Companies frequently use the internal audit and review process to verify compliance with applicable laws, regulations and internal policies. Periodic internal review and analysis can be an effective way for an organization to detect areas where it may not be fully compliant and, if necessary, take corrective actions. Companies should be mindful, though, that results of internal audits and reviews are potentially discoverable by regulatory authorities and in court proceedings. Protecting the results of internal audits from disclosure is a serious concern and it is therefore critical for counsel to consider the extent of applicable privileges and protections.

Generally, opposing litigants cannot discover privileged information in a court proceeding and neither can anyone other than the holder of the privilege divulge it. Failure to protect privileged information from disclosure, however, may result in the waiver of any applicable privilege.

As discussed below, protection against discovery of internal audit reports may be available under a common law self-evaluative privilege or critical analysis privilege. Protection may also be available under the attorney-client privilege, but the attorney work-product doctrine generally does not protect such reports. This article provides a high-level overview of the application of these privilege doctrines to internal audit reports.

1. Self-evaluative privilege. Self-evaluative privilege is a protection from adverse parties for certain types of reviews, such as internal audits and other inquiries. Courts recognizing self-evaluative privilege generally require a party asserting the privilege to demonstrate the following elements:

• The information must come from a self-evaluative analysis undertaken by the party seeking protection
• The public must have a strong interest in preserving the free flow of the type of information sought
• The information must be of the type that would be curtailed if discovery were allowed

Some courts have required the following two additional elements:

• The preparer and user of the material both had an expectation of confidentiality
• Steps were taken to protect the confidentiality of the information

In Reichhold Chemicals Inc. v. Textron Inc., the self-evaluative analysis privilege was described as protecting an organization from the “Hobson's choice” of risking  the creation of a self-incriminating record by investigating potential regulatory violations. At issue was a report prepared after the fact for the purpose of a candid self-evaluation and analysis of the cause and effect of past pollution. The court reasoned that the public's interest in encouraging these types of reviews, which also include securities law audits and environmental audits among others, outweighed the plaintiff's right to discovery. However, there is significant disagreement between the courts with respect to the scope and application of the self-evaluative privilege. Many courts do not recognize it.

The insurance industry is leading the way in lobbying state legislatures to codify the self-evaluative privilege. To date, nine states have enacted laws similar to the Insurance Compliance Self-Evaluative Privilege Model Act adopted by the National Conference of Insurance Legislators in 1998. Under the Model Act, an “insurance compliance self-evaluative audit document is privileged information and is not discoverable or admissible as evidence in any legal action”. In a civil matter, after an in camera review, a court may require disclosure of insurance compliance self-evaluative audit documents, if the court determines that the privilege is asserted for a fraudulent purpose or that the material is not subject to the privilege.

2. Attorney-client privilege. Internal audit reports also may be protected under the attorney-client privilege, which prohibits the compulsory disclosure of communications between an attorney and his client related to legal advice within the scope of the attorney-client relationship. Significantly, the privilege only protects against the disclosure of communications regarding confidential information while providing legal assistance and does not protect against the disclosure of the underlying facts of the communication. It only applies to internal audits in situations where an attorney carries out the review and only for purposes that predominately concern legal issues. Generally, the person asserting the privilege must demonstrate that there was a communicationmade between privileged persons in confidence  for the purpose of obtaining or providing legal assistance. In the context of internal audit reports, the last part is crucial. In order to receive protection under the attorney-client privilege, internal audit reports prepared by attorneys should clearly state that the report constitutes legal analysis and advice, rather than general business consulting.

3. Attorney work-product doctrine. The attorney work-product doctrine protects from disclosure confidential work product prepared by or for attorneys in anticipation of litigation. However, the doctrine does not generally apply to internal audit reports conducted in the ordinary course of business rather than in anticipation of litigation. Thus, even if the very purpose of an internal audit is to identify circumstances that may eventually lead to litigation, many courts still do not consider such a review to be in “anticipation of litigation,” and therefore do not extend the privilege to internal audit reports.

Companies frequently use the internal audit and review process to verify compliance with applicable laws, regulations and internal policies. Periodic internal review and analysis can be an effective way for an organization to detect areas where it may not be fully compliant and, if necessary, take corrective actions. Companies should be mindful, though, that results of internal audits and reviews are potentially discoverable by regulatory authorities and in court proceedings. Protecting the results of internal audits from disclosure is a serious concern and it is therefore critical for counsel to consider the extent of applicable privileges and protections.

Generally, opposing litigants cannot discover privileged information in a court proceeding and neither can anyone other than the holder of the privilege divulge it. Failure to protect privileged information from disclosure, however, may result in the waiver of any applicable privilege.

As discussed below, protection against discovery of internal audit reports may be available under a common law self-evaluative privilege or critical analysis privilege. Protection may also be available under the attorney-client privilege, but the attorney work-product doctrine generally does not protect such reports. This article provides a high-level overview of the application of these privilege doctrines to internal audit reports.

1. Self-evaluative privilege. Self-evaluative privilege is a protection from adverse parties for certain types of reviews, such as internal audits and other inquiries. Courts recognizing self-evaluative privilege generally require a party asserting the privilege to demonstrate the following elements:

• The information must come from a self-evaluative analysis undertaken by the party seeking protection
• The public must have a strong interest in preserving the free flow of the type of information sought
• The information must be of the type that would be curtailed if discovery were allowed

Some courts have required the following two additional elements:

• The preparer and user of the material both had an expectation of confidentiality
• Steps were taken to protect the confidentiality of the information

In Reichhold Chemicals Inc. v. Textron Inc., the self-evaluative analysis privilege was described as protecting an organization from the “Hobson's choice” of risking  the creation of a self-incriminating record by investigating potential regulatory violations. At issue was a report prepared after the fact for the purpose of a candid self-evaluation and analysis of the cause and effect of past pollution. The court reasoned that the public's interest in encouraging these types of reviews, which also include securities law audits and environmental audits among others, outweighed the plaintiff's right to discovery. However, there is significant disagreement between the courts with respect to the scope and application of the self-evaluative privilege. Many courts do not recognize it.

The insurance industry is leading the way in lobbying state legislatures to codify the self-evaluative privilege. To date, nine states have enacted laws similar to the Insurance Compliance Self-Evaluative Privilege Model Act adopted by the National Conference of Insurance Legislators in 1998. Under the Model Act, an “insurance compliance self-evaluative audit document is privileged information and is not discoverable or admissible as evidence in any legal action”. In a civil matter, after an in camera review, a court may require disclosure of insurance compliance self-evaluative audit documents, if the court determines that the privilege is asserted for a fraudulent purpose or that the material is not subject to the privilege.

2. Attorney-client privilege. Internal audit reports also may be protected under the attorney-client privilege, which prohibits the compulsory disclosure of communications between an attorney and his client related to legal advice within the scope of the attorney-client relationship. Significantly, the privilege only protects against the disclosure of communications regarding confidential information while providing legal assistance and does not protect against the disclosure of the underlying facts of the communication. It only applies to internal audits in situations where an attorney carries out the review and only for purposes that predominately concern legal issues. Generally, the person asserting the privilege must demonstrate that there was a communicationmade between privileged persons in confidence  for the purpose of obtaining or providing legal assistance. In the context of internal audit reports, the last part is crucial. In order to receive protection under the attorney-client privilege, internal audit reports prepared by attorneys should clearly state that the report constitutes legal analysis and advice, rather than general business consulting.

3. Attorney work-product doctrine. The attorney work-product doctrine protects from disclosure confidential work product prepared by or for attorneys in anticipation of litigation. However, the doctrine does not generally apply to internal audit reports conducted in the ordinary course of business rather than in anticipation of litigation. Thus, even if the very purpose of an internal audit is to identify circumstances that may eventually lead to litigation, many courts still do not consider such a review to be in “anticipation of litigation,” and therefore do not extend the privilege to internal audit reports.