Guidelines for handling regulatory investigations and inquiries

Posted: 22/06/2015


Encounters with regulators may be relatively rare but they can come as an unpleasant shock. Regulators have extensive powers of intervention and investigation where breach of regulations is suspected, regardless of sector. 

It is important to recognise that the management of the investigation process is critical and may determine not only whether or not you are prosecuted but also the final outcome. 

How should your organisation respond to an investigation?

Although there is invariably an obligation to co-operate with regulatory investigations - and potentially significant penalties for failing to do so - your co-operation should not involve allowing regulators to ride roughshod over your rights and your obligations to third parties. 

Events leading to an investigation may take many forms: 

  • There may be a single unexpected event, such as an accident
  • A routine financial or procedural audit may reveal a regulatory breach
  • A problem may be reported by a whistle-blower or, occasionally, the first suggestion of trouble might be a press report
  • The unannounced arrival of a regulator/investigator on the doorstep. 

However it starts, you are unlikely to get very much warning before you have to make critical decisions. 

Who should carry out the internal investigation?

Your first priority will be to find out what has happened for yourself, regardless of any investigations being carried out by the regulator.

An internal investigation must be carried out by someone who has sufficient seniority to compel co-operation but who is likely to be trusted by staff. Above all, it must be someone who is neither involved in the events which triggered the enquiry nor likely to be involved as a witness in any subsequent prosecution or civil trial. 

In-house lawyers often take on this work, only to run into difficulties because the legal issues arising on a regulatory investigation are specialised and outside their ordinary experience. It is often sensible to involve lawyers with specialist experience at the earliest stage. 

You need to be sure that you have advice about the regulatory process itself and your rights and obligations within it so you can protect your position where regulators overstep the mark, while always remaining compliant and co-operative. 

Three key legal risks

There are three specific legal risks of which you need to be aware: 

  • Interviewing witnesses 

You may need to interview members of staff. Particular care needs to be taken to preserve their rights, particularly if they are personally at risk of disciplinary action. Regulators are free to interview staff. You cannot influence what they say to regulatory authorities, nor can you sit in on their interviews. You can carry out your own interviews but notes of interviews taken internally are not privileged from production and, if questioning is too discursive, the notes may prove to be unnecessarily embarrassing. 

Care must be taken when interviewing witnesses so as not to lead them and not to ask unnecessary “sweep up” questions. It is important not to allow witnesses to taint each other’s evidence by group discussions or interviews, or to talk to a witness about the evidence of another witness. Above all, make sure that the investigation is directed only at the problem in hand. Consider before interviewing whether this is better done by your lawyers in order to protect privilege (see below). 

  • Documents

Care must be taken in creating internal materials which may ultimately have to be turned over to a prospective prosecutor. These could include documents such as reports, board minutes, correspondence with third parties and interview notes created by staff in the course of carrying out an investigation.

  • Legal advice privilege

Legal advice privilege exists to protect the confidentiality of the lawyer/client relationship. All communications created for the purpose of giving legal advice do not have to be given to the regulator in normal circumstances. 

In-house lawyers acting purely in their legal capacity may be able to rely on this privilege but not when they are fulfilling an executive role. At the margins this may be difficult to define. Regulators are keen to challenge what they see as abuse of this privilege and so care is needed. This problem is overcome by instructing external lawyers with relevant expertise to interview witnesses and prepare any advisory documents. The earlier this is done, the more effective the lawyers can be. 

Communications about the investigation, advice, opinions, etc, are privileged as between lawyer and client but not, for example, when circulated internally attached to board minutes or briefing papers. It is essential to restrict circulation to a limited and defined group. 

Giving management of the internal investigation to external lawyers can assist with the problem of privilege and saves management time because, in general, the demarcation lines are clearer. But this does not always work in cross-border investigations where the law of another jurisdiction about disclosure may be different and, therefore, may not attract privilege. 

Revealing your internal findings to the regulator

Although you should consider this strategy carefully, it can be a good idea to reveal the conclusions of your internal investigation to the regulator. Internal investigations are often completed sooner than the investigations completed by outside regulators and, if you have done a sufficiently good job, the outside investigation team may be prepared to adopt and accept most of your conclusions.  

In the context of such an investigation, it is important not only to establish what has happened but also to review systems to establish whether there are improvements which could be made and, if so, these should be described to the regulator and put in place. Follow-up plans should also be made and re-training of staff, where necessary, also shows an intention to ensure that no further breach will be committed. This approach may help to persuade regulators not to prosecute. 

When do regulators prosecute?

Decisions about prosecution are based not only on whether evidence of breach is available but also whether it is in the public interest to prosecute. There will be certain types of cases where a prosecution will automatically follow if the evidence is sufficient. These would involve, for example, serious injuries to people or the most serious type of “near misses” where systems were clearly inadequate. If, however, an incident is not so serious, has been isolated and remedial measures put in place, regulators may be happy not to prosecute or to offer a lower penalty. 

Regulators’ investigations may spread quite widely through the organisation across a number of its activities. The more positive your attitude and the more you engage with the process, the less likely it is that the organisation will be found to have developed a non-compliant culture. 

Your right to object

Note, however, that regulations do not always get it right and sometimes overstep the mark. When this happens, you are entitled to object without being deemed “unco-operative”. 

Examples can include unnecessary aggression and bullying; unnecessary seizure of documents or other items; unreasonable arrangements for conducting interviews relating, for example, to time or circumstances; and allowing you insufficient time to provide information. These are circumstances where legal advice is essential and your lawyers can make a real difference to regulators’ conduct in finding practical acceptable solutions.


Return to news headlines

Penningtons Manches Cooper LLP

Penningtons Manches Cooper LLP is a limited liability partnership registered in England and Wales with registered number OC311575 and is authorised and regulated by the Solicitors Regulation Authority.

Penningtons Manches Cooper LLP