Lawyers on the Front Lines: Identifying Risk and Managing Internal Investigations

Corporate crises are as old as business itself. However, the focus has never been more intense on the role of in-house counsel to prevent and respond to crises. This widening spotlight on in-house counsel is the result of several coalescing trends. It has been 15 years since the US Congress passed the Sarbanes-Oxley Act, which made it clear that lawyers are “gatekeepers” and play an important role in ensuring a clean corporate marketplace. In the years since Sarbanes-Oxley, government regulators have ratcheted up their compliance-related enforcement and the liabilities for in-house counsel as individuals and as corporate gatekeepers have increased.

In 2004, Stephen M. Cutler, then-director of the Securities and Exchange Commission’s (SEC) Division of Enforcement, explained the change to the investigations landscape when he said that pursuing gatekeepers is the “most targeted and effective way of using the agency’s limited enforcement resources” to ensure good corporate behavior. Increasingly, individual lawyers are named defendants in enforcement actions along with company leaders and board members. Occasionally, an in-house counsel is the sole defendant in a prosecution for a corporate failure.

While in-house counsel are being pursued as gatekeepers, companies are also simultaneously expanding the scope of responsibilities for in-house counsel. In an ongoing dispute, the traditional ability of in-house counsel to provide legal advice that considers a range of business concerns is being challenged. The Federal Trade Commission (FTC) is challenging the boundaries of whether the role of an in-house counsel in a business transaction is subject to the privilege as it relates to an FTC antitrust investigation. In the matter, a corporate general counsel helped negotiate a business deal. The FTC, as part of its investigation, has argued that such advice and supporting analysis should not be held under the privilege. The corporation, with the support of the US Chamber of Commerce and the Association of Corporate Counsel (ACC), has contended that the FTC’s approach would have a devastating impact on privilege and the ability of in-house counsel to, among other things, conduct meaningful internal investigations. As courts have noted, “[r]are is the case that a troubled corporation will initiate an internal investigation solely for legal, rather than business purposes.” Many believe the impact of adopting the FTC’s approach would frustrate the purpose of the privilege and discourage communication of relevant information by company employees to their in-house counsel. This case, and others like it, point to both the ever-expanding role of in-house counsel and the challenges of managing internal investigations.

In the aftermath of the economic recession, most companies are finding creative ways to “do more with less.” Many companies now save money by meeting more of their legal needs in-house and hiring fewer outside counsel. Increasingly, corporate in-house counsel are involved in enterprise-scope of strategic business decisions and advise executives on critical matters beyond those that are strictly legal. Job descriptions for in-house counsel continue to evolve; they often wear multiple hats and juggle more expansive workloads. One of the significant consequences of the expanding corporate counsel role is that such expanded responsibilities further stretch the ability of in-house counsel to devote the necessary focus to internal investigations, discern risks, and identify potential crises, thus further increasing the risks that problems may be overlooked or insufficiently addressed.

Naturally, in-house counsel are feeling the heat of the spotlight. The recent ACC Chief Legal Officers 2017 Survey showed that more than one out of every four respondents reported being targeted by a regulatory agency in the past two years. In the same survey, 74 percent of respondents rated ethics and compliance as their top challenges. In addition, the actions of general counsel during recent investigations at major companies have garnered significant media attention.

Though the CEO, chief compliance officers, and other top company leaders are generally considered to be primarily responsible for establishing a company’s values, in-house counsel are uniquely positioned to help support the integration of compliant behavior into organizational culture. Benjamin W. Heineman, Jr., author of The Inside Counsel Revolution, argues that that general counsel must serve in both a partner and a guardian role. As a business partner, an in-house counsel works with company leaders to make and help implement major business decisions. As a guardian, an in-house counsel is responsible for bringing an objective perspective to the company, and is uniquely positioned to challenge company practices that are too risky or don’t comply with the law. Armed with both an inside understanding of the business and an external commitment to the law, in-house counsel — in partnership with compliance departments — are empowered to help advocate for the embedding of processes and protocols that will help the company when crises occur.

In-house counsel play a critical role in helping organizations build and maintain robust cultures of compliance. Organizational culture is a set of shared values that can guide employees on how to respond to various situations. Compliance refers to the protocols companies use to help ensure employees follow the company’s risk management guidelines and obey the law. An effective culture of compliance is one that prioritizes honest communication, transparency, and accountability and helps all employees understand that legally compliant behavior is essential to advancing the company’s long-term goals and growth strategy.

There are many ways that in-house counsel can support and reinforce an organization’s culture of compliance. In the day-to-day work of providing advice and counsel to the organization, in-house counsel should enthusiastically emphasize compliance priorities with company leadership. This is critical because tension sometimes exists between compliance and a company’s bottom line. Unfortunately, there are countless examples of companies facing troubling situations with significant legal and financial impact because the company grew quickly without making compliance a priority during the early stages of growth. In-house counsel can help CEOs and other business leaders take the long view, encouraging them to model compliant behavior, and set the tone at the top. There is a compelling need for the business to engage counsel at the inceptive strategic stage to empower them, and inevitably the business, to be proactive on matters of compliance.

Corporate counsel can also support the business by helping develop and regularly evaluate compliance policies and guidelines. To effect long-term, sustainable compliance, companies must put in place accessible reporting platforms that act as early warning systems for nascent problems. In-house counsel are well-positioned to work with company compliance leaders to ensure that all employees are well trained and fluent in compliance policies, and that the organization has effective monitoring controls in place.

All in-house counsel, regardless of role or title, should work with company leaders and rank-and-file employees to ensure ongoing alignment between compliance goals and business goals. At the micro level, this may mean helping the business evaluate whether work assignments, compensation, and other incentives are structured so that employees are motivated to do their work in a legally compliant manner. At a more macro level, in-house counsel should be alert to how the company manages hiring, firing, promotion, and other personnel issues, as well as determine how it assesses procurement and sourcing practices to help ensure they align with best compliance practices. In-house counsel that readily engage with corporate employees in the day-to-day business of the organization are in the best position to identify red flags, elevate issues, and help the business proactively redesign practices, programs, and initiatives that have potential compliance defects.

In order to effectively help the company drive compliance best practices, in-house counsel must build strong channels of communication across the organization, both vertically and horizontally. Companies can run into trouble when their legal teams operate in silos. In the realm of cybersecurity, for example, lawyers need to work closely with technical staff to understand and respond to potential security breaches before they create larger risk to the company. In-house counsel should insist on unfettered communication channels with all departments, especially a company’s leadership team. Likewise, employees in the business should feel comfortable raising concerns to in-house counsel. Michael Held, executive vice president at the Federal Reserve Bank of New York, recently cautioned against organizational cultures that yield “too high a degree of adherence” and a “dangerous lack of questioning.” Leaders in business, compliance, and legal departments can help foster open communication within the organization by encouraging and rewarding employees who have the courage to flag issues, and by strictly enforcing non-retaliation policies.

Sometimes a company creates its own crisis and other times the unexpected occurs despite a company’s best efforts. When a corporate crisis strikes, general crisis management protocols and investigation efforts may consume significant resources. Yet, there are some preventive measures that will mitigate the impact of the crisis and any subsequent investigation. In-house legal teams should plan ahead by anticipating that their company may find itself faced with an internal or external allegation of wrongdoing that warrants investigation.

Below are four questions that every in-house counsel should consider as they examine their company’s readiness for the unexpected.

1. Do I need to investigate?

Depending on an entity’s line of business and the role of the in-house counsel within the organization, many lawyers are confronted with issues on a daily basis that require them to assess whether further inquiry is necessary. For example, an in-house counsel may be working on a transactional matter where, in the course of discussions, it appears there may be a “side deal” influencing the parties’ negotiation posture. Or in-house counsel may hear through rumors that a company employee is engaging in unethical behavior. Or a third party may formally allege corporate wrongdoing. Although each of these examples represents a vastly different circumstance, each situation requires that in-house counsel assess whether further inquiry is necessary and appropriate.

Many times, the in-house counsel’s “assessment” of the situation is rapid and instinctive. At other times, the attorney may need to spend focused time deliberating next steps. Too often, corporations recognize the need for an investigation too late in the process — often after significant internal actions have already taken place. In addition to relying solely on sound, individual judgment, the in-house counsel may need to confer with other in-house and/or external counsel to determine how best to proceed.

2. Do I conduct an internal investigation under privilege?

Once an in-house counsel determines that an internal investigation is warranted, they must be able to promptly plan how to proceed. Not all internal investigations need to be at the direction of in-house counsel; indeed, many internal investigations can be conducted with limited in-house involvement. In-house counsel should objectively examine the purpose and scope of the investigation while also considering resources and real-time business pressures. Here are three examples of the types of matters that are likely best handled as internal privileged investigations.

• A privileged investigation might be in order when an employee flags an issue for concern that could create legal risk for the company. For example, whistleblowers should be taken seriously, and their complaints appropriately addressed. Even seemingly innocuous issues might be indicative of a larger problem. At the very least, looking into the merits of a complaint sends a signal to employees that their input is valued and helps to create a culture of compliance. It is the job of the in-house counsel to evaluate the seriousness of a complaint and provide advice on the scale and scope of a potential investigation.
• A privileged investigation should also be considered when safety or other regulatory risks are at stake. For companies that are vulnerable to product liability claims where consumers might be hurt as a result of a design or manufacturing failure, in-house counsel should aggressively investigate potential problems and do so quickly. These cases are likely to spiral out of the company’s control in the wake of inaction. At the first whiff of a safety concern, in-house counsel should immediately elevate the issue to the stakeholders at the appropriate level within the organization. In one case, a senior lawyer hid the news of a product defect from company leadership. Later, after the product was implicated in causing serious harm to consumers, the company was sued and was found liable for significant compensatory and punitive damages. The post-crisis investigative report placed much of the blame on the lawyer for hiding the information.
• Too often companies let problems balloon into full blown crises, in-part because the in-house legal team or company leadership have not prioritized investigating the issue. For example, in the event of a cyberattack, it is never ideal for a company to have to admit that preventative security measures have failed, especially if the breach compromises customers’ confidential information. Nevertheless, in-house counsel should resist the urge to downplay the seriousness of any problem that has the potential to grow quickly. In one example, a general counsel of a major company resigned after a post-crisis investigation uncovered that the counsel sat on information that would have warranted an aggressive internal investigation years earlier, before additional and potentially preventable cyberattacks occurred.

3. Have I developed the right investigation framework?

An investigative framework will not be effective without thorough documentation of the investigative process. At the beginning of any investigation, it is good practice to develop a detailed work plan that outlines the investigative steps to be taken, including a list of witnesses to be interviewed and documents to be gathered. The work plan should be a living document that is regularly amended as the investigation progresses. All witness interviews should be memorialized in writing and a report that details investigative findings should be drafted at the conclusion of the investigation. Such documentation may ultimately serve as evidence of the investigation and may be crucial to proving the matter was appropriately handled.

Moreover, a clear document retention policy is a critical component of the in-house counsel’s investigative toolbox. Document retention policies that are clear and consistently followed enable organizations to more readily perform internal investigations and respond to requests for production. Even if the investigation reveals corporate wrongdoing, robust and consistently applied recordkeeping policies lend credibility to the investigative process, which may help mitigate liability for the company. Some companies have garnered negative media attention by attempting to change retention periods in the midst of an investigation. Even if a policy change is warranted and is unrelated to the investigation, in-house lawyers should think through the best approach for implementing and communicating the change — taking into consideration potential negative inferences.

Another step that in-house lawyers can take to build an effective investigative framework is to actively develop and maintain strong relationships with outside counsel. In-house legal teams are meeting an increasing percentage of most companies’ legal needs, but company lawyers simply cannot do it all and often need to rely upon outside resources to respond to complex, high-risk matters. When faced with an allegation of internal wrongdoing which meets a certain threshold, most companies will hire outside counsel to conduct an internal investigation. In the face of crisis, it is extraordinarily helpful and beneficial to be able to call upon trusted outside counsel familiar with the company, the industry, and regulators.

4. Who is my client?

Attorney-client privilege is the oldest common law protection for confidential communications and is designed to encourage a client to be open and honest with his or her attorney. Attorney-client privilege is a key element of a legally led investigation, and it is imperative that corporate counsel understand the technical aspects of how the privilege applies in the in-house context.

As an initial matter, in-house lawyers conducting investigations will need to promptly clarify their role via an “Upjohn warning” so employees understand that they represent the company as opposed to the individual employee.

In-house counsel have tripped over this issue when they were not in communication and in agreement with company leaders about whether they were representing the corporate entity or the individuals involved in an investigation. There are numerous cautionary cases where employees of an organization believed the in-house counsel represented them individually. Such confusion is easy to understand as in-house counsel and company employees often develop close relationships. A clear “Upjohn warning” dispels such confusion.

As in-house legal teams take on more varied responsibilities within companies, issues of attorney-client privilege are becoming thornier. This is especially true for in-house counsel who participate in strategic business decisions where they may be providing both legal and business advice. In many situations, the role of the in-house counsel is blurred when, for example, they are advising on the business aspects of a deal or corporate strategy. In certain of these situations, government agencies have requested communications related to the deal to determine whether any laws were broken. Companies have generally refused to turn over those types of documents, asserting attorney-client privilege. Government agencies have responded with strong arguments that when in-house counsel hold dual roles as legal counsel and business advisor, the burden is on the company to prove that the attorney was providing predominantly legal, rather than business, advice.

On June 2, 2017, the US Chamber of Commerce and ACC submitted an amicus brief against this position in a case involving the FTC. The brief argues that if in-house counsel are required to prove whether they are providing legal or business guidance when advising their clients, such a stance “will undermine the traditional ability of in-house counsel to provide legal advice that considers the full range of concerns relevant to the company, and will promote a moment-by-moment, communication-by-communication approach to attorney client privilege that would chill clients’ communications with counsel and undermine the provision of legal advice.” If the court finds in favor of the FTC on this issue, in-house counsel who are engaged in their companies’ business decisions will need to track whether each activity and communication is primarily for business or for legal advice.

Conclusion

The roles and responsibilities of in-house counsel are changing and expanding. Consequently, regulators and the general public now have higher expectations of in-house attorneys as corporate guardians. As counselors and advisors, in-house counsel have daily opportunities to positively impact their companies, and they often hold seats at the table where high-level, transformative business decisions are made. Such influence and potential for impact carries with it sobering and significant responsibility. As part of this responsibility, in-house counsel must closely collaborate and partner with their risk and compliance departments that are tasked with the day-to-day responsibility for implementing and maintaining controls that help mitigate the potential adverse impact of corporate threats. Now more than ever, in-house counsel are held accountable for the behavior of other corporate actors. Creating effective working relationships with compliance and risk organizations enable in-house counsel to better assist companies when they respond to unexpected crises or allegations of internal wrongdoing. Using sound judgment, acting proactively, and partnering with corporate risk and compliance departments positions in-house counsel to effectively monitor compliance, flag and escalate issues, and create an effective investigative framework that minimizes liability for themselves and their clients.

The authors would like to thank G. Meredith Parnell, a Harvard Law School Student and Crowell & Moring summer associate, for her assistance with this article.