CCBJ: Can you tell us a little bit about yourselves?
Melissa Cohen: I’m a Managing Director in Protiviti’s Legal Consulting practice, based in Dallas. I’m also a Certified Public Accountant and Certified in Financial Forensics. My practice focuses on forensic accounting investigations involving fraud, whistleblower allegations, and asset misappropriation and helping corporate clients, as well as external law firms, prepare for and respond to unplanned events. Before joining Protiviti, I spent 18 years in the forensics practice of a global public accounting firm.
Bill Roppolo: I’m a Partner with Baker McKenzie. I’m in charge of our litigation group from the Miami and New York offices and serve as the lead partner in our Miami office. I’ve been with Baker McKenzie for 19 years, and prior to that was a lawyer with U.S. Customs and Border Protection (formerly known as U.S. Customs Service). My practice and my team focus on high-stakes litigation, which entails everything from class action defense and antitrust work to white-collar and defense of companies that get embroiled in U.S. laws and regulatory issues. Litigation often starts before anyone knows about it, but if a company is smart, we’re able to get involved early in the process to find out what the problem is so that by the time litigation begins, we’re ready.
Can you speak about managing sensitive issues surrounding internal fraud investigations and some ways in which companies can prepare?
Melissa: The first bit of advice I would give is to not go at it alone. All too often, we hear that a company is attempting to perform an internal investigation without the support of counsel and advisors, and they encounter challenges trying to manage the investigation, in addition to conducting their regular day-to-day responsibilities. When companies become aware of or suspect potential wrongdoing, one of the first questions I ask is whether they have contacted external counsel. Next, I confirm that we are working under attorney-client privilege in order to maintain confidentiality and ensure that all data and information sharing is on a need-to-know basis.
Bill: One of the things we initiate when we are hired to support an investigation or litigation is what we call a “communication protocol,” which is mapping out who our point of contact is and the method(s) by which we will be communicating. We want to make sure we have privilege. And, for any and all matters, especially highly sensitive ones such as fraud, we do not want the whole company to know. We want to be very strategic about how we work together. We will bring in our team, including consulting firms like Protiviti to set up an investigative plan and work with the designated point of contact at the company to uncover the alleged fraud or misconduct.
What are some effective strategies and communication roadmaps for key stakeholders?
Bill: The primary strategy point is ensuring that every communication is privileged, which we do by setting up certain protocols within the company, as I mentioned above. For example, if the CEO and COO are talking about a litigation matter, that conversation is not privileged. We want to ensure that every conversation within the company has a privilege attached to it. To do that, the company would want to involve either in-house counsel or outside counsel in those communications or discussions regarding the investigation. Also, we limit communications to a small group of individuals within the company to minimize risk of public exposure to privileged material. Both are items we would include in our communication protocol.
Melissa: The response team is typically cross-functional, based on the nature and scope of the investigation, and may include general counsel, outside counsel, internal audit, compliance, and IT. The first time these stakeholders come together should not be in response to an incident. The response team should already have a plan, or process map, in place for coordinating and managing the investigation. They should know their respective roles and responsibilities. In such instances, we would also coordinate with Bill and his team on how we will preserve evidence, manage e-discovery, leverage protocols already in place, and determine what needs to happen to run an effective and complete investigation.
Can you describe your respective roles and how you work collaboratively in support of a client during an investigation or litigation?
Bill: Collaboration is critical to the outcome of an investigation. A law firm can’t set up a plan without having its e-discovery team or consultants, like Protiviti, and the client sitting next to us at the table. It’s important when setting up a plan that it’s not conducted in a vacuum. If Melissa and I set up an investigation plan and it’s deemed too disruptive for the company, then we just wasted a lot of time. The same is true if we come up with a plan with components that the company cannot implement or that contemplates the review of information or data that the company does not have. Everyone needs to work together to create a plan that works for everyone, that is strategic, and that is going to uncover as much as possible.
Melissa: In my role working with both internal and external counsel, we help support the investigation by assisting with case strategy, preserving and collecting data, conducting interviews, and performing transaction testing and analyses. We work hand in hand with our legal technologists to collect and process electronically stored information, perform analytics to cull the population, and post to a document review platform. Further, we create search terms, train and manage a document review team, and ultimately assist with productions to the other side, or potentially the government. Client stakeholders should have a litigation readiness plan, or response framework, in place to respond timely and efficiently to the matter. The plan should identify the cross functional response team, communication protocols, including potential coordination with law enforcement, document preservation and legal hold procedures, and how the company is ultimately going to remediate and monitor. As consultants, we provide an end-to-end solution where we’re coming in and helping, not only in scoping and investigating the matter, but also, making sure that proper controls are in place so something like this doesn’t happen again.
How can companies minimize or proactively prepare for a potential issue?
Melissa: So much of an investigation is driven by data. The most important thing companies can do is to know where their data resides and be aware of their document retention and mobile device policies. This helps when the forensic consultants come in to collect the data, so they can efficiently obtain what’s relevant to the investigation. Performing data mapping beforehand and knowing the appropriate stakeholders from whom to extract the information, helps save time and costs. This is particularly important given the change to remote and hybrid work where much more data, of all types, is sent between parties. Having a firm grasp on where data resides and if, when, and how it will be destroyed helps in the planning stages of an investigation.
Bill: Melissa’s point can’t be underscored enough. It’s surprising how many times you deal with companies that have no idea how their servers work, or that they have changed over or updated their servers; and they’re just a mess. The result is the client spending more time and money to rectify the issue. When it comes to litigation and investigations—preparation is key. Companies should ensure that their key individuals, for example, the Chief Information Officer, are equipped with all the relevant information to push the investigation forward efficiently and assist in litigation. Having executives who are well-informed and prepared to assist the company’s lawyers can make a great deal of difference in the prompt and beneficial resolution of a matter against the company.
If plaintiff’s lawyers or regulators target your competitors, that’s a good indication that you’re probably next. The most proactive companies monitor corporate litigation matters within their industry. Executives should ask themselves, “What motions are being filed?” and “What defense arguments are successful?” Being prepared to make the necessary arguments and having litigation procedures set up in advance will ensure the company is ahead of the game to successfully resolve investigations or litigations early.
Any final thoughts or key takeaways for our audience on internal investigations?
Bill: The key things are to be collaborative within your organization and with outside counsel and consultants to ensure you’re ready. Don’t procrastinate or wait for a rainy day to plan. Identify the risks that can potentially impact your organization and prepare for them. At some point, you’re going to get a subpoena or a complaint requiring you to conduct an internal investigation, and the more you plan, the easier it is going to be.
Melissa: Make sure that you have the right stakeholders involved and defined roles and responsibilities so there’s transparency among the team handling the response to the investigation. The investigation doesn’t end with the final report or the settlement, but rather, what is going to happen afterward. What are you going to do to remediate? What policies need to be updated or added? What protocols do you need to strengthen the controls in your environment? Just because a case is closed doesn’t mean it goes in a drawer somewhere to be forgotten. You should continue looking for ways to enhance safeguards, as well as implement training and controls to prevent something like this from happening again.
Published June 6, 2024.
