In recent decades, the Justice Department has grown more aggressive in criminally prosecuting what were once considered civil infractions. This has caused white collar counsel to focus more attention on conducting internal corporate investigations in response to internal or external complaints. The challenge of fighting the government can be insurmountable when they know more than you. This article provides a few items to keep in mind when conducting an internal investigation.

Who's the Client?

Deciding which entity will retain outside counsel isn't easy to determine with an internal investigation. In some instances, the allegations of impropriety focus on company management. As such, if the corporate entity itself is the client, the executives you're investigating may also be the people you answer to. This is untenable. And the board of directors may also have members who are members of management. Consider whether the client has an audit committee or is willing to create a special board committee of independent directors. If you're hired by—and report to—an executive under suspicion, your investigation may lose all credibility.

Outside Counsel

Most federal prosecutors will tell you that an internal investigation performed by outside counsel has a better chance of convincing the government of the investigation's credibility. A thorough and reliable internal investigation may be a valuable tool to avoid charges or harsh punishment. Such an independent investigation may help convince the government that the company deserves cooperation credit, and that the company is a good corporate citizen merely plagued by a rogue employee.

Document Preservation Notice

It is important to distribute a document preservation notice to personnel with potentially relevant data and to the company's IT department. But beforehand, consider imaging hard drives, cellphones, email or file servers, and other devices where relevant data may exist. In some cases, you may want to deactivate the auto-delete email function on the devices of the suspect employees. An employee with a guilty conscience who becomes aware of an internal investigation may take steps to destroy data. This can result in severe consequences for the company and may prevent a comprehensive investigation. And consider retaining the documents of outside third parties that do business with your client.

Retaining an Expert

In certain investigations, you should retain an expert consultant. For example, if the investigation concerns manipulating medical billing codes, it's wise to engage an expert in ICD-10 (a medical classification list which contains codes for diseases, abnormal findings, and other medical diagnoses). Trying to learn complex subjects without expert help is often a waste of resources.

Collecting Documents

Once it's time to collect documents, consider data privacy, blocking statutes, and state secrecy laws to determine whether collection is permissible, and if so, how it must be performed. Particularly for a data collection outside the United States, consider consulting with local foreign counsel knowledgeable on the law in the relevant jurisdiction. And in the United States, consider whether laws like HIPAA apply (if it does, accessing patient data without a binding business associate agreement is likely prohibited by the HIPAA Privacy Rule). And evaluate if contracts with third-parties forbid your document collection plan.

'Upjohn' Warning

Right at the start of the interview, make sure to provide employees with an easy-to-understand Upjohn warning which should generally state that you represent the company and not the employee, that the interview is protected by privilege, that the privilege belongs solely to the company, that the company may elect to waive the privilege and reveal the discussions to third parties (including the government) without notifying the employee, and that the discussion must be kept confidential to retain privilege. Consider using the American Bar Association's best practices Upjohn warning when in doubt.

Conducting the Interviews

Identifying an interview location where employees will feel most comfortable is an important consideration. And think closely about the order and timing of interviews. For example, if an employee may be fired, schedule that interview before termination when the employee is still under company control. It is also important to consider whether having someone from the company attend is wise. Sometimes having someone the interviewee knows and trusts is a good idea; other times, this can have a chilling effect or harm a privilege assertion. And if possible, perform a thorough document review and conduct other interviews before you interview the alleged wrongdoer or whistleblower. Interviewing an alleged wrongdoer before you have adequate ammunition to challenge untrue statements may lead you astray. And be cautious about how much information about the investigation you provide to interview subjects—revealing what you know could result in employees harmonizing their stories. It is also wise to consider whether verbatim notes are prudent or if it's better (and more likely to hold up if a privilege dispute ever occurs) to have the note-taker only write down summaries memorializing his or her thoughts and mental impressions (and of course, don't forget to include the provision of the Upjohn warning in the notes).

Presenting Your Findings

It is important to determine the best format to prepare and communicate your final report to the client. In some cases, a written report disseminated to your client, the government, and other third parties may be necessary. Of course, proceeding this way may open up everything you've done to a privilege waiver. In other instances, the final report should be solely oral and only given to a small group in order to retain privileges.

Remedial Measures

Few internal investigations present the company with a complete clean bill of health. Make sure your client takes your findings seriously, and works to determine what could have prevented the wrongdoing. In deciding to what extent an institution should be punished, the government always asks two questions: what steps did the corporation take to prevent misconduct? and how did the entity behave after it discovered that its prevention efforts were unsuccessful or inadequate?

Disclosure

If the government isn't aware of the alleged conduct, it's important to consider whether they should or must be informed. There are a lot of factors to consider in deciding whether to self-disclose. In some instances, companies decide that the likelihood of the government learning what happened is high, so getting in the door beforehand is wise; in other instances, the opposite may be true. And under certain laws like the Foreign Corrupt Practices Act, programs exist giving substantial credit for self-reporting illegal conduct. Sometimes the conduct must be reported to the company's regulator and to others. For example, if a HIPAA data breach is uncovered, keeping it to yourself isn't an option. While the instinct of many is to keep the investigation findings a secret, this isn't always a proper course.

Wifredo A. “Willy” Ferrer, the former U.S. Attorney for the Southern District of Florida, is a Miami litigation attorney. He is the leader of Holland & Knight's global compliance and investigations team. Michael E. Hantman is a Miami white collar partner with the firm. As a former assistant attorney general, he focuses on white collar criminal defense, internal corporate investigations, compliance and complex business litigation. Both are members of the firm's white collar defense and investigations team and may be reached at [email protected] and [email protected].

In recent decades, the Justice Department has grown more aggressive in criminally prosecuting what were once considered civil infractions. This has caused white collar counsel to focus more attention on conducting internal corporate investigations in response to internal or external complaints. The challenge of fighting the government can be insurmountable when they know more than you. This article provides a few items to keep in mind when conducting an internal investigation.

Who's the Client?

Deciding which entity will retain outside counsel isn't easy to determine with an internal investigation. In some instances, the allegations of impropriety focus on company management. As such, if the corporate entity itself is the client, the executives you're investigating may also be the people you answer to. This is untenable. And the board of directors may also have members who are members of management. Consider whether the client has an audit committee or is willing to create a special board committee of independent directors. If you're hired by—and report to—an executive under suspicion, your investigation may lose all credibility.

Outside Counsel

Most federal prosecutors will tell you that an internal investigation performed by outside counsel has a better chance of convincing the government of the investigation's credibility. A thorough and reliable internal investigation may be a valuable tool to avoid charges or harsh punishment. Such an independent investigation may help convince the government that the company deserves cooperation credit, and that the company is a good corporate citizen merely plagued by a rogue employee.

Document Preservation Notice

It is important to distribute a document preservation notice to personnel with potentially relevant data and to the company's IT department. But beforehand, consider imaging hard drives, cellphones, email or file servers, and other devices where relevant data may exist. In some cases, you may want to deactivate the auto-delete email function on the devices of the suspect employees. An employee with a guilty conscience who becomes aware of an internal investigation may take steps to destroy data. This can result in severe consequences for the company and may prevent a comprehensive investigation. And consider retaining the documents of outside third parties that do business with your client.

Retaining an Expert

In certain investigations, you should retain an expert consultant. For example, if the investigation concerns manipulating medical billing codes, it's wise to engage an expert in ICD-10 (a medical classification list which contains codes for diseases, abnormal findings, and other medical diagnoses). Trying to learn complex subjects without expert help is often a waste of resources.

Collecting Documents

Once it's time to collect documents, consider data privacy, blocking statutes, and state secrecy laws to determine whether collection is permissible, and if so, how it must be performed. Particularly for a data collection outside the United States, consider consulting with local foreign counsel knowledgeable on the law in the relevant jurisdiction. And in the United States, consider whether laws like HIPAA apply (if it does, accessing patient data without a binding business associate agreement is likely prohibited by the HIPAA Privacy Rule). And evaluate if contracts with third-parties forbid your document collection plan.

'Upjohn' Warning

Right at the start of the interview, make sure to provide employees with an easy-to-understand Upjohn warning which should generally state that you represent the company and not the employee, that the interview is protected by privilege, that the privilege belongs solely to the company, that the company may elect to waive the privilege and reveal the discussions to third parties (including the government) without notifying the employee, and that the discussion must be kept confidential to retain privilege. Consider using the American Bar Association's best practices Upjohn warning when in doubt.

Conducting the Interviews

Identifying an interview location where employees will feel most comfortable is an important consideration. And think closely about the order and timing of interviews. For example, if an employee may be fired, schedule that interview before termination when the employee is still under company control. It is also important to consider whether having someone from the company attend is wise. Sometimes having someone the interviewee knows and trusts is a good idea; other times, this can have a chilling effect or harm a privilege assertion. And if possible, perform a thorough document review and conduct other interviews before you interview the alleged wrongdoer or whistleblower. Interviewing an alleged wrongdoer before you have adequate ammunition to challenge untrue statements may lead you astray. And be cautious about how much information about the investigation you provide to interview subjects—revealing what you know could result in employees harmonizing their stories. It is also wise to consider whether verbatim notes are prudent or if it's better (and more likely to hold up if a privilege dispute ever occurs) to have the note-taker only write down summaries memorializing his or her thoughts and mental impressions (and of course, don't forget to include the provision of the Upjohn warning in the notes).

Presenting Your Findings

It is important to determine the best format to prepare and communicate your final report to the client. In some cases, a written report disseminated to your client, the government, and other third parties may be necessary. Of course, proceeding this way may open up everything you've done to a privilege waiver. In other instances, the final report should be solely oral and only given to a small group in order to retain privileges.

Remedial Measures

Few internal investigations present the company with a complete clean bill of health. Make sure your client takes your findings seriously, and works to determine what could have prevented the wrongdoing. In deciding to what extent an institution should be punished, the government always asks two questions: what steps did the corporation take to prevent misconduct? and how did the entity behave after it discovered that its prevention efforts were unsuccessful or inadequate?

Disclosure

If the government isn't aware of the alleged conduct, it's important to consider whether they should or must be informed. There are a lot of factors to consider in deciding whether to self-disclose. In some instances, companies decide that the likelihood of the government learning what happened is high, so getting in the door beforehand is wise; in other instances, the opposite may be true. And under certain laws like the Foreign Corrupt Practices Act, programs exist giving substantial credit for self-reporting illegal conduct. Sometimes the conduct must be reported to the company's regulator and to others. For example, if a HIPAA data breach is uncovered, keeping it to yourself isn't an option. While the instinct of many is to keep the investigation findings a secret, this isn't always a proper course.