Search News and Articles
Internal investigations: what you need to know
Barry Donnelly and Iain Mackie examine the questions every in-house lawyer needs to answer when dealing with internal investigations and working with the Financial Services Authority.
Due to the recent rise in instances of fraud and the increase in activity by regulators, conducting or commissioning internal investigations is becoming an increasingly important aspect of an in-house lawyer's role. This article aims to provide practical guidance about how to conduct an investigation, and goes on specifically to consider some of the Financial Services Authority's (FSA) investigatory powers.
The investigation team
The first step will be to assemble the investigation team. It will normally include: internal and/or external counsel, a member of the senior management team, and a member of compliance. Where appropriate, it may also include a representative from the internal audit team. Where assets need to be traced or recovered, the services of a forensic accountant may also be required; it will often be necessary to search for, preserve and review large amounts of digital data and forensic IT experts can be instructed to help with this process.
No member of the investigation team should have been involved in the events that gave rise to the investigation, because the team must be, and must be seen to be, completely independent. This will provide reassurance to individuals subject to the investigation that they will be fairly treated and demonstrate to outsiders, and a regulator in particular, that the matter is being dealt with appropriately. For this reason, it is often preferable to instruct external, rather than internal, counsel because their input may be seen as being more objective.
It is easy to underestimate the amount of time and energy that will need to be devoted to an investigation and members of the team from within the business will probably need to be relieved of other duties. An under-resourced investigation is likely to make slow progress, which will increase the disruption caused to the business. On the other hand, a quick response will help a business to get to the root of the problem efficiently and, where relevant, persuade a regulator that its systems and controls are adequate and that it is taking the matter seriously.
A key consideration in any investigation will be to ensure that, so far as it is possible to do so, documents created during the course of the investigation are privileged. It is a mistake to assume that documents will be privileged just because they were written by, or sent to, internal or external counsel.
Litigation privilege will only attach to documents created in contemplation of litigation1. This means that litigation must be a real likelihood rather than a mere possibility. Furthermore, for litigation privilege to apply, the relevant communication must have been made for the dominant purpose of litigation. Therefore litigation privilege will not apply where litigation is one of a number of reasons for creating a document, but not the dominant one. If litigation privilege does apply, the reasons for creating the document should be made clear on the face of the document to reduce the scope for a dispute at a later stage.
In light of the above, it will often not be possible to argue that litigation privilege applies to documents generated during the course of an investigation. In those circumstances, it will be necessary to try to rely on legal advice privilege. Legal advice privilege applies to:
- confidential communications;
- which pass between a client and their lawyer; and
- which have come into existence for the purpose of giving or receiving legal advice about what should prudently and sensibly be done in the relevant legal context.
The term ‘client’ is narrowly defined and may not extend to all employees of a corporate client. It is important, therefore, to ensure that the ‘client’ is clearly identified. Usually this will be the investigation team. So far as it is possible to do so, communications should then be structured in such a way that they pass between the lawyers and the investigation team. To ensure that this is done, a pre-agreed chain of communication should be established with external and/or internal counsel being the primary communicator.
To preserve confidentiality, and therefore privilege, communications should not be sent to or from individuals who are not the designated client. This is particularly important at the time communications are first sent because, as explained above, documents passing between anyone other than lawyer and client will not attract privilege. However, even documents which were privileged when they were first created can lose that status if they cease to be confidential. Therefore, documents should not be circulated outside the investigation team before legal advice has been taken. If properly structured and documented arrangements are put in place, it will usually be possible to disclose documents to third parties on the basis of a limited waiver of privilege such that privilege can then be maintained against the rest of the world.
In the case of Akzo Nobel Chemicals and Akcros Chemicals v Commission , the European Court of Justice held that communications between in-house counsel and internal clients are not privileged in relation to European Commission competition investigations. If there is any risk of such an investigation, businesses wishing to maintain a claim to privilege in legal advice should instruct external counsel.
In light of the limitations on the availability of privilege discussed above, it will probably not be possible to claim privilege in all documents generated during the course of an investigation. Even where documents are privileged when created, there is a risk that they will be ‘leaked’ or otherwise make their way into the public domain. Therefore, communications should be sent in the knowledge that privilege may be unavailable, lost, or waived, and drafted accordingly. Consideration should also be given as to whether, rather than produce a written document, it is possible to deal with the issue in a telephone call (unless, of course, the conversation will be taped) or at a meeting.
Preservation of evidence
It is vital to put in place procedures to ensure that all relevant documents, including those stored on backup tapes, are preserved. As well as refraining from actively destroying documents or deleting data, this includes suspending any policies that involve the routine deletion or destruction of documents and data and removing backup tapes from circulation. Unless the investigation is being kept secret, individuals involved in the events that gave rise to the investigation or litigation should be instructed to preserve documents in their control. If there is a concern that an individual has secreted important evidence at home or elsewhere which might be destroyed, consideration should be given to applying to the court for a search order to obtain that evidence.
Obvious places to look for relevant documents will include the working files and inboxes of the individuals involved, the hard drives of any computers used by those individuals and, where appropriate, the tapes of recorded conversations. However, it should be remembered that information can now be stored on a wide range of devices including, for example: blackberrys, handheld devices (PDA, iPad), portable data storage media (CD-Rom, DVD, USB drive, memory stick), and mobile phones. Assistance will be required from the IT department and/or external consultants to draw up a ‘data map’ of all the likely sources of information and to advise on the best method of extracting that data.
Particularly in the context of fraud investigations, the date on which a document was created, or the author of it, could be important. Hard copy files should therefore be preserved in their original order. Consideration should also be given to taking images of hard drives and servers to preserve metadata (embedded information about the document such as the date of creation/amendment) attached to electronic documents.
A detailed consideration of the Data Protection Act (DPA) 1998 is outside the scope of this article but it should be remembered that reviewing evidence may amount to processing personal data for the purposes of DPA 1998 and consideration should be given to which exemptions apply and/or whether consent is required from the relevant individual.
As well as preserving existing documents, it is important not to create new documents that may prejudice the company’s position, including in any future proceedings. When things go wrong, the individuals involved will often want to explain their actions or justify the decisions they have taken. There is a risk that those individuals will set out their version of events in writing. However, any such documents will not be privileged and may need to be disclosed in any future civil or regulatory proceedings. E-mails are a particular problem in this respect as they often contain statements that the author would not ordinarily include in a more formal document. In order to avoid the creation of ‘hostages to fortune’, therefore, individuals should be warned not to create any new documents without first speaking to internal or external counsel.
The investigation team will want to interview the individuals who were involved in the events that gave rise to the investigation. However, before this is done, it will be necessary to decide whether individuals who are or may be implicated in any wrongdoing should remain in the workplace. It is quite common to suspend someone on garden leave while an investigation continues, thereby preserving the employee’s contractual duty to co-operate when they come to be interviewed, as well as preventing the individual concerned from interfering with the investigation, tampering with evidence, or causing upset among other staff.
However this should only be regarded as a short-term measure and it must be made clear to the relevant individual and others that this is only a precautionary step and that it does not in any way pre-empt the outcome of the investigation. Commencing disciplinary proceedings, or dismissing an employee, may be seen as a tacit admission that there has been wrongdoing and this may be unhelpful if the business itself is at risk of being the subject of regulatory or criminal proceedings or a civil claim. Close reference must be made to the individual’s contract of employment and the business’s disciplinary procedure throughout the process.
Witnesses should not be interviewed in an ad hoc fashion. All potential witnesses should be identified at the outset, including support staff who may not be implicated in any wrongdoing but who may have relevant information. As a general rule, it is better to interview junior staff first as this will reduce the need to repeat interviews with senior staff if further evidence comes to light after an initial interview has been conducted.
A typical format for a witness interview entails the interviewer making it clear to the interviewee that the interview is part of a fact-finding investigation and not a disciplinary process. At least some of the questions to be asked should be agreed in advance of the interview to provide structure and to ensure that important matters are not overlooked – although it will be a judgement call as to whether the witness is provided with the list of questions and/or any key documents in advance of the meeting.
Unless regulators are involved and insist upon it, it is generally not advisable to tape the interview. In order to improve, although not necessarily guarantee, a claim to privilege, any written notes of the meeting should be taken by a lawyer and it should be made clear that the meeting is confidential. The lawyer should usually act as the principal interviewer with other members of the team asking follow-up questions as and when the need arises. In view of the need to demonstrate a degree of independence, particularly when the FSA is or may be involved, it will usually be appropriate for the lawyer to come from an external law firm.
Consideration must be given as to whether the individual should be separately represented. There is no obligation to suggest to an employee that they be represented unless the first interview is to be more than a fact-finding interview as part of a formal disciplinary process. This question must be judged on a case-by-case basis although from the employer’s perspective it is usually better not to have external representation of the employee because external lawyers can interfere with the process. However, if the witness asks to have a lawyer present, that request should normally be granted.
In general terms, the objective of preserving a business’s reputation will dictate that the existence and nature of an investigation are kept confidential. All members of staff should be instructed not to discuss the matter with third parties and to refer any press enquiries to an identified person (usually a senior member of management). Nevertheless, there is always the risk that the investigation may become public knowledge and in highly sensitive or newsworthy situations, it will often be prudent to consult public relations advisers at an early stage and to agree a media strategy in advance of any news breaking.
Where the business is the victim of a suspected crime, there is not normally an obligation to notify the police and it may be counterproductive to do so – at least before the business has concluded its own investigation. The prosecuting authorities will inevitably have a different agenda from the business and their involvement may hinder rather than improve the conduct of an internal investigation. The immediate threat of criminal proceedings may also discourage witnesses from co-operating in an open way and generally increase the atmosphere of tension surrounding the investigation.
The position may be different where a senior employee’s conduct has resulted in the business itself committing a criminal offence. Public policy is moving in favour of self-reporting and this may result in a reduced penalty. For example, the Joint Prosecution Guidance of the Director of the Serious Fraud Office and the Director of Public Prosecutions on the Bribery Act 2010 makes it clear that a decision by a business to report an offence at an early stage is a factor tending against the bringing of criminal proceedings. The government is also consulting about the possibility of introducing plea bargaining for companies in the form of ‘Deferred Prosecution Agreements’, which will operate on similar lines to the system currently in place in the US.
Irrespective of whether or not a business decides to report an issue to the police, there may well be an obligation to notify its regulator. For example, Principle 11 of the FSA’s Principles for Businesses requires a firm to deal with its regulator in an open and co-operative way, and to disclose to the FSA anything relating to the firm of which the FSA would reasonably expect notice. This is a very broad obligation and includes notifying the FSA of matters having a serious regulatory impact, breaches of rules and other requirements in or under the Financial Services and Markets Act (FSMA) 2000, civil, criminal or disciplinary proceedings brought against a firm, fraud, errors and other irregularities and any insolvency proceedings brought against the firm.
Most insurance policies require that insurers should be notified as soon as events come to light that give rise to a potential claim, regardless of whether, in the case of third-party claims, a claim has actually been made against the insured party. Failure to comply with this obligation may result in the insured party losing the ability to make a claim under the policy. Once an initial notification has been made, insurers are likely to want to be kept up to date with any material developments.
In some cases a business’s regulatory, fiduciary or contractual obligations may require that its clients and customers be informed. This may also be appropriate as part of a ‘damage limitation’ exercise. This is a decision that will need to be taken on a case-by-case basis.
The FSA’s powers of investigation
This part of the article summarises some of the key powers available to the FSA. As will be seen, these powers are broad and subject to only minor limitations. The article then provides some guidance on how best to respond to a decision by the FSA to exercise its powers of investigation.
Informal requests for information
As explained in greater detail below, the FSA has a range of formal powers to require the provision of information. Sometimes (usually when a formal investigation is not underway), however, the FSA may make an informal request for information in reliance upon a business’s general obligation to co-operate with it. A business would be well advised to comply with such a request because a failure to do so would be likely to arouse a degree of suspicion and result in a formal request and a hardening of approach by the FSA.
However, consideration should be given to the specific circumstances of each case. In some cases, a firm may be subject to an obligation of confidentiality and would prefer to receive a formal request for information in order to avoid the risk of being in breach of that obligation.
Formal information gathering powers
Section 165 FSMA 2000 contains a power to compel the provision of specified information or information of a specified description, or the production of specified documents or documents of a specified description. Such information or documents must be ‘reasonably required’ in connection with the exercise by the FSA of the functions conferred upon it.
The word ‘document’ is defined as ‘information recorded in any form’ and includes, among other things, all forms of electronically stored information and recordings of telephone conversations, and the obligation to ‘produce’ documents includes a requirement to produce, for example, electronic data in a legible form.
Section 165A contains a similar power to compel the provision of information and documents that the FSA considers to be, or might be, relevant to the stability of one or more aspects of the UK financial system.
In view of the broad definition of ‘document’ and, in the case of s165, the difficulty of proving that documents are not ‘reasonably required’ by the FSA, there are very few conceptual limits to the type and amount of information that the FSA can demand. A person cannot be compelled to produce a document in respect of which they owe an obligation of confidence by virtue of carrying on the business of banking but even here exceptions apply (see s175(5))2. In addition, firms cannot be compelled to provide ‘protected items’, meaning, broadly, documents that are covered by legal professional privilege (although a firm may agree to waive privilege to demonstrate to the FSA that it is co-operating fully).
Reports by skilled persons
Section 166 gives the FSA the power to require authorised persons (and, broadly, persons connected with them) to provide a report prepared by an independent person (a skilled person) on any matter about which it has required or could require the provision of information or production of documents under s165. The person appointed as a skilled person to make the report must be nominated or approved by the FSA and must appear to the FSA to have the skills necessary to make a report on the matter concerned. In practice, the skilled person will be a firm of accountants or lawyers or an individual partner within such a firm.
The FSA Handbook (SUP 5.3.1) states that this tool may be used:
- for diagnostic purposes, to identify, assess and measure risks;
- for monitoring purposes, to track the development of identified risks, wherever these arise;
- in the context of preventative action, to limit or reduce identified risks and so prevent them from crystallising or increasing; and
- for remedial action, to respond to risks when they have crystallised.
In addition, SUP 5 Annex 1 gives examples of circumstances in which the FSA may require a report by a skilled person.
As with the power to compel the production of documents under s165, the only limitation on the FSA’s power to require the provision of a report by a skilled person, is that this must be ‘reasonably required’ in connection with the exercise by the FSA of the functions conferred upon it. Since the cost of the report falls to be paid by the party required to provide it, the imposition of a skilled person report is potentially an onerous obligation (although the FSA Handbook does state that the FSA will take into account the costs consequences of commissioning a skilled person’s report and, broadly, whether an alternative means of providing the information would be more proportionate (see further SUP 5.3.9G))
FSMA 2000 also gives the FSA the power to conduct a variety of both general and specific kinds of investigation. The main categories are:
- General investigations into the ownership, nature, conduct or state of the business of a firm where ‘there is good reason for doing so’ (s167).
- Investigations into various regulatory or criminal offences (ss168(1) and (4));
- Investigations into certain serious criminal or regulatory offences (including market abuse) (s168(2)).
- Investigations in support of overseas regulators (s169).
- Investigations into collective investment schemes (s284).
The FSA is required to give written notice of the appointment of an investigator to the person who is the subject of the investigation unless (i) the investigator is appointed under s168(2) (see above); or (ii) the investigator is appointed under ss168(1) or (4) (see above) and the FSA believes that giving notice would be likely to result in the investigation being frustrated.
The nature and extent of the powers available to the FSA will depend on the investigation being conducted, but in each case the investigators can compel both persons under investigation and third parties to attend an interview and to provide documents. As with requests for information under s165 (see above) the definition of document is extremely wide and covers information recorded in any form, but a person cannot be compelled to produce protected items or documents covered by the business banking exemption. In broad terms, investigators have powers to obtain information from a wider range of people in specific investigations as opposed to general investigations. Investigators appointed under s168(2) can require third parties (whether or not they are subject to, or connected with the investigation) to give them all assistance they are ‘reasonably able to give’.
Practical Guidance for dealing with FSA investigations
- The best approach will often be to be open and co-operative with the FSA. This will improve a firm’s prospects of persuading the FSA that its concerns are unfounded and that there is no need for further investigation. Where wrongdoing has been committed, a co-operative approach and a genuine attempt to rectify the problem may have a mitigating effect on any penalty ultimately imposed.
- The FSA will often meet the firm for a scoping discussion at the outset of an investigation to help focus the process. This should be used to gain a better understanding of the FSA’s concerns and to demonstrate a willingness to co-operate. The scoping discussion should be attended by senior members of the regulated firm to demonstrate that the matter is being taken seriously.
- An individual, or a small number of individuals, should be given responsibility for communicating with the FSA. This will help to ensure that a consistent message is presented to the regulator.
- When requests for information are made:
- Clarify the basis of the request and the status of any investigation. As explained above, the FSA is obliged to inform a firm that it is being investigated unless one of the exceptions applies.
- Check exactly what information is required. A request for information may be made in broad terms to ensure that nothing is missed and there may be scope for agreeing exactly what documents are to be provided and the timescale for doing so.
- Keep a record of any documents provided.
- Make sure that individuals who are to be interviewed prepare thoroughly by reviewing relevant documents and reminding themselves about what happened (especially if it is a long time since the events in question took place).
- The FSA will allow the interviewee to be legally represented. Consider whether the firm’s lawyers should attend or whether the individual should be separately represented. If it appears that there is, or may be, a conflict of interest between the individual and the firm the individual should instruct his or her own lawyers.
- Be clear about whether an interview is being conducted on a voluntary basis or under compulsion. In broad terms, if a person is compelled to attend an interview, they cannot refuse to answer questions although the responses they give cannot be used in proceedings against them. Where a person attends a voluntary interview, they can refuse to answer questions but any answers that they do give can be used in subsequent proceedings. In general terms, once an investigation is underway, the FSA prefers to use its power to compel people to attend interviews.
- Unless they are privileged (see above), documents created during the course of an FSA investigation will be disclosable in future civil proceedings involving third parties. Care should therefore be taken to avoid creating documents that will prejudice a firm’s position in any such disputes.
By Barry Donnelly, head of financial services litigation and Iain Mackie, head of litigation and dispute resolution, Macfarlanes LLP.
E-mail: email@example.com. firstname.lastname@example.org.
- For litigation privilege to apply, the proceedings must be adversarial and not investigative or inquisitorial. An investigation by a regulator can, at least in principle, be sufficiently adversarial to attract litigation privilege – see Tesco Stores Ltd v Office of Fair Trading .
- For example, the firm itself is under investigation, or the person to whom the obligation of confidence is owed is either under investigation or consents to production.
C-550/07 Akzo Nobel Chemicals and Akcros Chemicals v Commission  ECR I-08301
Tesco Stores Ltd v Office of Fair Trading  CAT 6
For more articles from this author please click here