If there was an award for the biggest corporate flub of the year, Hewlett-Packard Co. would be the uncontested winner.

The California-based tech company made headlines in September with news that its former chairwoman, Patricia Dunn, secretly authorized a private detective company to search for the source of boardroom leaks to the media. Investigators spied on HP employees and business reporters, dug through their trash and used pretexting–falsely assuming someone's identity to obtain private information–to access their phone records. The latter could warrant criminal charges.

Dunn, who resigned following the revelation of the investigation, wasn't the only HP bigwig to get burned by the covert investigation. On Sept. 28, General Counsel Ann Baskins, who had overseen the probe, resigned from her post.

As California Attorney General Bill Lockyer, the DOJ and the SEC circle in on HP, companies would be wise to rethink their internal investigation strategies.

“You want to have the methods used to conduct an investigation clearly set out in your mind, especially if you're considering hiring a private investigative firm,” says Buck O'Leary, a partner at Dykema Gossett in Washington, D.C. “If you do hire private investigators, you need someone between the corporation and the investigators to supervise the manner in which the investigation is conducted to ensure its legality.”

Defective Detective

One of the biggest mistakes HP committed was not doing the necessary due diligence when hiring outside investigators. Although it remains to be seen why the company contracted outside investigators in the first place, there's no question it hired the wrong ones.

“I would make sure private investigators aren't going to run afoul of the law by doing something like bugging somebody,” O'Leary says. “Use people who have experience and know what's legal.”

There also are ways that a company can better ensure the credibility of its private investigators. If there's a choice between Joe Gumshoe who specializes in tracking cheating spouses and a former government agent, companies would be better off going with the latter.

“When I'm shopping around for third-party investigators, I tend to deal with people I know,” says Mark Rochon, a partner at Miller & Chevalier. “Whether it's a retired FBI agent or a known computer forensic expert, it's important that they have relevant experience.”

It's also important to assess whether a private investigator is needed at all. In fact, only in rare instances should an investigation necessitate contracting an outside investigator.

“I use investigators when I anticipate that there may be a dispute that will end up in litigation and I want to have someone to serve as a witness to conduct interviews along with me in tandem,” O'Leary says. “That way if there's ever a dispute about what someone said, I have a witness who can testify what was said during the interview.”

Even if the actions of its private investigators hadn't put HP in hot water, the company made another fatal mistake by not hiring outside counsel to oversee the investigation.

Outside Investigators

There are two reasons why HP should never have relied on Baskins to oversee the probe.

First, there is an issue of privilege. Anything revealed during an internal investigation that is not under attorney-client privilege is obviously accessible to the public and can put a company at risk for shareholder lawsuits. A judge is more likely to preserve privilege if outside counsel is conducting the investigation than if someone internally is at the helm.

“If it is a matter of substantial risk to a company, than you are almost always going to want to engage someone from the outside,” Rochon says. “If in-house counsel is conducting the investigation, a court may interpret their inquiries to not be protected by privilege.”

The other reason why in-house counsel shouldn't lead an investigation is because of the potential conflict of interest. If a GC has to interview his or her superiors, such as the CEO or a board member, about their involvement in a corporate misdeed, it's likely that the GC isn't going to ask the probing questions. This could compromise the effectiveness of the investigation.

“Being the one to conduct an investigation is not a popular role,” O'Leary says. “This is an assignment for somebody who is not going to have a continuing relationship with the company.”

However, just because outside counsel should lead the investigation doesn't mean in-house counsel should just sit idly by.

“They clearly should monitor the investigation,” says John Hogan, a partner in Holland & Knight. “Make sure the investigation is on track and supervise outside counsel to ensure everything is proceeding professionally.”

Professionalism was obviously lacking in the HP probe. If there is one lesson they should takeaway it's this: Next time, turn to lawyers and not trash cans.