Companies alleged to be involved in fraud or misconduct will most certainly continue to be obligated to conduct an internal investigation. It has become clear, however, from the investigative concerns at Deutsche Bank, Deutsche Telecom and Hewlett-Packard, to name a few, that an investigation can be at least as damaging to a company’s reputation as the initial allegation.

Whether an investigation is carried out by an internal group or an outside investigative firm, the company in question must seriously consider the methods used to conduct the investigation. First and foremost, the company must ensure that the investigative techniques are within legal boundaries. Secondly, the company must consider any investigative methods in light of its own stated code of conduct, which sets out the rules of behaviour, the ethical code that should govern the entire organisation from the top down.

Impermissible Tactics

Pretexting, the act of assuming a false identity to gain access to data, can not be used to obtain financial data or confidential phone records. The federal government has outlawed pretexting for both of these purposes. It is also not permissible to impersonate law enforcement, government officials or journalists. Even the law enforcement community, which has much wider latitude in the conduct of investigations than the private sector, has traditionally observed strict constraints in regard to its dealing with journalists and their sources.

Permissible Tactics

The telephone, computer networks and email system belonging to a company are that company’s property. As such, phone records, e-mails and files stored on local hard drives and network servers can be analysed by the company or third parties acting at its direction without the consent of the users. The company can also freely scrutinise mobile phones and handheld devices paid for by the company as well as home and mobile telephone bills submitted for expense reimbursement, without the user’s permission.

Other Considerations

In addition to legal boundaries, a company considering an internal investigation should look at ethical standards and possible public perception. A good rule of thumb would be to consider whether the company would be embarrassed to read about its internal investigation techniques in a newspaper or have those techniques examined in a court room. One example of a legal investigative technique that might raise these questions is the use of “trash covers” or “dumpster diving”, which refers to sifting through a person or company’s trash. Removing household trash after it has been placed at the curb is usually lawful but may be thought of as unseemly and cause a company embarrassment. On the other hand, paying a custodian to gain access to the trash of office receptacles or a dumpster on private property is generally an illegal activity.

Safeguards

Board members and senior executives, who can be held accountable for any misdeeds, must understand the methods employed by investigators and outside counsel retained to perform internal investigations. Board members and senior executives should know the identity of the investigative firm and any subcontractors they may use. They must ensure that those vendors have indicated in writing that they have familiarised themselves with and agreed to abide by the company’s code of conduct. In addition, it is good practice to request a detailed work plan from the investigative firm and then subject the work plan to thorough review, prior to authorising the start of the investigation. Any investigative steps the board may have concerns about should be discussed with legal counsel. Indeed, the vast majority of internal investigations should be undertaken at the direction of outside counsel to allow the company the protections afforded by the Attorney Client Privilege and the Attorney Work Product Doctrine.

Fortunately, the vast majority of investigators adhere to a strict ethical code and are well versed in the legal and ethical boundaries guiding investigations. Their insights can be invaluable in providing guidance to board members and senior executives as to the risks inherent in the investigative process. A good investigator will caution clients and their counsel against using questionable investigative techniques or resources.

Other Areas of Risk

While pretexting has received notoriety as an unethical investigative technique, there are other areas of risk that should be examined in the light of a company’s code of conduct and compliance programs. These issues are not confined to internal investigations but also include operational issues, such as executive compensation or foreign investment. There is no question that the Department of Justice’s increased enforcement of the Foreign Corrupt Practices Act (FCPA) and the government’s recent scrutiny of executive compensation packages, particularly in regard to financial institutions, are areas of increased vulnerability for companies and their boards.

Most risk in these areas comes from some combination of four elements: (i) employees and officers; (ii) vendors and agents; (iii) customers; and (iv) business partners. Understanding the unique risks presented by each in a given transaction is central to mitigating risk. For example, as US companies invest abroad, US officials seek viable solutions against potential violations of the FCPA. The design and implementation of an effective FCPA compliance program and corporate code of conduct, coupled with financial internal controls, can substantially minimise a company’s risk. When considering entering overseas markets, seeking to win contracts with foreign governments, or entering into joint ventures outside the US, senior management and directors need to have a keen understanding of the nexus between these transactions and any foreign public figure.

Do’s and Don’ts for Internal Investigations

At the end of the day, the tone at the top is a critical measure of a company’s commitment to ethical corporate governance. Legal compliance, the code of conduct, and reputational considerations should guide every major decision undertaken by a company and its board of directors. Below is a list of simple practices that will help prevent corporate scandals.

Do:

• review your code of conduct and apply your own “ethical litmus test”;
• insist on the investigator’s adherence to the code of conduct;
• request a detailed work plan;
• challenge the work plan on any areas of concern;
• consider how it will read on the front page;
• identify the risks.

Don’t:

• be uninformed;
• let emotions dictate decision-making;
• be bullied by other senior management or board members.
• assume that it must be okay because it’s what was recommended
• forget that you may be accountable.