MAY 22, 2019
Consistency is Key to Conducting Internal Investigations
One of the main functions of a compliance department is to conduct investigations of complaints and issues that can cause an organization financial and reputational harm.
Regulators want to see a program that is fully operationalized, and not just something that exists on paper, according to recent guidance from the U.S. Department of Justice regarding the evaluation of an ethics and compliance program.
That means having an investigations protocol that clearly identifies the procedures that need to be followed, and enforces those consistently throughout the organization.
But overseeing a robust but procedurally sound compliance investigation means more than interviewing witnesses, said attorneys and compliance experts Tom Fox and Mike Volkov last week during a webinar hosted by Hanzo, which helps companies with their document management.
The first step, Fox said, is to determine the nature and scope of the investigation, and whether it can be handled in-house by the compliance team or counsel, or whether an independent investigator is required.
When doing this, it’s important to move beyond the impact a legal violation could have, and consider other consequences, as reputational damage can be just as, if not more, devastating to a company’s business and stock price, said Fox.
“To try to prevent this going forward is a critical part of your investigation,” he said.
Volkov cited a recent study that found more chief executives were removed in 2018 for ethical and business judgment reasons, as opposed to simple financial reasons, due in part to a significant increase in litigation related to sexual misconduct.
“This speaks to how seriously boards see the reputational risk of having a CEO that has to be thoroughly investigated,” he said.
As part of its guidance, Volkov said the DOJ wants to see improvement in how issues are handled and assessed when they are first found out.
Another issue the department emphasized is compliance needs access to all information, and organizations no longer can silo certain aspects of the business, such as keeping HR issues away compliance.
“You can’t silo out HR issues and say compliance isn’t going to look at those,” said Volkov. “Usually, compliance should get notification of every concern that comes in so they have visibility as to what is going on with the company’s culture and what needs to be investigated.”
Focus on Data
Once the scope of an investigation is identified, Fox said the next step is to collect information and get it to the appropriate level of decision-making. This matters because companies that self-report potential problems get more credit from DOJ and other regulators than those that don’t--and that is dependent on funneling information to the right place.
Consistent handling of data is not just important to the integrity of an investigation--and any legal challenges that may arise--it’s also vital to show employees and other stakeholders that investigations are conducted in a consistent manner. This is a way to engender trust and show the company is living its values, the two men said.
One way to ensure consistency in discipline that is meted out--and making sure higher-ups don’t get an easier slap on the wrist than someone else who commits the same violation--is by having an independent supervisory committee of key stakeholders to review and decide final actions, said Volkov.
Another way to ensure consistency is to have a set of written standard operating procedures for how to conduct an investigation, and to have it in place before an investigation starts, said Fox.
It’s difficult to think through properly everything that has to be done, if those decisions are being made in the midst of a crisis. “It also means everyone is on the same page, whether they are [working] in China, the U.S. or South America,” said Fox.
Protocols should cover how information is collected, stored, and protected; how witnesses will be handled; how those involved will be kept abreast of developments; and how and who will administer justice.
“Every time I have done an internal investigations audit for a company, the thing I uniformly find is how inconsistent the procedures are, the way people document things,” said Volkov. “The more you have procedures, the more you hold yourself accountable.”
Documents don’t lie, and are a powerful investigative tool for how to handle witnesses and to establish a timeline of events, said Fox.
“Having documents under control, and receiving all documents before I begin face-to-face interviews, is a critical part of my investigative protocol,” he said.