1. The Decision to Conduct an Internal Investigation
1.1 What statutory or regulatory obligations should an entity consider when deciding whether to conduct an internal investigation in your jurisdiction? Are there any consequences for failing to comply with these obligations or with regulatory expectations? Are there any regulatory or legal benefits for conducting an investigation?
Although there are no explicit statutory or regulatory obligations pertaining to internal investigations in England and Wales, it is often in an entity's best interests to conduct an internal investigation when wrongdoing is suspected, whether this be criminal or regulatory. This will enable an entity to identify at an early stage evidence that might demonstrate if any criminal offences or regulatory breaches have been committed, and to make informed decisions.
An obvious benefit of an internal investigation is that it allows the entity to satisfy itself that it has isolated and dealt with the wrongdoing. Additionally, conducting an internal investigation may help an entity decide whether or not to approach a relevant authority with a view to securing a more favourable outcome than would likely be the case if it were the authorities in the first instance (including by means of a "dawn raid") that had approached the entity.
1.2 How should an entity assess the credibility of a whistleblower's complaint and determine whether an internal investigation is necessary? Are there any legal implications for dealing with whistleblowers?
Consideration should be given to whether there is likely to be any other evidence capable of supporting the whistleblower's assertions, such as documentary evidence and the extent to which the whistleblower can personally verify the allegations made. An entity should also consider the context and circumstances in which the whistleblower makes their disclosure. For example, even if they are a disgruntled employee, is the disclosure capable of belief? How much time has passed since the events occurred and what is the explanation for any delay? Is the whistleblower raising the matter for their own personal gain or motive?
A statutory framework exists to protect workers if they blow the whistle on their employer: a whistleblower who makes a qualifying disclosure has the right not to be subjected to any detriment by any act or deliberate failure to act by their employer on the ground that the worker has made a protected disclosure.
1.3 How does outside counsel determine who "the client" is for the purposes of conducting an internal investigation and reporting findings (e.g. the Legal Department, the Chief Compliance Officer, the Board of Directors, the Audit Committee, a special committee, etc.)? What steps must outside counsel take to ensure that the reporting relationship is free of any internal conflicts? When is it appropriate to exclude an in-house attorney, senior executive, or major shareholder who might have an interest in influencing the direction of the investigation?
"The client" will often be determined by who has retained the services of outside lawyers and who has control of the internal investigation. They should be suitably qualified and hold sufficient seniority within the entity to be in a position to provide instruction and direction, and to make critical tactical decisions about the course and scope of the investigation and any reporting that may occur. The wider the reporting relationship is, the more difficult it is likely to be for the corporate to assert and maintain privilege, and also to preserve confidentiality. Entities are best advised to set up an investigation team comprising a limited number of individuals. For more complex investigations, it may be advisable to set up a management or steering committee, as these create very clear reporting lines.
External counsel should make enquiries of the client to satisfy itself that those to whom they are to report are not conflicted – this can be done through, for instance, considering the nature of the allegations to be investigated and who is likely to hold relevant information, and asking those who have conceivably been involved in the matter under investigation to declare any interests. These steps are intended to have the effect of maintaining the credibility of any investigation results with the regulator.
2. Self-Disclosure to Enforcement Authorities
2.1 When considering whether to impose civil or criminal penalties, do law enforcement authorities in your jurisdiction consider an entity's willingness to voluntarily disclose the results of a properly conducted internal investigation? What factors do they consider?
Voluntary disclosure of the results of an internal investigation is an important factor considered by authorities in determining whether a prosecution is in the public interest, or whether a Deferred Prosecution Agreement (DPA) or civil settlement (or other alternative to prosecution) is appropriate. However, it provides no guarantee that a prosecution will not follow. Instead, it will form part of a case-by-case analysis looking at a range of factors, including the seriousness of the offence, the harm to victims and any history of similar misconduct by the entity.
It has been clear since the Rolls-Royce case, and guidance confirms, that failure to self-report is not necessarily a barrier to DPA negotiations. There must, however, be strong counterbalancing factors, notably complete cooperation and disclosure of materials, which will likely result in the waiving of legal professional privilege. If this is a strategy an entity wants to pursue, wrongdoing should be reported to enforcement authorities within a reasonable time of the offending coming to light.
2.2 At what point during an internal investigation should a disclosure be made to enforcement authorities? What are the steps that should be followed for making a disclosure?
There are a number of scenarios when entities must notify regulators of incidents/misconduct. For example, the General Data Protection Regulation (GDPR) requires that breaches of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data must be reported to the Information Commissioner's Office (ICO), without undue delay, but ultimately no later than 72 hours after the controller of the data becomes aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of the individuals concerned. The Financial Conduct Authority (FCA) requires its regulated firms to notify them immediately if they become aware of matters that would have a serious regulatory impact. Obligations to report suspicions of money laundering, or in connection with financial sanctions, can arise for regulated firms (and sometimes more broadly).
More generally, regulated firms must be open and cooperative, and, for example, notify the regulator of anything about which it would reasonably expect notice. The Health and Safety Executive (HSE) must be notified of reportable safety incidents under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR) requirements, and entities can be required to notify the Environment Agency (EA) of pollution incidents, etc.
Generally, details of any wrongdoing discovered during an internal investigation do not automatically need to be disclosed to enforcement authorities. Prior to any self-report, an entity should carefully consider the desirability and potential consequences (e.g. civil and criminal sanctions). Voluntary disclosure before enforcement authorities are involved may be desirable if the entity is considering cooperating with the authorities in an attempt to achieve a more favourable outcome. The DPA Code of Practice provides that companies wishing to be considered for a DPA (which are potentially available for specified economic crimes) should self-report suspected wrongdoing "within a reasonable time of the offending coming to light". It further specifies that the prosecutor will consider whether any actions taken by not reporting earlier may have prejudiced the investigation, including whether the manner of an internal investigation could have led to material being destroyed or impeding the gathering of first accounts. Relatedly, the Serious Fraud Office (SFO) has stated that companies should consider confining their internal investigation to document reviews and not interviewing employees in order to avoid "trampling on the crime scene" and risks in relation to the destruction of evidence.
When a self-report is being considered, it is, however, important to ensure that a sufficiently detailed investigation has been undertaken before disclosure of the facts. It is an unattractive proposition to provide details of an internal investigation in haste and without a proper understanding of the conduct, not least because the nature of the wrongdoing (or whether there has been wrongdoing) may not be apparent at the early stages of an investigation.
2.3 How, and in what format, should the findings of an internal investigation be reported? Must the findings of an internal investigation be reported in writing? What risks, if any, arise from providing reports in writing?
There is no requirement to provide voluntary disclosure of investigation findings in a specific format, such as in writing, rather than an oral briefing. It is a matter for the entity to decide on the extent and format of any disclosure made. A written report will undoubtedly be viewed more favourably in the context of any enforcement action, given that it demonstrates cooperation and is likely to contain a more complete examination of the relevant issues and underlying facts with evidential value.
However, there are risks associated with written reports. A report may contain findings or information that are damaging at a stage where the full picture is not known. Conversely, a report with too many caveats may be regarded as lacking. By disclosing a written report to law enforcement authorities, an entity runs the risk that the information contained in it will be used to open an investigation into the company. Moreover, a written report may be open to misinterpretation or misuse, which is possibly avoided (or the risks reduced) if the results of an internal investigation are presented orally instead.
Ultimately, however, any investigating authorities to whom matters are to be reported will expect materials in writing to be retained and may serve statutory production orders to compel the provision of information that is not legally privileged. Any oral report provided will likely be swiftly followed for a request from the enforcement agency for a written report of the same.
3. Cooperation with Law Enforcement Authorities
3.1 If an entity is aware that it is the subject or target of a government investigation, is it required to liaise with local authorities before starting or progressing an internal investigation? Should it liaise with local authorities even if it is not required to do so?
Entities are not required to liaise with law enforcement authorities before starting an internal investigation, but there may possibly be benefits to such early engagement, and it would be viewed favourably and encouraged by the authorities. For instance, if an agency is given the opportunity to comment on the proposed scope and purpose of an investigation, then the entity can ensure its report is appropriate. Early engagement may also avoid risks associated with tipping off and "trampling on the crime scene". However, an entity should remain cautious about disclosing information about possible wrongdoing without first having a proper understanding of the nature or extent of the conduct. To do so may result in an inappropriate or inaccurate self-report, which is not in the interests of any party involved.
3.2 If regulatory or law enforcement authorities are investigating an entity's conduct, does the entity have the opportunity to influence the scope of a government investigation? If so, how is it best achieved, and what are the risks?
Regulators and law enforcement authorities will retain full and independent control of the investigation process and will have extensive statutory powers to gather evidence as part of their investigation; for example, to compel entities to answer questions or produce documents.
Engagement with a regulator may, however, help to influence the scope of its investigation; guidance can be given regarding the relevance of material and the proportionality of requests for information and documentation.
3.3 Do law enforcement authorities in your jurisdiction tend to coordinate with authorities in other jurisdictions? What strategies can entities adopt if they face investigations in multiple jurisdictions?
The global nature of today's businesses, combined with the increasing availability of extraterritorial statutory powers to obtain evidence and extraterritorial offences, means that jurisdictional issues are becoming more prevalent. Law enforcement authorities in the UK frequently share information with authorities in other jurisdictions including through mutual legal assistance (MLA) agreements, via organisations such as Eurojust, or through alternative routes such as the UK-US Data Access Agreement, which allows law enforcement authorities in the UK and US to demand communications data from telecoms operators in each other's countries without the need for MLA.
There are increasing numbers of truly joint investigations by agencies from different states. Where an entity faces investigation in multiple countries, it will usually be advisable to engage legal advisors in all relevant jurisdictions and ensure that engagement with the authorities is coordinated with a view to a global strategy. For example, some jurisdictions may offer more favourable routes for reaching a settlement (sometimes without admission of criminal wrongdoing), which could give rise to ne bis in idem and double jeopardy arguments in other jurisdictions. In some circumstances it may be possible to pursue a "global settlement" that addresses criminal and civil risks in all relevant jurisdictions. Inevitably, approaches will depend on the nature and degree of cooperation between authorities in the different jurisdictions.
4. The Investigation Process
4.1 What steps should typically be included in an investigation plan?
All investigations are different, and planning must be approached on a bespoke basis and kept under review. An investigation plan may define the subject and scope of the investigation as well as the roles and responsibilities of the investigation team. It may include an outline of what tasks are to be performed, with timelines and rules of engagement (e.g. to preserve confidentiality and privilege).
An investigation plan should ensure that all relevant material is identified, collected and preserved, which will include securing hard-copy data and electronic data. How the investigation team will review the data and which individuals should be interviewed will also need to be determined.
4.2 When should companies engage the assistance of outside counsel or outside resources such as forensic consultants? If outside counsel is used, what criteria or credentials should one seek in retaining outside counsel? To what extent is independence of outside counsel desirable?
A decision on whether to use outside counsel or resources should be made with reference to the nature of the alleged misconduct, the issues to be determined, the kind of expertise required and the relevant experience of the intended resource. In circumstances where government intervention is likely, the independence of outside counsel who can attest to the validity of decisions made or procedures used and do so without being hampered by internal company politics is likely to enhance the credibility of the investigation. Moreover, it should ensure that relevant expertise is available to advise on matters that may pose significant financial and reputational risks, as well as the risk of imprisonment for individuals including senior management.
In the event that non-lawyer experts are used, e.g. forensic accountants, clear rules should be established to ensure that communications back to the client maintain legal privilege as far as possible. Provided the investigation can be properly conducted within the confines of legal professional privilege, this will ensure that the investigation can proceed without the entity being required to provide material generated during the investigation to the authorities.
5. Confidentiality and Attorney-Client Privileges
5.1 Does your jurisdiction recognise the attorney-client, attorney work product, or any other legal privileges in the context of internal investigations? What best practices should be followed to preserve these privileges?
Legal professional privilege falls into two categories: (i) legal advice privilege; and (ii) litigation privilege. Briefly, (i) legal advice privilege attaches to communications between a client and a lawyer for the dominant purpose of giving or obtaining legal advice, and (ii) litigation privilege attaches to documents created for the dominant purpose of conducting existing or reasonably contemplated adversarial litigation.
The availability of legal professional privilege has been scrutinised in a number of recent cases. In particular, such privilege needs to be carefully considered on a fact-specific basis rather than assuming blanket protection, and may be a factor affecting whether an investigation is desirable and, if so, when and how it is carried out. Evidence should be recorded, for example what litigation was in contemplation and why, to support any subsequent claim.
5.2 Do any privileges or rules of confidentiality apply to interactions between the client and third parties engaged by outside counsel during the investigation (e.g. an accounting firm engaged to perform transaction testing or a document collection vendor)?
As above, litigation privilege may apply to documentation prepared in relation to reasonably contemplated litigation, and any communications with third parties would be subject to rules of confidentiality. The use of third parties should be carefully considered and care taken to ensure, where possible, that their work is protected by legal privilege – generally by ensuring instruction is through external counsel appointed to advise on and/or handle the internal investigation – and that measures are in place to guard against inappropriate or unwanted disclosure.
5.3 Do legal privileges apply equally whether in-house counsel or outside counsel direct the internal investigation?
In short, yes, except in cross-border cases relating to European Union law (typically cartels or anti-corruption cases), where in-house lawyers cannot claim EU legal professional privilege over internal communications with employees. Although in-house counsel are inevitably closer to the business than external counsel, in the context of legal privilege, the "client", i.e. the corporate entity, is the same and legal privilege applies equally to any communications/material generated during the course of an internal investigation. However, claims of privilege will be easier and clearer if external counsel are instructed, as they are distinct from the business.
5.4 How can entities protect privileged documents during an internal investigation conducted in your jurisdiction?
Confidentiality must be maintained in respect of all legally privileged material. Practically, it is good practice (though not determinative) for all legally privileged material created during the course of an investigation to be marked appropriately (e.g. "Confidential – Subject to Legal Professional Privilege"). More fundamentally, the material should be treated so as to ensure that privilege is maintained (e.g. not inappropriately disclosed beyond the client team internally or externally).
Legally privileged documents uncovered during an investig-
ation, either produced in the course of obtaining legal advice or
in the course of separate litigation, should be separately stored
and marked (e.g. "Legally Privileged").
5.5 Do enforcement agencies in your jurisdictions keep the results of an internal investigation confidential if such results were voluntarily provided by the entity?
During the investigation stage, enforcement agencies will keep the results of any internal investigation confidential, unless shared with another agency or regulator. The same entity may be under investigation for criminal offences whilst simultaneously being under investigation (by a different agency) for regulatory breaches. The extent to which agencies will share information is dependent on their particular memoranda of agreement, although there are statutory gateways permitting such exchanges. Before providing any material, it would be prudent for the corporate to consider the risks of onward disclosure and liaise with the enforcement agency as necessary (acknowledging that an enforcement agency would usually be loath to provide undertakings that inhibited sharing). In the event of a prosecution, an internal investigation report would be subject to the usual rules of disclosure in criminal cases.
6. Data Collection and Data Privacy Issues
6.1 What data protection laws or regulations apply to internal investigations in your jurisdiction?
Any internal investigation must respect the requirements of the UK GDPR and additional provisions applicable under the Data Protection Act 2018. On that basis, "personal data" (broadly, data from which a living individual can be identified) needs to be accorded its proper protection under the law and processed lawfully, taking into account the rights of the data subject (the person whom the data identifies) and the lawful bases of processing under the GDPR whilst ensuring the integrity, security and confidentiality of the data at issue. There are exemptions to certain requirements where legal professional privilege is concerned or where regulatory functions or the prevention and detection of crime is engaged.
6.2 Is it a common practice or a legal requirement in your jurisdiction to prepare and issue a document preservation notice to individuals who may have documents related to the issues under investigation? Who should receive such a notice? What types of documents or data should be preserved? How should the investigation be described? How should compliance with the preservation notice be recorded?
Issuing a retention requirement (also known as a "hold notice") for individuals who are (or have been) under confidentiality obligations to the entity undertaking the investigation is generally considered best practice. It is to be anticipated that to the extent that the individual has documents that pertain to the business affairs of the entity, they will already be under a legal obligation to hold them subject to the rights of the entity itself. The policies of the entity as to the use and retention of electronic data on media not owned by it for processing data belonging to it (and knowledge about how such policies operated in fact), as well as to the rules concerning the retention of hard-copy material, will provide crucial information as to what material might exist. Necessarily, an obligation to preserve materials will require some information to be imparted about the circumstances in which preservation is to take place. This should be sufficient to allow informed retention choices, but without disclosing specific details that would give rise to an increased risk of destruction.
6.3 What factors must an entity consider when documents are located in multiple jurisdictions (e.g. bank secrecy laws, data privacy, procedural requirements, etc.)?
Data protection and bank secrecy laws in other jurisdictions remain a key element for consideration, especially as to whether relevant data can be transferred across national borders for the purposes of internal investigations. Well-informed expert (internal or external) counsel qualified in the relevant jurisdiction should be consulted before data is secured and in anticipation of any transfer.
Particular care should be taken in relation to data transfers from EU countries where the provisions of Chapter V of the (EU) GDPR become relevant. After a period of uncertainty around the future of EU-US data transfers, the EU adopted on 10 July 2023 a new adequacy decision, meaning personal data can flow safely between EU and US companies participating in the framework, without the requirement to put into place additional data protection safeguards.
In terms of transfers to the UK from the EU, the present data adequacy agreement between the UK and the EU generally allows transfers on the basis that the UK adequately protects data transferred to it. In UK–US terms, "data bridge" arrangements were agreed in principle in June 2023: they require completion, but subject to further work anticipate free data flow between the UK and US and vice versa.
For all cross-border transfers, consideration should be given not only to the transfer of data but also to the facts elicited from the data itself in the form of summaries and reports, etc.
6.4 What types of documents are generally deemed important to collect for an internal investigation by your jurisdiction's enforcement agencies?
Tradition has it that emails provide the most interesting and pertinent evidence. This is no longer true given the increasing variety of media that are used for communications and that evidence an individual's state of mind and conduct. It follows that not only should servers holding emails and other electronic data be retained and imaged by experienced professional and independent third parties employed to do so or to oversee the actions of internal staff (who in doing so will meet the necessary standards for preservation of material to evidential standards for the purposes of litigation), but attempts should be made to secure portable electronic devices where relevant data may be stored in the device itself. Contact with service providers is also important in seeking to retain material held or stored by them that might otherwise not remain in existence because of its ephemeral nature.
6.5 What resources are typically used to collect documents during an internal investigation, and which resources are considered the most efficient?
As above, the employment of an experienced computer forensics team is vital in demonstrating both the integrity and thoroughness of the internal investigation. It is prudent for such a team (perhaps using different team members) to catalogue the material retained and to put in place relevant search tools to enable examination of the data (in copy format, preserving a "clean" original version). Liaison with internal and external counsel is crucial and provides an efficient basis for understanding what has happened in the investigation and why particular steps were taken, with a view to being able to explain the scope and integrity of the work undertaken to enforcement authorities that may become engaged.
6.6 When reviewing documents, do judicial or enforcement authorities in your jurisdiction permit the use of predictive coding techniques? What are best practices for reviewing a voluminous document collection in internal investigations?
The volume of electronic material generated in any business means that the review of this material in hard-copy format is no longer feasible. Enforcement authorities and lawyers engaged in internal investigations will always use document review platforms, of which there are many, to search for and review relevant material. Data obtained, usually by imaging the electronic devices, is uploaded on to the review platform in a searchable format so that keyword searches can be run across the data. This process identifies the relevant material for review.
AI-based processing (e.g. deduplication and "threading" of emails to identify the most inclusive email chains for review) and predictive coding (applying human coding decisions to a larger data set) are now regularly used in order to make reviews of large volumes of data manageable. However, with technology developing rapidly (particularly should AI-based processing move beyond the understanding of the parties), there may be greater scope in the future to challenge the use of such techniques.
7. Witness Interviews
7.1 What local laws or regulations apply to interviews of employees, former employees, or third parties? What authorities, if any, do entities need to consult before initiating witness interviews?
Although current employees will often be expected, by virtue of the terms of their contracts of employment, to comply with internal investigations, former employees or third parties may be more difficult to interview as there is no threat of disciplinary action for their failing to cooperate with the entity's internal investigation.
Ordinarily, the authorities do not need to be consulted before initiating witness interviews, save that it may be prudent to do so in cases where the authorities have already been notified that an internal investigation is afoot (for example, where a self-report has been made), or where a self-report is being considered to the SFO or other enforcing authority (potentially with a view to a DPA) where there is a risk that the enforcing authority will view such interviews as "trampling the crime scene" (see question 2.2 above).
7.2 Are employees required to cooperate with their employer's internal investigation? When and under what circumstances may they decline to participate in a witness interview?
Employees cannot be compelled to attend an investigation interview, but failing to attend or cooperate with an investigation without reasonable excuse may mean that they are acting in breach of relevant duties towards their employer. Failure to attend an interview may therefore lead to disciplinary action being brought against that employee.
7.3 Is an entity required to provide legal representation to witnesses prior to interviews? If so, under what circumstances must an entity provide legal representation for witnesses?
An entity is not required to provide legal representation to witnesses, although a witness cannot be prevented from seeking legal advice. However, the entity retains control of the investigation and so it may determine who can or cannot attend internal investigation interviews, i.e. lawyers for the witness can be prevented from attending. If an entity is considering providing legal representation, careful thought must be given to the attendant costs and delays that this may entail; in some circumstances, an entity's Directors' and Officers' Insurance Policy may provide for legal fees for certain witnesses, but thought should be given to the overall fairness if only some employees are provided with legal representation by the entity.
If an employee is viewed as a potential suspect as distinct from a witness, it may be appropriate for the employee to be offered legal representation prior to the interview.
7.4 What are best practices for conducting witness interviews in your jurisdiction?
Interviewers should, where possible, be consistent so as to avoid any difficulties when comparing and contrasting different accounts. A variation of the "Upjohn Warning" should be provided to interviewees at the commencement of an interview, namely a warning: informing the interviewee that the lawyers involved are advising the entity and not the individual interviewee; giving a brief explanation of the background of the investigation; allowing requests for clarity when the interviewee is making a statement of fact or is speculating or stating a belief; and reminding the interviewee of the need for confidentiality.
Consideration should be given to the form of interview record required in the circumstances, including having regard to legal privilege and whether it may be advisable to disclose such interview records to enforcement authorities in due course. Companies engaging in cooperative self-reporting, for example with a view to obtaining a DPA, may find themselves under pressure to waive privilege in relation to interview notes, or, if there has been early engagement, encouraged to progress any ongoing interviews in a way that ensures they are not protected by legal privilege.
7.5 What cultural factors should interviewers be aware of when conducting interviews in your jurisdiction?
England and Wales is a multicultural and diverse society, and thus interviews should be conducted respectfully and sensitively as regards such matters. Post the COVID-19 pandemic, more flexible approaches to working may allow for interviews to be conducted via video conferencing platforms.
7.6 When interviewing a whistleblower, how can an entity protect the interests of the company while upholding the rights of the whistleblower?
Provided an entity can demonstrate that it has not discriminated against the whistleblower because of their disclosure (see question 1.2 above), it is unlikely that the entity can be said to have breached the whistleblower's rights. It is imperative that the investigation team comprise individuals who are completely independent from the areas of the business that are the subject of the investigation, as this demonstrates that the concerns raised by the whistleblower are being taken seriously and thoroughly investigated. The entity should clarify in any interview with a whistleblower that its lawyers are acting for the entity and not the individual, but also make it clear that the entity is aware of the whistleblower's status and that their disclosure is protected.
7.7 Can employees in your jurisdiction request to review or revise statements they have made?
It will commonly be the case that "witness statements" are not taken from employees during the course of an internal investigation. As stated at question 7.4 above, the interview records required will depend upon the circumstances of the case and may be in the form of summary notes. Any information provided during the course of an internal investigation, including through a fact-finding meeting, can be presented to the employee for verification.
7.8 Does your jurisdiction require that enforcement authorities or a witness' legal representative be present during witness interviews for internal investigations?
There is no requirement that enforcement authorities be present for witness interviews during internal investigations, and it would be highly unusual for them to do so. Interviews by enforcement authorities are an entirely separate process. Legal representatives for witnesses are also not required to be present, but may be present in some circumstances – see question 7.3.
8. Investigation Report
8.1 How should the investigation report be structured and what topics should it address? Is it always desirable or recommended that a formal written report is prepared?
Before producing a written investigation report, consideration may be given to whether the key findings should be presented orally to the client. It may be that an oral report is all that is required, and this will avoid creating a report/record over which arguments as to privilege may then arise – in addition, the ability to circulate an oral presentation is limited (although board minutes recording such presentations should make clear, where appropriate, the parts of any board meeting subject to legal professional privilege).
The structure and content of an investigation report will depend on the particular circumstances. It will often contain an introduction (describing the background to the investigation), a summary of the relevant regulatory regime or circumstances in which the misconduct arises, details of the investigative steps and factual findings, a summary of any improvements or remedial action already taken, advice in relation to potential offences and enforcement action, and recommendations in relation to further actions (e.g. further investigative steps, an analysis of potential actions or recommendations for actions under employment law, remedial actions, self-reporting).
9. Trends and Reform
9.1 Do corporate investigations tend to lead to active government enforcement in your jurisdiction? Has this increased or decreased over recent years?
If corporate internal investigations identify serious corporate wrongdoing that is reported to law enforcement, there is a high likelihood that enforcement action will follow. The context, nature of the offending, and the law enforcement authority in question provide for important differences. However, if the offending is sufficiently serious and evidence is disclosed (or will be obtainable) to provide good prospects of a conviction, there will be a significant risk that prosecution will follow. Enforcement action may stop short of prosecution even in serious cases, and self-reporting (and appropriate remedial action) will increase the prospects of alternative outcomes – whether that is, for example, a DPA in relation to economic crime, or an enforcement undertaking or variable monetary penalty in relation to environmental crime. Inevitably, the less serious the wrongdoing, the greater the chance of alternative outcomes or avoiding enforcement action altogether.
Enforcement action against corporates has increased signi-
ficantly in recent years, with a very pronounced trend towards
corporate criminal liability (see question 9.2).
9.2 What enforcement trends do you currently see in your jurisdiction?
There is a significant trend towards broadening and prosecuting corporate criminality liability. That means both: (1) treating much more seriously "regulatory" offences that may involve limited fault by the "company" – for example in relation to environmental crime, health and safety, food safety, or fire safety – with fines for the largest organisations in serious cases increasing from tens of thousands to millions and tens of millions (and sometimes more) within little over a decade, in addition to significantly increased risks of imprisonment for senior management in the worst cases; and (2) extending the "regulatory" approach to new areas including economic crime, such as by introducing a new model of "failure to prevent" (FTP) offence. Subject to certain requirements, FTP offences make commercial organisations criminally liable if employees and other "associated persons" commit a relevant offence (to date, bribery and the facilitation of tax evasion), with no mental fault needing to be attributed to the organisation, subject to a defence that the organisation had in place adequate/reasonable procedures to prevent the offending.
Regulatory offences are easy to commit and difficult to defend, with the upshot that criminal risks for corporates have increased significantly. There has also been an expansion of the scope and maximum fines available for civil penalties as an alternative to prosecution, with the intention of making enforcement action quicker and simpler in appropriate cases.
9.3 What (if any) reforms are on the horizon?
Corporate criminal liability in England and Wales will be significantly reformed when the Economic Crime and Corporate Transparency Bill becomes law, possibly as early as late 2023.
A new FTP fraud offence is to be introduced, adopting a similar model to the FTP bribery and facilitation of tax evasion offences. Due to the pervasiveness of fraud risk, the difficulties inherent in commercial organisations preventing individuals from committing fraud offences, and the multiple routes by which fraud allegations could be made and pursued, this offence is likely to be significantly more impactful on businesses than even the watershed FTP bribery offence. While initially the FTP fraud offence will apply only to "large" organisations, there is provision for its application to be extended to other organisations, and significant Parliamentary efforts have already been made to do so.
Additionally, the fundamentally important "identification doctrine" is to be reformed for many economic crimes so that the category of persons who could be "identified with" a commercial organisation for the purposes of attributing criminal liability will be significantly expanded from "directing minds" (usually Board directors) to "senior managers" (so broadly defined as to potentially include department heads). This reform will not be limited to "large" organisations, and if relevant offending by a "senior manager" were established, organisations would not even have the protection of the FTP adequate/reasonable procedures defence.
Originally published by ICLG.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
