1© 2018 Kirkland & Ellis LLP. All rights reserved.

PRIVILEGED AND CONFIDENTIALATTORNEY WORK PRODUCTATTORNEY-CLIENT COMMUNICATION

Conducting Internal Investigations May 23, 2018

Brigham CannonNicolas Thompson

2

Table of Contents

Overview Best Practices Importance of Following Best PracticesQuestions

3

OVERVIEW

4

Are Internal Investigations Important?

5

Importance of Effective Internal Investigations

The ability to conduct a good internal investigation is a key element of an effective compliance program. Can help to identify and put a stop to undesirable

conduct, preferably when that conduct is in its early stages or limited in scope. Allows a company to get out in front of potentially tricky

legal, public relations, and HR situations. Can help to mitigate liability in government-facing or

private litigation. Assists corporate directors and management in fulfilling

fiduciary duties and other legal duties.

6

Basics of an Internal InvestigationQuestion Response

What is it? An internal review of allegations of potential violations of company policy and/or the law.

Purpose? To determine whether allegations are founded; to put a stop to misconduct; and to remediate any issues.

How does an investigation begin?

Can arise from a variety of sources, including whistleblowers, internal or external audits, and inquiries by government authorities.

What kinds of allegations get reviewed?

Companies usually adopt the policy that all allegations are reviewed at some level, depending on the seriousness.

Who is involved in review?

Typically, internal audit or compliance people, and, depending on the nature and/or seriousness of the allegations and desire to preserve privilege, in-house and outside counsel may be involved. Other subject matter experts may assist.

7

Basics of an Internal InvestigationQuestion Response

How does an internal investigation work?

Legal and/or compliance personnel assess the allegations, typically by conducting investigatory interviews of relevant employees and/or conducting a targeted review of relevant documents.

The scope of the review is tailored to the allegations.

Findings are documented.

A remediation plan is put in place and executed.

What does remediation typically involve?

Depends on the seriousness of the allegations and findings, but can involve employee discipline, including termination, and/or changes to business practices.

Includes a specific plan, with individuals assigned specific roles, to fix issues.

8

Internal Investigations: Potentially Relevant LawsLaw Overview

Foreign Corrupt Practices Act

Prohibits giving value to a government official in exchange for business and/or keeping false records to conceal such conduct. Affects all companies who do business outside of the U.S.

Penalties: Can include criminal prosecution, significant fines, disgorgement of profits, and civil liability.

Examples: Odebrecht / Braskem ($3.5 billion in 2016); Weatherford ($153 million in 2013); KBR / Halliburton ($579 million in 2009).

False Claims Act

Prohibits submitting false claims to the government for payment. Affects all companies who do business with the U.S. government.

Penalties: Can include treble damages; statutory penalties of roughly $11k - $21.5k per claim; and exclusion from government programs.

Examples: DOJ and whistleblowers have recovered billions under the FCA, with a focus on healthcare and financial services.

9

Internal Investigations: Potentially Relevant LawsLaw Overview

Securities Laws

Prohibit a variety of fraudulent corporate conduct, including accounting misstatements, and require corporate disclosures relevant to internal investigations. Affect all publicly-traded companies.

Penalties: Can include criminal and civil liability.

Antitrust Laws

Prohibit price-fixing, collusion, and other anti-competitive behavior.

Penalties: Can include criminal and civil liability.

Employment Laws

Prohibit various forms of discrimination and unethical conduct, including sexual harassment.

Examples: Uber, Weinstein Company, NBC, Fox

Fraud and Embezzlement Laws

Prohibit the improper use or diversion of corporate funds, including expense report fraud.

Penalties: Can include criminal and civil liability.

10

Internal Investigations: Potentially Relevant LawsLaw Overview

Data Privacy Laws

Require expeditious investigation and, often, public disclosure of data breaches.

Penalties: Include substantial fines and reputational impacts.

Examples: Equifax, Target, Yahoo, Uber.

OUS Analogs

Many jurisdictions outside of the U.S. have analogs to most or even all of these laws, and foreign jurisdictions are increasingly active.

Examples: U.K. Bribery Act; recent enforcement actions by Brazilian regulators.

11

BEST PRACTICES IN AN INTERNAL INVESTIGATION

12

Internal Investigations: 10 Best Practices1. Understand the ground rules.

• Internal investigations are essential to identify and stop misconduct, but they are not without risks.

• Internal investigations will result in a factual record that future litigants may try to access and use.

• Preserving the privilege, particularly for more serious issues, is critical.• Ideally, the scope will be broad enough to capture relevant issues, but

targeted enough to minimize disruption and costs.

2. Assess the scope / seriousness of the allegations.• What business(es), product(s) and jurisdiction(s) are potentially

implicated? What are the relevant sales that are implicated?• What is the wrongdoing alleged and how serious is it? E.g., is it a

violation of law or could it result in meaningful liability to the company?• Is management potentially involved in wrongdoing?• Is the allegation of systemic wrongdoing?

13

Internal Investigations: 10 Best Practices3. Staff the investigation appropriately.

• Determine, based on the potential for liability and/or potential seriousness of results, whether to: – have compliance and/or internal audit personnel to lead the review; – conduct the review under privilege at the direction of in-house

counsel; and/or – bring in outside counsel and/or local outside counsel to lead or assist

with the review. • Factors that weigh in favor of engaging outside counsel: meaningful risk

of liability; reputational risks for the company; serious and systemic issues; involvement of management; possible need to interface with government authorities.

14

Internal Investigations: 10 Best Practices4. Devise a strategy to efficiently but thoroughly address the

allegations.• Carefully define the plan and objectives.• Tailor the plan to the seriousness of the allegations, with an eye to

ultimately evaluating and documenting the results of review.– More serious allegations merit more in-depth review.

• Best to adopt a tiered approach, focusing first on the actual allegations and expanding further to other issues if warranted (i.e., don’t begin by boiling the ocean).

• Set deadlines for milestones in the review to ensure progress and manage business expectations.

15

Internal Investigations: 10 Best Practices5. Preserve and review relevant documents.

• Tailor the review to the allegations.• Leverage targeted searching and/or analytics to efficiently identify the

most relevant material.• Ensure a system is in place to collect and preserve documentation in

international locations, where issues can often arise.

6. Conduct effective, targeted interviews.• Tailor the scope and quantity of interviews to the allegations.• Upjohn and confidentiality. • Avoid a tone / approach that would cause employees undue concern.• Use documents strategically. • Limit the scope to the employee’s area of responsibility and personal

knowledge.• Document the interview appropriately.

16

Internal Investigations: 10 Best Practices7. Periodically evaluate progress and findings.

• Check your progress against the milestones established at the outset of the review.

• Periodically reassess potential legal impacts of conduct that is uncovered (i.e., have any disclosure obligations been triggered, like a data breach).

• Provide updates to management as warranted (e.g., a significant expansion of the review or proof of a significant legal violation).

• Adjust the plan if needed.• Helps to maximize efficiency and avoid getting off track.

17

Internal Investigations: 10 Best Practices8. Take steps to preserve privilege.

• If conducted by in-house or outside counsel, take steps to ensure the privilege is protected:– Engage in careful, limited communications, and mark communications

as privileged.– Be thoughtful about reports and documentation that are created.– Conduct the investigation with clear legal supervision, direction, and

purpose.– Non-lawyers and lawyers in business roles should act at the direction

of counsel.– Appropriately limit the scope of personnel involved.

• Protecting the privilege is a significant factor in determining the extent to which counsel—both in-house and external—is involved.

• Standard business reports, like audit reports, are typically not privileged.• Be aware that in some circumstances, getting an individual employee

separate counsel may be appropriate.• Privilege laws, particularly for in-house counsel, vary by country.

18

Internal Investigations: 10 Best Practices9. Be careful in your communications.

• Applicable at every stage of the investigation and important for everyone at the company.

• Internal communications can have both substantive and atmospheric impacts on future litigation, including government investigations.– Example: Biomet FCPA resolution for $22 million in 2012 Non-privileged correspondence from audit department helped to create

detailed narrative of misconduct (e.g., unnecessary, off-the-cuff references to “fraudulent product registration certificates, bribery of customs officials, and other charges as reported to legal via electronic media”).

– Example: Walmart FCPA investigation A hot quote in the media came from an non-lawyer, internal Walmart

investigator drawing a legal-sounding conclusion in a non-privileged email that “there is reasonable suspicion to believe that Mexican and USA laws have been violated.”

• Use the Wall Street Journal or Courtroom Test: Would the employees at your company feel comfortable if their emails appeared on the cover of the WSJ or in front of a jury in a courtroom?

19

Internal Investigations: 10 Best Practices10. Document results of the review and implement a specific

remediation plan.• Document the results of the review, with an eye to privilege issues and

the need for careful communication.• Devise a remediation plan tailored to the conduct and findings, which

can include:– Training– Disciplinary action– Preparation for anticipated enforcement action / litigation– Public relations strategy– Reporting / disclosure

• To be effective, the remediation plan must be specific, and specific owners should be identified for specific tasks/issues.

• Follow up to ensure that the remediation plan has been implemented and that the issues have been addressed.

• The review is not over until the problem has been fixed.

20

Internal Investigations: Review of Best Practices1. Understand the ground rules.2. Assess the scope / seriousness of the allegations.3. Staff the investigation appropriately.4. Devise a strategy to efficiently but thoroughly address the

allegations.5. Preserve and review relevant documents.6. Conduct effective, targeted interviews.7. Periodically evaluate progress and findings.8. Take steps to preserve privilege.9. Be careful in your communications.10. Document results of the review and implement a specific

remediation plan.

21

IMPORTANCE OF FOLLOWING BEST PRACTICES

22

Importance of Following Best PracticesFailure to learn and follow best practices in investigations can have significant, negative impacts:

• Failure to identify key information: Failure to identify key information can have bad consequences when that information eventually surfaces.

• Cost overruns: Inefficient or poorly run investigations can result in significant short and long-term costs.

• Waiver of privilege: Failure to limit communications or to appropriately involve legal personnel can result in needless disclosure of information.

• Heightened penalties: Failure to properly investigate or implement appropriate remediation can dramatically increase the company’s potential exposure, including the risk of prosecution.

• Embarrassment: Failure to oversee a careful investigation and appropriately address issues can embarrass you and your company.

• Loss of employment: Following best practices is typically part of the job. • Obstruction: Conducting an investigation that improperly influences

employees or involves the destruction of evidence can constitute obstruction.

23

QUESTIONS?

24

BACK-UP

25

External Investigations: Key DifferencesDifference Significance

Less control overscope

Government agency or regulator (e.g., the DOJ, SEC) shapes the scope of the investigation and issues to be reviewed.

Increased involvement of outside counsel

Prospect of a government investigation increases need to involve outside counsel to direct and/or conduct the review and to interact with the government.

Government-conducted witnessinterviews

Government may choose to conduct its own interviews of employees, including former employees.

Length and cost Government investigations are typically lengthier and more costly than internal investigations.

Increased public profile

Government involvement can increase public profile of the issue, including by potentially triggering SEC public disclosure requirements.

26

External Investigations: Key DifferencesDifference SignificanceHeightened need for careful communications

Government often requests and reviews internal communications; those communications shape the government’s investigation and its outcome.

Less control over remediation

Government often dictates required remediation (e.g., compliance monitor, corporate integrity agreement, etc.),which underscores the importance of getting remediation right in an internal review.

Increased exposure of management

Government investigations can target individuals, often in management/supervisory positions.