Companies all over the globe are increasingly aware of the record number of corporate criminal enforcement actions brought in recent years by enforcement authorities to combat corruption, and many companies now are also well-accustomed to internal investigations. When confronted with an indication that the conduct of the company or one of its employees may have violated criminal laws, in particular the U.S. Foreign Corrupt Practices Act (“FCPA”), companies commonly launch an internal investigation to determine whether any illegal misconduct took place and whether anyone within the company was or is responsible. Although an investigation may be useful to reveal that the company and its employees have no culpability, where the investigation reveals company or employee involvement in legal violations, the facts uncovered can aid the company’s defense strategy and, where appropriate, assist the company in providing meaningful cooperation to law enforcement authorities. Cooperation can result in an agency decision not to charge the company or to seek reduced penalties.

On November 20, 2013, the second day of the 30th Annual Conference on the FCPA, two leading attorneys from the FCPA enforcement units of the U.S. Department of Justice and the U.S. Securities and Exchange Commission (“SEC”) discussed during a panel presentation what they believe to be the elements of effective internal investigations, particularly when the company conducting the investigation plans to use the investigation’s findings to cooperate with authorities. Matthew Queler, Assistant Chief of DOJ’s FCPA Unit, and Tracy Price, Assistant Director of SEC’s FCPA Unit, speaking on the basis of the standard qualification that their comments represent their views and not necessarily those of their employers and that their agencies are not bound by their comments, gave rare insight into what enforcement attorneys look for from cooperating companies. In general, they conveyed their view that a robust internal investigation can enhance a company’s credibility with authorities, and their comments concerned varying stages of the process, spanning from the first “red flag” indicating a potential criminal issue to the process of cooperating with authorities and remediating violations. 

Scoping. From the beginning of an investigation, it is important to understand the scope of the issue and on what topics authorities would like a cooperating company to provide information.  Ms. Price encouraged companies to partner with authorities early on so that authorities can assist in the scoping process where feasible. She suggested that authorities’ participation in scoping may help the company focus the investigation on issues of most interest to authorities. Also, Ms. Price noted that early conversations with authorities on potential roadblocks in an investigation, like foreign blocking statutes and data privacy laws, provide authorities an opportunity to help the company overcome potential issues, where possible.

Documentation. At the outset of an internal investigation, it is important to document not only the facts underlying the potential misconduct at issue, but also the procedure followed by the investigation team, noting particularly when and in what context important facts first arise. Mr. Queler suggested that companies may develop a “procedural chronology” to document the steps followed by the company, so that the company can indicate exactly when the internal investigation team learned a specific fact and, for instance, whose interview or what document revealed that fact.

Building an investigative team. Ms. Price described the potential benefit of including specialized personnel like forensic accountants, technical experts, or others in an investigation team, adding that it can be persuasive when an expert involved in an investigation can answer authorities’ pointed questions about the facts in addition to the company’s counsel. On a related note, Mr. Queler pointed out the pitfalls of failing to “wall off” personnel within the company who may be implicated in the investigation’s factual predicate. For instance, if the internal investigation involves members of the company’s finance department, the members of the department who are implicated should not participate in the process of gathering transaction information for review in the investigation. 

Preservation of documents and other materials. Both officials underscored the importance of early preservation of materials such as emails, text messages, and other documents so that the materials can be available to the investigation team for later collection and review. Ms. Price advised that companies should be prepared to discuss the measures taken to preserve relevant materials in detail, as well as the timing of those measures. This may include efforts to preserve materials on employee-owned devices like iPhones and iPads used for company business under increasingly-popular “bring your own device” policies in place at some companies, as well as communications on social media platforms. 

Mr. Queler stressed the importance of “up the chain” preservation, warning that an investigation that only preserves the materials of lower-level employees may be inadequate. If a company fails to preserve the materials of the employee’s supervisors and management, the company runs the risk of making authorities skeptical about the thoroughness of the company’s investigation.

Sharing facts with authorities. When a company elects to disclose the facts of its investigation to authorities, Mr. Queler and Ms. Price urged that the company should ensure that all the relevant facts are presented, including those that may not show the company in its best light, in order to build trust with authorities.   

Remediation efforts. As a part of an internal investigation, it is important to identify any shortcomings or loopholes in a company’s compliance program or internal controls that allowed misconduct to occur. Ms. Price emphasized the importance of a company taking prompt efforts to remediate any issues with the compliance program or internal controls once those issues are identified. Prompt efforts allow the company to report to authorities not only about the new measures put in place to fix the compliance program or controls, but also on the performance of those new measures and any further remediation by the company.