With the COVID-19 health crisis and its myriad of impacts on companies and their employees, operations, service providers and securities, it is reasonable to expect increasing scrutiny from regulators, government agencies and private litigants alike during and following the crisis. The current crisis also substantially increases the risk that employees, business partners, insiders and service providers become entangled in dicey situations, including corporate misconduct— whether deliberate or not—that might trigger the need for an internal investigation.
Priorities have shifted in light of the evolving COVID-19 crisis, and human and capital resources may have been reallocated. In this context, companies may consider delaying an internal investigation that would normally have commenced immediately. In assessing whether to postpone an internal investigation, companies must consider the additional risks that may result from the delay.
A. Issues to address before delaying an internal investigation
The following questions should be carefully considered before opting to delay an internal investigation:
- Under normal conditions, would the situation or conduct give rise to an immediate response by the company in the form of an internal investigation?
- Under normal conditions, would internal controls and procedures have covered the situation and/or prevented it from happening?
- Did the situation or conduct occur in the context of remote work, travel, sheltering-in-place, enhanced use of personal technological devices for work, or related scenarios?
- Did the company review and enhance its internal controls and procedures in light of the novel policies implemented in response to the crisis?
- Does the situation or conduct reveal weaknesses or failures in the company’s internal controls and procedures?
- Is the situation contained, or is it likely to repeat itself, impact more people or create additional damage to the company if the source of the problem is not identified and dealt with rapidly?
- Will delaying the internal investigation result in ongoing non-compliance?
- Does the situation or conduct bear potentially serious regulatory, legal, financial or reputational risks?
- Are those risks enhanced because the situation arose in the context of the COVID-19 crisis?
- Does the situation or conduct put the company’s internal systems, data or other critical assets at risk?
- Will delaying the investigation compromise sources of relevant data, documents, or other information and limit access to key witnesses?
B. Preserving and protecting privilege
The protection of confidential and privileged information is critical to a well-conducted internal investigation, given the potential for regulatory investigations as well as penal, criminal and civil proceedings. As such, it is paramount for in-house and external counsel to pay careful attention to the protection of confidential and privileged information if and when an internal investigation is launched and conducted. The delay of the investigation may pose serious risks to the security of confidential and privileged information. It may, therefore, have an impact on the preparedness of the company to face litigation and regulatory investigations.
Every internal investigation should be initiated with that protection in mind. From the outset, an internal investigation protocol should be put in place. This protocol should include the following elements:
- The goal of the investigation, including the need to provide legal advice and/or prepare for and respond to a regulatory investigation or litigation.
- The identity of the internal investigation team and the role of each member of the team.
- A protocol to ensure that all communications remain within the investigative team and refer to the original object of the investigation as defined by in-house counsel or external counsel.
- It is important to keep in mind that simply labeling documents as “privileged and confidential” or as covered by “solicitor-client privilege” has been found to be insufficient to render a contested document privileged.1
- The internal investigation should be conducted on a need-to-know basis to prevent a waiver of privilege and limit any equivocation as to the role of the members of the investigative team and the goal of the investigation.
The present crisis presents many new challenges for companies, in-house counsel, directors and officers, including the why, when and how of conducting internal investigations when faced with extraordinary circumstances that carry legal, regulatory and reputational risks to the company. It is important to carefully assess the situation or conduct that may give rise to an internal investigation and determine if it is, or is not, in the best interest of the company to delay it.
There will be an end to the COVID-19 pandemic. In the meantime, companies need to continue identifying, managing and mitigating legal, regulatory and reputational risks to avoid facing yet another crisis when this one is over.
1 Howard v. London(City), 2015 ONSC 156, at para 67.