Skip to main content

Starting Off an Internal Investigation Right

By Casey C. Sullivan, Esq. on March 15, 2017 | Last updated on March 21, 2019

Missteps at the early stages of an internal investigation can snowball later on, frustrating your ability to respond to a crisis, whether it's a data breach, employee scandal, or potential violation of the law. Failure to react to allegations of employee misconduct could damage the reputation of the company, for example, while a slow start to an investigation could mean lost evidence. Regulatory obligations could be missed, confidential information made public or destroyed.

When you start off an internal investigation, it's essential that you start it off right.

First Steps: Risky Employees, Regulators

Even as internal investigations are becoming more important and common, there remains little "practical guidance on how to run an investigation in-house," according Charles Hastie, regulatory head at the Clutch Group. Thankfully, Hastie has some tips for those of you handling internal investigations.

When handling a 'live concern,' the first priority, Hastie explains, writing in Corporate Counsel, is to identify whether "any employees present a significant and current risk to the business, its customers, or perhaps even the markets." You should also consider if any employees could destroy evidence, influence others, or frustrate your efforts. In such cases, those employees may need to be suspended as a protective measure.

Your regulatory responsibilities also need to be quickly taken in to account. Is there an obligation to report a matter to regulators? If so, "a failure to do so will be grounds for enforcement action in and of itself," Hastie writes.

Protecting Confidential Information

Once those matters have been examined, an investigation should turn to controlling confidential information. Here's why:

First, investigations are likely to generate highly sensitive material relating to concerned individuals. In most jurisdictions there is an overriding responsibility to ensure that such material is protected from access by those who have no legitimate interest in it.

Additionally, external leaks of information relating to the investigation can also be extremely harmful. They are likely to generate unwelcome speculation in the press and deep concern amongst key external stakeholders such as shareholders and regulators.

You'll want to identify stakeholders, create a confidentiality list, and define who has access to what information. Make sure any with access understand their responsibilities.

At the same time, you'll want to make sure you're not inhibiting anyone's ability to report a matter to regulators, as such restrictions may be a violation of federal law.

From there, your investigation can continue apace, establishing document holds where necessary, looking in to your insurance coverage, dealing with regulators, and the like. Having started with a good foundation, the investigation ahead should be much smoother.

Hiring? Post the job for free on Indeed, or search local candidate resumes.

Related Resources:

FindLaw has an affiliate relationship with Indeed, earning a small amount of money each time someone uses Indeed's services via FindLaw. FindLaw receives no compensation in exchange for editorial coverage.

Copied to clipboard