Conducting effective cross-border internal investigations is more critical than ever for companies facing increasingly complex regulatory frameworks across the globe. With heightened scrutiny from regulatory authorities and diverse legal landscapes, navigating internal investigations requires precision, cultural awareness, and a deep understanding of varying legal frameworks. Mistakes in internal investigations can expose companies to further legal, reputational, and financial risks. By conducting thorough, well-managed investigations, companies can ensure compliance, mitigate risks, and reinforce trust among key stakeholders.

Why Conduct an Internal Investigation?

Internal investigations are the tool by which a company that receives allegations of wrongdoing can determine the facts of what occurred and, if necessary, develop appropriate remedial steps. Under the DOJ’s Evaluation of Corporate Compliance Programs (ECCP), a “hallmark of a well-designed compliance program is the existence of an efficient and trusted mechanism by which employees can anonymously or confidentially report allegations” of suspected or actual misconduct. The ECCP instructs prosecutors to “assess the company’s processes for handling investigations of such complaints, including the routing of complaints to proper personnel, timely completion of thorough investigations, and appropriate follow-up and discipline.” Internal investigations thus are a fundamental part of an effective corporate compliance program.

How to Conduct Effective Investigations

For starters, the foundational principles of a successful international investigation mirror those of any robust internal investigation. By adhering to four key principles, companies can navigate the complexities of international investigations consistently and effectively:

1. Independence means that investigators must operate free from external pressures or biases. The key question to ask when evaluating independence is: How would your choice of investigator and decision on investigation oversight be perceived by someone in a position to challenge your findings?
2. Objectivity/Fairness means that the investigation findings are based on facts rather than preconceived notions. Companies and investigators must ask themselves whether they are assessing reports/allegations and conducting investigations fairly and objectively. Keep in mind that serious allegations can be buried in “frivolous” complaints.
3. Thoroughness guarantees that all relevant information is considered, leading to well-informed and supported findings and conclusions. Investigation procedures must be tailored to the nature of the allegation but should be as extensive as necessary to fully and fairly uncover all relevant facts. Considering all potential audiences and how each might perceive the thoroughness of your procedures can help evaluate whether additional procedures should be undertaken.
4. Confidentiality protects sensitive information, fostering a safe environment for reporting concerns and ensuring the integrity of privileged materials and processes. At the beginning of an investigation, it is critical to consider whether you will potentially want to assert privilege over the investigation process and conclusion. Steps must be taken at the outset and throughout the investigation, including preserving confidentiality. Sound investigation techniques include obtaining independent, untainted versions of facts from witnesses, and avoiding destruction of evidence.

Internal investigations are always challenging exercises. International or cross-border investigations raise the stakes even further. Set forth below are five key steps and best practices for effectively managing international internal investigations, ensuring that companies navigate these complex issues with integrity and transparency.

1. Secure Good In-country Counsel

Engaging knowledgeable local counsel is crucial for international investigations, as they provide a deep understanding of the legal landscape, cultural nuances, and regulations specific to the jurisdiction. Local counsel can navigate complex laws that differ from the company’s home country, ensuring compliance and minimizing legal risks. Their knowledge of local customs and practices allows them to shape investigation strategies that are both effective and culturally appropriate, encouraging cooperation with local authorities and stakeholders. Additionally, local expertise helps safeguard the company’s interests by offering advice on legal risks and maintaining confidentiality throughout the process. Ultimately, leveraging local counsel strengthens the investigation’s integrity and effectiveness, enabling companies to address issues more successfully on a global scale.

2. Pay Attention to Data Privacy Laws

Considering data privacy laws during international internal investigations is critical for ensuring compliance and protecting the integrity of the investigation. Data privacy laws in the U.S. differ significantly from other jurisdictions’ data privacy laws in both approach and scope. The U.S.’s legal framework is characterized by a patchwork of federal and state laws, which focus on sector-specific regulations rather than a comprehensive national standard. This means privacy protections can vary widely across industries, with laws like the Health Insurance Portability and Accountability Act (HIPAA) for health care and the California Consumer Privacy Act (CCPA) for consumer data.

Unlike U.S. data privacy laws, regulations like the European Union’s General Data Protection Regulation (GDPR) and China’s Personal Information Protection Law (PIPL) enforce stricter controls on how personal data is collected, stored, and processed. These differences can have numerous implications for internal investigations. For example, placing legal holds to preserve data during an investigation must be evaluated under some jurisdiction’s rules that require minimizing retention of personal data. Similarly, the common practice in domestic internal investigations of reviewing employees’ emails must be considered in light of some jurisdictions’ protections for employees’ personal messages, even on company-administered email systems.

Transfers of data are also sensitive: The PIPL, similar to the GDPR, requires explicit consent from individuals before handling their data, mandates the appointment of a Data Protection Officer, and sets detailed rules for cross-border data transfers. It also imposes severe penalties for non-compliance, underscoring the need for businesses to prioritize data privacy. China’s regulations reflect a more centralized and state-driven approach, focusing on both individual privacy and national security, creating additional compliance challenges for global companies.

Ignoring or misunderstanding foreign data privacy laws can lead to significant legal and financial repercussions, including fines and sanctions. The last thing an investigator should do is create new problems for his or her clients or firm. Be informed and follow the rules.

3. Consider Privilege Issues

Privilege rules vary significantly between the U.S. and many other countries, leading to different protections for communications with counsel. In the U.S., attorney-client privilege is a robust doctrine that protects the confidentiality of communications between clients and their attorneys, encouraging open and honest dialogue essential for effective legal representation. This privilege typically extends to all communications made for the purpose of seeking legal advice, and it generally protects internal investigations conducted by or at the direction of lawyers where the purpose of the investigation is to provide the client with legal advice.

Many countries, however, take a narrower view of attorney-client privilege or provide limited protections. For example, in Germany, while attorney-client privilege is recognized, it is not absolute and does not always apply to searches of a lawyer’s client files amid a potential enforcement action. In 2017, a Munich prosecutor raided the offices of Jones Day, counsel to Volkswagen AG, to seize documents related to their internal investigation. The German Constitutional Court upheld this, confirming the limited scope of privilege in such cases.[1] Meanwhile, in India, attorney-client privilege does not apply to in-house lawyers under the Indian Evidence Act — courts treat in-house counsel as part of the company’s management, not independent legal advisors; therefore, outside counsel should be engaged to preserve privilege in investigations.

Companies operating internationally and conducting international investigations must navigate these varying privilege standards carefully to ensure the protection of their communications and work product that they seek to keep confidential. Alternatively, if it appears that the privilege protection will not be available, the investigation plan should be adjusted accordingly, such as by segmenting the investigation into different parts in different jurisdictions.

4. Catch the Real Issue

Paying close attention to whistleblower complaints is vital for American companies navigating regulatory compliance. These complaints often reveal critical insights into potential violations of law, serving as an early warning system for internal issues that may otherwise remain hidden. By addressing these complaints promptly and thoroughly, companies can prevent minor infractions from escalating into major scandals, thereby safeguarding their reputations and avoiding substantial legal penalties.

When evaluating complaints from other countries, especially those from non-native English speakers or unfamiliar cultural contexts, it is essential to be vigilant. Do not overlook or dismiss serious compliance concerns simply because they are mixed with frivolous or personal attacks. In our experience, it is not uncommon for serious issues to be intermingled with broader criticisms of management or colleagues.

5. Prepare for Law Enforcement Action During the Investigation

Law enforcement approaches vary widely across jurisdictions and can significantly impact an internal investigation. Consider the following examples:

• India: The focus is on convicting individual wrongdoers, with investigations moving swiftly and often resulting in arrests and media coverage. Serious crimes rarely offer the option of plea deals, leading to rigorous trials where the burden of proof is on the prosecution. This can result in prolonged litigation and uncertainty.
• Sweden: Swedish prosecutors lead investigations, file cases, and prosecute the case in court. Sweden has not yet adopted a plea-bargaining system.[2] Defendants often are kept in pre-trial detention, and Swedish law does not place a time limit on pre-trial detention.[3] Extremely lengthy pre-trial detention is somewhat exceptional, but pre-trial detention lasting for over a year is not unheard of if an investigation is particularly complicated.[4]
• Japan: The Japanese legal system emphasizes strong cooperation between law enforcement and the judiciary, with police relying heavily on confessions to secure convictions. Defendants are often placed in pretrial detention, and detainees cannot request bail while in preindictment detention. After indictment, the conviction rate is over 99%.[5] This contrasts sharply with the U.S. adversarial system, where defendants have more rights, including the right to remain silent and access to legal representation.

These differences can significantly affect internal investigations, especially if the findings need to be disclosed to U.S. regulators but might lead to arrests or charges in another country. Always have a contingency plan in place and prepare for how different legal systems might alter the course of your investigation.

Conclusion

By adhering to these foundational principles and staying informed about evolving global regulations, in-house counsel can guide their companies through complex investigations with confidence.

[1] Constitutional complaints relating to the search of a law firm in connection with the “diesel emissions scandal” unsuccessful, Bundesverfassungsgericht (July 6, 2018), https://www.bundesverfassungsgericht.de/SharedDocs/Pressemitteilungen/EN/2018/bvg18-057.html.

[2] The role of a prosecutor, Swedish Prosecution Authority (last visited Sept. 30, 2024), https://www.aklagare.se/en/the-role-of-a-prosecutor/.

[3] Elin Hofverberg, FALQs: Sweden’s Pre-Trial Detention Laws, Library of Congress Blogs (Aug. 15, 2019), https://blogs.loc.gov/law/2019/08/falqs-swedens-pre-trial-detention-laws/.

[4] Id.

[5] Indictment, U.S. Embassy & Consulates in Japan (last visited Sept. 30, 2024), https://jp.usembassy.gov/services/indictment/.