COVID-19 New Realities: Considerations for Conducting an Internal Investigation During the Coronavirus Outbreak

Key Takeaways

• Companies must rely on their compliance functions to remain robust and vigilant even during these enormously trying times. To be sure, rightsizing in the face of COVID-19’s financial, workforce and logistical impacts can be expected—indeed, are almost certainly necessary.
  
  
• But complacency poses its own risks, which may create greater challenges when normal (or near normal) operations resume.
  
  
• As a result, companies that are confronted with evidence of potential wrongdoing, either a policy violation or a legal or regulatory violation, should resist the temptation not to act now, but instead should continue to adhere to best practices, even if that means making needed adjustments to normal protocols.
  
  

Pandemic. Domestic travel restrictions. Shelter in place. Work from home. Social distancing. Twenty-second handwashing. “Essential” vs. “non-essential” businesses. In just a few “long” weeks, these phrases have gone from the obscure (indeed, in some ways, inconceivable) to the ubiquitous, all with the underlying purpose of preventing the spread of the virus and protecting the global health and economic community. And, in the process, newfound verbs like, “let’s Zoom,” have become part of our everyday business vernacular in the same way that “Google it,” entered our diction a generation earlier, and “411 it,” a generation before that. But, as we all know, the impact of the novel coronavirus is far from just pop cultural—it stretches into board rooms, C-suites, Main Street, the Oval Office, and the halls of Congress.

More than ever, companies are learning fast how to cope with the wide-ranging effects (and collateral consequences) of COVID-19, including how to conduct business in these unprecedented times. And, naturally, the office of the general counsel is not immune from this struggle. This note seeks to provide guidance on one overarching question for the white collar/internal investigations community: How best should (and can) companies respond to allegations of wrongdoing over the coming weeks and months while the pandemic runs its course. Critically, our guidance is not focused on allegations of coronavirus-related wrongdoing; instead, it is geared to how to best conduct an investigation (irrespective of the subject matter) in a pandemic response environment.

I. Conducting an Internal Investigation During The Pandemic

If one thing is for sure, when a crisis hits, especially one of the order of magnitude of the global coronavirus, best practices, investigative protocols, and recommended steps for conducting an internal investigation need to be reassessed. This is especially needed to make sure that the investigative functions are taken seriously and to accommodate changes in a company’s operations, including, for example, something as obvious as a company’s operations being transitioned to a remote environment.

A. Deciding Whether to Conduct an Internal Investigation

In times of tremendous stress and financial turmoil, sometimes criminal wrongdoing and other malfeasance surfaces. Bernie Madoff and his massive Ponzi scheme fully came to light when investors sought to redeem their investments in the immediate wake of the 2008 financial crisis, only to learn that their money was not there. Risky (or even criminal) lending and borrowing practices came to light during the Great Recession when mortgages and other loan recipients entered into default. When the Troubled Asset Relief Program (“TARP”) became law to bailout banks at the height of the financial crisis, the law included the creation of a TARP inspector general to help protect against fraud and abuse—and, to make referrals when they occurred. And, when Hurricane Katrina struck the southeastern United States in August 2005, fraud and malfeasance followed suit, so much so that the Justice Department established a Task Force to investigate and prosecute hurricane-related wrongdoing. Thus, with Congress passing, and the President signing, the largest stimulus package in American history (valued in the trillions of dollars) to combat the effects of the coronavirus, it certainly would not be surprising to see fraud and abuse by corporations and their executives. Indeed, if past experience is any guide to the future, the coronavirus might well bring to light unethical, improper, or even criminal conduct, even if that conduct has nothing to do with the virus, itself. History teaches that extreme pressures sometimes causes people (and companies) to do things that they otherwise might not do. 

Therefore, during tough times, the need for investigations might actually intensify—not subside. The threshold question, thus becomes, when confronted with wrongdoing in this environment, should a company conduct an internal investigation, put off the investigation, or simply look the other way. The answer should be informed by the best investigative protocols, which in part lay out factors such as the nature and the seriousness of the allegation. The more serious the alleged wrongdoing (especially if it implicates top management or presents significant financial or reputational risks), the more likely that some kind of response is needed now, even if only to preserve evidence for a closer review when a greater level of normalcy returns.

Generally speaking, there are numerous benefits for a company to conduct an internal investigation that is protected by the attorney-client privilege (whether by in-house counsel, outside counsel or compliance personnel under the direction of counsel). That does not change in times of crisis, although it might need to be modified. To be sure, some investigative work might need to be put on hold (and put in the queue), and yet others will still need to move forward, although perhaps on a truncated basis. For example, there is little reason why issuing document holds, preserving evidence, collecting electronic documents remotely, conducting telephonic scoping interviews and other similar steps should not still be undertaken during a crisis such as this. Aside from terminating the offensive conduct, even such modest steps sound a loud message to the troops that the compliance function moves forward even in the face of strong headwinds. Of course, investigative work that is put in the queue should be tracked and monitored so work can eventually continue in due course.

B. Deciding Who Should Conduct the Investigation

The next critical decision for a company is deciding who should conduct the investigation (whether it be in-house counsel, outside counsel, or compliance personnel). As was true before the pandemic, the nature of the alleged offensive conduct will largely dictate how to answer that question. No matter who conducts the investigation there must be coordination and buy-in between the relevant stakeholders. Although this has never been an easy question to answer (balancing cost, privilege, independence, speed, investigative credibility, and the like), there are certain new considerations to take in account when making this decision in light of the pandemic.

In this shelter-in-place model, companies now must conduct investigations remotely. This will require careful planning from the outset, which in turn affects the decision of who should conduct the investigation. In terms of things that do not change, there are many benefits to counsel (either in-house or outside) leading the investigation. Most importantly, when in-house or outside counsel leads or directs the investigation it will be protected by the attorney-client privilege and the attorney work product doctrine.

The benefits of using outside counsel under these circumstances, though perhaps at an added cost, can be (but not always are) especially beneficial. First, outside counsel are often viewed as more objective, independent, and frequently offer extensive experience in leading investigations.

Furthermore, larger firms typically have the technology to operate as a cohesive team despite not sitting in the same office (or no office at all), and are likely more capable of and accustomed to conducting remote investigations. In times of crisis, management often needs the company’s in-house team to take an “all purpose,” “all hands on deck” approach to triaging problems and supporting top management in the various unforeseen ways. Having a general counsel, deputy general counsel, associate general counsel, or other in-house counsel leading or overseeing an investigation—much less one of a large scale—can be overwhelming, if not impractical, at a time when the C-suite is commanding (indeed, demanding) the general counsel office’s undivided attention to triage crisis responses. For example, in house counsel might need to focus on the legal implications of an acute shift in operations, such as the implementation of, and fallout from, a presidential (or governor’s) executive order or the Defense Production Act. They may also be called upon to help secure emergency financing and conduct the due diligence that comes with it. In any event, in-house counsels’ time and attention might be at an usually high premium, one that justifies outsourcing certain investigative work to outside counsel.

C. Creating an Investigative Work Plan

Once a decision is made as to who will conduct an investigation, the next step is to create an investigative work plan. As the name suggests, a work plan is meant to provide direction to ensure all parties that are involved in the investigation are working in unison. The work plan should be sufficiently detailed and broken down into phases, but at the same time have room for readjustment as facts are uncovered during the investigation—and logistical and other limitations are effectively addressed. Not surprisingly, some new considerations need to be given to the availability and utilization of online resources like Zoom, Microsoft Teams, Cisco WebEx, and Facetime, all of which provide additional options for at least parts of an investigation to move forward remotely.

As always, the work plan should include a list of key custodians whose documents will be collected and reviewed as well as witnesses to interview, as discussed further below. 

1. Document Review

As under normal circumstances, when companies become aware of potential wrongdoing it is critical to implement a document freeze to preserve any documents that are potentially relevant to the investigation. Companies must conduct a search for relevant documents, and that search process should be documented. This process might be slightly different in light of the pandemic. For example, the process of identifying prospective custodians and relevant documents is typically done by interviewing a wide range of personnel. As set forth below, this can proceed as usual, albeit remotely by telephone or via a web-based vehicle.

Although the majority of documents and emails are stored electronically, there are some companies that still maintain hard copies of certain documents (particularly if the alleged wrongdoing dates back numerous years). If it is impossible to gather the hard copy documents because of the inaccessibility of certain facilities by government order or quarantines then the actual collection of those documents should, of course, be placed on hold until the documents can be collected and reviewed. This fact, however, should be documented and noted in the document freeze, litigation hold, or some other documentation. Nonetheless, document reviews can still proceed on review platforms, like Relativity, which can be accessed from anywhere, including from a reviewer’s dining room table. But, working remotely requires greater organization, clarity, and instruction: The document review memo becomes more important than ever, as does clear issue tags.

2. Witness Interviews

In addition to reviewing and synthesizing documents and financial and other information, one of the other most fundamental ways to learn the facts in an investigation is to conduct witness interviews. The format in which interviews are conducted likely will be significantly different in light of the pandemic. The individuals who are conducting the investigation will need to plan their interview schedule more carefully than ever. In an ideal world, the investigative team would identify key documents to ask a witness, draft an interview outline, and schedule an in-person interview for critical witnesses. In light of the current state of affairs that approach cannot, realistically, be fully implemented.

Given the obvious challenges, companies will have to determine whether to move forward and conduct at least certain interviews remotely. For fact witnesses that are not alleged to have participated in the wrongdoing, it will likely be full speed ahead as interviews can be conducted over the phone or by videoconference. Indeed, by sharing screens, an interviewer can show documents to a witness while maintaining custody and control of the documents. But in other circumstances, especially when the documents in question are not sensitive, it might even be acceptable to email documents to a witness, who is not central to the misconduct or not expected to have engaged in any wrongdoing and so long as it permitted under applicable data privacy and export control laws.

But when things go remote, there are some additional considerations (and pitfalls) to keep in mind while conducting an interview by phone or videoconference. For example, interviews should not be recorded as such recording may become discoverable in future litigation (and if the recording is undisclosed, would be a crime in states that require two-party consent). As a result, investigators should ensure controls are in place to limit the risk of a party unilaterally recording an interview. Furthermore, interviewers need to remain cognizant of protecting the privilege while conducting remote interviews. The privilege may be destroyed if third parties, such as spouses, children, or roommates, are in the same room or nearby and can overhear the interview. At the outset of the interview, interviewers should confirm that all participants are in a location that is private and require a verbal affirmation that there will be no recordings of the interview.

For individuals alleged to have participated in the wrongdoing, it is likely more of a game-time decision whether the interview should be put on hold or should move forward remotely—or even under extreme circumstances, in-person while maintaining social distancing. Factors such as the availability of the witness, including whether s/he is going to be furloughed or RIF’d, or otherwise made unavailable, will need to enter the calculus. In turn, whether the person to be interviewed is a current employee—or has been rendered a former employee—impacts whether the corporate attorney-client privilege attaches to that interview. And, the current-versus-former-employee distinction also impacts whether a company has access to—and can require the cooperation of—an employee. A former employee is much more likely to decline to speak to a company, especially if s/he has legal, much less criminal, exposure and if s/he was just let go.

In addition, although there may be a desire to gain access to information and lock in a witness’s statement, human suffering, stresses, and anxieties need also to be taken into account. Many people and their families are suffering or are operating under great stress. Working from home with young kids in the background (especially in a small space), can be highly distracting, if not tremendously stressful. Working while a loved one is self-quarantined in the room next door not knowing whether they are infected (or unable to get access to the necessary tests) can be crushing and demoralizing. So, in tough times, companies and their agents (whether in-house or outside counsel) need to be mindful of the human condition. Whatever decisions that are made however, ought to be documented so that answers to questions that may arise later are quickly available and transparent, especially if those questions come from regulators, prosecutors, or other government actors.

D. Data Privacy Considerations

Multinational companies that are confronted with allegations of wrongdoing that span the globe will face additional challenges. Companies must comply with governmental requirements that are changing on a regular basis, and may vary drastically between countries and even on a more local basis depending on the state or province. Privacy laws and the treatment of employees’ data is an area that regulators might be focused on, particularly after this pandemic. Regulators are issuing statements and guidance on complying with regulations, such as the Global Data Protection Regulation, in the context of COVID-19.¹ For example, The UK Information Commissioner’s Office’s (the “ICO”) COVID-19 guidance calls on companies to “consider the same kinds of security measures for homeworking that you’d use in normal circumstances.”² In the same way, the ICO’s guidance states that it will not bring a regulatory action against a company if their data protection practices might not meet the usual standard given that individuals might be diverted away from typical compliance work. Overall, companies will need to keep abreast of the ever changing guidance and work to the best of their ability to comply with the various privacy laws in this difficult time.

II. Conclusion

The COVID-19 pandemic has drastically changed the way in which companies are operating, all with the common goal of slowing and preventing the spread of the virus. Tough times often bring out the best, but sometimes the worst, in people. Thus, fraud, corruption, and chicanery may not subside in times of crisis, but may actually be exacerbated as companies and their employees seek to cut losses and “survive.” Under these trying circumstances, investigations should not be gone with the wind, but they may need to be adjusted and even reduced. When wrongdoing is alleged, whether through a hotline complaint, a vendor, a margin call, or some other mechanism, rightsized responses might be (in fact, may have to be) the appropriate solution. In short, if history is any guide, companies should not turn a blind eye if and when they become aware of wrongdoing. Instead, we can all learn from General Douglas MacArthur’s famous farewell speech to the cadets of West Point in 1962: We should be ready to “stand up in the storm” and “face the stress and spur of difficulty and challenge” head on.

Footnotes

1) The European Data Protection Board issued guidance that confirmed that the Global Data Protection Regulation should not impede the fight against the pandemic, but added that “even in these exceptional times . . . the data controller and processor must ensure the protection of the personal data. . . .” The European Data Protection Board, Statement on the processing of personal data in the context of the COVID-19 outbreak (March 19, 2020), available here.

2) The UK Information Commissioner’s Office, Data protection and coronavirus: what you need to know.