Multinational companies should have in place well considered protocols for investigating claims of alleged internal wrongdoing. Claims of misconduct are often multi-faceted. For example, a claim of unlawful retaliation may also require a review of whether the employee has a reasonable basis for believing that the employer is engaging in wrongful or perhaps illegal conduct. This may, in turn, require an investigation into whether the alleged wrongdoing that is the subject of the complaint actually occurred.
Investigation protocols therefore should provide guidelines that assign investigation roles and responsibilities among various key stakeholders, which may include the general counsel, the chief compliance officer, chief risk officer, head of human resources, and others.
Oversight and Principles
Investigation protocols need to be guided by the company's code of conduct, policies, and workplace rules. They should indicate that they are intended to promote the highest ethical standards of the business and proper behavior of employees.
The guidelines should centralize oversight of investigations in a predetermined and identified investigations team, in order to enable investigations that promote consistency and independence, preserve the attorney-client privilege, and properly evaluate and address legal risk. At the same time, guidelines should not be considered as inflexible or mandatory steps for every investigation. Rather, the guidelines should be tailored through professional judgment to the circumstances of each investigation.
Some general principles: Guidelines need to recognize that country-wide and local laws—especially those governing employee rights and data privacy—may impact the proper approach to an investigation. They should recognize as well the employer's commitment to take appropriate steps to maintain the confidentiality of investigation information.
Guidelines should prohibit retaliation against an employee for raising good faith concerns of misconduct, or for participating or assisting in investigations of such matters. They should make clear that the employer does not prohibit anyone from electing to report concerns, make lawful disclosures, or communicate with any governmental authority about conduct believed to violate laws or regulations, nor does it require disclosures interfering with those rights.
Investigation Intake and Triage
The guidelines should designate a lead officer for identifying the proper team to conduct the investigation. As indicated above, in some circumstances, this may be human resources. In others, it may be the compliance department. And in many circumstances, it may be a combination of different resources who will need to work together to carry out the investigation and formulate remedial measures.
This team will first analyze the nature and significance of the concern and develop or modify a response plan based on, among other things, the nature, severity, scope, and complexity of the allegations; whether there were prior or similar allegations; the past history of personnel involved; the level and role of personnel involved; whether there is a need for escalation; and, critically, the potential financial, legal, reputational, business, contractual, customer, and compliance risks.
Concerns should initially be segregated by type and level of anticipated risk into ethics and compliance concerns and human resources concerns. Teams are then formed based upon the assessment of the type of concern. The team may include internal and external counsel, human resources investigators, forensic accountants or technology professionals, an independent third party, and combinations of the above.
However, certain concerns normally should be brought first to the attention of the individual leading the investigation, or escalated appropriately with senior leadership, the audit committee, external auditors and outside legal counsel. This would be the case where, among other things, an individual has hired counsel or mentioned litigation, the matter may attract press attention, there exists potential criminal liability or a regulatory fine or exposure to a consent decree, allegations of bribery, questionable accounting, accounting controls or auditing matters, alleged misconduct of an executive, officer, or a member of the Board of Directors, a complaint reported to an outside government agency or a threat to do so, or a threatened or actual government agency investigation.
Other concerns that should be elevated would include allegations of illegal, corrupt, or fraudulent activity, internal controls deficiencies, physical harm, retaliation, or an expense or other personal fraud or theft that exceeds a fixed amount, e.g., $50,000.
Matters should normally be shared with senior business leadership only where the business leader is outside the scope of the alleged misconduct, and where the business leader has a legitimate and significant business reason to be notified.
External Counsel, Legal Privilege
As a general rule, absent supervision by an attorney, internal legal investigations will not be protected by the attorney-client privilege. Depending on the nature of the matter, counsel may choose to structure the investigation to utilize or disclose the factual results and process steps in subsequent litigation. Further, certain issues may raise legal questions that require the prompt opinion of counsel. These issues may guide the investigation and related communications.
Of course, the privilege is often waived. And significantly, overseas law and culture may not support application of the privilege; to the contrary, doing so may be greeted with hostility by local law enforcement authorities. Outside the United States, the law generally does not recognize application of the privilege to in-house counsel's communications.
Initial Responses, Internal Steps
A prompt initial response to the reporting party should generally acknowledge receipt of the allegation, reinforce the employer's commitment to investigating all concerns in a fair, prompt, thorough and appropriately confidential manner, reinforce the anti-retaliation policy, provide a contact for further communications, encourage the reporting party to provide any further information, and provide some information about timing and resolution, which normally will depend on the circumstances.
The team needs to consider the rights of the reporting party and the subject. This may include reviewing employment policies or agreements relevant to the review of data, employee interviews, or employee-related remedial measures (e.g., works council rights); considering interim employment measures necessary to a proper investigation (e.g., for the subject of the investigation or for the reporting party); and informing supervisors or other management personnel in an appropriate way.
The team needs to take steps to identify key witnesses and data custodians. It must consider data privacy issues (including cross-border transfer of data), particularly where an investigation involves cross-border transfer of data. The team must consider whether a litigation hold is necessary. It must be sure to preserve relevant electronic data and other physical information, determine the need for and availability of third-party interviews and information, and address the logistics of data formats, foreign language documents, and distant witnesses.
Conducting the Investigation
Obviously, every investigation is unique. The facts and circumstances will affect the specific investigation steps taken. In any case, the investigator should develop an investigative plan, which should consider the chronology of events, appropriate data to capture and review, appropriate search terms, an approach to obtaining data, the identities of witnesses and timing with regard to approaching them, the involvement of counsel, applicable standards from the company's code of conduct and policies, potential legal issues, development of interview questions, and appropriate communications to interviewees and counsel.
Documentation
Normally, the company will prepare an appropriate investigation report, unless legal considerations suggest a different approach. The report should focus factually on the alleged conduct, information gathered during the investigation, and whether the conduct runs counter to the company's applicable policies. Reports normally should not make legal conclusions or contain personal opinions or speculation. They should be shared only with appropriate personnel who have a legitimate need to know, and in a manner that preserves the attorney-client privilege where applicable.
Drafts of the report should normally be reviewed with counsel prior to finalizing.
Remediation and Closure
At the close of the investigation, appropriate internal groups should consider steps forward, including the possibility of disciplinary action, communications to subjects, following up with the reporting party, notifying business personnel with a legitimate need to know, informing other parties, determining whether there should be business process, internal control, or ethics and compliance program enhancements.
Disciplinary action should normally be made by independent personnel and implemented consistently based on standard considerations that include past precedent, level of intent, company risk, and compliance with law. These recommendations should be documented in such a manner as to describe the employee's conduct (or failure to act), how it did or did not comply with the Company's policies, and recommended disciplinary action.
Other Key Issues
This article necessarily provides only the barest outline of an investigation protocol. We would normally also provide, among other things, templates of questions for investigators, lists of appropriate contact points and action items, templates for correspondence with complaining parties and other third parties.
Many other questions must be considered. For example, when should the company permit the employee's counsel to be present during a witness interview, and what role, if any, should the employee's counsel play? As noted below, another important question is whether the investigation should be carried out in a manner designed to maintain the attorney-client privilege, how the privilege can be maintained, and whether the company should waive the privilege.
When matters involve criminal law, it is important to coordinate with competent criminal counsel and to consider whether witnesses may decline to cooperate or insist on having counsel present, and whether they require separate representation.
In some countries, local law may require that the investigation be carried out in the local language. The role of counsel in carrying out an investigation is also important to consider, particularly in countries where counsel's role may be limited by bar association or ethics rules.
Timing can also be critically important. In some countries, the employer may be unable to discipline the employee if too much time passes. In that case, the investigation may curtail the employer's right to discipline the employee, but nevertheless it may fulfill other possibly more important functions such as determining whether the employer is in compliance with the law.
It is critically important that human resources, compliance, the general counsel, and external counsel of all stripe cooperate and communicate with regard to all aspects of an investigation.
And finally, investigation protocols must be pushed out to key stakeholders. Advance training in implementing these and carrying out an investigation is essential.
Read full article here: http://www.newyorklawjournal.com/id=1202785747011
Philip M. Berkowitz is a shareholder of Littler Mendelson and co-chair of the firm's U.S. international employment law and financial services practices. Reprinted with permission from the May 10, 2017 edition of the New York Law Journal© 2017 ALM Media Properties, LLC. All rights reserved. Further duplication without permission is prohibited. ALMReprints.com – 877-257-3382 - reprints@alm.com.
