Regulatory investigations and inquiries: how to handle internal investigations

Posted: 04/05/2018

Unexpected encounters with regulators may be relatively rare, but where breach of regulations is suspected, intervention and investigation by regulators can come as an unpleasant shock as, regardless of sector, they have extensive powers. It is important to recognise that the management of the investigation process is critical and may determine not only whether or not you are prosecuted but also the final outcome.

How should the organisation respond?

There is invariably an obligation to cooperate with regulatory investigations and potentially significant penalties for failing to do so, but cooperation should not involve allowing regulators to ride roughshod over your rights and obligations to third parties.

Events leading to an investigation may take many forms: 

• a single unexpected event, such as an accident;
• a routine financial or procedural audit may reveal a regulatory breach;
• a problem may be reported by a whistleblower or, occasionally the first suggestion of trouble might be a press report; and
• the unexpected arrival of a regulator on the doorstep. Investigators may arrive unannounced.

However it starts, you are unlikely to get very much warning before you have to make critical decisions. 

Your first priority will be to find out what has happened for yourself, whatever investigations are being carried out by the regulator.

Who should carry out the internal investigation?

An internal investigation must be carried out by someone who has sufficient seniority to compel cooperation, but who is likely to be trusted by staff.  Above all, it must be someone who is not involved in the events which triggered the enquiry, or will be likely to be involved as a witness in any subsequent prosecution or civil trial.

In-house lawyers often take on this work, only to run into difficulties because the legal issues arising are outside their ordinary experience.  It is often sensible to involve lawyers with specialist experience at the earliest stage. 

You need to be sure that you have advice about the regulatory process itself and your rights and obligations within it so you can protect your position where regulators overstep the mark, whilst always remaining compliant and cooperative.  

There are certain specific legal risks of which you need to be aware:

• Interviewing witnesses
  You may need to interview members of staff.  Particular care needs to be taken to preserve their rights, particularly if they are personally at risk of disciplinary action. Regulators are free to interview staff.  You cannot influence what they say to regulatory authorities, nor can you sit in on their interviews. You can carry out your own interviews but notes of interviews taken internally are not privileged from production, and if questioning is too discursive, the notes may prove to be unnecessarily embarrassing. Care must be taken when interviewing witnesses so as not to lead them and not to ask unnecessary 'sweep up' questions. It is important not to allow witnesses to taint each other’s evidence by group discussions or interviews, or talking to a witness about the evidence of another witness. Above all, make sure the investigation is directed only at the problem in hand. Consider before interviewing whether this is better done by your lawyers in order to protect privilege (see below).

• Documents
  Care must be taken in creating internal materials which may ultimately have to be turned over to a prospective prosecutor. Note that documents created by staff in the course of carrying out an investigation include reports, board minutes, and correspondence with third parties as well as interview notes.
  
  
• Legal advice privilege
  Legal advice privilege exists to protect the confidentiality of the lawyer/client relationship and all communications created for the purpose of giving legal advice do not have to be produced to the regulator in normal circumstances. 

In-house lawyers acting purely in their legal capacity may be able to rely on this privilege, but not when they are fulfilling an executive role, and at the margins this may be difficult to define. Regulators are keen to challenge what they see as abuse of this privilege and so care is needed. This problem is overcome by instructing outside lawyers with relevant expertise to interview witnesses and prepare any advisory documents. The earlier this is done, the more effective lawyers can be. 

Communications about the investigation, advice, opinions, etc, are privileged as between lawyer and client but not, for example, when circulated internally attached to board minutes, or briefing papers. It is essential to restrict circulation to a limited and defined group. Giving management of the internal investigation to outside lawyers can assist with the problem of privilege and saves management time because in general the demarcation lines are clearer. This does not always work in cross-border investigations, however, where the law of another jurisdiction about disclosure may be different, and therefore may not attract privilege.

Although you should consider this strategy carefully, it can be a good idea to reveal the conclusions of your internal investigation to the regulator. Internal investigations are often completed sooner than the investigations completed by outside regulators, and, if you have done a sufficiently good job, the outside investigation team may be prepared to adopt and accept most of your conclusions. In the context of such an investigation it is important not only to establish what has happened, but to review systems to establish whether there are improvements which could be made and if so, these should be described to the regulator and put in place. Plans for follow up should also be made; re-training of staff, where necessary, also shows an intention to ensure that no further breach will be committed and this may help to persuade regulators not to prosecute.

Decisions about prosecution are based not only on whether evidence of breach is available but also whether it is in the public interest to prosecute. There will be certain types of cases where a prosecution will automatically follow if the evidence is sufficient.  These would involve, for example, serious injuries to people or the most serious type of ’near misses’ where systems were clearly inadequate. If however an incident is not so serious and has been isolated and remedial measures put in place, regulators may be happy not to prosecute or offer a lower penalty. 

Regulators’ investigations may spread quite widely through the organisation, across a number of its activities.  The more positive your attitude and the more you engage with the process, the less likely it is that the organisation will be found to have developed a non-compliant culture. 

Note however that regulators do not always get it right, and sometimes overstep the mark. When this happens you are entitled to object without being deemed ’uncooperative’.

Examples can include unnecessary aggression and bullying, unnecessary seizure of documents or other items, unreasonable arrangements for conducting interviews relating, for example, to time or circumstances, and allowing you insufficient time to provide information. These are circumstances where legal advice is essential and lawyers can make a real difference to regulators’ conduct in finding practical acceptable solutions. 

Return to news headlines