In any given week, news headlines reveal numerous examples of fraud and misconduct occurring at corporations. The consequences often include massive fines, large jury verdicts or settlements in civil litigation, and criminal prosecution of corporations and their leaders. In many instances, the collateral results of these events such as debarment from government (and even private-sector) contracting and delisting from stock exchanges can be devastating to a company and its stakeholders.

A company that is well-prepared, and has the know-how to conduct an effective internal investigation has a better chance of weathering the storm and mitigating the impact of such unfortunate events. This series of articles will discuss a dozen do’s and don’ts of corporate internal investigations, covering best practices for identifying and investigating corporate misconduct, conducting and managing internal investigations, and for determining when and to whom to report conclusions.

With that backdrop, a discussion of the first two do’s and don’ts follows.

1. Do listen for the whistle

The sooner a company discovers (and stops) potential misconduct, the better chance it has of avoiding the worst consequences. Recent legislation such as Dodd-Frank and the Affordable Care Act has created unprecedented incentives for whistleblowers. Accordingly, it is paramount that a company develop internal processes that motivate employees to report concerns internally before contacting government agencies.  

Although the details of internal reporting structures may vary, certain core elements are universally applicable: 

  • Emphasize the duty to report

Employees cannot turn a blind eye to misconduct. Every employee should be cognizant of her own duty to report potential wrongdoing.

  • Educate employees

Employees understand the company’s culture and expectations. It is not enough to post your company’s policies on a poster in the cafeteria. Education about reporting duties and compliance must be a central part of every employee’s training.

  • Prevent retaliation

Retaliation against reporting employees will not only chill candid reporting, but it is also illegal and may lead to enhanced consequences for the corporation. Maintain strong policies against any retaliation.

  • Ensure confidentiality

Some employees may hesitate to report misconduct due to fear of retaliation. Establish channels of communication that allow the employee to maintain confidentiality.

  • Establish a hotline

Companies can ensure confidentiality through use of an internal hotline to foster reporting to management.

  • Appoint an ombudsman

An ombudsman is a company representative who acts as a confidential and neutral listener with whom employees can address concerns.

Ultimately, the goal should be to educate employees about the importance of reporting wrongdoing, in an atmosphere where employees feel comfortable doing so and have confidence that management will follow-up.

2. Don’t shoot before you aim

Your compliance policy has led to disclosure of misconduct: What now? Your investigation must start with a plan to gather information. The plan must take into consideration the ultimate objectives of the investigation: What is the proper scope? How pervasive is the alleged wrongdoing? When and where did it start? Who knew or should have known? What happened?

The investigation must be broad enough to determine whether misconduct actually occurred, discover evidence helpful in responding to an actual or potential government investigation, and enable the company to take remedial action. Yet, it must be managed in a way that limits disruption to business operations and ensures confidentiality. As the corporation learns information, circumstances may change and you must be agile enough to adjust the focus and scope of the investigation.

Typically most of the critical information will appear in documents and business records. Accordingly, the first step is to determine where relevant documents likely reside and how can they be collected. The analysis of the documents will then dictate what internal and third-party witnesses the company should contact.

Finally, all of these considerations must be informed by one overarching factor—time. The company must assess the level of urgency and create a timeline. The investigation may need to be completed and disclosure made before the government becomes independently aware of the facts. Alternatively, management may need to make business decisions based on the findings. The constraints of time may dictate both the scope of the investigation and the resources you devote to it.

Our next piece will address the next two of our 12 do’s and don’ts of internal investigations: do dig where the treasure is buried and don’t destroy documents.