This article has been co-authored by Sundar Narayanan, Director – Forensic Services at Nexdigm (SKP), Anuj Berry, Partner at Shardul Amarchand Mangaldas & Co., and Sourabh Rath, Senior Associate at Shardul Amarchand Mangaldas & Co.

Covid-19 has brought in unprecedented times for business and community alike. The pandemic has not only created uncertainty but also impacted the beliefs and the way business moves. Workplace investigations on misconduct or policy violations are no exception. Cases reported through the whistleblower channel are expected to drop initially considering business re-stabilization or accustoming to short term turbulence caused by the pandemic. However, the investigation of reported cases will continue to be a priority of ethics and compliance officers.

Remote investigations are not a novelty; however, remote investigations are only partially remote in most cases. For instance, interviews are often conducted in person, while the review of documents/evidence occurs at a different location. With people mandated to work from home, the complexity associated with remote investigation increases many-fold during the pandemic.

Some of the key challenges during this lockdown and partial extensions are as below:

Gathering data/evidence

Organizations will face challenges in gathering digital evidence as access to individual devices for forensic imaging and processing will hit a roadblock. Moreover, the collection of data in hard copy or physical evidence will be challenging during the lockdown. While remote forensic tools are available, they have limitations, and imaging a device requires significant internet bandwidth. While companies may consider using data from cloud archives or vaults like Office365 or Gmail for business, they will have to understand that this does not entirely cover the full spectrum of data/evidence that needs to be gathered.

Further, challenges exist in terms of personal devices (pursuant to Bring Your Own Device ("BYOD") policies) or use of devices that do not have company IT policies implemented. It is pertinent to look at the limitations of conducting digital investigations and accordingly plan stage-based review of accessible data (files or emails from cloud archives, shared drives of internal server, and so on).

Also, it is necessary to understand that working from home carries an enhanced risk of data leakages caused primarily by the use of unauthorized video calling or file-sharing applications. The organization needs to assess avenues to limit unauthorized app usage and create a log of outside network video calling or file-sharing applications. This would enable the gathering of evidence/material to address emerging cases of data theft or cyber-crimes in the future.

In the current crisis, companies must issue clear guidelines and policies addressing the distinction between personal data and work-related data. Companies may direct that employees only work from home on work-issued devices. However, if that is not possible, the company can issue guidelines to employees specifying that personal email or unauthorized video calling and file-sharing apps cannot be used for document sharing or official communications. Additionally, the company may notify employees that it would have the right to access all work-related data even on the employees' personal devices.

Review of documents

Document review is a critical part of the investigation process. The current crisis necessitates adequate access to electronic documents to reviewers. Companies must provide secure access to data review platforms for both internal reviewers and attorneys. Data security issues must be addressed with each reviewer and companies must ensure the implementation of measures preventing the download of electronic data to any IP address that has not been pre-approved.

However, not all organizations have digital versions of documents. As stated earlier, access to physical documents during this crisis will be a significant challenge. As a result, it may be prudent for such companies to assess if investigations that have a considerable dependence on physical documentation should be postponed, including reaching out to the concerned regulatory bodies for extensions of time.

Conducting interviews and presentation of evidence

Interviews and putting evidence/documents to interviewees is a crucial part of any internal investigation. The current crisis necessitates that interviews are conducted remotely, either through tele-conferencing or video-conferencing.

At the time of a remote interview, a third party presence would compromise attorney-client privilege and sharing of interview related documents with third parties would affect the confidentiality of the investigation. Companies should issue a disclaimer and guidelines stating no third party presence, the prohibition of recording the interview, interview to be only conducted via video-conferencing. There is a risk that such recordings would be discoverable in Indian court proceedings and by regulators.

Interviewers must keenly observe the subject's behavior during the interview, explicitly noting inconsistent response patterns, asking for repeated breaks during the interview or constant efforts to switch off the video during the call. This additional vigilance will help in avoiding any potential threat that may compromise the sanctity of the interview process. Additionally, these factors and inconsistencies in responses will need to be considered while arriving at conclusions from the interview.

While screen sharing , it is possible that the subject may take screen shots of the documents presented. The company should avoid sharing of documents during the conference, and if extremely important then, they may choose to use platforms and technologies which prevent screenshots. Additionally, they should also gatherundertakings from the interviewees that they will not record/capture the contents of documents shown.

It is also necessary to ensure that while seeking information or clarification from the key stakeholders on the case, care is taken to classify the email and the attachments therein as confidential, thereby limiting forwarding or saving on the hard disk or printing of such files by any of the stakeholders.

Communication and reporting

Investigation reports and findings can be presented to the relevant stakeholders through video-conferencing. Investigation reports and findings will need to contain the necessary qualifications/limitations associated with the COVID-19 crisis and lockdown related restrictions, as discussed above. These qualifications/limitations will be critical to the sanctity and reliability of the investigation report. This is also necessary to alert the audience of the report (compliance committee or the decision maker on a disciplinary recommendation as an outcome of the investigation), so they can take an informed approach to precipitative actions.

While these steps may appear to be necessary until the lockdown, companies would be well placed to consider incorporating these steps into their standard investigation procedures as well. If appropriately adapted, these steps will streamline the entire process and enable the company to be in a state of readiness for remote interviews and investigations. It is also imperative for investigators and ethics and compliance professionals to be conscious of potential challenges associated with these factors and prepare to deal with them in the investigations.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.