Corporate internal investigations, brought to the forefront of crisis responses in the post-Enron, WorldCom, and Sarbanes-Oxley era, seem to have exploded in the wake of the stock option backdating scandals, the resurgence of the Foreign Corrupt Practices Act, and seemingly endless corporate financial restatements. The actual numbers of such investigations may be even larger than the anecdotes would suggest: according to a recent law firm survey, more than one-half of U.S. companies surveyed over 2007 and 2006 reported having undertaken at least one internal investigation requiring the use of outside counsel (Fulbright & Jaworski LLP, Fourth Annual Litigation Trends Survey Findings, 2007).
Unfortunately, as the number and reach of these investigations grows, so do the opportunities for criticism of the investigations, the investigators, and those responsible for overseeing them.
Most often, criticism of the investigations, though driven by the findings (or lack thereof), centers on a range of issues and decisions that arise at the outset of the investigation. In fact, it is in the first hours and days of these matters — when facts are least certain, when trust of management and existing controls seems most warranted, when distrust of the motives of whistleblowers and other critics is highest, and when the instinct to “defend” rather than investigate the company pulls the hardest — that present the most risk for companies, boards, and management. The decisions made in these critical, but chaotic, first 48 hours can either set a path toward resolution or create additional exposures when they are later examined, as they always are, with perfect hindsight by shareholders, the media, plaintiffs lawyers, and government enforcement authorities.
Although there is no “one-size-fits-all” approach to guarantee an investigation that critics cannot assail, there are common questions that arise in such circumstances, the answers to which should provide a reasoned basis for decisions that can survive scrutiny. In connection with each of these questions, the key to avoiding catastrophe lies not strictly in getting the answer right (if there is such an answer), but in the ability to demonstrate, after the fact, that the decision was informed and reasonable given the facts and circumstance reasonably available to decision makers at the time.
Investigation or no investigation?
Most often, the first question facing board members in a potential crisis is whether to conduct an internal investigation at all. In some cases, such as a dawn raid on a foreign subsidiary or a notice from the outside auditors of potential “illegal acts” under Section 10A of the Securities Exchange Act of 1934, it is quite clear that a thorough investigation is required. In other cases, however, seemingly isolated, and frequently disputed, complaints from whistleblowers or “routine” findings from internal or compliance audits may be presented to senior management or directors with, at best, lukewarm recommendations that some limited investigation might be helpful.
There can be no substitute in these circumstances for good judgment, but a single question can be an important starting point for making that judgment: Is the board receiving assurances or facts? Mere assurances of compliance programs working or accounting entries being properly recorded will wilt in the glare of hindsight, particularly if offered by those who may later turn out to be culpable in some form. Facts, on the other hand, may be more difficult to harness initially, but provide a much more concrete basis on which to determine the best path forward.
Faced with a problem having potentially serious implications, boards should demand facts and, if sufficient facts are not readily available, be prepared to authorize the investigation necessary to obtain them.
Who should oversee the investigation?
The decision on the appropriate body to oversee an internal investigation ultimately revolves around the nature of the issue being investigated and the ability of the oversight body or individual to act in a disinterested fashion in the best interest of the company. While it is certainly possible for management, when they are not implicated, to oversee internal investigations, a clear trend for all but the smallest, least potentially significant, issues has been that investigations should be carried out under the oversight of a committee of independent, outside directors.
Reinforcing this fact, in its October 23, 2001, Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934 and Commission Statement on the Relationship of Cooperation to Agency Enforcement Decisions, SEC Release No. 34-44969 (generally known as the “Seaboard Report”), the SEC included the following question among the criteria it would consider in weighing cooperation in an SEC investigation: “Did management, the Board or committees consisting solely of outside directors oversee the review?” In asking this question, the SEC clearly meant to suggest a preference for oversight by outside directors.
As seen in the more recent stock option backdating cases, however, even outside board membership is not always a sufficient indicator of independence if the board members responsible for a given issue may be involved in the investigation. The issue to be considered at this stage, therefore, really comes down to assurance of both independence from management and disinterestedness in the subject matter of the investigation.
Who should conduct the investigation?
The choice of investigator requires careful analysis of the issues giving rise to the need for the investigation, consideration of the company's objectives in the investigation, and evaluation of the available alternatives for conducting the investigation. “Independent” counsel have become the favored choice in the corporate crisis scenario, but not every investigation — not even every accounting-related investigation — is a potential meltdown on the Enron/WorldCom/HealthSouth scale that requires investigation by multiple outside law firms, forensic accounting consultants, and other experts. Other matters may reasonably be reviewed by the company's in-house counsel, regular outside counsel, compliance function, or internal audit.
As with the decisions described above, the decision to depart from the more conservative trend should be carefully considered and the basis for it documented thoroughly.
What should the investigation cover?
An initial step that should always be taken when planning for an internal investigation is a determination and documentation of the initial scope of the review. Although there generally are concerns at the beginning of every investigation that the investigators should be appropriately and narrowly focused to avoid undue delay and expense, the scope must be broad enough to yield a comprehensive understanding of the facts at issue and to allow the company, the board, and management to reach reasonable conclusions on an appropriate response.
In its Seaboard Report, the SEC noted that one factor it would consider when assessing the cooperation of entities in connection with potential enforcement proceedings is whether there were scope limitations placed on any internal investigation. To meet the dueling objectives of efficiency and breadth, at the outset of the investigation the scope should always be considered an initial scope, generally with specific developments (i.e., certain findings or the identification of additional issues) that could cause those overseeing the investigation to request an expansion of the scope. This approach both avoids later questions about artificial limitations on the ability of the investigation to effectively understand and address the matters at issue, and provides appropriate focus and an effective oversight tool for those charged with oversight.
How should we start?
Document destruction wreaks havoc on internal investigations. It undermines the credibility of the process and those involved in it, taints the conclusions, and negates a company's ability to rely on it in any meaningful way. Accordingly, regardless of who is chosen to investigate, all involved in the process need to be sure that appropriate document retention protocols are implemented as soon and as effectively as possible.
What disclosure is necessary or appropriate?
A final consideration when planning an investigation should be the extent to which companies should or must disclose to their auditors, regulators, or the public the existence of the investigation and the issues it covers. Although the actual disclosure decisions will be driven by the issues and the circumstances surrounding the facts under review, caution dictates that, at a minimum, auditors be apprised as soon as practicable of any investigation that raises material questions about the company's financial statements. Disclosure to the SEC or other regulatory agencies and the public will depend significantly on the specific nature and perceived validity of the complaint, and should be decided in consultation with experienced SEC and disclosure counsel.
First-hours action
There is no magic formula for internal investigations. They involve difficult judgments, and will always be subject to the potential for hindsight-driven criticisms. Carefully considering these questions and documenting the bases for the essential decisions, judgments, and choices made in the first hours and days of the investigation will help to structure an appropriate investigative process and provide the best protection for the investigation and those overseeing it. â
The author can be contacted at jrtuttle@debevoise.com.