At 4:30 one Friday afternoon, Jason Lane, an attorney, receives a call from his neighbor, Tim Donovan.

Donovan is also the president of Acme, Inc., an Alabama corporation that makes industrial tubing which it markets and sells to various construction companies, contractors and state and local govern- ments. Donovan tells Lane that earlier in the week, Acme fired its long-time accounts payable clerk, Susan Thompson, after determining that roughly $15,000 had been paid the previous month to apparently fictitious entities via checks she had issued. After learning of her planned termination, Thompson became upset and responded to Acme’s in-house counsel by threatening to report to “the feds” Acme’s longstanding practice of paying kickbacks to local government officials in return for agreements to award Acme con- tracts for public works construction proj- ects, followed by Acme’s recording those payments as “contracting expenses.” Donovan expresses great concern and asks for an immediate plan of action.

While this scenario presents an array of challenging questions and potential traps for the unwary, all are driven by one thresh- old issue: do Thompson’s allegations have any merit? To answer that question, an and external counsel will be handicapped significantly in advising Acme.

In any internal investigation, certain procedural and substantive issues must be addressed and resolved to instill confi- dence in the investigation’s results.

Perception is reality in this context: an investigation considered to be a sham will be disregarded (or worse, potentially used as evidence against the company in subse- quent civil and criminal litigation), whether that result was intended or that assessment is accurate. With the Acme hypothetical as a backdrop, this article endeavors to explore the range of issues implicated when an attorney undertakes an internal investigation by (1) identify- ing the primary areas of concern counsel faces when a corporate client learns of allegations of misconduct, (2) under- standing the most significant strategic and ethical hazards that typically arise and (3) recommending practical strate- gies to overcome challenges presented.1

Procedural Issues

An internal investigation typically con- sists of three stages. The first involves assessing the reported conduct, determin- ing the proper scope of review, preserving

key evidence and developing an investiga- tive plan. The second involves gathering and analyzing information to determine whether, and to what extent, further expansion of the inquiry is appropriate.

The third entails final determination of the nature and scope of any misconduct, appropriate remediation and the obligation or prudence of self-disclosing the matter to government enforcement agencies or regu- lators. In theory, these stages stand sepa- rate and distinct. In practice, however, they are interdependent, such that decisions made in one stage often have a dramatic and immediate impact on others. The dis- cussion below considers some of the more significant issues presented, and offers sug- gestions to address them.

a. Determining Who Will Conduct the Investigation

The majority of internal investigations are appropriately conducted either by in- house counsel, compliance officers or human resources personnel. These inves- tigations stem from relatively higher-fre- quency, lower-impact matters such as improper use of company facilities,

expense account impropriety and lower- value theft. In certain situations, however, the failure to outsource the investigation can cast doubt on the legitimacy of the process. Two scenarios are most common: where the allegations are lodged against senior management, either directly or by implication; and where the allegations, if proven true, would expose the company to criminal or regulatory sanctions.2

The involvement of outside counsel is essential in the Acme scenario. Thompson has not only alleged conduct amounting to a serious crime, her assertion almost certainly implicates the company’s senior management. The internal vetting of her claims–either by individuals alleged to have participated in or, at a minimum, possessed knowledge of the activity in question–would be inherently suspect, as it would amount to the accused investigat- ing themselves (or having those who report to them do so). Under those cir- cumstances, it is prudent not only to secure outside counsel, but also to ensure that such counsel’s independence could not be called into question.

b. Determining the Investigation’s Scope

As a general principle, the contours of an internal investigation should correlate to four key dimensions of the underlying allegations: the time period, geographic scope, financial impact and number of individuals involved. At the outset, coun- sel should design an investigative plan to gather evidence relevant to the underly- ing allegations. The first determination investigating counsel should undertake is whether the activity in question is ongo- ing. Occasionally, the impropriety of cer- tain activity might not be clear on its face, thus complicating the decision about whether to cease what may, in fact, be innocuous conduct. Where, as in the Acme scenario, the wrongfulness of the conduct is readily apparent, bringing it to a halt should be top priority.

Applying theory to practice demonstrates the challenges which can often occur when a less-than-detailed allegation is made, and highlights the need to gather as much infor- mation as possible about the accusation in order to construct an investigative plan that is at once suitably comprehensive and appropriately tailored. In the Acme sce- nario, counsel will be challenged to some degree based on the relatively generic

nature of Thompson’s allegation. Thompson referenced the company’s “longstanding practice” of paying kickbacks but provided no specifics about the length of time this conduct supposedly occurred. She failed to identify which individuals orchestrated, car- ried out or were aware of such conduct, just as she left unidentified the financial impact (whether in terms of kickbacks paid or ill- gotten gains realized) which resulted.

Finally, her bare-bones assertion provided no indication of the geographic breadth of this activity, so that counsel could know to look for quarantined pockets of impropri- ety, systemic misconduct or even something in between.

Faced with such a broad allegation, one possibility is that counsel simply embark on a no-stone-left-unturned investiga- tion, one which searches far and wide without regard for cost or collateral impact.3 Far more frequently, however, the better course of action is to seek greater detail regarding the initial allega- tion. Under this approach, counsel accomplishes at least two purposes: gath- ering much-needed specifics which better inform the direction and contours of the investigation; and providing tangible evi- dence to the would-be whistleblower that her allegations have been taken seriously.4 In following up with Thompson, counsel would want to know at least the following about the conduct she alleged:

1. How long did it occur?
2. Who came up with the idea to carry it out?
3. Who carried it out?
4. Who was aware that it was being car- ried out?
5. To whom were payments made?
6. In what amounts?
7. On which contracts did Acme realize a benefit from this conduct?
8. How much of a benefit was realized?
9. Which documents provide evidence relating to conduct?
10. Has anyone taken steps to alter or destroy documents which relate to this conduct?

Counsel can focus the investigation in a far more informed manner armed with as many answers to each of these various questions as possible. Sometimes, however, such follow-up is either not feasible or even possible. In those instances, investigating counsel should proceed by reducing the

allegations to their core. For example, because Thompson asserted that kickbacks were paid and mischaracterized in Acme’s books as “contracting expenses,” a review of those entries–and the information purport- edly validating them–is an ideal starting point. Counsel will want to scrutinize any expenses Acme recorded and labeled as such on public works contracting projects for a set period (the “longstanding” modifi- er suggests that three years would be an appropriate starting point), looking specifi- cally at whether the amounts recorded are corroborated, whether by invoices reflect- ing the amounts claimed or other authentic support, and identifying all involved in the recording of those expenses.

c. Deciding How to Gather Information

Once the initial framework of the inves- tigation is set, counsel needs to determine how to gather information. Two general categories exist: documents (whether in hard copy form or electronically-stored information (“ESI”)), and witness inter- views. For each, the challenge is to secure and analyze enough information to allow for informed determinations without wasting time, effort and money on matters of minimal significance.

The first step in securing documents is to issue a litigation hold which, at a mini- mum, ensures that custodians with potentially relevant information are on notice that such material should not be altered or destroyed.5 In addition, meas- ures should be taken to ensure that any auto-delete systems in place (e.g., those which cause emails or documents to “roll off ” the system after 90 days) are sus- pended. The failure to take both of these steps will almost certainly draw the gov- ernment’s ire, if and when the investiga- tive process is assessed at a later point, particularly if vital evidence is lost.6

Next, counsel should develop a frame- work which ensures that documents are collected and reviewed in a consistent fashion. The larger the investigation is, the more individuals necessary to con- duct it. Without investing time at the out- set to ensure that everyone collecting documents is using the same approach, those collection efforts will produce sepa- rate groups of documents that are over- or under-inclusive, depending on who undertook to gather them. Perhaps more significantly, the lack of a consistently

applied framework for reviewing the doc- uments will mean that critically impor- tant evidence is missed.7 To avoid this outcome, investigating counsel should prepare and disseminate to reviewers uni- form guidelines explaining the categories of information and types of documents relevant to the inquiry. Particularly where multiple reviewers are involved, focused training at the beginning of the project, distribution of checklists, protocols and other standards (ideally in handbook form to allow for efficient consultation), and regular auditing of performance all serve to maximize the possibility of a consistent approach.

In conducting interviews, counsel must determine: who to interview, in what order and at what point in the process (i.e., whether before or after relevant doc- uments and ESI have been gathered and analyzed). While these decisions are nec- essarily fact-driven, a few basic rules prove helpful. Counsel should identify the epicenter of the conduct and develop the list of interviewees from there. The list should not be a static record, however– even a moderately effective interview will generate new leads, including the identity of additional interview subjects.

Sequencing of witness interviews can follow one of two approaches: starting at the center of the conduct and moving out, or starting at the outskirts and moving in. As a default position, the authors prefer to begin at the heart of the conduct at issue. This approach not only serves to reduce a wrongdoer’s ability to formulate a false explanation and anchor it in the versions attested to by others, but also maximizes the possibility that a full and frank confession by the scheme’s architect may serve to reduce dramatically the amount of time, effort and money that would otherwise be necessary to discern the size and shape of the misconduct. For this reason, the authors also prefer to interview witnesses early, even if that means going forward without all poten- tially relevant documents, on the theory that later acquired evidence can serve as the basis for a follow-up interview.

Applying these principles to the Acme scenario means that counsel will want to secure all documents relating to public contract work, particularly those having an impact on the amounts recorded as “contracting expenses.” In addition, coun- sel will want to interview all of the indi- viduals connected to those entries,

including those who made them, those who submitted information purportedly in support, their respective supervisors and any internal and external auditors who are charged with evaluating the entries’ accuracy. Counsel will also want to interview senior management regard- ing this supposed activity to explore the possibility that genuinely innocuous con- duct has been misinterpreted by someone with a less than complete understanding of the facts.

This is common when allegations arise outside of an employee termination sce- nario. Because most companies of any sig- nificant size separate the function of providing goods or services and billing for them, it is common for employees with knowledge about part of the process to make assumptions about the other. For example, healthcare providers frequently provide services to patients under circum- stances which do not qualify for reimburse- ment by Medicare. Employees involved in the provision of those nonqualified services often assume that the company has improp- erly submitted a claim for such services and raise allegations of impropriety when in fact

those in the company’s billing department, having identified the deficiencies surround- ing the particular services, have properly declined to do so. When the possibility exists that uninformed assumptions may have triggered the allegations of miscon- duct, an investigating attorney serves the client best by paying particular attention to determination of which portions of those allegations stem from personal knowledge, and which do not.8

During the course of these interviews, the lawyers conducting them must take pains to make clear where their loyalties lie. In conducting an internal investiga- tion, counsel represents the company and not the individual employees being inter- viewed in their individual capacity.

Counsel who fail to make clear this fact do so at their peril. The most effective means to do so is the issuance of an “Upjohn warning,”9 which explains to the interviewee that: a) interviewing counsel represents the company, and not the indi- vidual employee; b) because the inter- viewer is conducting the interview to gather information to provide legal advice to the company, the substance of the interview is protected by the attorney- client privilege; c) that privilege belongs to the company, not the interviewee; d) the interviewee must maintain the confi- dentiality of the information disclosed during the interview; and e) the company, in its sole discretion, may decide to waive that privilege at some future point.10 Without such warnings, investigating counsel can engender confusion and leave the company–and themselves–exposed.11

d. Guiding Principles

Beyond ensuring that each internal investigation is fair and thorough, those conducting an inquiry should be mindful of the dangers of the “invisible gorilla” effect and the need for “structured flexi- bility.” The former refers to a well-known psychological experiment designed to measure “inattentional blindness,” the state of being so focused on a primary task that an unexpected event, even one that should be blatantly obvious, is over- looked.12 In the internal investigation context, the invisible gorilla effect can result in a lawyer’s concentrating so intently on addressing the primary mis- sion (in the Acme case, determining whether Acme paid kickbacks and cate- gorized them as legitimate business

expenses) that readily apparent and per- haps even more troubling conduct is overlooked (e.g., the systematic practice of overbilling on government contracts).

Structured flexibility involves main- taining an appropriate balance between adhering to a plan of attack while also recognizing the need to change course when circumstances dictate. As detailed above, it is essential to develop a plan at the outset of any internal investigation. As information is gathered and assessed, however, it often becomes necessary to modify the scope of the inquiry or focus it in a new direction. Successful investiga- tions require counsel to formulate a strat- egy at the beginning of the process, but not be enslaved by it as information is gathered. By developing a framework at the outset that allows information to be evaluated in an organized fashion while at the same time preserving the ability to modify slightly or overhaul completely the approach as necessary, depending on what the investigation reveals, counsel will be best positioned for success.

One relatively simple approach mitigates both of these challenges. By assessing the information gathered at regular intervals throughout the course of the investiga- tion–rather than waiting until the end of the process–lawyers can better evaluate the significance of facts gathered thus far, the key questions that remain unanswered and how best to move forward.

Substantive Issues

With this framework in place, investi- gating counsel should be well-equipped to begin uncovering the truth. In most cases, it is not difficult to determine the under- lying factual events. In attempting to determine whether misconduct occurred, however, investigating counsel must ascertain whether those actions were undertaken with improper intent.

The clearest and most compelling mark- er of improper intent–overt and explicit agreements between wrongdoers planning the scheme–seldom stands out on its own. Instead, counsel is typically required to search for circumstantial evidence of improper purpose from among the mass of information collected in order to identify not only the scope of illicit activity, but to distinguish scheme’s generals from its foot

soldiers. Such evidence frequently falls into the following categories:

a. Concealment

Short of an unqualified confession, evi- dence of concealment is typically the most forceful indicator of intent. That evidence can take several forms. The list below cata- logues some of those forms and offers examples relevant to the Acme scenario:

• Efforts to mask involvement in cer- tain activity (e.g., proof that particu- lar individual recorded kickbacks as legitimate “contracting expenses” under different computer username);
• Attempts to destroy documents (e.g., computer forensics showing that a member of senior management attempted to “double delete”13a series of emails which reflected a discussion of the kickback scheme in its infancy);
• Attempts to alter documents, whether by backdating those that purport to reflect transparency or supervisory approval of certain activ- ity (e.g., evidence that a witness cre- ated and then backdated a memorandum outlining the rechar- acterization of kickbacks as “con- tracting expenses” to suggest that no effort had been made to hide the activity, and that approval to under- take it had been sought and granted) or by removing traces of misconduct (e.g., the creation of a second general ledger which scrubs clean the “con- tracting expenses” entries);
• Steadfast and unexplained refusals to cooperate with investigative efforts, as well as attempts to cause others to do so the same (e.g., despite repeated attempts and offers to accommodate schedules, the entire accounting department at Acme refuses to be interviewed or provide access to seemingly relevant documents); and
• Efforts on the part of the investiga- tion’s subjects to harmonize their explanation of certain events (e.g., when interviewed, several members of senior management recount a meeting with Acme’s prior outside counsel where the practice of paying money to contracting officials, and then booking those payments as “contracting expenses,” was discussed and approved as lawful).14

b. Inconsistent Statements

In the words famously attributed to Mark Twain, “If you tell the truth, you don’t have to remember anything.” Applying this adage often proves helpful when seeking to expose efforts to cover up improper conduct by telling false- hoods. Particularly where a witness’s explanation contradicts documentary evi- dence, other witnesses’ accounts or, most significantly, the witness’s prior state- ments, identifying and confronting the witness with inconsistencies can bring the witness to the conclusion that the scheme has been uncovered, and compel him or her to come clean.

c. Efforts to Evade Internal Controls

In most companies, internal controls exist to ensure that applicable laws are complied with and/or to prevent the mis- appropriation of corporate funds. In effect, these internal controls often function as the company’s own “laws” and, thus, behavior calculated to circumvent those restrictions can provide valuable insight on an actor’s motivations. Most often this motivation emerges when an employee expends a vastly disproportionate amount of time and effort for no apparent purpose other than to evade existing protocols. For example, where a company requires dual signatures on checks above a certain amount (e.g., $5,000), the existence of numerous checks in amounts below that threshold to the same payee within a rela- tively short period often signals improper intent. The existence of such controls also serves to foreclose the defense customarily offered by wrongdoers–that at all times they acted in good faith, and did not know their conduct was prohibited.

d. Denials Buttressed by “Derivative” Documents

Those engaged in misconduct frequent- ly cannot help but leave behind evidence which documents their actions. Like foot- prints in the snow, this evidence provides valuable circumstantial proof which not only exposes the conduct, but also, more importantly, reveals the identity of those who carried it out. In searching for such proof, investigating counsel must secure and review the “raw” documents and ESI left in the wake of the scheme.

All too often, complicit actors seeking to cover their tracks create “derivative” documents which purport to reflect the substance of the contemporaneously gen- erated records which detail the miscon- duct. Such documents often take the form of spreadsheets or other summaries which claim to accurately represent the substance of other documents, which may be voluminous, scattered or both. When investigating counsel receives information of this type, he or she must not simply accept it as an accurate representation of historical events. Rather, the evidence must be scrutinized and its contents com- pared to the “raw” materials purportedly summarized, in order to ensure that the “derivative” document is a suitable proxy.

In the Acme scenario, for example, such evidence might take the form of a recently generated spreadsheet which purports to document the manner in which “contracting expenses” were recorded and paid. In its original form, such information carries significant value: it serves to memorialize how those pay- ments were treated–and by whom–before the conduct was subject to scrutiny. In order to avoid allowing a wrongdoer to buttress his denials with manufactured evidence, investigating counsel must strive to secure the original documents and exploit them for their greatest value– by contrasting what actually happened with the apocryphal story offered after the fact.

Effective Strategies to Overcome Evasive Tactics

To detect and expose the maneuvers detailed above, counsel should consider utilizing the following techniques:

1. To identify concerted efforts to thwart an investigation’s effectiveness, or to uncover attempts to deter others from cooperating, counsel should be sure to ask each interviewee whether he or she has discussed the issues at hand with other Incredibly, those who invest great effort to get their sto-

ries straight frequently fail to coordi- nate what they will say when asked if they have spoken with each other.

Questions designed to root out con- spiratorial endeavors often serve an equally important purpose by exposing inconsistencies among witnesses about whether they have, in fact, discussed the conduct under investigation.

2. To determine whether acts of conceal- ment stem directly from a specific stimulus (thus revealing the most compelling evidence of improper intent), investigating counsel should endeavor to monitor the conduct of key individuals immediately after the investigative spotlight has been Where possible, watching an individ- ual’s computer activities–specifically, attempts to delete documents or emails–in the period following notifi- cation of the investigation’s existence greatly enhances the ability to secure valuable information. Even when the investigation lacks that level of forensic sophistication, close scrutiny of post- notification behavior can often pro- vide valuable insight.

3. To uncover inconsistencies in witness accounts, investigating counsel can benefit from not simply requesting that a particular witness detail again his version of events and his explana- tion for certain conduct (particularly where those prior explanations were offered before the investigation began), but also from inquiring of others about what the individual may have said to them Material variations constitute valu- able arrows in the quiver when inves- tigating counsel is attempting to expose an interview subject’s attempt to deceive.15
4. To prevent interview subjects from frustrating the interview process, counsel should, whenever possible, eliminate questions which allow for subjective Inquiries in this format very often do nothing to advance the mission at hand, and instead allow the interviewee to invent validation for his or her improper conduct where none actu- ally exists. Even counsel well versed in questioning witnesses in other contexts, such as depositions or tri- als, will benefit from investing the time necessary to frame proper inter- view questions calculated to elicit information of maximum value.

This means that investigating counsel should labor to formulate questions which require an answer susceptible to being proven demonstrably true or false. For example, rather than asking an Acme accounting department employee if he took “appropriate” steps before recording certain payments as “contracting expens- es,” investigating counsel instead should formulate questions designed to ascertain exactly what the employee did, when, on what basis and for what reasons. While this approach is often more cumbersome, there is virtually no comparison between the values of the answers produced.

Conclusion

Any lawyer conducting an internal investigation must understand that those affected by the investigation’s findings– both internal and external–will scrutinize not only the final conclusions reached, but also the methods undertaken to arrive at them. Regardless of whether the reviewing party is a whistleblowing

employee, adverse counsel, a board mem- ber or a prosecutor, judge or jury, the integrity of the investigative process serves as the means by which any investi- gation’s legitimacy is measured. By recog- nizing this at the outset, and employing methods which demonstrate the hall- marks of a unbiased, thorough and prin- cipled undertaking, counsel can maximize the ability to conduct internal investigations which are valid and confi- dence-inspiring not only in theory, but also, more importantly, in fact. 

Republished with permission. The article "Conducting an Internal Investigation: Recognizing and Resolving Key Issues from an Internal and External Perspective" was published in the September 2014 edition of The Alabama Lawyer.