The world of corporate governance has changed starkly since the Sarbanes-Oxley Act of 2002. As a result of increasingly common Securities and Exchange Commission investigations, criminal prosecution by the Department of Justice, civil securities fraud class actions, or civil shareholder derivative suits, even the concept of an "internal investigation" has become oxymoronic. With such outside interests, any "internal" findings become "external" very quickly.
It is critical to proceed cautiously and deliberately in determining whether and how to conduct internal investigations. To do so successfully requires a prior working knowledge of the nature of the public and private constituencies involved, and the consequences that may ariseÑfrom criminal prosecution and regulatory enforcement to private shareholder liability.
Duty To Investigate
A director's duty to investigate fraud has long been stressed by the SEC and did not arise with the passage of Sarbanes-Oxley, but Sarbanes-Oxley raised the bar by further clarifying the responsibilities of all members of a corporation's audit committee, who are now directly responsible for the appointment, compensation, and oversight of the work of any accounting firm that the corporation employs. In addition to the audit committee's special duties, all directors have a fiduciary duty to investigate. This duty arises if a director learns of facts suggesting that management may have engaged in fraud or that the corporation's prior public statements may be inaccurate. As a result, even outside directors must be familiar with the corporation's public disclosures and accounting procedures and must not rely solely on management to make disclosure decisions when any red flags appear. Once the board is informed of the potential misconduct, it must then make the decision whether and how to investigate.
Benefits And Risks Of Internal Investigations
A properly performed investigation enables the corporation to: determine the extent of potential liability and mitigate consequences; dissuade the government from conducting its own investigation or at least reduce its scope; minimize criminal exposure through self-reporting and timely cooperation (factors considered under the Federal Sentencing Guidelines); minimize civil exposure arising from officers' and directors' fiduciary duty to investigate; eliminate or diminish SEC enforcement actions; and shape media scrutiny by showing the corporation's good-faith investigation. But along with these benefits come potential risks, including jeopardizing confidentiality, waiving attorney-client and work-product privileges due to regulators' demands, and losing control over the investigation.
Whatever the potential risks and rewards in a given situation, Sarbanes-Oxley indirectly compels the board to investigate and to preserve evidence through a number of far-reaching and interwoven provisions, including the requirement for attorneys to report material violations of the securities laws "up the ladder," increased protection for whistleblowers, a new destruction of records statute, a requirement to preserve audit records for five years, and a prohibition against officers or directors improperly influencing auditors. Fortunately, a properly designed and conducted internal investigation can maximize the benefits and minimize the risks associated with such an inquiry.
Assessment Criteria
The Department of Justice guidelines list the following criteria to be used in assessing "the proper treatment of a corporate target" in a criminal investigation:
Nature of the offense.
Pervasiveness of wrongdoing within the corporation.
The corporation's history of similar conduct.
Existence and adequacy of a corporation's compliance program.
The corporation's remedial actions.
The corporation's timely and voluntary disclosure of wrongdoing.
The SEC uses similar criteria, along with the following additional benchmarks, to determine "whether, and how much, to credit self-reporting, remediation, and cooperation":
The audit committee and board's role in the investigation (including that outside directors oversaw the review and that the process included a thorough review of the nature, extent, origins, and consequences of the misconduct).
The corporation's cooperation with the SEC (including production of a thorough and probing written report of its findings and voluntary disclosure).
There are three consistent threads between the DOJ and SEC criteria: thorough investigation is expected and favored; internal controls and compliance procedures should be established; and if a criminal or regulatory investigation proceeds, waiver of privilege may be inevitable.
Conducting An Independent Investigation
With the DOJ and SEC guidelines in mind, the board should take several threshold steps when considering an investigation:
Directors should meet separately from any potential offender to determine how to proceed.
The corporation should not issue a press release denying wrongdoing before the conclusion of the investigation.
Directors must decide whether any alleged offender should retain employment, compensation, or benefits during the course of the investigation.
To assist in these critical inquiries, the board should consider promptly hiring outside counsel.
While in-house counsel have the advantage of being more familiar with the corporation, outside counsel provide the independence that the SEC favors. Retaining outside counsel also provides the corporation greater attorney-client and work-product protection, since courts generally scrutinize more closely privileges asserted by in-house counsel. To bolster this protection, the board's authorization should specifically state that outside counsel has been retained to assess potential legal problems, clarifying that counsel will not be conducting solely a business or factual inquiry.
In the context of shareholder derivative actions - in which the shareholder sues corporate management and/or the board derivatively on behalf of the corporation - corporations may establish a "special litigation committee." This is typically done when the board has conflicts that prevent it from independently addressing the potential wrongdoing alleged in the derivative suit. The special litigation committee is composed of disinterested directors who investigate the alleged impropriety. A court may dismiss the derivative action if the committee has determined that no lawsuit is needed and the court finds that the committee is sufficiently independent and has acted in good faith. A court also has discretion to apply its own business judgment to determine whether the lawsuit should be dismissed, but this usually occurs where the committee's decision is patently unreasonable despite independence.
To protect the corporation from inevitable hindsight criticism, the board should establish guidelines for all internal investigations that address when an investigation should be conducted, who will decide to conduct it, who will direct it, and how it will proceed. If outside counsel is retained for a specific inquiry, they should immediately establish a detailed protocol for the investigation so that its boundaries are clear.
Conducting A Timely And Thorough Investigation
Once the need for an investigation arises, it should be conducted in a timely and thorough manner. Timely investigations have a two-fold benefitÑthey are viewed favorably by prosecutors and regulators, and they tend to produce more accurate results because memories have not faded and documents are more likely to remain available. Investigations also should be thorough. From the outset, employees should be directed by management to cooperate fully, to keep information confidential, and to recognize that all information will be utilized by outside counsel for the purpose of providing legal advice. The scope of the investigation should not be artificially limited - all areas relevant to the specific misconduct at issue should be probed to the fullest extent. But at the same time, the investigation should not be so broad as to encompass any possible area of misconduct - such an inquiry would be counterproductive and would unnecessarily harm employee morale. Documents should be reviewed before interviewing employees, and document-preservation procedures should be established when the investigation begins.
Reporting The Investigation's Results
Outside counsel will typically prepare a report once the investigation is complete. At a minimum, the report should: summarize the circumstances giving rise to the investigation; detail the investigative procedures employed; describe the factual findings; analyze relevant legal provisions; and provide conclusions, suggested revisions to the corporation's internal controls, and suggested internal remedial measures. Regardless of the intended use of the report, the investigators should ensure that as much positive factual information as possible is includedÑthis protects the corporation if the report is ultimately disclosed. If the corporation intends to use the report to deter criminal or civil enforcement action, the findings should be copiously detailed. Finally, if the government has been involved throughout the investigation, the investigators might consider giving an oral report to avoid later disclosure of the report.
Preserving Privilege
Asserting privilege in the context of an internal investigation is a double-edged swordÑprosecutors and regulators will likely view the corporation as obstructionist and seek full penalties, but claiming privilege may well prevent shareholders or plaintiffs' lawyers from obtaining the report and using it as a roadmap in subsequent securities fraud class actions.
If conducted properly, much of the internal investigation will be protected by privilege. The attorney-client privilege protects confidential communications between an attorney and client for the purpose of rendering legal advice, while the work-product privilege protects material prepared in anticipation of litigation. In a corporation, the attorney-client privilege generally protects not just upper management but also employees who were aware of legal implications and who were discussing matters in the scope of their employment.
Corporations waive attorney-client privilege if the communication is no longer confidential. Thus, disclosure to a third party (such as the DOJ or SEC) ordinarily results in a waiver. The board thus faces a difficult decision -- cooperate with the government to mitigate potential criminal and civil liability, or stand firm in asserting privilege. Both the DOJ and SEC standards view privilege waiver as an important criteria in determining whether to prosecute and what penalties to pursue. And while the SEC acknowledges that privileges "serve important social interests," it still views waiver as "a means (where necessary) to provide relevant and sometimes critical information to the Commission staff." The SEC is often willing to enter into confidentiality agreements and stipulate that disclosure does not waive the privilege as to all documents concerning the same subject matter, but the enforceability of such agreements is in question. Some courts, recognizing the benefits of a thorough investigation through use of outside counsel, have been willing to give effect to such agreements. Disclosure of the internal investigation report is one of the most important decisions in the case and should be considered carefully by the board and its outside counsel.
Conclusion
Internal investigations present a minefield of problems for the unwary director. Independence of the internal investigators is critical to retaining the protection of the business judgment rule. Investigators must be cautious about preserving confidentiality to avoid inadvertent waiver of privilege. Finally, the board must make the decision whether to transform an internal investigation into an external one: disclosure to prosecutors and regulators. By proceeding with full awareness of the possible unintended consequences, directors likely will minimize potential exposure and maximize corporate reform.
Published September 1, 2004.
