Michael Carter (mcarter@alvarezandmarsal.com) is a Senior Director with Alvarez & Marsal Disputes and Investigations in Washington, D.C., and Lex Urban (lex.urban@cwt.com) is a Special Counsel for Cadwalader's White Collar Group in Washington, D.C.

High-stakes corporate investigations into bribery, corruption, and other misconduct—whether focused on internal actors or third-party business partners—are often highly complex, require a broad range of investigative and functional expertise, and can involve multiple work streams running in parallel under crushing deadlines. Various internal and external teams are likely to play primary or supporting roles, and these roles may change over time, depending on a variety of factors, including in-process findings and the emergence of government regulators or law enforcement. When such a critical matter arises, the first impulse is often to throw resources at it and let every conceivable stakeholder play some role. However, this well-intentioned approach can often lead to a "too many cooks in the kitchen" situation, undercutting the efficiency and effectiveness of the entire investigative process.

As a result, identifying those roles and responsibilities, managing resources and timelines, and remaining nimble in the face of change can be critical to ensuring that a "bet the company" matter does not devolve into an all-out catastrophe. In fact, the Department of Justice has specifically addressed "Properly Scoped Investigations by Qualified Personnel" and "Investigative Respons[iveness]" in its most recent Evaluation of Corporate Compliance Programs guidance in April 2019, 1 which considers the manner and structure in which investigations are handled.

Initiating the process

An investigation may be initiated in a number of ways, including by a tip (internal or external), an audit finding, or a call from outside law enforcement. When negative information arises that necessitates further investigation, proper staffing and a thorough but realistic work plan can be key to the inquiry's success.

Start with just the facts

The initial focus of the investigation should be on identifying what information should be collected and who should be doing the collecting. The investigative team should begin in fact-finding mode, looking at all relevant information surrounding the suspected complaint or misconduct, both incriminating and exculpatory. An effective investigator exercises measured diligence, critical analysis, and professional skepticism. Document holds are an effective investigative tool to preserve information and aid the initial fact-finding missions.

Keep good records

During the fact-finding stage, it is vital to be cognizant of how information is documented and preserved. All information collected should be viewed through the lens of it potentially appearing in a formal legal proceeding at some point in the future. Accordingly, it is paramount that the integrity of the information is maintained with a clear chain of custody established, and the method by which it is gathered should be objectively reasonable and defensible.

Maintain confidentiality

It is also critical that information collected during the course of the investigation—as well as the identities of those it is collected from—remain confidential. Investigators should share information among team members with a "need to know" to avoid duplicative efforts or miscommunications, especially in fast-moving investigations with multiple tracks running in parallel. However, at the same time, the investigation team should be careful about what information needs to be shared with witnesses, corporate stakeholders, and even outside law enforcement while the investigation is still running its course.

Manage witnesses and whistleblowers

Witnesses often provide the core information or "the meat" of an investigation. Witnesses provide wide-ranging types of information from the proverbial "smoking gun" to information that provides color to a motive or context to information gathered that, at first glance, did not appear to fit within the scope of the investigation. It is the investigator's job to exercise professional skepticism and diligence in order to ensure, through validation, that witness testimony can be supported.

Finally, witnesses may also include a whistleblower that notified the investigation team of fraudulent activity. Treatment of whistleblowers is an extremely sensitive issue and carries significant consequences if mishandled. The company and its employees need to be advised not to take any acts against a whistleblower that give even the appearance of retaliation.

Identifying the players

Investigations are conducted by a team as opposed to an individual, because typically, different investigators have unique skill sets that enhance the overall analysis and efficiency of the investigation. The success of an investigation team is often dependent on both the direct actions of its team members, and the indirect support from stakeholders and others both within and outside the company.

Internal investigators

A company's internal investigations team, typically found within the legal or compliance function, is the key to any fact-finding effort. Investigators, who often bring with them extensive audit, law enforcement, and litigation experience, must possess the right combination of tenaciousness and tact so they can get to the facts quickly without alienating potential witnesses. They must know the company and the subject matter being investigated, particularly if dealing with forensics and complex issues such as accounting or cyberfraud. And their integrity and objectivity must be unblemished; otherwise, any conclusions reached are highly likely to be second-guessed going forward.

Outside counsel

Outside legal counsel can be a key component to an investigation, either by advising or supplementing the investigative team or acting as the primary investigators when resources or independence needs dictate. Relying on the work of experienced outside counsel can not only free up limited internal resources, but can help ensure the information, documentation, and testimonies gathered will meet any evidentiary standard if the claim results in more formal proceedings.

An additional benefit to using outside counsel is that communications and work product generated during the course of an investigation will enjoy a strong presumption of attorney-client and attorney work product privilege, which is not always the case with internal investigators and compliance personnel. This helps ensure that information gathered during the course of investigation will be protected from disclosure to potential civil litigants.

External counsel can also be extremely helpful as the company's go-between with law enforcement and other government regulators. Law firms frequently have a deep bench of former federal and state prosecutors and other regulatory officials who have seen how investigations are viewed by the other side. Their advice and relationships with current government officials can be key in ensuring that communications remain open and productive.

Forensic accountants

If an investigation involves potential books-and-records issues, internal control lapses, or other corporate governance concerns, the internal audit department can be an invaluable partner in the investigative process. Once an investigation has begun, they may also be called in to address issues relating to materiality, severity of conduct, scope of conduct, the response of management, and the company's culture of compliance. Post-conclusion, the internal audit department can be essential in identifying and addressing gaps in a company's controls that present opportunity for future misconduct. However, internal audit personnel operating in an investigative capacity should always work under the direction of internal or outside counsel to maximize legal privilege to the greatest extent possible.

A company's controller's office can be another key resource if there is a need for the investigation team to understand complex financial or cost accounting issues. External forensic accountants can be essential if internal resources are limited or independence must be maintained, but they often must start from scratch if there is no institutional knowledge of the company and its systems. A hybrid approach can also work, pairing external experts with a trusted internal resource.

Senior management

Although management, directors, and audit committee members are not often directly involved in conducting investigations, they will frequently want to be kept abreast of breaking developments. This can be challenging in high-stakes matters where time is limited and confidentiality is key. It can also get awkward if those same individuals are potentially implicated, directly or indirectly, in the alleged misconduct. Finding a way to keep senior management appropriately informed while not jeopardizing the integrity of the investigation can be a delicate dance with both legal and political implications. And although management can be an asset to an investigation team in terms of ensuring cooperation and buy-in, their involvement should not be allowed to create the perception that the investigation team lacks independence or that the conclusion was preordained.

Human resources

Human resources (HR) is another internal stakeholder that can assist with an investigative effort, but whose involvement can be deleterious if not properly managed. Typically, checking a witness's or a subject's HR file is the first investigative step in understanding the employee's background with the company. Some companies opt to have HR present during internal interviews to reduce tension, but that approach can backfire if the witness becomes confused about HR's role. If HR is there as part of the investigation team, that fact should be disclosed as part of the "Upjohn" warning. If HR is there to support the employee, then they should have nothing to do with the investigation and remain an independent party.

Third parties

The role of vendors, business partners, and other third parties in an investigation is often most relevant during the information-gathering stage. These parties should be able to provide the investigation team with documentation for any communication, contracts, invoices, and any other relevant information. Something important to note, though, is that the supply of this information will be restricted to what can be disclosed under the terms of any contract, written agreement, or other legally binding document. In addition, the investigation team will need to be careful on how much of the investigative purpose to share with outside third parties. It must be enough to facilitate their retrieval of information, but not so much that confidentiality and legal privilege are threatened.

Public relations

Public relations and media management become key components of an investigation when the conduct at issue is public or will likely become public and will garner media interest. It is important that the company is prepared to respond in a manner that is accurate, but also reassures the public and its employees that things are under control. To that end, it is key that public relations personnel are given enough nonprivileged information to make accurate statements, but also not divulge information that needs to remain confidential. Any media statement should first be vetted by the investigative team for these purposes.

Remaining flexible

Every investigation is unique. The general foundational steps of an investigation may remain consistent, but the facts as well as unforeseen circumstances will determine its ultimate path. As a result, even the best work plan may need adjustment when (not if) unforeseen circumstances arise.

The only constant is change

Complex corporate investigations will frequently change course over time, sometimes radically so. For example, a company begins a forensic investigation into discrepancies identified in inventory logs. The investigation leads to multiple employees exposed as having engaged in a pattern of inappropriate comments and angry outbursts toward coworkers. While the inventory log probe continues, there are sufficient grounds to now look into whether a harassment or bullying culture exists within the organization and whether middle management covered it up, steering the initial probe into previously unexplored territory. As a result, a different type of investigative expertise may be needed, the scope of the investigation may expand greatly, and additional players may become involved. Although the initial investigation must be pursued with haste, there is now a significant new effort that must be tackled.

Confidentiality is breached and conflicts arise

Another factor may be that the confidentiality of an investigation is compromised. For example, an HR representative who is asked to provide testimony in an investigation may give the suspected employee a heads-up. Conflicts of interest may arise in the course of an investigation if, for example, the suspect is related to the lead investigator or members of senior management are complicit in the alleged misconduct. Any of these things can potentially compromise the integrity and objectivity of an investigation.

The stakes change

The roles of investigation stakeholders are subject to influence depending on the hierarchical level at which the inquiry is targeted, and the type and severity of risk that may be exposed or assumed depending on the outcome of the investigation. A high-impact result that is found to present itself as extended risk throughout an organization is likely to have more involvement from senior management or the board of directors than a business unit-level case that doesn't affect strategy, operations, or company reputation. Either way, the independence of the investigations team should be protected through an organizational structure that facilitates appropriate communication among stakeholders and enables thorough examination.

The government emerges

Nothing can shake an ongoing investigation to its core like the sudden receipt of a government information request or subpoena. This means that an already tense situation can be made worse by having to respond to a subpoena while still in fact-gathering mode. The best outcome is often to negotiate the delay or even withdrawal the request while the investigation is pending, followed by a voluntary read-out to the regulator on the investigation's findings. But this approach will typically only work if there exists a degree of trust and confidence with the regulator that the investigation will be fulsome and the read-out complete. It also raises a host of questions about privilege waiver and confidentiality that promise to further complicate things.


Early missteps, poorly defined roles, and an inability to deal with change are all hallmarks of investigations that are likely to end badly. They can lead to out-of-control costs, tainted outcomes, internal upheaval, and a variety of unforeseen consequences. Choosing your team members and building your team carefully are key to a successful investigation and avoiding the issue of having too many cooks in the kitchen. Although you can never predict with certainty how an investigation will play out, you can take steps up front to help prevent a bad situation from becoming a terrible one.


  • Corporate investigations can be complex undertakings with a variety of different stakeholders who have different and/or competing interests.

  • Understanding and defining the process, potential players, and roles before an investigation proceeds is key.

  • The parties and entities interested in and affecting an investigation are likely to change over time.

  • Adequately managing all related stakeholders and their roles is vital to ensuring that an investigation remains effective, accurate, confidential, and efficient.

  • No two investigations play out the same way. It is essential to build in flexibility to be able to quickly respond to unforeseen circumstances.


1 Evaluation of Corporate Compliance Programs, U.S. Department of Justice, Criminal Division, updated April 2019, http://bit.ly/2Z2Dp8R.

Copyright 2019 CEP Magazine, a publication of the Society of Corporate Compliance and Ethics (SCCE).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.