When Misconduct Reaches the C-Suite, Who Investigates?

When allegations of serious misconduct surface within an organization, few decisions carry greater consequence than how to investigate them. While routine compliance concerns can often be handled internally, certain matters may require an independent approach. 

In-house counsel plays a critical role in recognizing when an independent investigation may be necessary, selecting outside counsel to lead it, assisting outside counsel with access to information and witnesses and safeguarding privilege throughout the process. 

When an independent investigation is warranted

While a variety of circumstances may warrant an independent investigation, the most clear trigger is when the allegations implicate senior management, including C-suite executives, board members or individuals with authority over compliance functions. In these situations, an internal team may face real or perceived conflicts of interest that undermine the investigation’s efficacy and even its credibility.

Similarly, when allegations are likely to attract regulatory scrutiny from agencies such as the DOJ, the SEC or state attorneys general, an independent investigation signals to regulators that the organization is taking the matter seriously and conducting a thorough, unbiased review.

Other situations warranting retention of independent counsel include matters involving potential financial restatements, significant whistleblower complaints, allegations of systemic compliance failures and cases where litigation is anticipated or already underway. In each of these scenarios, the perceived independence of the investigation can be as important as the substantive findings themselves. 

Structuring the investigation for credibility and effectiveness

Once in-house counsel decides to pursue an independent investigation, they must ensure that the investigation’s structure supports its objectives. Several key elements require careful consideration from the outset.

Selecting outside counsel 

Outside counsel should have deep experience in internal investigations and, if applicable, familiarity with the relevant regulatory landscape. When the investigation touches on regulatory issues, retaining a firm with credibility before the regulators’ scrutiny can pay dividends if the investigation’s findings are later presented to the government. 

Equally important is that counsel be free from conflicts of interest, not only with regard to the potential subjects of the investigation but also with regard to the company’s regular business. This means that in-house counsel may need to look beyond the company’s usual outside counsel relationships if their independence could be questioned. In-house counsel should conduct thorough conflicts checks, evaluate candidates’ relationships with the relevant regulators and ensure that the engagement terms clearly define the scope, responsibilities and reporting lines.

Establishing oversight and defining scope

In-house counsel should ensure that independent counsel reports to the board of directors, an independent committee of the board or a specially formed committee rather than to management. This reporting structure reinforces the investigation’s independence and helps insulate its findings from accusations of bias. 

In-house counsel should work with the relevant company committee to clearly define the scope of the investigation and the committee’s authority. Defining these parameters early helps prevent scope disputes and role confusion as the investigation progresses and can help streamline privilege determinations later.

The scope should be broad enough to address the core allegations and any reasonably related conduct but sufficiently focused to avoid the investigation becoming unwieldy. The scope should also be documented in writing at the outset of the investigation and revisited periodically, as new facts may necessitate expansion or refinement. Overly narrow scoping risks missing related misconduct, while an unbounded investigation can drain resources and delay resolution. 

Counsel should also ensure that the scope and engagement clearly indicate the company’s reason for the investigation, which will further assist in protecting privilege down the road. Finally, in-house counsel should establish a process for outside counsel to flag scope questions in real time so adjustments can be made promptly to avoid delaying the investigation.

Managing document preservation and collection

One of the first steps in-house counsel must take in support of an investigation is issuing a litigation hold or document preservation notice to all relevant custodians. This notice should be clear, comprehensive and promptly distributed. In-house counsel should coordinate with outside counsel and forensic vendors to oversee the collection process and ensure defensibility of the steps taken to retain relevant information. Counsel should consider and balance competing priorities: collecting and producing documents to outside counsel in a timely manner while limiting the number of individuals involved to protect privilege or safeguard sensitive information. This balance relies on the needs of the investigation and any time constraints as identified in the investigation plan.

In collecting and preserving information, in-house counsel should pay particular attention to ephemeral messaging platforms, personal devices, cloud-based repositories and AI-based programs, such as Copilot or ChatGPT, which are increasingly common sources of relevant evidence and frequent subjects of regulatory inquiry. Organizations with bring-your-own-device policies face additional complexity, as personal devices used for work purposes may contain relevant data that must be preserved and collected while navigating employee privacy expectations and any applicable agreements. 

In-house counsel is often best positioned to identify custodians, locate data sources and facilitate access within the organization. If the investigation involves extremely sensitive or confidential subject matter, such that there is a risk in broadcasting its existence even to a limited set of custodians, in-house counsel should work with internal and external IT vendors to ensure that all routine deletion is suspended from the back-end.

Conducting witness interviews

Witness interviews are the backbone of most internal investigations. In-house counsel should work with outside counsel to identify key witnesses and ensure that all relevant documents are provided before each interview session. In-house counsel plays a key logistical role in making witnesses available for interviews. In practice, witnesses are more receptive to cooperating with outside counsel when introduced by in-house counsel. Beyond facilitating an introduction, in-house counsel should assist in providing an appropriate private space for interviews to be conducted, ensuring that the setting preserves confidentiality and minimizes the risk that other employees will learn who is being interviewed. In-house counsel can also be instrumental in impressing upon witnesses the importance of not sharing the substance of the interview with other potential fact witnesses.

Some witnesses may be hesitant to work with outside counsel and may fear retaliation by the company for participating in the interview or providing honest disclosures. In-house counsel may consider including a copy of the company’s retaliation or whistleblower protection policy in its original outreach email to provide witnesses with reassurance that their rights will be protected. Additionally, these policies can help ease the hesitation some witnesses experience after outside counsel administers Upjohn warnings at the outset of every interview. While they can be uncomfortable, Upjohn warnings are necessary to inform witnesses that (1) counsel represents the organization and not the individual, (2) the conversation is privileged, but (3) the organization and not the witness holds the privilege and may choose to waive it. 

Failure to provide these warnings can create confusion, jeopardize the privilege and expose the organization to claims of improper representation. However, in determining how to deliver the warning, and who is the best conduit, due consideration must also be given to ensuring that the witness feels protected and empowered to freely and completely provide all information available to them.

Preparing the final product 

In-house counsel should work with outside counsel and the board or designated committee early in the process to determine the form of the investigation’s final work product, whether a written report, an oral presentation to the board or a combination. 

Written reports create a detailed record but also create a discoverable document if privilege is waived or successfully challenged. Oral presentations preserve greater flexibility but may be viewed as less rigorous. The choice often depends on the anticipated regulatory posture and litigation landscape. Regardless of format, in-house counsel should ensure that findings are presented with precision and supported by the evidentiary record.

Privilege and confidentiality concerns

Privilege and confidentiality issues permeate every stage of an independent investigation. While outside counsel bears primary responsibility for establishing the protocols that protect these interests, in-house counsel plays an integral part in enforcing these protocols within the company.

The attorney-client privilege protects communications made for the purpose of obtaining legal advice, and the work product doctrine shields materials prepared in anticipation of litigation. To preserve both, in-house counsel should ensure that (1) outside counsel’s engagement is clearly documented as a legal engagement and includes the purpose of the investigation, (2) communications are marked as privileged and confidential where appropriate and (3) the circle of individuals with access to privileged materials is carefully limited to those necessary to the successful completion of the investigation. In-house counsel should establish clear internal protocols that separate legal communications from business communications, especially when in-house counsel often wears both a legal and a business hat. Mixing legal and business purposes in investigation communications is one of the most common ways privilege is inadvertently weakened or waived.

The tension between a desire for transparency and the preservation of privilege is often most pronounced when a government investigation proceeds alongside an internal inquiry. Regulators may request or expect full cooperation, which can include sharing the findings of an internal investigation. In-house counsel must carefully consider whether, to what extent and via what means to disclose investigation results to the government. Voluntary disclosure of privileged materials to a regulator may constitute a waiver of privilege as to third parties. In-house counsel should therefore develop a disclosure strategy in coordination with outside counsel, identifying what can be shared without waiving privilege, what requires a confidentiality agreement or common interest arrangement and what should be withheld.

Finally, beyond privilege, in-house counsel should not overlook the confidentiality expectations of employees and other stakeholders. Witnesses may have concerns about retaliation, and information leaks can compromise the investigation’s integrity. In-house counsel should establish clear protocols for information security, limit dissemination of findings on a need-to-know basis and ensure compliance with whistleblower protection laws and policies.

Reporting and self-disclosure obligations 

One of the most challenging tasks during an independent investigation is determining whether and how to report findings up the chain of command and, in certain circumstances, outside the organization. Under the Sarbanes-Oxley Act and the SEC’s standards of professional conduct, in-house attorneys who become aware of evidence of a material violation of securities laws or a breach of fiduciary duty are required to report that evidence up the ladder, beginning with the chief legal officer or the CEO. If the initial report does not result in an appropriate response, in-house counsel must escalate the matter to the audit committee, another independent committee of the board or the full board of directors. Failure to report up can expose both the attorney and the organization to significant regulatory consequences.

Beyond reporting up, in-house counsel must also evaluate self-disclosure obligations to external regulators and law enforcement. Certain regulatory regimes impose mandatory disclosure requirements or provide significant benefits for companies that self-report potential violations. For example, the DOJ’s corporate enforcement and voluntary self-disclosure policy provides concrete benefits, up to and including potential declination of prosecution, for companies that voluntarily self-disclose misconduct, cooperate fully and remediate promptly. Similar incentive structures exist at the SEC (see SEC enforcement manual § 2.5.1), CFTC (see Letter 26-15) and other federal and state agencies.

Despite the potential benefits, the decision to self-disclose is rarely straightforward. In-house counsel must weigh those potential benefits, such as cooperation credit and reduced penalties, against the risks, including triggering government investigations, waiving privilege and creating exposure for individuals within the organization. In-house counsel should work closely with outside counsel and the board or audit committee to develop a disclosure strategy that accounts for the specific regulatory landscape, the strength of the evidence or severity of the potential misconduct, the organization’s remediation efforts and the potential impact on ongoing or anticipated private litigation.