The Importance of Investigation Protocols Amid Heightened Corporate Exposure
In the face of well-publicized corporate scandals such as #MeToo, and in response to heightened corporate accountability standards under Sarbanes-Oxley and Dodd-Frank, internal investigations serve as a critical component of an effective governance and corporate compliance program. While companies recognize the need to conduct internal investigations to respond to allegations of potential misconduct, many companies have not adopted a written investigation policy or protocol. Implementing a written investigation policy is an important step companies should consider to help promote effective internal investigations.
Investigation protocols serve several critical functions, including (i) ensuring internal investigations are carried out in a process-oriented manner that demonstrates commitment to the company’s corporate culture; (ii) defining a complaint triage process that allows for a heightened and more rapid response to complaints that present the greatest exposure to the company; (iii) ensuring appropriate contacts and responses to whistleblowers and complainants; (iv) providing guidance and resources on appropriately conducting an investigation; and (v) addressing matters of privilege, protection of investigation materials, and distribution of any investigation results.
Investigation policies and protocols take many forms and necessarily will vary by company, but there are several elements companies should consider as they develop and enhance their own investigation procedures:
- A documented triage process for matters presenting the greatest exposure to the company will prevent a company from conducting lengthy investigations for minor complaints and ensure that significant issues are immediately brought to the attention of senior executives. In defining the highest risk complaints that may trigger a more robust investigation, companies should consider whether the issue could give rise to a government inquiry or investigation, result in a disclosure to a regulator, lead to litigation, or result in significant reputational harm to the company.
- A standard set of responses to be provided to any whistleblower or complainant which includes clear statements about the company’s policy against retaliation.
- Internal investigation resources — including legal, compliance, human resources, and information technology resources — should be identified in the policy and it should advise on the appropriate use of outside counsel or forensic auditors.
- The written investigation policy should serve as a guide for investigators, providing instructions on how to scope an investigation, identify corporate resources, preserve and collect documents including electronic evidence, conduct and document interviews, preserve privileges, and control the distribution of investigation materials. Investigators should be reminded that the company is the client by providing appropriate Upjohn warnings to employees, that they are independent fact-finders without an agenda, and that while employees are often obligated by company policy to cooperate, they should be treated professionally and with respect.
- For multinational companies with global investigations, a written investigation policy also should address data protection and data privacy, such as foreign restrictions on personal data and blocking statutes.
- Protocols should include a defined process for reporting findings to appropriate company personnel, and for tracking any recommended remediations. For any investigation resulting in disciplinary action, human resources and where appropriate, labor counsel, should be consulted.
Subscribe to Managing the Modern Workplace to receive weekly email updates.