Tears in the fabric

In recent years, allegations of misconduct within businesses have been in the spotlight and the global lockdown is expected to make this trend more pronounced.

Hence the rise of internal investigations – fact-finding exercises by a company to establish wrongdoing and, at the same time, assuage public concerns and reassure investors, regulators and others affected. Lawyers, including those at external law firms, play big roles in these investigations, and as this line of work increases there are also attempts by regulators to limit the protection against disclosure provided by legal professional privilege.

Alan Sheeley, a partner and head of the international civil fraud and asset recovery practice at Pinsent Masons in London, notes increased demand from businesses to help run these inquiries.

Whistleblowing is also culturally more acceptable and it is treated much more sensibly than it was a while back

Neil O’May, Norton Rose Fulbright

Underpinning this is tough legislation on corporate liability. Take the Bribery Act 2010. This introduced a corporate criminal offence of failure to prevent bribery, which burdens companies with proving that they have ‘adequate’ anti-bribery procedures and policies. More recently, the Criminal Finances Act 2017 created a similar strict liability offence of failing to prevent the facilitation of tax evasion.

This has in turn led to ‘a big increase’ in criminal law expertise in the larger commercial firms, according to Sheeley. The firm has a dedicated investigations team comprising around 10 white-collar crime lawyers and as many civil fraud and asset recovery experts. They work alongside specialists in other legal disciplines depending on the issue under investigation (such as financial irregularities or breaches of competition law).

Complaints by whistleblowers are leading triggers for investigations (others include the media, a regulatory probe or stock market fluctuations). Neil O’May, a partner at Norton Rose Fulbright in London, says the number of internal investigations started as a result of whistleblowing has escalated in the past three to four years.

Research published by whistleblowing hotline service Expolink in April 2019 found that employees were 57% more likely to speak up about workplace misconduct than they were in 2017.

The Facebook/Cambridge Analytica data breach scandal that erupted in 2018 is one example. It followed revelations by a former Cambridge Analytica employee who blew the whistle on the company. Whistleblowers’ complaints are also said to have played an integral role in the Wirecard accounting scandal that surfaced in early 2019.

Whistleblowers are protected by law. Larger organisations, including in the regulated sector, now have policies and systems in place to encourage the reporting of workplace wrongdoings. ‘It is also culturally more acceptable and it is treated much more sensibly than it was a while back,’ says O’May. Companies are also promoting cultures of ‘speaking up’, which has been aided by movements such as #MeToo.

Internal investigations can also be triggered by probes by the Financial Conduct Authority (FCA), Competition and Markets Authority (CMA) or the Serious Fraud Office (SFO) – and these can be interlinked. O’May notes how, for instance, ‘suspicious activity reports’ received by the National Crime Agency often lead to the involvement of the FCA, which then tends to ‘triage’ the issue to the CMA or the SFO.

Law enforcement agencies and regulators also work with their overseas counterparts. ‘The level of co-operation between the US Department of Justice and the SFO in the UK is immeasurably greater now than it was a few years ago, and probably a lot of that is to do with the recent director of the SFO,’ says O’May. He is referring to Lisa Osofsky, a dual British-US national and lawyer, who took up the directorship in August 2018.  

Covington partner Ian Hargreaves observes that investigations rarely commence as a result of competitors’ complaints. ‘However, tip-offs and investigative journalists can lead to competitors or commercial customers putting companies under financial pressure to act, leading to internal investigations,’ he adds. ‘See the Boohoo investigation and the pressure it is now under as a consequence of customers, such as Next and Asos, dropping it.’

Hargreaves notes that this is ‘particularly prevalent in the area of “modern slavery” which is becoming a significant issue for many companies, especially in the retail and manufacturing sectors’.

On 8 July, Boohoo launched an independent review into its supply chain following allegations of low pay and unsafe conditions.  

The media plays a big role, both as a trigger and during investigations. Raj Parker, an associate member of Matrix Chambers specialising in corporate criminal investigations and white-collar crime, says a lot of his work has been prompted by ‘a financial journalist asking difficult questions about a transaction or something that is happening at a company’.  

That typically ‘triggers panic’, as the organisation strives to ascertain the facts and keep the crisis from escalating. This is compounded by social media, which has ‘accelerated the speed at which information can spread enormously’, Parker says.

Organisations should therefore have a media strategy right from the start, especially if they have a public profile and reputation to protect.

‘The struggle to calm the market, regulators and stakeholders is really difficult,’ says Parker. The corporates and financial institutions he advises work closely with media advisers who can do ‘sophisticated searches internationally across media organisations to work out who is likely to run a story and what it is likely to say, and you can make a strategy around that.

‘Unless you get a sense of the size and scale of the problem quickly, you are always going to be on the back foot,’ he advises. 

Cans of worms

There are other steps that organisations should take at the start of the process. Omar Qureshi, a partner and head of corporate crime at CMS, recommends companies engage ‘appropriately’ with whistleblowers, ‘in part to ensure that they have shared all relevant information, but also to try to avoid their making any allegations more public before you have had a chance to consider them’. Organisations will also need to ‘assess their credibility and potential motivation,’ he says.

The scope of an investigation should be ‘properly defined’ at the outset to avoid any ‘investigation creep’ – which is a mistake many companies and sometimes their external advisers make, according to Qureshi. In appropriate cases he recommends creating a ‘terms of reference document’, with the client setting out the issues to be investigated, the work involved and who will do it, as well as expected timeframes.

From the start, organisations should also be aware of all potential ramifications of an investigation. For example, there may be criminal exposure for individuals and companies, civil litigation risks, and employment and regulatory issues if the client is in a regulated sector. ‘Focusing only on one element may lead to decisions that are extremely damaging in the context of another risk,’ Qureshi warns.

It is important not only to define but also to ‘document’ the scope of the investigation – for example, using an engagement letter instructing an external law firm to lead the inquiry. This is especially true if a company wishes to rely on privilege in order to withhold documents created during the investigation from disclosure in subsequent litigation.

‘If you don’t do that, then it is just an open investigation that could be reviewed at another point by regulators,’ as well as other third parties or the court, says Sheeley, who acted for RBS in Bilta v RBS, a 2017 High Court case on litigation privilege.

O’May outlines four steps. First, echoing Sheeley, he advises companies to ‘make absolutely certain that there is sufficient evidence of privileged issues and that lawyers are involved in those so that it can be claimed without difficulty if necessary’.

Second, ‘lock down all information’. This entails issuing a ‘litigation-hold’ notice to preserve all documents, including their electronic versions.

Things can get muddied if in‑house lawyers give commercial as well as legal advice during the investigation

Omar Qureshi, CMS

Third, and this is particularly pertinent for large, complex investigations, set up ‘a focused and dedicated steering committee within the client company’ that is not connected in any way with the allegations, but can respond to external lawyers and give instructions rapidly as well as manage the process.

The fourth step is to devise ‘a really effective plan of the investigation’ which includes how and who to interview and in what order, and what documents and material are presented to the interviewee. All of the above has to be done ‘pretty quickly’ to avoid prejudicing the whole investigation, according to O’May.

A team will also need to be set up to conduct the actual investigation. This group is usually interdisciplinary. Hargreaves says it should include a ‘trusted internal team of experts’ encompassing IT, HR, data security, finance, compliance, media and PR, corporate governance and legal.

‘Have a clear chain of command and ensure the leader of the investigation has room to consider the issues, options and strategies,’ he says, recommending that ‘legal should run the process to maintain privilege’.

Companies should also look for external expertise such as private investigators, forensic accountants, independent IT experts, media and PR agencies, and, of course, lawyers.

There are advantages to using external lawyers and firms, according to Hargreaves. For example, they can seek immediate court relief such as disclosure orders, freezing injunctions, unmasking orders, and search and seizure orders. ‘They offer an independent view’ and ‘help to maintain legal professional privilege,’ he says.

Outside help

External lawyers will also bring expertise in criminal law and litigation, says O’May, highlighting concerns raised by the SFO over investigations that were not conducted by litigators or to criminal investigation standards. In its Corporate Co-operation Guidance published last August, which sets out what companies should and should not do when self-reporting wrongdoing and looking to secure co-operation ‘credit’, the UK agency said that failure to co-operate includes ‘putting subjects on notice and creating a danger of tampering with evidence or testimony’. Co-operation is necessary to secure a deferred prosecution agreement.

‘Knowing how to run an investigation to a criminal standard of evidential proof is essential,’ O’May stresses.

Specialist external lawyers will also have skills, resources and expertise that may not exist in-house – for example, when it comes to handling large data reviews or interviewing relevant people in the business, says Qureshi. He adds that they ‘can spot and resolve issues that come up time and again that may not be on the company’s radar’, such as privilege, data protection and employment, and how to deal with regulators and other authorities.

External law firms pride themselves on offering a ‘full service’ to their clients. For example, Pinsent Masons has a team of expert forensic accountants that can assist with identifying financial irregularities, says Sheeley, adding: ‘That’s the joy of being in a multidisciplinary team.’

Technology is becoming an integral part of conducting investigations and the larger law firms can facilitate that. O’May’s firm uses AI and data platform technologies, as well as its own in-house tech, for handling large document searches: ‘That is really a key part of the operation because it has to be done to a high level of accuracy and quickly.’ The firm also relies on external providers ‘in very significant cases where there is a huge amount of data’.

A key reason to engage external lawyers is that legal advice from an in-house lawyer is not always privileged, not least in EU competition investigations. And, as Qureshi observes: ‘Things can get muddied if in-house lawyers give commercial as well as legal advice during the investigation.’ But he warns: ‘Engaging external lawyers can help with a privilege argument. Although it will not provide automatic, blanket coverage.’

If a company uses its own lawyers to conduct the investigation it can look ‘a bit cosy’, says Parker. Bringing in an external law firm that is ‘independent’ of the company and has ‘a strong brand and reputation’ will send out a positive signal that the allegations are ‘really taken seriously’ and the company is not afraid of  ‘taking a big risk’.

Take Wirecard, the collapsed German payment group, which last year hired one of Asia’s most high-profile law firms, Rajah & Tann, to conduct an independent internal investigation into alleged accounting irregularities at its Singapore subsidiaries.

But Parker, who before joining Matrix Chambers was a partner at Freshfields for 23 years, says: ‘It is much easier to bring in barristers because they cost a lot less than solicitors – we don’t have armies of people.’

‘Barristers are like the architects,’ he says. ‘We work out what the shape of the investigation should look like and the outcome, and then we might bring in people to run it, but we don’t do the building works.’ By this he means interviews, document reviews and other ‘lawyering’ tasks. An example is Boohoo, which has hired Alison Levitt QC of 2 Hare Court to lead an independent review of its UK supply chain.

Boohoo’s board has said it is ‘shocked and appalled’ by the allegations and that it will terminate relationships with any suppliers who do not meet its code of conduct.

What other actions are necessary to ensure the best possible outcome of an internal investigation? In deciding when and what to self-report to regulators, exchanges or criminal authorities, the company should consider if there is any discretion, when self-reporting is commercially appropriate, the reputational consequences of reporting early or late, and what the law says.

‘Consider the very serious consequences of not making a disclosure,’ says Hargreaves, citing the Proceeds of Crime Act 2002. ‘Certain offences offer leniency where you are the first mover and therefore it is important to decide from a strategic point of view how quickly you make an announcement and whether you should be the first affected company to make a report,’ he adds. This applies, for example, to competition law investigations.

What about internal and external communications, including issuing litigation-hold notices to employees, telling them not to destroy any documents which may be relevant to an investigation? ‘Too early and you may tip off. Too late and documents, including evidence, may be lost which could prejudice your case and your chances of recovering any assets,’ says Hargreaves. The same principle applies to notifying the wider business, as it could tip off the culprit.

How and when to communicate to the external world will depend on the type of investigation. If it is about a data breach or a product liability issue the earlier the better; but if the matter relates to a fraud or a serious employment complaint early communication ‘may prejudice the whole investigation as the suspect destroys evidence, hides assets, manipulates evidence and puts pressure on potential witnesses’, Hargreaves says.

The remote working lifestyle that we have all become used to will have to be translated into the investigations world, which I think will cause some problems

Raj Parker, Matrix Chambers

Covid-19

Jasvinder Nakhval, a Peters & Peters partner and an expert in white-collar crime, says lockdown has had ‘a significant impact’ on her internal investigation work. ‘Regulators have not stopped working during Covid-19 and are still pursuing their inquiries,’ Nakhval points out. Yet it has been ‘difficult’ to retrieve relevant material from physical premises or to obtain instructions from clients, and this has had a ‘knock-on effect’ on the speed with which companies respond to regulators, the police and enforcement agencies. ‘The flip-side is that it just means that we have got to be more imaginative and innovative,’ she says.

Internal investigations, especially larger ones, are commonly multi-jurisdictional and this has meant dealing with different lockdown stages at different times, depending on the nation.

‘The remote working lifestyle that we have all become used to will have to be translated into the investigations world, which I think will cause some problems,’ says Parker. An internal investigation ‘involves a lot of documents, material and preparation. It’s possible to do it digitally, it’s just a lot more effort, a lot more tiring and possibly costly’. There may be savings on travel costs and time, but he says that it is easier to interact with witnesses during an investigation ‘when you are sitting next to them in a room… than constantly being on video calls’.

‘We have done a couple of big investigations in the last three or four months, and we have had to do the interviews virtually, which when we started was quite difficult, but we have got platforms and systems where we can do it pretty well,’ says O’May. But he adds that ‘it is never as good as a proper interview’.

Logistical problems aside, lawyers expect an uptick in internal investigations work in the coming months due to the rapid shift to remote working. Sheeley says there will be ‘more frauds uncovered’ as companies’ internal systems will have been ‘weakened’ to allow them to continue to function with a remote workforce. In July, UK whistleblowing charity Protect said that furlough fraud made up 59% of the 510 coronavirus-related cases it had taken on its advice line since March 23.

O’May says he has seen ‘an upturn’ in new instructions, particularly in the financial sector, since June. As in the global financial crisis, ‘there is an anticipation that Covid-19 may encourage bad behaviour and therefore banks, for instance, are incredibly concerned to make sure that they don’t end up with a lot of [it] coming to light in a year’s time and regulators just giving a real kicking. So they are just carrying out their internal investigations to make sure that everything is OK’.

 

Marialuisa Taddia is a freelance journalist