Alban Caushi is the partner in charge of the corporate and commercial practice of Albanian law firm CR Partners and has advised clients from a range of sectors and industries on how to mitigate and handle a crisis. He has provided domestic and international clients with legal advice across all sectors on M&As both for buyers and sellers; restructurings of commercial companies, shareholders agreements, corporate governance matters, due diligences and drafting legal reports for clients. He has also worked as team leader in various PPP and energy projects advising contracting authorities, investors and concessionaires.

Fivehundred sat down with Alban to discuss the key questions that in-house counsel ask when facing a crisis situation.

What is at stake when a firm is faced with a crisis? What is the cost of not getting it right?
The continuity of the firm is obviously at stake. The crisis caused by the coronavirus pandemic presents a health risk for the employees of the firm and a risk related to a decrease in demand which one cannot exactly foresee how long it will last. It is imperative that the firm addresses its’ employees’ health concerns as soon as possible (by switching to remote work) and planning phased return to the office following the government’s health and safety guidelines. Once this issue has been addressed, firms should sense the effects of the pandemic on their demand, foresee the extent of the crises and plan for measures that preserve the financial health of the company until things return to normality.

Do epidemics justify the disruption of delivery? And when does a company have grounds to look into a force majeure?
This is very industry specific. In Albania, many businesses were ordered to close and remain closed until the emergency created by the pandemic is lifted. There are administrative penalties or even criminal sanctions if one does not abide to the governmental orders. This seems to be a clear example of force majeure when the disruption of delivery is justified. There can be other not so evident examples of force majeure situations, for example when a business can remain open but due to the circumstances created by the pandemic, they cannot deliver. One example is the upstream oil & gas industry in Albania that suspended production of oil due to lack of demand in the market and Brent prices being hit by the pandemic. This is not the case for law firms however which can easily switch to working from home and cannot justify disruption of their services.

How does the approach vary in each jurisdiction? What steps should a company that has interests in Albania take?
Some jurisdictions will have well defined force majeure provisions in the law (i.e. civil codes) or case law. This is not the case of Albania where force majeure lacks legal definition and doctrine thus leaving large room for debate. A company with interest in Albania looking to justify disruption of delivery, should first check the underlying agreements and the force majeure clause in the contract. When the contract is silent on this matter, it is advisable to turn to lawyers and ask for advice. Commentaries that law firms have published on force majeure or other related topics during this period can also provide some non-tailored guidance.

What do you see as the main points that differentiate CR Partners from your competitors in handling a crisis situation?
We created a task force designed to monitor closely the countless governments orders adopted during the crises that can affect our clients’ business such as business operation restrictions, travel restrictions, safety protocols etc. Legal alerts were prepared and published daily in our website and our social network pages and sent to our regular clients by e-mail. We were quick to adjust to remote working without interruption and advised our clients that during this unprecedented times they were free to contact our lawyers at any time, weekends and evenings included to address their urgent needs, although one can say that this is our regular working mode.

What’s the main change you’ve made in the firm that will benefit clients?
Returning to normal after the COVID-19 pandemic is over, will not mean the same thing. The coronavirus crisis taught the lawyers of our firm to be tech-enabled, flexible with remote work, set up crises task forces, and be more sensible with our clients by offering more pro bono work to those more in need. These are all transformative aspects to our firm which we recognized and embraced and believe that will always benefit our clients.

How can companies build effective risk and crisis management systems?
The outbreak of coronavirus was the lesson learned for most companies in Albania which did not have in place a crises management system. Most of them had no or very little time to set a strategy on how to handle such unprecedented situation. To respond to crises situations properly and rapidly, first of all the companies must set up a permanent crisis management team, depending of course also on the size of the company. In addition, it is important to implement of a crisis management plan which will help the crises management team to effectively respond to similar situations in the future.

How can companies assess the stress-test compliance protocols to identify and address risk?
This is a discussion that entails a thorough analysis as to whether the stress test compliance protocols are effectively used as an exercise to detect the business risks and enhance the long-term sustainability. Stress testing in Albania is more relevant in the context of banking and financial institutions; it helps to alert the bank’s management and supervisory authorities to unexpected adverse events arising from a wide range of risks and, of the financial resources that should be deployed to absorb losses across the business line. From our experience, the financial institutions in Albania perform the stress test exercise as a regulatory compliance formality but they do not see it as a powerful tool to be used for mitigation and management of the risk exposure.

What are regulators’ expectations in relation to risk assessments in each jurisdiction? What risks do changing regulations pose?
We advise clients operating in specific industries like banks, telecommunications, and pharmaceutical sector. Enforcement of government measures to control the Covid-19 outbreak as well as the regulatory measures issued to align those government measures with industry specifics created a new business behavior. All these new measures brought various regulatory changes impacting many industries resulting in, operational interruptions, consumption shortages, trade restrictions, data privacy issues, corporate governance issues etc. As an example, due to the changing work environment, it becomes more difficult to control compliant behavior, therefore our clients started to restructure internal regulations and protocols with the help of legal advice, to respond to such new business models.

Can due diligence and honest efforts to foresee and prevent crises ever be enough, by themselves, to either avoid the ire of regulators entirely or significantly mitigate the consequences?

We believe it is important that all companies regardless of their size have in place internal capacities to identify the sources of risk, evaluate factors contributing to such risk and takes measures to mitigate the consequences. However, the Covid-19 pandemic is a crisis that it was and believe still is, difficult to foresee in the first place, not only in terms of its occurrence but also the extent of its duration, intervention of the government and effects on the economy. Therefore, a measured regulator’s intervention may be necessary, despite businesses best efforts and systems to mitigate consequences caused by these types of crisis.

Lydian’s dedicated and multidisciplinary internal investigations team advises global and local clients on all aspects of business crime and employee fraud. Fivehundred sits down with Jan Hofkens and Yves Lenders, who provide guidance on an employer’s responsibilities in regards to whistleblowing.

1.1 What statutory or regulatory obligations should an entity consider when deciding whether to conduct an internal investigation in your jurisdiction? Are there any consequences for failing to comply with these statutory or regulatory regulations? Are there any regulatory or legal benefits for conducting an investigation?

Belgian law does not provide for a specific legal framework for internal corporate investigations. However, general rules of Human Rights (such as privacy and fair trial), and internal domestic law (such as criminal law and employment law) may apply and govern certain aspects of an investigation, depending on the scope and circumstances of the investigation.
The legal test is to conduct an internal investigation that is “reasonable in all the circumstances”. This means that the way in which the investigation is conducted should be “careful, balanced and thorough”. A court will not impose its own view of what a reasonable investigation would comprise, but will have to decide whether the entity’s actions were reasonable and in line with applicable legislation. In any case, a private company may never use force or violence during an internal investigation: only public authorities are allowed to use force or compulsory measures (such as detention or house search) to the extent permitted by criminal law.

Legal provisions aim to protect the rights of the persons involved in an internal investigation, especially in the context of the tools used to collect evidence. Privacy law in general and Data Protection rules (GDPR) in particular regulate and restrict the use of certain investigation methods, such as screening of mailboxes, data mining, search of hard disk, CCTV, recording of telephone conversations, body search, etc.

Belgian employment law in particular protects employees involved in an investigation. Specific collective bargaining agreements (CBA’s) regulate monitoring and screening of online communication data (CBA 81), body search (CBA 89) and video surveillance (CBA 68). A breach of a CBA constitutes a criminal offence.

Moreover, specific procedures apply when it comes to disciplinary actions against employees, such as the 3 working days deadline to terminate an employment contract for gross misconduct.

Furthermore, internal business conduct policies or IT policies may contain restrictions in case of an internal investigation. For independent contractors, such as service providers and freelancers, the contract clauses might include reporting duties and investigation rights. This is up to the parties’ contractual freedom.

As a general principle under Belgian law, evidence which is obtained in breach of the abovementioned legal provisions, is unlawful. A court may nevertheless accept such evidence in legal proceedings, civil or criminal, provided that:(i) the evidence has not been obtained in breach of formalities that are legally sanctioned with nullity, (ii) its reliability is not adversely affected by the breach; and (iii) the use of the evidence does not prevent the right to a fair trial. In practice, this means that the judge will balance the breach of protective law, on the one hand and the gravity of the irregularities or fraud on the other hand. Based on this assessment, the judge will decide whether the unlawfully obtained evidenced is admitted as evidence or not.

How should an entity assess the credibility of a whistleblower’s complaint and determine whether an internal investigation is necessary? Are there any legal implications for dealing with whistleblowers?
There is no clear (legal) rule to assess the credibility of a whistleblower. The specific circumstances will determine this assessment. The credibility of a whistleblower’s complaint and the decision to conduct an internal investigation or not, must always be assessed on a case-by-case basis. The position of the whistleblower within the entity, the detail of the complaint, reference to concrete situations and the existence of “prima facie” evidence to support the allegations, are such elements to consider in the assessment. Guidelines and best practices in a whistleblower policy are in this context very useful.

Belgian law currently does not provide for a general legal framework for whistleblowers. However, legislation exists for certain industry sectors, such as:

• The Act of 15 September 2013 on the reporting of an alleged breach of integrity in the National administrative authorities by its staff members. This Act, which only applies to federal public authorities, offers protection to civil servants and employees who report irregularities and abuses (“whistleblowers”). Sanctions affecting their careers are prohibited. Similar rules apply to regional public authorities.

• Belgian credit institutions are obliged to set up an appropriate internal whistleblowing procedure to report breaches of rules and codes of conduct of the institution (article 21, §1, 8° of the Act of 25 April 2014 on the status and supervision of credit institutions).

• Several legal instruments provide for a whistleblowing structure in the insurance sector, such as the IDD Directive ((EU) 2016/97 on insurance distribution and the PRIIPs Regulation ((EU) No 1286/2014 on key information documents for packaged retail and insurance-based investment products). The Market Abuse Regulations and Solvency II Law provide for similar procedures.

Furthermore, the Belgian Data Protection Authority issued a recommendation in 2006, setting forth guidelines for companies on how to establish an internal whistleblowing procedure or hotline in accordance with the Data Protection Act (Recommendation 01/2006 of 29 November 2006).

At European level, a Directive on the protection of persons who report breaches of Union law (“The Whistleblower Directive”) has been approved on 7 October 2019. This Whistleblower Directive aims to protect whistleblowers across the various countries within the European Union. Member States (including Belgium) must implement this Whistleblower Directive in national law by the end of 2021. The Whistleblower Directive has a very broad scope of application, as it applies to any breach of Union law in general and it covers civil servants, employees, self-employed individual and board members. On the basis of this Directive, member states are required to take all necessary measures to prohibit any form of retaliation against whistleblowers.

How does outside counsel determine who “the client” is for the purposes of conducting an internal investigation and reporting findings (e.g. the Legal Department, the Chief Compliance Officer, the Board of Directors, the Audit Committee, a special committee, etc.)? What steps must outside counsel take to ensure that the reporting relationship is free of any internal conflicts? When is it appropriate to exclude an in-house attorney, senior executive, or major shareholder who might have an interest in influencing the direction of the investigation?

This depends on the scope and specific circumstances of the internal investigation. In principle, the decision to conduct an internal investigation should be taken by the board of directors, or a person duly authorized by the board the make such decision. The board (or the person to whom such decision is delegated) also decides on the person(s) or team conducting the investigation, including legal counsel. In case of suspicion of involvement in irregularities against board members, the decision to investigate and to appoint external counsel may be taken by the shareholder, but this should be confirmed afterwards by a valid board decision.

The entity is free to decide on the members of the investigation team. This will obviously depend on the nature of the allegations. Normally the lead will be taken by an internal specialist of the entity (loss prevention team, compliance manager), supported by financial and/or technical (IT) experts. The team members should sign specific non-disclosure agreements (unless such NDA is included in their contracts). The person or body authorized to take (disciplinary) decisions should not be part of the team.

It is recommended to involve the legal team from the beginning to avoid that evidence is collected in breach of protective legislation. If no internal legal team exists, or if the legal team is not experienced with this type of investigation, it is recommended to appoint immediately a specialist outside counsel, whose role is to ensure that the investigation is properly conducted and evidence can be used in (disciplinary) proceedings and recovery actions afterwards.

In principle, it is for the entity to determine who the client will be. The “client” ordering the internal investigation and instructing outside counsel may obviously not be someone who is a (potential) witness, or who is (in-)directly involved in the department under investigation. An outside counsel may assume that no conflicts of interest exists unless it turns out otherwise pending the investigation. A signed engagement letter prior to starting the investigation is important; this engagement letter should include the client for the mandate, the scope of the investigation and the way of reporting.

The Headline on 12 June 2020 was that the UK economy shrank by 20.4% over the month of April and by 25% between February and April. Over those three months, some businesses have sadly failed and others have had, almost overnight, to adapt to an entirely new way of working. When the threat of the virus is gone and the lockdown is lifted, we will not return to how we were before: customer bases and supply chains will have to be rebuilt and home working will increase. But whilst ways of working may change, the legal and regulatory environment in which businesses operate will not and the authorities’ long term priorities have not changed. What will that mean for internal investigations?

However they are run, they will need to cover the same three key areas: gathering in documents; learning what witnesses have to say; and ensuring that the investigation is carried out in such a way as to place the company in the best possible position with the authorities.

Documents

The document-gathering exercise remains the essential first step to any credible investigation. The gold standard for the authorities is an exercise which is prompt, covert, co-ordinated and simultaneous.  At the same time, they will expect rolling data destruction processes to be stopped. Hard copies tend to be office-based and, at present, may be difficult to access. Where they are temporarily beyond reach, companies will need to ensure they are held securely until they can safely be processed: seized, scanned and uploaded onto a document review platform.

Soft copy data present different practical issues. Most are backed up onto a server from which they can be accessed. The rest will be stored locally, on company laptops or other storage devices, to which digital forensic professionals will need access. That may not be a problem where all the company’s employees are office-based but this is not what is happening now and, once the pandemic has passed, we can expect more home working. Quite how to access this data (and any hard copy the employees may have at home) is a matter of judgement depending on the facts of the case: do investigators need to require the immediate handing-over of the data or can they rely on the employee to simply send it to them? In such cases, remote access software is part of the solution. In the longer term, companies will no doubt have to update their data handling and security policies to accommodate a greater degree of home working, and to ensure control over their data is maintained.

Once the data has been retrieved, it will need to be prepared for review. This is an act of data processing and, if personal data is involved, the legal requirements for processing such data apply. Particular care needs to be given to cases where personal data is transmitted from one country to another.  Blocking statutes also need to be identified and complied with.

We then come to the review process. Before the pandemic, reviewers would typically work in the same office environment where informal communication was easy and a consistent approach to the review exercise could be achieved through dialogue. The pandemic has shown that, with a robust review platform, this work can be done remotely. That work will only be effective if it is properly co-ordinated and each reviewer has a clear understanding of the review’s parameters. In practical terms this places an increased emphasis on the clarity and level of detail provided in the written instructions prepared for reviewers and on properly-structured remote team meetings.

Witnesses

Companies will need to take an early decision about their witness strategy, particularly where the matter they are investigating has the potential to interest the law enforcement authorities, or indeed the civil courts, in more than one jurisdiction. In such cases they need to manage conflicting expectations from prosecutors about how to deal with witnesses and, if and when they do speak to them, the consequences for the company of different approaches to privilege in the various countries in which they may face legal action. Indeed, for a range of reasons it can be sensible not to speak to witnesses, or to keep such interviews to a minimum.

But where witnesses are to be spoken to, practices will inevitably change. Whilst for some witnesses, typically those at the heart of the investigation, there will always be a preference for a live interview, for others there may be an increasing move towards the use of video communications platforms. They are efficient and so help keep costs under control. Interestingly, only some UK law enforcement bodies have been prepared to use them during the pandemic-induced lockdown, whilst others have deferred any witness of suspect interviews for the time being.

Where remote interviews are conducted, it is important that proper controls are put in place. Witnesses need to be in an environment where no-one can listen in so as not to compromise the investigation’s security and, with it, the company’s data protection duties and privilege rights. Security is also an issue when it comes to providing witnesses with any pre-interview disclosure: remote-access and password-protected platforms can be used for this. Rules or best practice of non-contamination of witnesses knowledge remain whatever the forum. Where a witness is legally represented, confidential access to that representation will need to be factored in. Irrespective of how the interview is conducted, it is important that the investigator retains control of how a record is made of the witness’ account: witnesses should not be pressing the record button.

Law Enforcement

Finally, all the active enforcement authorities have made clear that they would expect any company that seeks credit for co-operation to engage with them early and in constructive way. A large part of that engagement consist of a dialogue on the steps they are taking and why. As the way we work changes, there is all the more reason to ensure that that dialogue is maintained.