Global companies today face multiple pressure points. They must manage a work force that spans the globe and that may hold diverse views on almost every aspect of corporate culture, including compliance. They must develop their brand and image across different societies, social media sites and press corps. And, if and when misconduct arises, they will be confronted with the difficult challenge of figuring out what happened in a way that satisfies employees, investors, the public and—importantly—regulators across multiple countries, all while taking care to address the risks related to possible civil litigations that may be filed around the world.

Last year, nine of the 10 corporate enforcement actions pursued by DOJ's Fraud Section involved conduct that took place in multiple countries. In the past two years, the SEC has acknowledged receiving assistance from more than 25 different jurisdictions in matters involving the Foreign Corrupt Practices Act. Both agencies have commented that global coordination among regulatory and criminal authorities continues to increase. Matthew S. Miner, “Deputy Assistant Attorney General Matthew S. Miner of the Justice Department's Criminal Division Delivers Remarks at the 5th Annual GIR New York Live Event,” Sept. 27, 2018; Steven Peikin, “The Salutary Effects of International Cooperation on SEC Enforcement,” Dec. 3, 2018. In a worst-case scenario, “issue contagion” can lead stakeholders in one country to focus on an issue with more intensity, and with more bite at the end of the day, in reaction to parallel investigations elsewhere.

It is essential to be prepared for the complexity of a global investigation. This piece will address best practices that companies can use to guide their decision-making in the first few hours and days after allegations of potential misconduct emerge and throughout the investigation.

Lesson One: Effective Crisis Management Sets the Stage for an Effective Internal Investigation. An allegation of wrongdoing may emerge from whistleblower complaints, an article in the press, an investigation of a competitor, an academic study, an audit report, a regulatory inquiry or elsewhere. The manner in which the company first responds can have a significant impact on the overall outcome of the investigation.

Companies should work with internal and external advisors to put in place a crisis management plan that it will follow in the event of a live crisis. The plan should address which stakeholders within the company should be involved under various scenarios, how decisions should be made, who has the authority to speak on behalf of the company and what they should (or must) say or not say immediately after allegations are raised.

The hallmark of many crises is that little may be known about the underlying conduct at the same time that the company is facing tremendous public pressure to explain what happened. It is important to think through how the company would respond in that scenario. A hasty denial or mea culpa before any fact finding has occurred can carry significant risks. If it can be avoided, the company should very carefully consider any commitment to share the results of its investigation publicly. The company should also think through what its disclosure and reporting obligations may be in various countries around the world and should consider identifying advisors it can work with to map out a potential response in the event of an issue arising.

Lesson Two: Assess Global Risk From the Outset. It is worth taking time up front to think through the ways in which the potential misconduct may affect multiple countries, particularly those with strong enforcement cultures like the United States. For example, what may seem at first blush like a localized KYC issue in Italy could affect banking relationships in New York. A potentially improper payment in Brazil could implicate anti-bribery laws in the UK. A trading decision in Hong Kong could affect a customer in Ohio.

If multiple countries may become involved, it is essential to think strategically about a global approach from the outset. This is true both in terms of big picture, medium- to long-term issues—such as self-reporting requirements and how ultimately to resolve the issue—and the short-term nitty gritty of the investigation.

Lesson Three: Put in Place a Plan to Protect Legal Privilege. A key consideration at the beginning of an investigation is the extent to which it can be conducted under legal privilege. Privilege works differently in different jurisdictions.

Common law jurisdictions such as the United States and UK tend to have stronger privilege protections; civil law jurisdictions such as Germany and France tend not to. Even among relatively similar legal regimes, there are important distinctions.

Spending a few hours at the outset of an investigation thinking about which jurisdictions are likely to be in play and what privilege protections may be available can save considerable trouble down the line.

Lesson Four: Take Care With Global Data. In recent settlements, enforcement authorities have considered the company's production of foreign data in identifying the cooperation credit to give the company. Credit Suisse (Hong Kong), Non-Prosecution Agreement With Statement of Facts, May 24, 2018.

Collecting data in a global matter, and ultimately producing it to a regulator and/or plaintiff, requires careful thought and attention. The United States has relatively loose data privacy standards. By contrast, data privacy and bank secrecy laws in many other jurisdictions require, at a minimum, that companies obtain consent and redact personal information. This raises complicated questions about the location from which the data was sourced, what substantive law applies to it, and what data must be withheld.

It is essential to evaluate these competing requirements early in the investigation in order to develop a coherent, consistent, and defensible approach to collecting and producing data.

Lesson Five: Employment Laws Must Be Treated With Care. Many countries outside the United States have well-developed, employee-friendly employment laws that contrast sharply with the United States' at-will employment regime. The employee's duty to cooperate with investigative requests and attend interviews may be far more limited in many countries than it is in the United States.

In addition, these laws often protect employees from discipline or entitle them to a hearing or other process. This may limit the company's ability to take action against its own employees, even where the company believes they engaged in misconduct.

Understanding the scope of these laws and the rights that employees have under them is a critical component of a global investigation.

Lesson Six: It's All About Culture. A strong culture is a company's best defense against potential misconduct. Conversely, the way in which an investigation is conducted and the manner in which misconduct is addressed are critical tools for building a positive corporate culture. Employees will evaluate how the company reacts to potential misconduct—and how they themselves are treated in the context of an investigation—in forming opinions about the company's approach to ethics and compliance. To have the greatest impact—and to conduct effective fact finding—the investigation team must be alive to the company's internal culture and how that varies across locations.

Equally important, the investigation team must take into account the broader legal, business, and cultural environment when investigating global conduct. Employees in different countries will have different expectations about what it means to cooperate with an investigation, to maintain confidentiality, to preserve documents, and to conduct a document review. They may not be accustomed to having a third party review their emails and may be deeply unsettled by this, even if they have not engaged in any misconduct. They may not be comfortable discussing sensitive matters in a second language, even if they regularly conduct business in multiple languages, and even if they have nothing to hide. They may have mannerisms—such as shrugs or head shakes or around eye contact—that make sense in their local culture but that can be misinterpreted by a U.S. audience. The same word—or its translation—can have very different connotations in two different languages or cultures. The investigation team must take care to evaluate explanations in light of local customs and language. These cultural nuances must be taken into account throughout the investigation. The investigation team must be attuned to them from day one and should ideally include members who are fluent in the language and customs of each of the countries in question.

Conclusion. The first steps that a company takes in response to allegations of potential misconduct can have serious ramifications for the investigation down the line. Global investigations are inherently complex and must be handled with care. The six lessons described above are critical to keep in mind in the context of an investigation implicating multiple jurisdictions.

Olivia Radin is a partner at Freshfields Bruckhaus Deringer in New York.