Editor: What is the impact of the FCPA, Whistleblowing, False Claims Act (including the qui tam provisions) and the UK and other antibribery laws on investigation procedures overall?

Gouraige: The substantive legal rules don’t have a significant impact because internal investigation procedures are fairly standard. Obviously, the first steps are to gather the facts, to get a sense of what might have happened and then to develop an investigative plan. There are a number of different methodologies you can employ. You can start at the bottom of the corporate hierarchy and work your way up; you can work your way in from the periphery toward a core of individuals who appear to be at the center of potential wrongdoing; or you can work either option in reverse. What’s important at the outset is to learn enough to generate a hypothesis as to what might have happened, and then test that theory during the interview process until you are confident about having a good sense of what happened.

Olinsky: I agree with Hervé that the application of these laws in various contexts doesn’t affect the investigation process itself. The goal is to gather facts, to investigate according to a thought-out plan, to draw viable conclusions and, ultimately, to be in a position to undertake appropriate remedial actions. What we have seen, however, is that certain laws tend to receive greater emphasis by law enforcement authorities at different times, so at any given time there may be greater or fewer investigations undertaken in particular areas. For example, we have seen a big increase in FCPA investigations, and False Claims Act cases, particularly in healthcare, have had a strong enforcement emphasis for a long time.

Editor: Might some of the intricacies within individual laws come into play during the hypothesis stage?

Gouraige: It’s always important to have some knowledge of the substantive legal standards because ultimately you need to make a judgment call as to whether the facts demonstrate that legal violations have occurred. And sometimes, knowing what was said, who said it and when they said it will be particularly important because the case may involve elements such as criminal intent of individuals, which then could be attributed to the company.

Editor: What is the board’s responsibility for assuring that the company has adequate internal procedures designed to uncover fraud and avoid violations of law? Do the SEC’s whistleblower rules undermine such procedures?

Olinsky: The board has ultimate responsibility for assuring adequate internal controls and procedures for the purpose of detecting and preventing violations of the law. That model grows out of the Sarbanes-Oxley Act of 2002, in particular as it applies to independent directors and audit committees. Since Sarbanes-Oxley, the model called for reporting violations “up the ladder,” which can afford the board the luxury of time to evaluate the information to see if it merits an internal investigation, and then deciding how to conduct that investigation and what to do with the results. Ultimately, the board must decide whether to disclose the results to the government, either because doing so is in the best interest of the corporation or because it is mandatory.

Some of this has changed with the enactment of Dodd-Frank, which creates whistleblower incentives for the employee to bypass the company and report violations directly to the government, resulting in bounties of 10 to 30 percent of the monetary sanctions resulting from a successful enforcement action. The employee’s interest to earn the bounty by reporting directly to the government may be contrary to the interest of companies that want to understand what happened before facing a government investigation.

Now, to some extent, subsequent SEC rulemaking has ameliorated this negative effect with three additional incentives. The first gives employees 120 days to report within the corporation, during which time they are still eligible to report to the government and qualify for the bounty. The second provides that if the employee reports internally and the corporation then undertakes its own investigation and uncovers further information, the employee will also get credit for that information. Third, internal reporting will be a positive factor in the government’s determination of an employee’s award amount. So, despite the Dodd-Frank provisions, companies can encourage employees to report internally and, at least, give the company an opportunity to look into alleged misconduct before the government gets involved.

Gouraige: Beyond establishing procedures designed to detect fraud, it’s also the board’s responsibility, within the audit or some other committee, to ensure that these procedures are periodically tested. This process may take place with an outside auditor and outside the presence of management, which allows the committee to ask the tough questions. I’m amazed at how many companies have very good procedures that are never tested, especially since checking may be as simple as calling the company’s compliance hotline, making an allegation and observing the response for speed and follow-through.

Editor: When issues arise, should a company first explore whether or not to do an internal investigation?

Gouraige: Yes, when confronted with a problem, the first step is to determine if an internal investigation is warranted. Let me start by noting some of the wrong reasons for deciding against an investigation. They include management’s unwillingness to make the difficult decision and therefore not wanting to be confronted with facts that might require action. Another example is management’s indecisiveness regarding a set of facts that results in deferring the decision-making responsibility, and the possible consequences of action or inaction, to outside counsel. In retrospect, this allows management to say when the problem becomes public that outside counsel did not recommend an investigation or any corporate action.

One good reason to decide against an internal investigation is that the outcome might trigger negative consequences in situations where a government law enforcement agency is already investigating the issue. Here you may be required to share your results with the government, which in turn may use that information to bring charges against, or at least force a settlement from, the company.

Among the many good reasons for deciding to do an internal investigation are the desire to uncover and correct an illegal violation; to keep senior management informed about the issues and the possible need for broader remedial action; and, for publicly traded companies, to address concerns about the reaction of investors and the market. In the last instance, the investigation report is likely not to be privileged.

Editor: If a company decides to go forward with an investigation, should it be concerned about a race to DOJ or the SEC?

Gouraige: Yes, but that concern should not override the principal considerations in that decision. After the decision is made, if you suspect that a whistleblower may be in contact with the SEC or DOJ, one possible response is to inform the agency that you’re doing an investigation, that you will share the results and that you’d like them to delay issuing subpoenas until you’re done. This may neutralize the appearance of actually responding only because of the whistleblower’s potential allegation, and the company can earn brownie points with regulators by being proactive and doing the right thing.

Editor: Should inside or outside counsel be in charge of doing an internal investigation? If outside counsel, which firm should the company use?

Olinsky: That decision directly relates to the question of whether and how to do an internal investigation to begin with. Where serious misconduct is concerned, it’s best to use outside counsel for a couple of reasons. The first is privilege. Investigations that are headed by outside counsel are much more likely to be covered within the attorney-client privilege and the work-product doctrine; further, because in-house counsel tend to wear multiple hats in advising on business as well as on legal issues, their work may be deemed for purposes other than strictly providing legal advice and, therefore, may be found not to be covered by privilege.  

Second, it’s almost unavoidable that investigations run by company employees will be viewed by prosecutors and regulators with a certain amount of skepticism, particularly if those employees report to a person who, or are within a business unit that, could potentially be found responsible for the misconduct. It’s important to have the reality and the appearance of objectivity, both of which are most likely attained by retaining outside counsel to conduct the investigation.

Editor: What should be the selection criteria for outside counsel in this context?

Olinsky: First, it goes without saying that you want a firm with experienced people, such as former prosecutors or assistant U.S. attorneys, who have expertise as to sound methodologies and who are looked upon by regulators and prosecutors as a trusted source for facts and a reliable end-product.

Another consideration is whether a firm has a preexisting relationship with the corporation, which can work in both directions. Obviously, firms with lots of company experience will be more familiar with its business and operations, which may facilitate doing an investigation. On the other hand, their credibility may suffer because of that relationship, so there is a tug and a pull. Depending on the severity of the allegations and how complex the facts appear to be, it may make sense to engage an outside firm that is new to the company and will be perceived as having taken a fresh look.

Editor: What resources or outside consultants/investigators might a company employ to uncover fraud or regulatory violations?

Olinsky: I’ll mention five categories. The first involves e-discovery and computers. Almost any investigation these days requires capturing email and other electronic documents, and it’s important to get an early and comprehensive understanding of potentially responsive documents that may help in discovering facts and preparing for witness interviews. Companies needing to provide information to the government must protect themselves by making sure that they preserve and retain all responsive documents, so, just as it’s common in today’s civil litigation to engage some kind of computer expert, it will often make sense to do so for an internal investigation as well.

The next two are related to the review of financial information. Forensic accountants can analyze financial data for evidence of fraud, and economists can be useful to analyze issues of loss or impact to the company. The fourth category is factual investigators, who can help put the story together. Our firm regularly employs former federal agents to assist in gathering and sifting through evidence, sometimes even making the initial contact with potential witnesses. Finally, subject-matter specialists can provide expertise related to a particular area, for example, with regard to an esoteric financial instrument.

Editor: What are the components of defensible investigations and audit procedures that protect confidential information?

Gouraige: These days, transparency is the buzzword, and even national security secrets get published in newspapers. All good attorneys follow certain fundamental procedures, such as limiting communications only to people who fall within the category of the attorney-client relationship or to people within your law firm. I might take it a step further and refrain from creating a written record of those communications. Once you put it in writing, the government can demand that you share the document.

During litigation, there may be an issue as to whether the communication is truly privileged, whether the privilege was waived, or whether it’s defeated by the so-called crime-fraud exception. My own personal experience in the criminal area is that very sensitive information, such as involving a possible criminal act by the client, should be fully communicated verbally and followed by a written record that conveys that message without being as blunt as the oral communication. That way you serve the function of communicating with clients while also protecting them in the event that a subsequent investigation attempts to use that communication to buttress a case for criminal intent.

Editor: What best practices do you recommend for delivering Upjohn warnings? Please start with a brief description of the warning itself.

Olinsky: In its 1981 decision in Upjohn Co. v. United States, the U.S. Supreme Court resolved an issue regarding the application of attorney-client privilege to corporate employees. In a nutshell, the Court held that if attorneys for the corporation are communicating with employees of the corporation under the authority of the corporation and for the purpose of providing legal advice to the corporation, then those conversations are privileged, with the company in control of the privilege. 

The need to protect the company’s privilege has led to a long-standing best practice of giving employees a so-called Upjohn warning, the name of which is drawn from the Upjohn case and the well-known Miranda warning. The intention is to protect privilege for the company by avoiding a situation in which employees claim that they were being personally represented and, as a result, that the privilege is theirs to control. In delivering such warnings, the essential message from the attorney to the employee is, I represent the corporation; I do not represent you. Now, the art of it is to deliver this message clearly but without alienating the employee, in fact, while encouraging the employee to cooperate and provide information so that the lawyers can do their job for the company.

There have been several cases pertaining to a company’s right to waive privilege, one a few years ago in California and the Ninth Circuit and another here in New Jersey. These cases involved the question of whether, in the course of being interviewed for an internal investigation, the employee reasonably came to believe that he or she was being personally represented by the attorney who was conducting the interview. In both cases, collateral litigation occurred in which the employees claimed that they were not given full or proper Upjohn instructions at the outset of the interview that would have protected the corporation’s control of the privilege.

My own method to avoid this kind of problem is to give the Upjohn warnings using a written form that makes clear that I do not represent the employee, but to seek the employee’s cooperation so that I can do my job of providing legal advice to the company, and I ask the employee to acknowledge and confirm his or her understanding of each section after I cover it. I start by saying that this is a privileged discussion, but it is important that the employee understand who the privilege belongs to and how it works. I explain that I am interviewing the employee because the company has asked my firm to provide the company with legal advice, which is a specific prerequisite of Upjohn, and that in order to provide that advice, I need to gather information by reviewing documents and talking to employees. After explaining why we are doing the interview, I end this part the way that many lawyers start off the Upjohn warnings, by saying that, together with other lawyers in my firm, I represent only the company and not the employee.

I then explain the company’s right to waive the privilege. I tell them that the attorney-client privilege is like personal property and that the owner, the company, has the sole right to give up the privilege. I say that the company may share what it learns with third parties, including the government, and that the company may do so without seeking or getting the employee’s permission.

The third category is confidentiality. I explain that because our conversation is protected by the attorney-client privilege, it must be kept confidential, which means that the employee cannot talk about the interview without the company’s permission. Finally, I cover the importance of truthfulness, which, surprisingly, I have not found mentioned in the Upjohn literature, and how being truthful and complete is critical to the lawyers’ ability to do a good job for the company, the interviewee’s employer.

Following an Upjohn form allows me to draft an interview memo that refers specifically to the form and, if I decide to do so, to the fact that I gave the employee a copy of it at the end of the interview. This way there should be no doubt that a proper Upjohn warning was given and that the employee understood it. In addition to successfully protecting the company’s privilege, this method can avoid some of the horror stories we’ve seen, for instance, where entire trials or evidentiary hearings were held just to resolve Upjohn issues.

Gouraige: This is one of the more complicated aspects of internal investigations. While there’s no perfect solution and many inherent dilemmas, Mark’s approach is very good, particularly his suggestion to emphasize the importance of truthfulness, not only for the company’s sake but also to protect the interviewee.

It sometimes happens, for instance, that a firm conducts an entire investigation, but the company then cuts a deal with the government, which includes turning over the interview memos. If false statements were made, the government could file criminal charges against the interviewee – perhaps an employee or even a high-level company executive. The defendant in the criminal case now subpoenas those privileged communications as highly probative evidence, claiming that they contain information showing that the defendant lacked criminal intent; however, the company refuses to turn them over, asserting privilege. Here, the judge faces a real dilemma in having to consider the privilege issue in the trial context: either uphold privilege and thus potentially deny the defendant his or her right to mount a defense when personal liberty is at stake, or grant the request and thereby deny the corporation its privilege in the criminal case and in subsequent civil cases. There doesn’t seem to be a clear answer, so we grapple with this problem on a case-by-case basis.

Editor: What should you say when an employee asks, “Do I need my own lawyer?” or “Will the company pay for a lawyer I select?”

Gouraige: As company counsel, you really can’t answer that question without potentially crossing the line by giving legal advice to employees. My solution typically involves asking employees to think through their own behavior and then decide if they need a lawyer. If the answer is “yes,” then we can adjourn and reschedule the interview as necessary.

Whether the company pays for the employee’s counsel depends on a number of factors. First, it may be obligated to do so, either by the laws of the state in which it is incorporated or by its own bylaws, which, for example, may mandate this obligation in situations involving its CEO or other executive. If an obligation exists, the interviewee must sign an undertaking agreement that provides for repayment to the company if subsequent criminal charges are filed and result in a conviction.

Absent a formal obligation, the company has to make a difficult judgment call, which will depend on the company’s role in the investigation and the individual’s position. You want to avoid creating a perception by regulators or prosecutors that the company is paying counsel for a witness in order to prevent the government from getting access to that witness.

Olinsky: I will add that because these are predictable issues, we always discuss them in advance with in-house counsel and management and plan for a response. This includes resolving the question of whether to allow employee interviews to be postponed or adjourned to accommodate a request for personal counsel; there may be time pressures involved, such as when a particular employee’s information is needed to connect the dots to other potentially important interviews. Remember, this is not a law-enforcement situation where the person has a constitutional “right to counsel,” although that right may exist by virtue of company policy or union contract.

Editor: What if the employee says he or she doesn’t want to talk to you?

Olinsky: As I mentioned earlier, there is an art to delivering the Upjohn warning in a way that both protects the corporation’s privilege but also encourages the employee to cooperate. The message to an employee is that, while I don’t represent you, we are nevertheless undertaking a joint effort: you have a duty of loyalty to cooperate with the investigation being conducted on behalf of the company that employs you so that I can carry out my duty to give the best possible legal advice to that company.

Now, since an employee’s refusal to cooperate is a predictable issue, I always develop a strategy in advance based on the client’s policies and procedures, which I note should be uniform for all employees. This way I have an answer at the ready and never have to improvise. When interviewees refuse to talk, I remind them that what we are doing is in the best interests of the company. To the extent the client gives me such authority, I will send a firm message to employees that they are risking disciplinary action – perhaps termination – if they fail to cooperate. Otherwise, I will simply explain that failure to cooperate carries risks, and the company will determine possible consequences afterwards.

Gouraige: I agree with everything Mark just said. Consequences notwithstanding, there are a few reasons that someone may refuse to cooperate. One is that this person may have committed a criminal act and feel he or she has some exposure. Another reason may be that this person is a whistleblower who has reported to the DOJ or the SEC, whose action has already disrupted the company, and whom his or her own counsel has advised not to talk. If the company fires a person in this situation, it may get in trouble for retaliation, so it’s important to be careful and try to gauge the interviewee’s state of mind in refusing to talk.

Let’s consider the other perspective. Mark and I often represent individuals who are implicated in a criminal investigation. Perhaps you are representing someone who works for a broker-dealer company that’s under investigation and that discovers certain transactions that must be reported to FINRA. The company asks to talk with your client. Now, there’s no upside for your client in talking to the employer because the statement will be reported to FINRA and the SEC and might be used against him or her. In these situations, it may be better for the person to resign, let the existing documents speak for themselves and not add anything to the body of knowledge.