By Michael Olver, Pacific Strategies & Assessments
In-house teams should be prepared for an inevitable increase in incidents requiring investigation as whistleblower protections grow.
Over 15 years I have had the privilege of working with some of the best in-house and external teams as they work to mitigate critical risks to their organisations. Among these challenges, the process of investigating and responding to whistleblower allegations of corrupt practices is uniquely dynamic. It is often fast paced and tense, with significant implications for both the company and the individuals allegedly involved. From this experience I have only seen a handful of truly excellent responses, but they each share several core aspects in common — even though the allegations, responses and companies and industries involved may differ significantly.
Leadership
In times of crisis, external law firms and investigations firms can bring decades of expertise to help prepare an opinion, obtain information and arrive at a solution. But an organisation needs strong leadership to be able to ask the right questions and appropriately scope an investigation, direct its consultants and then act decisively and effectively on the basis of the investigation’s conclusions. An experienced in-house counsel who has the support of the CEO and has been empowered to act quickly is best placed to lead investigative efforts and, in turn, to quickly limit vulnerabilities.
On several occasions I have been engaged by parties whose only power lay in infrequent access to a distant C-suite figure who was only marginally present. They had no ability to change consultants or the scope of work of the investigative team, and they could not act on information in anything close to real time. Such limitations would often delay the delivery of findings to key decision-makers, which in turn would limit options. In cases where allegations are proved to be correct, this model of organisation will often heighten rather than reduce vulnerabilities. Most commonly it results in a scenario in which strong indications or even proof of significant corrupt practices might be discovered but are nonetheless “permitted” to continue for months because of an inability to take action. It goes without saying that a regulator’s view of such inaction would hardly be forgiving.
Preparation
Only the exceptional rise to meet a crisis — the rest of us fall to the highest level of preparation. The companies that deal the best with whistleblower events are those that already have whistleblower protocols in place and have procedures for responding to such allegations. A great response team comes to the investigation from the outset with a detailed understanding of its internal reporting and external disclosure requirements for a range of issues. The team members understand when to “wake up the board” and have already planned out whom to engage, how to maintain confidentiality and how to initiate a process that preserves as many options for their firm as possible.
A company where the chief legal officer is learning the company whistleblower handbook (or worse, that of another company) at the launch of a response should likely cancel any big plans for a while and prepare itself for a steep and painful learning curve. It should also expect to rely on a lot of expensive external advice and make some significant mistakes along the way.
The variability in content and jurisdiction make preparation for a whistleblower event difficult. There are many potential complications that can and must be anticipated, discussed and thought through in advance. For example, over the past two years we have had numerous discussions with informed clients on the implications of the notable May 2017 ruling in the matter of SFO v ENRC. This is one of several recent rulings to introduce ambiguity regarding the extent to which privilege can be relied upon in investigative matters. These discussions always indicate to me a well-prepared team seeking to think through the likely practical implications of the potential for a UK judge ruling to suspend privilege. Such conversations may extend to the types and extent of safeguards which would need to be put in place to prevent this from happening during any prospective interviews or investigations into alleged corrupt practices.
As with all preparation, one should plan and develop tactics and strategies to avoid something that may never occur. Such groundwork will be much appreciated if the contingency arises. In the one instance in the past year where this privilege issue was judged to be a potential factor, having a formula for managing a complex but known risk at the outset enabled an investigation to assist a client in identifying a risk, rather than creating one.
Responsibility
The best responders consist of a well-organised team that allocates and reallocates responsibilities on a frequent basis in response to events as an investigation unfolds. But it is also important to clearly delineate responsibilities before an investigation even commences. Depending on the scenario, a response team may consist of two to 100 people conducting interviews, document reviews, e-discovery or engaging in other field-based investigations. At every moment of discovery each member of the response team must understand what the group is trying to accomplish that day and must know who they are responsible for reporting to. Effective teams have clear organisational structures and unambiguous reporting lines that include cascading oversight and, ultimately, access to key stakeholders in the organisation. They have clear policies covering who may instruct or adjust an investigation.
On more occasions that one might expect, I have seen an inexperienced mid-level leader in a client company take a team and its rather costly resources down an expensive and ultimately counterproductive rabbit hole before more experienced hands prevailed. Alternately, but with largely the same outcome, capable investigative teams might sit idle for weeks for lack of clear direction once on the ground. Planning and oversight are essential to an effective response.
Priorities
Allegations of corruption generally present several possible actions, including multiple investigative avenues. Elements of an allegation requiring confirmation or identification can include the claimed payment mechanism, names or descriptions of the alleged parties involved, the description of the arrangement and its alleged frequency, named affiliated companies, shell companies and names of individuals known and unknown to your organisation. Investigators might be able to interview the whistleblower or correspond with them. Or they may have access to a key witness. Once an allegation is made, there is typically a broad array of options, ranging from taking no action, to conducting a google search, to engaging an external firm.
The best teams start from the premise that even though they may be well prepared, the clock is ticking from the moment the complaint is received and they do not have infinite time or resources. They also acknowledge that choosing to initiate an investigation is the first in a chain of key decisions, not the last. The best even acknowledge that they are going to get some of the decisions wrong, but that wrong or right, decisions need to be made to move forward.
Investigative priorities need to be set by leadership but should subsequently be revisited often — even daily — by investigators, responders and researchers to avoid a dissipation of efforts. In almost every investigation of any difficulty, a good investigative leader will work directly with a client to ensure that their focus is only on those lines of inquiry that materially impact the focus of the case. Without actively and consistently refocusing and making decisions on what not to follow up on, an investigation will stall. Investigators often frame it as regularly “thinking strategically rather than tactically” with the guiding question being, “which action today will have a maximal impact on the investigative goal?” No matter how it is framed, a good whistleblower response investigation is an exercise in the active and regular setting and resetting of priorities.
Discretion
The best response teams know to balance the need to be discreet with the need to get things done quickly. The fact that representatives of human resources, audit or IT all had a role in the last investigation does not mean that they must be part of every investigation or indeed that they should be privy to the full facts of an allegation while the matter is still at the stage of a complaint. It is actually preferable for an investigation into any allegation — regardless of its sensitivity — to be limited in the number of people involved. Ideally a team should be composed of the minimum number of people representing the required skillsets or access.
In selecting a team, it is best to review the allegation in detail and break down its component parts to identify the minimum required personnel. For example, if there is an IT component to the case one might ask whether it is necessary to involve the head of IT or instead simply request logs for a particular day without disclosing any details as to why. Sometimes, it is necessary to go to greater lengths to maintain discretion.
To give a (highly anonymised) example, a client received an allegation in which the claim and the persons named were so sensitive that it could not be openly investigated without significant potential impact on continuing business, stock price and, if true, action by the local authorities. A C-level executive was therefore assigned ownership of the matter by the board. He engaged an external law firm, which in turn tasked our investigations firm under privilege. On engagement we first ran a standalone research and investigations team to seek to validate those broad aspects of the claim that were entirely external to the client to confirm the veracity of the allegation. This was done without any one of the external investigators knowing the client’s identity or the total dimensions of the allegation they were investigating.
In parallel, a completely separate team was deployed to the client’s site as “a consultancy seeking to look into breakdowns in processes and policies”. This included an evaluation of the anti-bribery policy and the vendor on-boarding process, which allowed us access without misrepresenting ourselves. Logs were requested from IT and files from HR by the consultants when appropriate and by the appointed manager when this was not. For three months the investigation employed over 20 people. By the end of the case only three people in the client company were aware of the existence of the allegation or of the investigation, and only five people either within out outside the company ever knew the full details of the allegation.
Perspective
The best teams approach every case as if it is likely to be a long-running issue even while team members may move on and off the team. This means they keep accurate case files and records, establish rules governing communications, chains of evidence and storage of material, and maintain multiple electronic and hard copies of relevant material including investigative notes.
It is always better to approach each allegation and subsequent investigation from the beginning with a view to potential litigation or regulatory action rather than to try to prepare for this at the end of the process once all external parties have moved on.
A good team must keep in mind during the investigation and especially during its communication on the process that the matter may be subject to either affirmative or defensive litigation and to plan accordingly. In cases where either is a potential outcome, rules covering what is communicated and to whom should be put in place at the outset and modified as the matter and understanding of the risk develops. A flowing email chain with multiple parties in CC is rarely a good idea for critical communication either from an evidentiary standpoint or in the interests of discretion. Instead, it is advisable to provide limited recipients who must be kept informed with dated memos or briefing notes and reports containing detailed findings and evidence in associated annexes for later use. It may be worthwhile to have a monthly update report provided to maintain detailed records of actions as well as associated findings. These tempo reports then become the basis of all knowledge as personnel cycle through and events move on. They should also be used to create or modify the final evidential pack and overarching report of findings. This becomes more essential the longer an inquiry runs and the more turnover in team members and leadership occurs.
An example of the importance of such practices comes from a colleague at a previous firm who participated in a case that started as a six-week engagement and turned into a multi-year investigation into multiple complex and varying allegations of corrupt behaviour across 54 countries. Some years later the client chose to pursue the counterparties in civil court for damages, which subjected its investigation and documentation methods to scrutiny by the defence. It became clear that because of the duration and the turnover in participants during the investigation, key materials supporting the client’s case had been misplaced and could not be recovered or recreated. In some areas of the case there was uncertainty about what evidence specific conclusions were based on. This severely limited the positive financial outcome of a sophisticated five-year investigation.
Looking forward
In the past decade, whistleblower protection legislation has become an important part of the international good governance agenda. Following commitments made by the G20 in 2010, more than a dozen countries have added or revised whistleblower protection statutes, and dozens more have legislation planned. As whistleblower protection continues to grow as an integral part of the compliance landscape, in-house teams should be prepared for the inevitable increase in incidents requiring investigation.
According to the largest dataset of whistleblower reports available, published by PSA’s partner Navex Global, approximately one-quarter of complaints relate to integrity issues such as corruption and fraud, or misuse of company assets — and nearly half of such complaints are substantiated in some way. It is therefore not a question of if, but only a question of when, the in-house counsel of any company will face the challenge of running an investigation into corruption. With this in mind, I’ve presented these insights in hopes that they can comprise a helpful primer for dealing with the inevitable challenge of managing or controlling an investigative response into corruption allegations. However, at the end of the day there is no substitute to an experienced team operating under an experienced and prepared leader in a time of crisis.
_________________________________
Pacific Strategies & Assessments is a global risk consulting firm offering ethics & compliance, investigative and advisory services.
