The corporate internal investigation has become increasingly commonplace since the post-Enron days, when Sarbanes-Oxley made good corporate governance a mandate. At the same time, government agencies and prosecutors have come to rely on self-investigations to carry out costly, intensive company probes. The Washington Post recently reported that an internal investigation into global bribery cost Siemens around $950 million—almost triple the budget of the Securities and Exchange Commission's (SEC) entire enforcement division at the time the case was resolved in 2008.

“Most companies will have to deal with an internal investigation at some point. You're very lucky if you don't,” says Peter Zeidenberg, a DLA Piper partner who spent 17 years as a federal prosecutor both at the Department of Justice (DOJ) and the U.S. Attorney's Office in the District of Columbia. “In any large company, it's hard to imagine that at some point in time there's not going to be some suggestion or allegation of internal misconduct.”

Sometimes these investigations seek information on small, contained issues. But when they're triggered by a criminal or regulatory inquiry, or when major problems—such as widespread company fraud or Foreign Corrupt Practices Act (FCPA) violations—seem to be looming, designing them and carrying them out correctly becomes crucial. In the following pages, former prosecutors and other lawyers walk companies through the self-investigation process, offering tips and warning against pitfalls along the way.

1. Issue a Hold

Any number of events may launch an internal investigation at a company: a subpoena, a search warrant or a notice of investigation from federal prosecutors; a phone call from a regulatory agency; an employee complaint; a shareholder demand letter; concerns from auditors; or even a media report that makes management aware of a potential legal issue. Whatever the driver may be, a first step in carrying out an investigation is to ensure any potentially relevant documents are preserved by issuing a litigation hold that suspends any routine document-destruction practices and makes clear to all relevant parties that they must preserve documents or communications related to the investigation.

“If this is an investigation that's likely to be scrutinized by the government, this will be a crucial step,” says Barry Pollack, a member of Miller & Chevalier's White Collar & Internal Investigations Group. “One of the biggest pitfalls [in investigations] is that you might have an allegation that, at the end of the day, the government would not have pursued, but because they have concerns about after-the-fact destruction of evidence, they pursue it.”

2. Define the Scope

Simultaneously, the client should begin working with outside counsel to determine the scope of the investigation going forward.

“Sometimes these issues can get away from you if, at the outset, you haven't identified what needle you're going to look for in the haystack,” says Valecia McDowell, a member at Moore & Van Allen.

If a subpoena triggered the investigation, it's necessary to clarify what prosecutors are seeking. In some instances, the subpoena might be specific enough to understand the general allegations. But often, prosecutors cast wide nets.

“Subpoenas are normally drafted way more broadly than even the prosecutor wants,” says Kenneth Julian, who should know. Now a partner at Manatt, Phelps & Phillips, Julian was previously deputy chief of the U.S. attorney's office in Orange County and a federal prosecutor in California.

In that scenario, getting in touch with the U.S. attorney on the case can help determine what exactly the subpoena is targeting and avoid overbroad investigations and the production of potentially thousands of documents. The conversation can yield valuable information for the company about where the investigation is likely to go and what exactly is being investigated, and the U.S. attorney gets targeted information rather than hundreds of thousands of documents.

“If that conversation goes well, it normally will be grounds for narrowing the subpoena and attempting to figure out what's at the heart of the subpoena,” Julian says.

If the investigation is the result of an employee tip or another internal trigger, it's just as important to define the scope, although the conversation will be different. In either case, it's vital to be as specific as possible about where the probe is going at its outset.

“Circumstances and facts may present themselves over the course of the investigation that may alter your scope, but you want to make sure you're ready at the beginning and that everybody understands where you're beginning,” McDowell says.

3. Focus the Investigation

Steven Tyrrell, a Weil, Gotshal & Manges partner who was chief of the DOJ's fraud section from 2006 to 2009, says the most common pitfall in internal investigations is doing too much and lacking focus. The other extreme is another misstep: If prosecutors don't think the investigation is thorough enough, he says, the company might not get any credit for it. “Strike the right balance and have a dialogue with the people to whom you're reporting the results of the investigation,” he says.

It's impossible to define the scope without considering the client (the board, management or a special committee) and the ultimate destination of the final report. Is it an outside governmental agency? Is it going to the FBI or DOJ with criminal implications? Or will it be reported to an internal audit committee, the board or senior management?

“That has a very dramatic impact on how I approach the process going forward,” says McDowell. “Really determining what the end product is going to look like informs the decisions I make over the course of the investigation itself.”

Determining who gets the end product also will affect the scope of the investigation and the level of detail the ultimate report contains. It also will inform the decision to deliver either an oral or a written report, which is heavily dependent on the audience. That can be a complex decision, McDowell says.

When reporting to the board, the conventional thinking today is that it's more appropriate to do an oral as opposed to a written report because of disclosure issues, according to Zeidenberg. “The first thing the government's going to ask for is any reports you've done,” he says.

4. Build a Team

A strong team experienced in internal and white-collar investigations can lend credibility to a company's findings.

“You need people who are vocal and prepared to disagree because it can take a lot of intellectual back and forth to get to conclusions,” McDowell says. “It helps navigate what can be a mountain of information to get to more well-reasoned ultimate conclusions.”

In any matter that could be explored by a regulatory agency or in the criminal context, companies almost always turn to outside law firms. It would be “foolhardy” not to, Julian says.

Many large companies now have sophisticated and substantial enough legal departments that they may actually have the capability to handle the investigation internally. “People at the DOJ don't believe that,” Tyrrell says. “They don't think in-house lawyers can be objective, which is kind of an insult, the idea that they can't be impartial legal advisers and stay true to their ethical obligations.”

Still, Tyrrell says, the expectation among prosecutors is that companies retain outside counsel to carry out the investigations. An internal investigation that involves smaller matters unlikely to interest regulators or prosecutors is a more appropriate matter for a legal department to handle fully.

At the same time, the general counsel shouldn't just be a bystander, says Zeidenberg.

“It's a difficult situation,” he says, “because the idea is that the outside counsel is supposed to be basically independent in the sense that they're generally working for the audit committee or special committee, not working directly for the general counsel.”

But general counsel should still ask questions, ensure their understanding of the situation and work with outside counsel to help guide the investigation in a constructive and productive way. Their knowledge of the company can be an invaluable resource to investigators.

5. Collect and Review Documents

Once the investigation team lays the groundwork and deals with the most pressing initial issues, the meat of the investigation begins. The investigation team identifies search terms and custodians, and begins document production and review. It's usually the costliest part of an internal investigation, but the assistance of the government agency or prosecutor can help make the process more manageable.

“I find the government is pretty amenable to having the company share search terms with it before you run them and start document review,” says Rachel Skaistis, a litigation partner at Cravath, Swaine & Moore. “The government can agree with them or say, 'Why not add these following 10 terms before you get started?'”

Early in an investigation, determining where potentially relevant documents are likely to reside—in particular business units, geographic areas and servers—can be a complex exercise, and this is an area where in-house counsel's knowledge of the company can be invaluable. Because of its hefty cost, it's important to get discovery right the first time. If a company is disclosing information to the government and the government isn't satisfied with the initial search, it won't hesitate to force the company to go back and make fixes.

“In my experience, when companies have to go back and redo things, it's usually, but not always, document-review issues,” Skaistis says.

Investigation teams also must ensure that during the course of the investigation they don't disclose any documents to authorities that would inadvertently create a waiver of privilege.

“It can and often does happen when you're dealing with tremendous amounts of documents—hundreds of thousands or even millions, all stored electronically,” Zeidenberg says.

6. Interview Witnesses

Along with identifying search terms, investigators should identify potential witnesses. Deciding whether to interview witnesses before or after document review usually depends on the situation. If the investigation time frame is short and things are moving quickly, sometimes there's not enough time to wait until after review. In other instances, the lawyer conducting the interview wants to go in with full knowledge of what documents were uncovered in discovery.

Either way, before interviewing any employee witness, it's imperative to consider attorney-client privilege issues. Particularly in criminal probes but also in other government investigations, the witness may need his own specific counsel, which may or may not be clear at the outset. The interviewer should give the employees a so-called Upjohn warning notifying them that the lawyer administering the interview represents the company, not the individual employee, and that the company can choose to waive the attorney-client privilege and deliver the contents of the interview to the government.

Often confidentiality issues will preclude recording the interview, so a best practice is to have a second person in the room responsible for taking thorough notes and writing up a report of the interview. That person should be able to take the stand in court if someone needs to testify about the contents of the interview.

“As a lawyer, you don't want to be that person,” Julian says. He uses former FBI agents in that capacity because they have special training on note-taking, they have report-writing skills, they're thorough and they make “very good” testimonial witnesses, if it comes to that. Often, he says, a paralegal of the law firm doing the interview will fill this role, but he doesn't recommend it.

“Paralegals may take good notes and write good reports, but they aren't trained in testifying,” he says. “There's also an inference of bias because they work directly for the lawyers.”

McDowell adds that there's great value in specifying how people take notes and write reports too. Because styles vary so much, a standard form may be useful.

“You don't want to freestyle,” she says. “You need consistency there because when you have to go back after a period of months or years, it can be very important to your ultimate ability to synthesize that information.”

7. Mind the Privilege

After analyzing the collected information and determining proper remediation for any uncovered misconduct, investigators will put together a summary report of the investigation. Then companies must decide whether to turn over the entire report to prosecutors or a government agency or to keep it privileged. It's a thorny issue because once the company decides to waive the attorney-client privilege and disclose the report to a third party, the privilege is waived forever.

“You have to consider the collateral impacts of the decision to cooperate and decide how best to manage the investigation and get to a result that one hopes the company can live with and continue to do business under,” says Peter Spivack, co-leader of the investigations, white-collar and fraud practice area at Hogan Lovells.

Skaistis says it's possible to share factual findings with the government while maintaining privilege over legal advice. But where there are DOJ or SEC investigations, follow-on litigation is never far behind, and the first thing plaintiffs in a civil litigation will ask a company to produce is any written documents given to the government.

“There are certain ways to protect documents you give to the government,” Skaistis says, “but none of them are foolproof, depending upon what jurisdiction you are in. You have to operate under the assumption that any written work product you give to the government could potentially end up being produced to plaintiffs in a civil action.”

Since the DOJ set forth updated charging guidelines in the 2008 Filip Memo, the government is not supposed to consider a company's failure to waive privilege in deciding whether to charge it. Under current guidelines, companies can give authorities a narrative of what the investigation uncovered while avoiding specifics such as who revealed information and what documents back it up.

“When you start getting into who told you what and what document reflects it, you get into the question of attorney-client privilege or work-product privilege,” Tyrrell says, noting that the only time he would suggest waiving privilege is to invoke an advice-of-counsel defense. “But there is still an expectation that you will in some fashion keep the department informed about what you're finding [in a reasonably prompt manner].”

Julian adds that while the Filip Memo is the rule on paper, a company's failure to cooperate with authorities still raises suspicions.

8. Time Any Disclosures

For companies cooperating with government agencies or prosecutors, another decision is when in the investigation process to self-report to the government, either in real time or after the investigation's completion. “It's a real debate in the corporate community and the defense community,” says Pollack.

Report immediately and the risk is that companies will disclose something to the government that may, at the conclusion of the investigation, turn out to be meritless. Now the company has attracted scrutiny for no reason, and it likely will incur additional investigation costs—the government could direct a deeper investigation of a reported potential issue. The decision to go talk to authorities can be made at any time, Pollack says. Giving yourself some time to learn more about the allegations and the company's exposure allows you to keep your options open and avoid a premature judgment.

“Having the government involved can add tremendous cost, which you wouldn't have had to incur had you done an investigation first and then decided it wasn't something that needed to be reported,” Pollack says. On the flip side, if you decide to report after the investigation process is complete, the government may discover the underlying conduct before you report, which means less government buy-in to the design of the investigation and less credit for cooperation.

What form that credit takes can vary widely.

Cooperation credit can mean the authorities bring no charges, a reduced charge or a charge against a subsidiary instead of a parent company. It can mean a narrowing of charges, a reduction in fines or a reduction in other collateral impacts. It may mean a government contractor avoids being debarred from future contracts or a pharmaceutical manufacturer can continue getting Medicare and Medicaid reimbursements.

Different prosecutors may view the same sets of facts differently; an SEC enforcement lawyer may have another view. And every one of these matters is bound up in the facts and circumstances of what occurred.

“In reality, it's the subject of raging debate,” says Pollack. “The government will tell you that you get significant credit [for cooperating] but, speaking anecdotally, it depends on the seriousness of the offense, how regulated your industry is and, frankly, a bit of luck.”