Mounting regulatory pressure, new legislation and a fear of reputional damage have fuelled a rise in the number of corporates conducting internal investigations to tackle bribery and corruption. Caroline Hill finds out why an effective self-reporting regime is a necessary burden  

Internal investigations are nothing new, but in the wake of banking scandals, growing regulatory pressure and a raft of legislation tightening and criminalising corporate law, investigations have become as burdensome for general counsel as they are burgeoning for their external legal advisers.

Many corporates have gone to great and costly lengths to improve their internal processes, not least in light of the Bribery Act 2010, which forces UK and foreign companies with a UK operation to ensure they have adequate procedures in place to minimise the risk of bribery and corruption.

However, the Financial Services Authority (FSA) – now split into the Financial Conduct Authority (FCA) and the Prudential Regulation Authority, with the FCA taking on all enforcement activity – and Serious Fraud Office's deeply political and somewhat unpredictable agenda is making for an uneasy and complex relationship between the regulators and the firms. 

Growth of internal investigations

Both in-house counsel and private practice partners attest to a significant increase in internal investigations, as corporates – alive to the reputational and financial ramifications of even the smallest misdemeanour – have on hand litigation lawyers and multi-disciplinary external teams to investigate and stamp out perceived irregularities.

"There are many more internal investigations than there used to be, it's become extraordinarily burdensome for financial institutions," says Linklaters litigation and arbitration partner Alan Walls, who specialises in corporate fraud investigations.

Sam Coulthard, a partner in the financial markets disputes group at Dentons, adds: "People are more keen to conduct investigations and I think there is a shift in culture."

For regulated businesses, this is partly driven by the knowledge that a deeply politicised regulator needs to be seen to act following scandals such as the Libor rate-fixing, money-laundering and insider dealing. 

"For understandable reasons, regulators are often under huge pressure to be seen to be doing something," says Philip Bramwell, group GC at BAE Systems.

However, there is an awareness among banks and corporate entities themselves that they need to regain the public's trust. At the start of the year, HSBC announced it had recruited a panel of experts to help it identify areas where it could be exposed to financial crime. The creation of its Financial System Vulnerabilities Committee came two months after the bank was fined $1.9bn (£1.3bn) by US authorities after it was found that two large Mexican cartels had laundered money through the bank.

"More companies are genuinely taking early action in the interest of the business," says Coulthard.

The reputational damage that can result from a corporate scandal – fuelled by a media hungry for stories of corporate corruption and downfall – is undoubtedly a large stick.

Speaking to Legal Week for a risk and compliance intelligence report in conjunction with Deloitte, Grant Dawson, GC of Centrica, says: "Today you are tried by the media before any court decision, and that is what drives a lot of activity."

However, this combination of fear and willing is underwritten by legislative reporting requirements including section 166 of the Financial Services and Markets Act 2000 (FSMA, giving the FSA the power to require a skilled person to provide a report into any relevant matter they may specify), improving processes under the Bribery Act and whistleblower legislation, including the Dodd-Frank reform and Consumer Protection Act in the US.

The criminalisation of corporate law – and, more importantly, the willingness of the regulator to use these powers – has been a powerful driving force. The FSMA provides powers to investigate and prosecute insider dealing, but the first FSA prosecution only came in 2009.

Walls says: "There have been 22 successful convictions for insider dealing, which is a lot considering the first one was only a few years ago."

The most recent prosecution was in March 2013, when futures trader Richard Joseph was found guilty of six counts of conspiracy to deal as an insider, resulting in a net profit of £591,117, and was sentenced to four years on each count, to run concurrently. 

"The criminalisation of corporate law is driving awareness – people know they have to act," says Barry Vitou, head of Pinsent Masons' corporate crime team.

Added to the melting pot is the transatlantic creep of US culture, where investigations have long been big business. 

Clifford Chance litigation and dispute resolution partner Roger Best, who specialises in regulatory enforcement proceedings, says: "The US corporate governance model of having an independent law firm investigate has become the norm here."

However, companies are also providing their own staff with legal training to ensure that investigations are conducted properly, leaving less margin for employment tribunal action or a case being thrown out of court. Legal training group Bond Solon works with 25% of the FTSE 100 to set up or improve their internal investigation processes. 

"Tackling fraud has always been a priority for large companies," says senior manager Adam Millward. "But as profit margins have been hit by the downturn, increasing importance has been placed on the investigative function within these businesses, along with a requirement to ensure those tasked with carrying out investigations are trained to do so in line with best practice standards." 

Best adds: "Large sophisticated clients are building in-house teams to conduct routine investigations (eg into allegations of bribery or internal fraud). But since many more companies are investigating issues, there is still much more work for external law firms in this area on a year-by-year basis."

Oil and vinegar

In bolstering their internal capability and processes, general counsel and their legal compliance teams are inevitably hoping to show the regulator that they are capable of regulating themselves.

In 2009, BAE Systems settled long-running corruption allegations against it. It has since enhanced its internal investigations procedure. 

"We try hard to conduct internal investigations to a standard that regulators will find acceptable," says Bramwell.

"If we go on to make a voluntary disclosure, we want to present it to the regulator and say 'we believe we have done all that you would want us to do', and thus minimise the likelihood that they go on to take parallel action."

But while companies could once have legitimately hoped that showing zero tolerance towards internal wrongdoing would result in clemency and reduce the need for parallel action by the regulator, that is no longer the case. The FCA – and even the FSA in its latter days – is far harder to predict than before. 

"These days, there is no guarantee that they will be satisfied that you've dealt with a problem, and with them taking more to enforcement it's far less predictable," says Walls.

According to Bramwell, corporates should not be demonised for the actions of a tiny minority, whose behaviour is not reflective of overall attitudes. 

"In my experience, damaging failures on the part of a handful of individuals within a large multinational company are seldom attributable to a wholesale failure of the company's culture. 

"It is unfair for commentators to seek to infer that a single event accurately reflects the everyday behaviour of tens of thousands of hard-working employees. As a US colleague once observed: 'Whoever saw a town of 100,000 people without a sheriff?'" 

The cost and disruption associated with regulator investigations means it makes commercial and economic sense for an effective self-reporting regime to be in place backed by stringent systems and processes. 

"A board that has got confidence in its system of rules and regulations and code of conduct ought to have confidence that it can remediate problems itself," says Bramwell.

However, corporates and banks alike are having to prove themselves. "We are all in a difficult environment where many large companies have got to earn back the trust of their regulators and with it the permission to put their house in order," adds Bramwell.

Backlash

Until this trust is earned back, regulated companies have to live with the knowledge that they may go to great lengths to uncover wrongdoing only to be heavily penalised, adding to the potential reputational and financial damage.This has led individuals in some quarters to question whether there is any incentive to unearth wrongdoing in the first place. 

"A lot of misguided people within organisations have said you may be better off not uncovering wrongdoing – let sleeping dogs lie," says Walls. "Responsible financial institutions need to get these problems resolved. The clients I work with are all of that mind and the legal and risk departments are hell bent on sorting such issues out."

Ignoring issues in the hope that they remain undetected is commercially self-defeating, as it means more chance of financial loss and the problem escalating. 

Vitou says: "It's a real mistake to ignore it is it will more likely than not come back and bite you later. If you've got allegations of people engaged in bribery then ultimately the company is the victim. 

"The money to pay the bribe has to come from somewhere, which usually means someone is defrauding the business of cash with fake paperwork. This is not something to be encouraged!"

Until the political and economic landscape has settled down, internal investigations may continue to be a necessary but bitter pill to swallow.