ASSOCIATION OF CORPORATE COUNSEL ANNUAL MEETING
BOSTON, MA – SEPTEMBER 18-21, 2015

CROSS-BORDER INTERNAL INVESTIGATIONS:
A PRACTICAL GUIDE FOR CORPORATE COUNSEL

William Leone, Norton Rose Fulbright, New York
Jeremy Devereux, Norton Rose Fulbright, Toronto

More and more frequently businesses, including public and private companies, agencies and other entities, find they are required to conduct internal investigations. An internal investigation may be the result of a business’s intention to identify, remedy and prevent misconduct by the business and its employees. An internal investigation may be the result of a business’s recognition that one or more regulators or law enforcement agency may expect, or may require, the business to conduct the internal investigation. Often, both of those factors are involved.

The number and the complexity of internal investigations conducted by businesses is increasing as a result of a number of factors, including increasing enforcement action by regulators and law enforcement agencies, increasing expectations by regulators and law enforcement agencies that internal investigations will be conducted, and that they will be conducted in a competent and rigorous fashion, and increasing civil liability risk, particularly with respect to class actions. The number of internal investigations involving more than one jurisdiction is also increasing, as businesses becomes more international and regulators and law enforcement agencies increasingly scrutinize conduct outside of their own national borders.

Where an internal investigation involves more than one jurisdiction, it is not only more logistically complicated, it also raises potential risks that may not be present in internal investigations involving domestic jurisdiction. For example, different jurisdictions may have different laws relevant to internal investigations, such as those dealing with legal privilege, employee privacy and rights, and disclosure obligations. The movement of information and documents obtained during an internal investigation across borders may be problematic, or even illegal.

At the same time, corporate counsel are facing significant pressure to reduce overall legal spend. The result is that many corporate counsel find that they are increasingly required to conduct or manage internal reviews using only internal resources. Where external counsel are involved, corporate counsel are increasingly required to take an active role in managing the investigation to ensure that it is conducted in a cost-effective way.

The goal of this paper is to provide assistance to corporate counsel in planning, managing and conducting internal investigations. This short paper cannot answer every question, but the hope is that it will help corporate counsel to be alive to the questions that need to be considered and addressed.

1 Internal Investigation Goals

It is important to identify and consider the goals of a particular internal investigation at the outset and throughout the investigation. Internal investigations can vary significantly in terms of size and scope, the nature of the issues being considered, and the overall purpose. But, there are some goals that are important in most internal investigations.

First, internal investigations generally seek to obtain all information relevant to the issue being investigated, including all relevant documents and full and truthful evidence from all relevant witnesses.

Second, in most internal investigations the business wants at least the option of keeping the investigation confidential and having it protected from disclosure by legal privilege.

Third, a business may wish to have the option, or may be required, to disclose the investigation to a regulator or law enforcement agency, without triggering potential disputes as to privacy and legal privilege rights of employees whose information was obtained in the investigation.

These goals, and any goals particular to an investigation, are most likely be met with an investigation that is carefully planned and executed.

2. The Importance of an Investigation Plan

It is helpful in any internal investigation to prepare – and maintain – a written investigation plan. The preparation of in investigation plan helps to ensure that the scope and procedure for the investigation are thought out in advance, before work starts. This means that necessary tasks are more likely to be done in an efficient way, and unnecessary work is avoided. An investigation plan can also help to avoid taking steps that could jeopardize confidentiality or legal privilege, or result in legal or regulatory risks for the business and its employees.

Counsel often find that there is urgency, or perceived urgency, to commence an internal investigation right away. However, time spent in preparing an investigation plan, even in urgent cases, will often shorten the length of time needed for the investigation. Also, a business that frequently conducts internal investigations may find it helpful to prepare a template investigation plan in advance, which can shorten the time needed to prepare a plan for a particular investigation.

Ideally, the plan will specify responsibility for tasks, and expected completion dates.

It is unlikely that every issue that may arise in an investigation can be anticipated at the outset, when the plan is first prepared. The plan should be modified as necessary when additional tasks or issues are identified, or where tasks or issues initially identified are found to be unnecessary. The plan should also be kept up to date with respect to the completion of tasks, and any changes to expected completion dates.

The following are some of the basic issues that should generally be considered in an investigation plan where more than one jurisdiction is involved.

a. Identify and define the issue(s) to be investigated

A crucially important, but sometimes overlooked, step is to define clearly the issue or issues to be investigated before the investigation starts. The issue is the determining factor for all of the steps necessary for the investigation.

If the issue to be investigated is not clearly defined, there may be misunderstandings amongst the people conducting the investigation and the people requiring it to be conducted (whether internal to the business or at a regulator or law enforcement agency). The result can be that the issue that should be investigated is not properly investigated – which raises regulatory and civil risks, and that issues that were not intended to be investigated are investigated – which results in wasted costs and employee time.

Well intentioned people conducting internal investigations will often want to look into anything that may be interesting. The careful definition of the issue to be investigated serves to keep the investigation properly focused and avoids such “scope creep”. In addition, where a person conducting an investigation comes across something that is potentially problematic that may warrant investigation, a clear definition of the issue that is being investigated will help to ensure that the new issue is identified as something different, to be considered and dealt with separate and apart from the active investigation. This helps to keep the active investigation focused. In addition, it is often helpful to keep the investigation of distinct issues contained in distinct and separate investigations. This assists in preserving confidentiality and legal privilege, particularly in the event of disclosure of an investigation of a given issue internally or to regulators or law enforcement agencies.

b. Identify jurisdiction(s) where the conduct at issue occurred

It is important to identify each jurisdiction in which the conduct at issue occurred or may have occurred. This will be relevant to the a number of factors in the investigation including the identification of the jurisdictions (1) whose laws and regulations may be engaged; (2) where relevant documents may be located; and (3) where witnesses may be located.

c. Identify jurisdiction(s) whose laws and regulations may be engaged, and how so

The identification of each jurisdiction whose laws may be engaged can be complex, and is not limited to the jurisdictions where the conduct occurred. The laws of a jurisdiction may be engaged because the conduct at issue may have occurred in whole, or even in part, in a given jurisdiction. In other cases, the laws or regulations of a jurisdiction have such reach that they may be engaged by conduct that took place entirely outside the jurisdiction. Often, the laws of more than one jurisdiction may apply to the same conduct.

The determination as to whether the laws of a given jurisdiction may be engaged often requires a good understanding of the laws of that jurisdiction. Once it is apparent that the laws of a jurisdiction may be engaged, it is important to identify (1) the laws that may be engaged, (2) how those laws and regulations are applied in practice, and (3) the views of the regulators and law enforcement agencies – with respect to the conduct and with respect to the manner in which it should be investigated. This will assist in planning the investigation and in assessing the risks raised by the conduct at issue.

d. Identify jurisdiction(s) where relevant documents may be located

Document collection and review is usually central to any internal investigation. The documents may be in paper form but the term “document” comprises a potentially massive amount of information contained in emails, texts, instant messages, and many other electronic files that may be located the business’s servers, on individual computer hard drives, or on individual hand held devices. For many regulators and courts, “documents” also includes the metadata associated with electronic documents.

It is obviously important to identify the jurisdictions where documents may be located in order that document collection can take place. But, it is also important to know where documents are located because the jurisdiction in which the documents are located may have laws relating to the right of the business to access and review those documents, and with respect to the right of the business to move those documents, or copies of those documents, outside of the jurisdiction, or to rely on them at all.

In addition, a jurisdiction whose laws may be engaged by the conduct, may have laws or views as to how documents should be collected in an investigation, including issues such as the preservation of metadata for electronic documents, drives and devices.

e. Identify jurisdiction(s) where witnesses (employee and otherwise) may be located

In any investigation, it is important to identify the witnesses, both employees and otherwise, who may have relevant information and who may need to be interviewed. In a cross border investigation, it is also important to identify where a witness resides, works, and is presently located. This information is necessary in planning the interviews and, in the case of a less significant witness, deciding whether an interview is warranted and/or whether to conduct the interview by phone or video conference rather than in person.

It is also important to know where witnesses reside, work and are presently located because those factors may determine which jurisdiction’s laws apply to a request for information from an employee. As set out in more detail in the section on Employees and Employee Information below, the jurisdiction may have its own laws and regulations regarding the way in which employees and other company members can be questioned and what information they are permitted to withhold or are required to disclose.

In addition to legal considerations, as set out in the section on Cultural Differences below, linguistic and cultural characteristics of each jurisdiction may play an important part in formulating the correct approach to interviewing witnesses located in a particular jurisdiction. To be effective in obtaining accurate and complete information from foreign interviewees, investigators may need to be culturally competent and sensitive in their dealings with witnesses .

f. Consider confidentiality and privilege issues

In most internal investigations, the business wants at least the option of keeping the investigation confidential and having it protected from disclosure by legal privilege. The section below on Establishing and Maintaining Legal Privilege sets out some advice and issues to assist in that respect, which should be considered in the investigation plan.

However, there are times when a business decides to conduct an internal investigation that will not be privileged or that will be neither privileged nor confidential. For example, a business may want to have an internal investigation to deal with alleged misconduct that is already public. Or, the business may have a regulatory obligation to conduct an internal investigation and to disclose the entire investigation to its regulator.

If a company is considering a non-privileged or non-confidential internal investigation where the laws of more than one jurisdiction may be engaged, the company should be particularly careful of the consequences in each jurisdiction of doing so, before proceeding.

f. Consider and decide on staffing for the investigation

Careful staffing can ensure that any internal investigation is conducted efficiently and cost-effectively. In a cross border investigation, careful staffing is even more important. A cross border investigation may need individuals who are sufficiently knowledgeable of the legal and cultural issues related to the investigated conduct, document collection, witness interviews, and investigations generally. Any of these issues may require specialized knowledge in different types of laws, in order that the business can obtain reliable advice, such as advice on potential violations, penalties, defenses, reporting requirements, and so on. It may also be helpful to have individuals who are already located in various jurisdictions, for reasons of cost and convenience.

A business will usually want to begin by assessing its internal resources to determine whether it has people with the necessary knowledge and expertise for each relevant jurisdiction. A business will also want to determine whether its internal resources are adequate for the volume of work anticipated. If there is not adequate expertise and/or capacity for a given task or jurisdiction, or if there are elements of the work that should otherwise be outsourced, the business will need to retain legal counsel with the expertise and capacity and/or other service providers.

The decision as to the role of corporate counsel in an internal investigation needs to take into account the possible differences in legal privilege as between different jurisdictions, as set out in the section immediately below on Establishing and Maintaining Privilege. In some jurisdictions, communications to and from corporate counsel may not attract the legal privilege that would exist in that jurisdiction for the same communication to and from an external lawyer.