Columbo probably wouldn't cut it as a compliance officer in charge of internal investigations.
Far from the drama-filled detective work portrayed in movies and television, those tasked with conducting corporate internal investigations deal more with rigorous discovery protocols than third act plot twists.
Three former prosecutors, now serving in compliance-related positions, addressed the challenges of conducting internal investigations and offered their suggestions for best practices last month at the Compliance Week 2013 conference in Washington D.C.
James Finnerty, associate deputy global anti-money laundering officer for TD Bank, stressed the importance of having an investigatory approach that is both credible an independent.
The goal of an investigation, he said, shouldn't just be to root out individuals—whether they are employees, executives, or internal or external partners—who exposed the company to liability or regulatory repercussions. As important as the “what” of a case, is determining the “how and why” of the situation. Why did internal controls fail? How can the findings of the investigation help prevent similar failures in the future?
The investigation plan also needs to determine how all the information that is rounded up will be used. What is produced? When is it produced? Who is it provided to? Who decides on corrective actions or punishment? What follow-up communications or outreach will be needed? Should regulators be apprised of the matter and its resolution? Will the media come calling and, if so, who is properly trained and briefed to handle these interviews?
Finnerty stressed the importance of shaping a comprehensive and productive “pre-investigation environment” that allows a company to, ideally, uncover malfeasance before regulators do. Given the high cost of defending against violations of the Foreign Corrupt Practices Act, for example, and the millions of dollars in fines a company may be on the hook for, being reactive rather than proactive can be disastrous.
In developing an “early warning system,” there should be a full understanding of how the company responds to regulatory violations and policy breaches, he said. Third parties, overseas employees, and foreign partners, need to be just as carefully monitored as those with a desk at headquarters.
Technology-based tools can be a great help in coordinating the many paper trails that need to be consolidated and reviewed, said the panelists. Finnerty, for example, stressed the importance of using a document retention system that can track, sort, and secure data that may eventually be needed or demanded, including e-mails, invoices, memos, and chat logs. These systems can be particularly useful when it comes to piecing together information left behind by former employees and navigating foreign privacy laws when overseas employees are involved.
Those tasked with oversight of internal investigations will require a top-notch support team. “You don't want to put these teams together on the fly,” Finnerty said of the various HR, audit, and forensic accounting specialists the investigation team may require.
There is, however, the “hot rail” of using private investigators as part of that team. Finnerty suggests that, when needed, all external investigators should be pre-vetted, with an approval chain that leads to general counsel. Private investigators should also be apprised of the company's code of conduct and fully instructed to keep the investigation to the limited purview of the job they are hired for.
James Finnerty of TD Bank (left); PepsiCo's Stephen King (center); and Pfizer's Andrew Gaillard, spoke about how to conduct an effective internal investigation.
“Be intelligent,” was the advice of Stephen King, legal senior director and chief compliance investigator for PepsiCo. “Do your homework when it comes to investigations. Put together an investigation plan and understand what is it you are really trying to find out. Drill down on that question.”
Get a Game Plan
King said investigators must resist the temptation to be a cowboy. “There are people in investigations who just want to run out and interview immediately,” he said. “But you need to keep an open mind and you need to be methodical in your investigations. Don't make your investigative plan so locked in that you miss important information.”
A focused game plan should guide many of the initial decisions that need to be made, panelists said. Gathering documents, correspondence, and personnel records before interviews begin helps provide a foundation to build a line of questioning upon.
“Getting documents and e-mail pulled together ahead of time really makes a lot of sense,” said Andrew Gaillard, assistant general counsel, U.S. compliance investigations, at Pfizer. “There's often huge pressure to just get to the person, get the answers, and just get this over with. But it makes sense to get all this information up front, so you can ask intelligent questions and know when you get an answer that's not consistent.”
“Generally when people lie to you they have one really good coherent lie, but if you ask them two more questions they haven't thought down that far,” King said. “You can trip them up if you ask additional questions. Listen not just to what they say, but also for what they omit.”
GOOD INTERNAL INVESTIGATIONS
Below is an excerpt from the CW 2013 presentation, “Tackling the Hardest Issues in Internal Investigations.”
Building Blocks
Tracking and monitoring of regulatory and law enforcement contacts: An early warning tool
Document retention
Investigation teams: Identification and Training
Private investigators: Use and control
Triage and escalation: Review, notice, and updates
The Role of the Investigator
Be intelligent
Be independent
Be intrepid
Be inquisitive
The Investigation Output
What is produced?
When is it produced?
Who is it provided to?
Who decides punishment/corrective action?
What about follow-up communications?
Investigation Scenarios
Investigating the C-Suite Executive
Too Many Cooks – Internal Partners
Too Many Cooks – External Partners
Pressure to Race to the Finish
Overseas Investigations
Source: CW 2013.
Gaillard said that chasing down documents becomes problematic when someone sends confidential documents from a company account to a personal one. At Pfizer, there have been instances where security personnel escorted an employee to their home to remove documents that shouldn't have been saved on their own hard drive. The knowledge that this information was improperly moved came from the IT-based monitoring of employee Internet use. To gain the upper hand, investigators should always know more than the subject assumes they do.
King urged investigators to resist the temptation to start hunting for the person behind an anonymous tip. “All you are doing there is putting a chilling effect into your reporting process,” he said. “People will not want to be straightforward with you if they know they are going to be targeted for coming forward.”
Independence and the backbone to stand up to anyone, no matter what rung of the corporate ladder they stand upon, are qualities an investigator needs to possess, King said. “As investigator you have to be the person who goes out to determine what the facts are,” he said. “If you are lucky, the C-suite gets it and understands you have to be independent. But be prepared to be vilified and have people pull rank on you.”
The job of an investigator “is to figure out what the facts are so you can give them to decision makers, so they can formulate a strategy and offensive or defensive decisions,” King added. “If you don't get them the facts they are going to get the strategy and the plan wrong.”
No comments yet