Internal Investigations Are Moving Out of the Shadows and Into the Spotlight

There was a time when companies, faced with allegations of wrongdoing, conducted an under-the-radar internal investigation, quietly dispensed punishments to those it deemed responsible, and kept the whole process hidden from the public and regulators' view.

Those days are largely over.

Companies are rethinking the balance between secrecy and transparency when it comes to internal investigations. The regulatory encouragement given to whistleblowers, the danger of data breaches, hazards of hackers, and rapid-fire leaks amplified via social media and a non-stop news cycle, means that what happens in-house probably won't stay there. And more commonly, companies find they need to demonstrate that internal problems were handled fairly and completely and that those responsible for the wrongdoing have been disciplined or removed.

“Keeping things under wraps is almost impossible,” says Lee Smith, who specializes in internal investigations for the law firm Hinshaw & Culbertson.

Smith says that high-profile cases, notably the Penn State scandal have caused internal investigations to “take on a different tone.” There is a greater demand for transparency and specificity now that allegations and information on subsequent investigations find their way into public hands.

There are lessons to be learned from two very different examples of internal investigations at work. The Penn State child sex abuse scandal is a textbook example of how not to conduct such an investigation. An autopsy of the investigation into charges of child sex abuse by former coach Jerry Sandusky  in an independent report by Louis Freeh and the law firm Freeh Sporkin & Sullivan revealed that allegations were covered-up, not exposed. The in-house review conducted by the University was focused on protecting reputations, regardless of whether that protection was deserved. The university's board of directors placed far too much faith in the very people it should have challenged, the Freeh report concluded.

On the other end of the spectrum, an internal investigation by Ralph Lauren Corp. into allegations of corruption and bribery at the clothing retailer is becoming a case study on how to conduct an effective internal investigation. “The SEC has determined not to charge Ralph Lauren Corp. with violations of the Foreign Corrupt Practices Act due to the company's prompt reporting of the violations on its own initiative, the completeness of the information it provided, and its extensive, thorough, and real-time cooperation with the SEC's investigation,” that announcement said. “[Its] cooperation saved the agency substantial time and resources.”

The lesson from both matters is that if you are going to win over an agency or prosecutor, not to mention the court of public opinion, “you are going to do so by having as much transparency as you can,” Smith says.

It's rarely that cut and dry, however, say lawyers. “You conduct this investigation and then at the end of the day what do you do with it? Do you report the results to the regulators—the Justice Department or SEC? Or do you keep it internal, learn the facts and sit tight? It's a really hard question,” says David Smyth, of counsel for the law firm Brooks Pierce.

It's true, too, that a company's hand may be forced when it comes to transparency. The whistleblower bounties provided for in the Dodd-Frank Act present the threat “that someone who is not in the executive suite can learn about something, take it to the government, and make a lot of money,” Smyth says. “That possibility is always out there so the decision not to self-report is just that much harder these days.”

“If you are charged with finding out what went on in a scandal drawing that much public interest, there is going to be pressure to have the report be independent, complete, and accurate as possible in reflecting what went on.”

—David Smyth,

Of Counsel,

Brooks Pierce

One resulting, evolving change in modern approaches to investigations is a greater focus on written reports. “[Over the years] it wasn't uncommon that you would make an oral report to the board, or whoever was requesting the investigation,” Smith says. “The thought was that you could protect the information through attorney-client privilege. If there were unfavorable things, at least there wasn't a written record. That approach is becoming far less common for several reasons, including that it is hard to have a whole lot of credibility if there is no report produced. The days of the oral report are coming to a close.”

The Freeh report, Smith says, illustrates how to best leverage an investigation's due diligence to build confidence. “You might quibble with the conclusions that were drawn, but you would really have a hard time disagreeing with such a detailed investigation,” he says.

The Public Interest

The nature of the allegations can also influence how much transparency companies should give to internal investigations. Those that have a public interest element or could lead to criminal charges should be conducted more out in the open. “If you are charged with finding out what went on in a scandal drawing that much public interest, there is going to be pressure to have the report be independent, complete, and accurate as possible in reflecting what went on,” he says. Cases with similar ramifications—the next Enron or Penn State—will continue to amplify public scrutiny.

Regulators are also encouraging greater transparency, says Steve Lee, a certified fraud examiner and managing partner at the corporate investigations firm Steve Lee & Associates. “Ralph Lauren's lawyers would have been saying to management that they didn't have any choice other than getting out in front of it,” he says. “The consequences for doing otherwise would be extraordinary.”

Aside from FCPA violations, regulators are also demanding greater transparency regarding technology failures and building public-private partnerships in the war against cyber-crime. These “partnerships” will likely lead to many companies opening their books on security breaches that might otherwise have been investigated internally and kept that way, Lee says.

SANDUSKY ABUSE CASE

Below are some remarks made at a July 2012 press conference held by Louis Freeh and his law firm, Freeh Sporkin & Sullivan, addressing his investigation into child abuse committed by Penn State employee Gerald Sandusky. His comments offer cautionary advice for directors dealing with executives who would rather hide than expose internal investigations.

Although we found no evidence that the Penn State Board of Trustees was aware of the allegations regarding Sandusky in 1998 and 2001 that does not shield the Board from criticism. In this matter, the Board – despite its duties of care and oversight of the University and its Officers – failed to create an environment which held the University's most senior leaders accountable to it. [Former Penn State President Graham Spanier] resisted the Board's attempt to have more transparency.

After a media report on March 31, 2011, the Board was put on notice about serious allegations that Sandusky was sexually assaulting children on the Penn State campus. The Board failed in its duty to make reasonable inquiry into these serious matters and to demand action by the President.

The President, a Senior Vice President, and General Counsel did not perform their duty to make timely, thorough and forthright reports of these 1998 and 2001 allegations to the Board. This was a failure of governance for which the Board must also bear responsibility.

We also found that:

The Board did not have regular reporting procedures or committee structures to ensure disclosure of major risks to the University.

Some Trustees felt their meetings were a “rubber stamp” process for Mr. Spanier's actions.

The Board did not independently ask for more information or assess the under-reporting by Spanier about the Sandusky investigation after May 2011 and thereby failed to oversee properly his executive management of the worst crisis in Penn State's history.

The Board was over-confident in Spanier's abilities to handle crises and was unprepared to deal with the filing of criminal charges against senior University leaders and a prominent former football coach in November, 2011.

From 1998–2011, Penn State's “Tone at the Top” for transparency, compliance, police reporting and child protection was completely wrong, as shown by the inaction and concealment on the part of its most senior leaders, and followed by those at the bottom of the University's pyramid of power.

Source: Freeh Sporkin & Sullivan.

New pressure to move internal investigations out of the shadows doesn't mean all investigations are going to be conducted under a spotlight. According to Lee, the model of internal investigations isn't changing that rapidly. “Executives want something that is cost-effective that gets the job done as quickly as possible, and they do not want to read about this in the Wall Street Journal.”

“You can't let the fact that something could become public dictate how you run an investigation,” says Tammy Albarrán, who advises clients on internal investigations for the law firm Covington & Burling.. “The way you run the investigation needs to be very fact driven. To the extent that you find things that could be a PR problem, you may have to work with your media team to figure out a strategy on how to present it publically. You need to prepare for that, but don't let it dictate the investigation.”

“There is an increasing recognition that it is very hard to keep a secret in a big company, so whatever your process was it needs to be defensible,” Lee says. “You really need to do a buttoned-up job, so if there is an issue and discovery is demanded by the Justice Department or SEC you can unload on them a trail of documents that shows what you did.”

Withstanding that scrutiny gets to the heart of what a well-executed investigation should do, regardless of how public it may or may not become. A credible investigation emerges when leadership refuses to compromise on the scale or scope of an investigation, Lee says. “If a board is going into the process with a ‘rubber stamp' mentality, it is not going to get a very good investigation,” he says. “It does take some courage to allow the investigation to go where it needs to. But when organizations see the consequences of not doing that, it leads them to wider and more candid investigations.”

The level of independence is another avenue to transparency. “It is really important that an investigation be independent and is in the company's interest,” Smyth says. “That doesn't necessarily mean that it is in the executive's interest, which is a critical distinction. When you go in and investigate conduct at a company, the investigators do not represent those executives and have to say as much out loud so that the executives get it. Privilege runs between the investigators and the company, not between the investigators and the people they are interviewing.”

Documentation should provide insight into the internal debate over going public, especially if the choice was ultimately made not to disclose the problem to regulators. Lee says it is important to “show that proper and diligent consideration was given at every stage.”

“Prove that you gathered and maintained the appropriate information and maintained custody in such a way that if it does become a public issue, it becomes a Ralph Lauren type affair,” he says. “The regulators may say you should have called them right away, but if you did things right they will eventually say you did a good job and saved them a lot of work. There's no incentive for them to give you a hard time if you've done the right things.”