The typical investigation is reactive, conducted with a prosecution mindset and imposes legalistic rules and a watchdog. The more effective model is to conduct the investigation as a proactive tool to solve a business problem and add significant value by effecting change of culture and remediating ineffective business practices.
The post-Enron business community is coping with a swirl of investigations. Whether prompted by whistle-blowers, external auditors, regulatory authorities, internal audit groups, or management, there are definitely more investigations occurring today. Some investigations require special committees; some are conducted under the auspices of audit committees; others are simply conducted by management under normal compliance program procedures and reported either to a committee of the board or directly to the board. Though it seems unlikely that the circumstances of business are different today, the times are different, and we should expect that the present stimuli will continue to be activated for some time and that the number of investigations will increase.
Because every investigation is triggered by misconduct, and in the most extreme cases the misconduct is illegal and sometimes criminal, it is tempting to conduct every investigation as if it were an incipient prosecution. But in fact, every investigation is an inquiry into the core of a business problem which must be addressed, understood, managed and solved.
Even when the misconduct is subject to an investigation or later prosecution by an external regulatory or law enforcement body, there must be an internal investigation. Commonly, these investigations mirror law enforcement proceedings. The interviews with employees are conducted as if they are hostile witnesses or defendants. Documents are searched only for signs of wrongdoing and not for indications of how the problem may be fixed. In the worst case, business operations are left damaged, cultures are bruised and confused employees are still waiting for guidance in modifying the offending business practices.
But, if the investigation's focus is to solve the business problem, the end result can be not only to understand and fix the problem but also to bring the added value of remediation of business practices - changes which, in turn, enhance operations and performance. Whether conducted internally or by external professionals, this kind of investigation can deliver just as certainly all the evidence of wrongdoing and at the same time develop and install a thorough, effective plan of remediation.
In accomplishing this approach, it is useful to think of an investigation being conducted in four stages.
Stage One - Stage One is an inquiry into the identified misconduct. The investigative team inquires as to the misconduct itself, so it can understand fully the actual misconduct and resulting consequences, including the possibility of criminal or otherwise illegal conduct. This stage is important because it provides the core information about the business problem that needs to be addressed.
Stage Two - Stage Two is a review of the environment in which the misconduct occurred. This part of the investigation is designed to accomplish two primary goals:
(1) To understand the environmental conditions in which the misconduct occurred. This is important in order to address the question of remediation. For example, the questions can be: did a particular control fail, did management override the control, or was there no control that might have intercepted the issue in an early stage. Remedying a failed control requires one set of actions; constructing new controls and culture requires others.
(2) To explore other aspects of the overall company environment which may contribute directly either to the misconduct itself or to the immediate environment in which it occurred. For example, if the issue is one of revenue recognition, did it result from a weak corporate policy?
In the course of either Stage One or Stage Two, it is often the case that the investigation also will unearth indications that the issue may or may not exist in other areas of the company and in which additional areas the company may be exposed. Exploring those leads in order to develop an overall picture is the objective of Stage Three.
Stage Three - Stage Three establishes the pervasiveness of the issue throughout the company. Is the given instance of illegal misconduct unique and isolated, or is it an indication that there are issues of a similar kind in other parts of the company?
Stage Three is unique to any investigation. What the company needs from Stage Three is knowledge that the misconduct under review was isolated or, if not, that the investigation must extend to those other environments, divisions and business units in which the issue may exist.
The plan of action for Stage Three is usually derived from the basis of the information gathered in Stages One and Two. With the help of the appropriate managers, the investigative team constructs a plan for evaluating other relevant areas of the company. For instance, it may be relevant that employees who were once in the job function of the operating unit where the misconduct occurred are now stationed in the same or similar function in another operating unit, or even in a different function in a different operating unit. Or there may be similar operating conditions in another operating unit.
The starting points for Stage Three are the specific facts provided by interviewees and documents obtained in Stages One and Two. Stage Three is completed when the plan designed for Stage Three has been executed, and Stage Three has not itself uncovered still more environments that need exploration.
In Stage Three, it is particularly critical that the investigative team work closely with company management. The investigative efforts in Stage Three must be conducted in the least disruptive manner possible. To ensure minimal disruption, a great deal of thought and planning goes into the analysis of other environments in which the same misconduct may have occurred and the investigation itself is undertaken with a strategy of maximum efficiency, meaning as few interviews as possible and as little intrusion upon files and operations as possible.
Stage Four - Stage Four is remediation development with the right managers of the remediation program and the plan for its implementation. In developing the program, the investigative team works closely with personnel identified by the management as responsible for implementing and subsequently overseeing the program. The program is reviewed carefully with the appropriate board committee or company management. It is reviewed with an eye for completeness, but also cost and efficiency of installation. Remediation plans can include steps as simple as terminating particular employees, to redefining job functions, to designing controls, to establishing training. Or, the remediation plan can be as complex as an intricate restructuring of an entire operating unit.
Remediation plans almost always implicate a component of the company's compliance program and the company's control systems. It is important to emphasize prevention over detection (although both are necessary) with the goal of having prevention built into the business model as a value add. Detection alone tends to encourage "going underground" with undesirable practices.
In companies without compliance programs, one component of the remediation plan is often the design and installation of a compliance program. A well-constructed compliance program can reduce the number of incidents precipitating investigations in several significant ways:
The preparation of such a program requires the identification of principal risks in the business model and the design of processes to address them.
The installation of the program requires training of employees to meet the expectations of the company and its business model.
The program requires managers to detect faulty business practices or misconduct early and often provides early warning signals for their use in this function.
The program will require the installation of a system of responses to problems once detected.
A robust compliance program will include an annual audit, which is no more than a thoughtful review of the performance of the company under the program. This will in turn lead to further tightening of the compliance program and will provide another opportunity to identify failures in conduct.
Although the scope and objectives of any investigation are captured and conducted in the stages described above, this does not mean that each stage is completed before the next is begun. The investigation is conducted along a continuum so that it can be efficiently completed. Document review that is related to one stage may still be ongoing while another stage is in process. Although the remediation program is always the end game, its basic components will emerge at the earliest stages of the investigation.
There are some process management musts. Any investigation must aim at creating an investigation team that is no larger than necessary but contains individuals with necessary expertise. The investigative team should have as one goal the minimization of business disruption. Because any investigation is an inquiry from the known into the unknown, care must be taken to preserve any and all attorney-client and other privileges which may be important upon conclusion of the investigation.
Finally, any company needs to address when to embark upon an investigation. Without exception, senior management and especially general counsel who have experienced costly investigations in conjunction with even more costly regulatory proceedings will all expound on the value of undertaking an investigation at the first sign of trouble. When early questions and concerns are taken seriously, a well-planned, non-intrusive investigation can lead to the correction of problems before a company pays an expensive price from both a monetary and a public image standpoint. Nevertheless, corporate cultures tend to ignore the early signals just as human beings tend to ignore early symptoms of ill health. The present business and judicial environments reinforce the notion that early investigation of a problem, especially in an environment in which the problem is spotted during a regular audit of a full-scale compliance program, can be a significant value-add instead of an undue burden.
Published June 1, 2006.
