manage costs and time, and deliver an output that is fit for purpose.  Scope change can be necessary to keep an investigation useful and relevant, but focus and a careful balance will be needed to avoid unnecessary scope creep. Broadening scope will often impact on timing and may dampen the key purpose and learnings.  The work can become vague and unwieldy if every hare that is set running is chased down.  Equally, an overly-narrow scope may be seen as self-serving or, worse, deliver an output that begs the question: if material which is excluded from scope is necessary to assess the matters in question, the resulting work product will not achieve its aims. Robust discussions around scope review are a valid part of investigation governance.

It is important to establish a clear governance framework around the investigation.  Consider:

• an investigation sponsor to lead and direct the work
• establishing a steering committee
• having clear terms of reference – to establish the purpose and scope of the work
• management information needs – to help project management and oversight
• how the team will update senior management (and if that is appropriate)
• information sharing protocols, so that all involved are clear on who needs to review and approve what documents, communications and decisions

Legal professional privilege

Legal professional privilege affords confidentiality to communications made for the purposes of legal advice or for litigation and can only be provided by lawyers.  Where there may be sensitive legal issues, legal analysis and advice required, or the risk of litigation or employment claims, you will need to preserve your right to receive privileged legal advice without disclosing it to third parties. That does not mean that a law firm cannot produce, or be involved in producing, a report over which you would not claim privilege.

Where law or regulation is in question, there is value in having this assessed by a professional lawyer rather than a lay person.  Equally, if the subject matter is heavily financial or data driven, other types of expert will be of value.

Litigation privilege

For communications with "third parties" to be protected by privilege, "litigation privilege" must apply.  Litigation privilege only applies, however, where adversarial proceedings are in reasonable contemplation.  The application of litigation privilege to an investigation is thus very fact specific.  The strength of any claims to privilege must be properly tested and understood from the outset and may shape the strategy of the investigation.

Privilege in investigations

The current law around privilege and how it applies in investigations is complex.  Commonly the most difficult privilege issue that arises in investigations is in relation to witness interviews.  It is often necessary to speak to witnesses, but these communications may not be protected by privilege.  This is because "legal advice privilege" only covers communications between client and lawyer, and the term "client" is currently construed very narrowly in English law to mean a person authorised to give instructions and receive the advice.

Specific issues can arise where an individual who is a director or shareholder is under investigation, as the law on their rights to privileged material arising from their status is different than for other workers, employees or third parties.  Care should therefore be taken to minimise such entitlements in an investigation context.

Sharing privileged material

English law recognises that it is possible to share privileged material with third parties without destroying the privilege in the document as against the rest of the world, known as a "limited waiver of privilege".  If companies decide to share investigation reports or extracts of them with third parties such as auditors, it is important to maximise the level of privilege protection that endures by sharing the material under a limited waiver.  It is important to bear in mind that some jurisdictions do not have a limited waiver doctrine, and to take account of the impact of sharing privileged content in all relevant jurisdictions. In addition, the Government's ARGA White Paper includes a request for views on whether the regulator should be able to obtain such material shared with auditors on a limited waiver basis as part of its investigation powers, despite the material being privileged. [1]

[1] Read our commentary in the FT on this proposal here

Internal investigations will often be triggered by, or involve an element of, employee conduct or whistleblowing.  Companies need to ensure careful coordination with HR and employment lawyers on the employment law risks and processes, the impact of the investigation work on potential tribunal claims, and managing staff exits.  The "investigative" and "employment" parts of the process need to be delineated as confidentiality and privilege that apply to investigative interviews do not transfer to grievance and disciplinary processes.  Labour laws vary tremendously across jurisdictions and employment law risk is always heightened in cross-border investigations.  For example, France and Germany do not currently have one concise code/regulation in this area and, like other EU countries, will need to introduce new laws by December 2021 to comply with an EU Whistleblower Protection Directive.  There will therefore be significant change as EU countries pass legislation and EU employers revise policies and procedures to comply with the new rules.

Specific considerations (under UK law) include:

• in order to be protected, the whistleblower only has to reasonably believe that their allegation of wrongdoing is true – it does not matter if the allegation is in fact untrue
• a whistleblower is protected even if they raise their allegation in "bad faith" (e.g. for personal gain)
• whilst the whistleblower must reasonably believe their disclosure is in the public interest (in order to be protected), case law has shown this is a low hurdle
• compliance with whistleblowing and grievance processes
• the need for any suspensions or dismissals
• communications with employees, including those who are whistleblowers or have brought claims, those whose assistance may be needed as witnesses or resource, and the wider body and
• exit arrangements and settlements

Preserving and collecting relevant data is one of the most critical steps in an investigation and if there is any business crime or civil fraud risk this should be done in a forensic way.  The sources of relevant data have been multiplying in recent years with the result that specialist help is usually required to ensure a thorough preservation process.  Allocating responsibility for document preservation, collection and storage needs careful consideration at the outset, including advice as to the legal restrictions on gathering and sharing data arising from data protection legislation.  A plan for preserving electronic data and documents at the outset, to reduce the risk of attempted or accidental deletion, will be important to support the collection and review of material during the course of the work.

At the other end of the spectrum, it is important to avoid creating material which may fall to be disclosed and may reflect poorly on staff or the company.  Consider:

• Highlighting to staff the importance of not engaging in unnecessary or speculative discussions through messaging tools, mobile phones or email
• HR and Internal Audit may be engaged in related investigations and may not realise that their communications, including with other team members, are not protected from disclosure
• The investigation team and committee itself thinking carefully before creating material in a way which is not legally privileged

Witness interviews are an important part of evidence gathering.  We have already mentioned the challenges they present around privilege.  Interviews have to be handed skilfully and cautiously.  There have been a number of high profile complaints from interviewees about the conduct of interviews, and the clarity of explanations around who interviewers work for.  Interviews, particularly of sensitive issues, need to be conducted carefully and with appropriate explanations, warnings and caveats.  In the present COVID-19 environment, challenges may also arise over the veracity and confidentiality of interviews that have to be conducted remotely – including the risk of unauthorised recording and the presence of other parties.

Part of the value of voluntary investigations and reviews is in the opportunity to explain and position the subject matter and findings with stakeholders.  To optimise this opportunity, consider: 

• The need for "Maxwellisation" in certain types of investigations – a process of allowing individuals who are named in the report an opportunity to comment before publication. This is a way both to check the accuracy of findings and reduce defamation risk.
• The need for market announcements or shareholder communications, particularly if an issue, or the investigation itself, has been made public
• What should be said (if anything) by way of key messages to the Board and to other internal stakeholders
• Public relations support if the outcome is to be communicated more widely, or if there is press interest in the work

Companies need to consider reporting obligations from the outset of an investigation and keep them under review.  The UK has very expansive legislation relating to money laundering.  Dealing with criminal property that a person knows or suspects is criminal property can give rise to a money laundering offence.  This is the case even where the crime has been committed by third parties not linked to the company.  This means that as the company's understanding of an issue develops, it must keep criminal risks under review.  A good example is where a company receives contract revenues that it comes to suspect may be tainted.  Those suspicions can mean that the revenues are considered "criminal property" for money laundering purposes.  In those circumstances companies will wish to secure a statutory defence to money laundering, which may be available through reporting the conduct in a prescribed way.

PRA and FCA regulated firms may have additional regulatory reporting obligations arising from the conduct under investigation.  Listed firms may have to consider market announcement obligations.

In addition to statutory and regulatory reporting obligations, companies will need to consider whether the conduct triggers contractual reporting obligations such as under insurance policies, financing agreements and other commercial arrangements.

The discipline of investigations is developing.  While there are a lot of black letter legal issues that arise in investigations, much of the wisdom and learning in relation to investigations is borne out of experience and embedded in good practice, rather than hard law.  The areas we have set out above are key issues where inexperience can cause difficulties for companies.  It is important to achieve best practice.  Investigations play an increasingly important part in how companies can provide assurance around strong corporate governance.