The exceptional circumstances related to COVID-19 have required investigators to think creatively about how they will conduct investigations when much of the workforce is working remotely and social distancing restrictions are in place. This creativity is necessary to ensure that critical information can be obtained when long-standing investigative processes – physical site visits, in-person interviews, review of original documents – are not consistently available. When developing these solutions, it is important that investigators adhere to certain general investigation principles to ensure a conducive and transparent process.
These principles may include:
1. Confidentiality – Maintaining confidentiality is critical to the integrity of an investigation. The need for confidentiality arises at the time of receipt of a complaint but does not end upon the conclusion of investigation. The materials and/or information gathered, and the results of the investigation must always be treated confidentially, regardless of the circumstances under which they are obtained.
2. Professionalism - Investigators should conduct themselves and their investigation in a manner exemplifying integrity, fairness, and diligence. Investigators should not only be objective, independent, and free of conflicts of interests, but also viewed by all stakeholders as having these qualities.
3. Preventing Retaliation - It is fundamental that those who are the source of a complaint and/or those who cooperate in an investigation be protected from retaliation. It is important to understand that a person will only provide information if they believe they will not be penalized in the future for doing so.
4. Timeliness - The timeliness of an investigation will be unique to each case. Generally, the Investigation Leader will set a timetable that gives a reasonable amount of time to conduct the investigation, to which investigators should adhere. While current circumstances may pose challenges in this respect, clear communication around timeframes is essential.
Getting it right from the start
Regardless of who is ultimately appointed to lead an internal investigation or how it is being conducted, a Single Point of Accountability (SPA) for the investigation must be established at the outset. Our experience has shown that a methodical approach at the commencement of an investigation goes a long way towards bringing efficiency and credibility to the process. This is even more true when investigations are conducted using a variety of methods and in uncertain business environments. It is crucial that the SPA adhere to the following best practices.
- Clarify the allegations - Clearly identify and understand the allegations. Start with what you know and determine what additional information is needed to assess the veracity or seriousness of the allegations.
- Decide whether to investigate - The decision to investigate should be taken carefully regardless of the current business environment and pressures. Consideration should be given to critical factors, such as legal and regulatory requirement, severity of the alleged misconduct, the potential criminal or regulatory enforcement or civil litigation that may arise from the matter, as well as whether such an allegation can be addressed through management action alone.
- Build the investigation team - Identify investigation team members with the necessary skillsets and independence early on to ensure that the investigation will be conducted competently and will withstand scrutiny. The team should include an Investigation Leader responsible for managing day to day investigations. Determine who within the company will direct the investigation: the board; an independent committee of the board (e.g., Audit Committee, Special Investigative Committee); management (CEO, General Counsel, Chief Compliance Officer (CCO), Corporate Security); or a “Qualified Legal Compliance Committee” under Sarbanes-Oxley.
Covering the bases
Once the investigation team has been assigned, the Investigation Leader should:
- Locate and preserve the evidence – The term “evidence” here includes people, papers, and electronic records. Consider immediate steps such as halting routine document destruction by IT department, as well as taking forensic copies of documents available on the network and individual computers. Once the investigation ceases to be confidential within the company, consider extending the preservation notice to all concerned employees.
- Develop an investigation plan – This should include the purpose and scope of the investigation; lines of authority between the investigative team and the Client/Board; timeline of the alleged violations; applicable laws, policies, procedures, code; and identification of the concerned staff members from whom information will be sought in the process. In an uncertain environment, the logistical limitations or challenges of remote work will need to be acknowledged throughout the plan.
- Collect documentary and physical evidence – In the case of overt collection, employees must be asked about the devices and means to access the data. Further, data privacy laws in various jurisdictions may warrant legal advice and specialized consultative help. The current COVID-19 situation may necessitate remote document collection; however, it is critical to thoroughly document the process of data collection and maintain an access log. It is important that the “Chain of Custody” be maintained to establish the authenticity of the evidence.
- Review documents – The documents should be reviewed for “privilege” and “relevance”. Access to the former should be limited to avoid inadvertent waiver. Establish a privilege log, meeting the requirements of Federal Rule of Civil Procedure 26(b)(5)(A), containing the information for each privileged document such as the date, type of document, author(s), recipient(s), general subject-matter of the document and the privilege being claimed (e.g., attorney-client).
- Interview Witnesses – Where possible, investigators should use two-person interview teams so that one interviewer can ask questions and the other can document the interviewees’ responses as well as identify areas for follow-up questions. It is important to establish from the outset of the interview who the interviewers represent and their relationship to the interviewee. Specifically, the interviewers must make clear for whose benefit they are conducting the investigation and to whom the results of the interview will be reported. Due to COVID-19 remote working conditions, it is prudent to consider video calls, as opposed to regular phone conversations, as these would help capture the body language and may provide useful cues to the investigators.
- Reporting – At the outset of an investigation, and as it progresses, due consideration should be given to how investigative findings will be reported to corporate stakeholders. Thought should also be given to the medium by which findings will be relayed – i.e., orally or in writing; in a prose report or through a slide presentation – as well as the amount of detail to be included. These decisions will be influenced by factors such as the need to preserve privilege, the potential for discovery in future litigation, and the likelihood of a regulatory or prosecutorial enforcement action, among others. Irrespective of the medium selected and the desired degree of detail to be included, it is important that any reporting include a description of what occurred, who was involved, how it occurred and the potential consequences of the findings, including the likelihood of civil or criminal liability on the part of the company. To the extent, that the report finds misconduct resulting from a failure of policies, procedures, or internal controls, it is helpful to include recommended changes for remediating any perceived shortfalls.
COVID-19 has drastically changed the way businesses have traditionally operated and many investigation teams have already added new technology options to their investigative toolkit. This will, inevitably, change the way investigations will be conducted going forward. Nevertheless, following the basic principles that have been consistently applied over the years will ensure the credibility and transparency of the investigation process. It is critical that the key stakeholders--General Counsel, CCO, IT corporate security and others within the company--be proactive about ensuring that the inevitable changes in how investigations will be undertaken in the post-COVID-19 era not cause the company to deviate from these long-standing basic principles.
Authors:
Brian Mich, Partner and Salman Raza, Senior Consultant