What to Do When the Whistle Blows: A Guide for Investigating Internal Complaints

All companies inevitably face complaints that allege improper, unethical, or illegal conduct. The best-run companies welcome those complaints because it provides an opportunity to investigate the allegation, determine whether wrongdoing occurred, and (if necessary) fix the problem. Oftentimes, how companies respond to complaints becomes just as important as the underlying alleged conduct — the Department of Justice, for example, may take a more lenient approach to companies that promptly investigate and remediate misconduct. Still, that leniency will disappear if companies try to delay or minimize an investigation.

As a result, it is imperative that companies follow these best practices when the whistle blows:

Take all complaints seriously.

• Whether reported through internal channels or offhand in a social media post, even informal or vague complaints can lead to investigations of consequence.
• Experienced employees should evaluate all complaints to determine whether an investigation is warranted, and if so, who should conduct the investigation.
• And if the complaint alleges ongoing unlawful activity, take steps to ensure that the activity stops immediately.

Do not investigate the whistleblower.

• The company must, in policy and practice, have zero tolerance for retaliation against whistleblowers.
• Investigate the allegations, not the whistleblower. If the whistleblower is anonymous, do not try to determine the whistleblower’s identity.
• While the whistleblower’s motivations or credibility may become important to the investigation, the investigation must first and foremost focus on whether the allegations are true.

Make an investigation plan and know that it will change.

• Set the investigation’s scope by defining the issues to be investigated and identifying the relevant people, documents, and time period.
• Identify who needs to know about the investigation and when. Investigations also spur office gossip, and you may not want potential witnesses to know an investigation is pending until you have the opportunity to preserve evidence and conduct interviews.

Preserve the evidence and protect the privilege (if need be).

• Send a document preservation notice to people who may have relevant information if you think there’s a threat of litigation. However, keep in mind that such notices can often generate office speculation or gossip and should be thoughtfully drafted.
• Work quickly and closely with your IT, HR, and Records departments to suspend any regular data disposition procedures, ensure information from custodians who are separating from the company is maintained, and collect potentially relevant documents and communications. Engage an electronic discovery provider to perform the collections if you do not have the necessary in-house expertise.
• Consider whether employees’ personal mobile devices may contain texts, chats, or other relevant information not otherwise accessible to your IT department, and if so, whether your bring your own device (BYOD) policy requires employees to make those devices available for inspection.
• Decide if the investigation should be conducted under the attorney-client privilege. Not all investigations need to be, but if the stakes are high or litigation is threatened, a privileged investigation may be necessary.
• For privileged investigations, make sure that the privilege sticks. In-house or outside counsel can create the privilege but copying in-house counsel on correspondence will not suffice. The attorney must be actively involved with, and advising on, the investigation for the privilege claim to be clear.
• If the investigation requires outside experts (for example, forensic accountants), it is preferable that such experts be retained by counsel to preserve the privilege. To minimize risk of a privilege waiver, experts must act as agents for counsel and work under counsel’s control and direction for the purpose of assisting counsel in providing legal advice.

Gather documents and interview the witnesses.

• Early interviews can be invaluable to lock in recollections and better understand what needs to be investigated. But some interviews are best conducted after a thorough review and analysis of relevant documents. In either event, give thought to how interviews are sequenced.
• Give all corporate witnesses an “Upjohn” warning if the interview is being conducted by an attorney, and make sure that witnesses understand the role of each person in the room.
• Build rapport, ask follow-up questions, and make sure that you understand the witnesses’ statements. Remember that no one enjoys being interviewed for an investigation — be thorough and persistent, but also professional and patient.

Make credibility determinations, factual findings, and conclusions.

• Internal investigations do not carry a “beyond a reasonable doubt” burden of proof, but the investigator should reach well-supported, principled, and unbiased conclusions. This is why choosing the right investigator from the start matters.
• Conclusions should be concise and specific and cite to relevant documents and witnesses. Sometimes investigations are inconclusive, and that is acceptable too.

Report the conclusions and advise on next steps.

• Decide whether final reports should be oral or written — there are advantages and disadvantages to each.
• Final reports — whether oral or written — should only be shared with the people who need to make decisions about next steps. Generally, reports should not be widely disseminated and should stay within the company.
• In most cases, it is appropriate to tell the person who raised the complaint and the person(s) who is the target of the complaint that the investigation is closed. Depending on the complaint and the investigation results, you may not want to share the findings.
• If the investigation confirms that there was improper, unethical, or illegal conduct, the company should consider its disclosure obligations (if required by law or otherwise advisable) and appropriate remediation, including (among other things) employee discipline, enhanced compliance controls, or further employee training.