# Internal Investigation Playbook Reference Guide ## Overview Internal investigations are critical for responding to allegations of misconduct, regulatory inquiries, and compliance failures. This guide outlines procedures for conducting effective investigations while preserving privileges and protecting organizational interests. --- ## INVESTIGATION TRIGGERS ### Common Investigation Triggers | Category | Examples | |----------|----------| | Internal Reports | Hotline calls, employee complaints, manager reports | | External Reports | Customer complaints, vendor allegations, media inquiries | | Audit Findings | Internal audit exceptions, external audit issues | | Government Inquiries | Subpoenas, CIDs, search warrants, informal requests | | Litigation | Discovery in civil litigation, whistleblower suits | | Monitoring | Transaction monitoring alerts, exception reports | | Regulatory Examinations | Examination findings, MRAs, consent orders | | Other | M&A due diligence, self-identified compliance gaps | ### Triage Considerations - Nature and severity of allegation - Potential legal exposure (civil, criminal, regulatory) - Number of individuals involved - Geographic scope - Ongoing vs. historical conduct - Media/reputational implications - Regulatory notification requirements --- ## INVESTIGATION PLANNING ### Initial Response Checklist **Immediate Actions (24-72 hours)**: - [ ] Assess nature and scope of allegation - [ ] Determine investigation leadership - [ ] Identify need for outside counsel - [ ] Assess document preservation needs - [ ] Consider interim personnel actions - [ ] Evaluate regulatory notification obligations - [ ] Establish communication protocols ### Investigation Team Structure **Core Team**: - Investigation lead (typically legal) - Subject matter experts - Compliance personnel - HR representative (if employee matters) - IT/forensics support **External Resources** (as needed): - Outside counsel - Forensic accountants - E-discovery vendors - Digital forensics experts - Crisis communications ### Investigation Scope Memorandum Document investigation parameters: - Factual allegations being investigated - Time period covered - Geographic scope - Individuals and entities involved - Key documents and data sources - Preliminary legal issues - Reporting structure - Privilege protocol - Budget considerations --- ## PRIVILEGE PRESERVATION ### Attorney-Client Privilege **Elements**: 1. Communication between attorney and client 2. Made for purpose of obtaining legal advice 3. Intended to be confidential 4. Privilege not waived **Investigation Application**: - Engage outside counsel early - Internal counsel should direct investigation - Mark privileged documents appropriately - Limit distribution of privileged materials - Separate legal from business advice ### Work Product Doctrine **Elements**: 1. Materials prepared in anticipation of litigation 2. By or for attorney or client 3. Protect mental impressions and legal theories (opinion work product) **Investigation Application**: - Document litigation anticipation - Attorney should direct work product creation - Maintain separate files for privileged materials ### Common Privilege Pitfalls | Pitfall | Prevention | |---------|------------| | Sharing with non-privileged parties | Limit distribution lists | | Business advice mixed with legal | Clearly label legal advice | | Forwarding to business recipients | Use privilege designations | | Failure to document privilege | Privilege logs, headers | | Involuntary disclosure | Secure document handling | ### Upjohn Warnings When interviewing employees, counsel must clarify: 1. Counsel represents the company, not the individual 2. Communications are privileged and belong to company 3. Company may waive privilege and disclose communications 4. Employee should not discuss interview with others 5. Employee may wish to consult personal counsel **Documentation**: Document that warning was given and understood. --- ## DOCUMENT PRESERVATION ### Legal Hold Implementation #### Step 1: Issue Preservation Notice **Timing**: Immediately upon reasonable anticipation of litigation or government investigation **Content**: - Nature of matter requiring preservation - Categories of documents to preserve - Custodians and systems affected - Prohibition on destruction/alteration - Contact for questions - Acknowledgment requirement **Distribution**: - All potentially relevant custodians - IT department - Records management - Relevant business units #### Step 2: Suspend Routine Destruction - Identify affected retention schedules - Suspend auto-delete features - Preserve backup tapes (if necessary) - Document suspension #### Step 3: Identify and Secure Sources **Common Data Sources**: - Email (including personal accounts if used for business) - File shares and network drives - Cloud storage - Mobile devices - Messaging applications - Voicemail - Physical documents - Third-party systems #### Step 4: Collection and Preservation - Forensic collection for key custodians - Self-collection with instructions for others - Chain of custody documentation - Secure storage #### Step 5: Monitor Compliance - Track acknowledgments - Periodic reminders - Address non-compliance - Update as custodians/sources identified ### Spoliation Consequences **Potential Sanctions**: - Adverse inference instructions - Issue preclusion - Evidence suppression - Monetary sanctions - Case dismissal (extreme cases) - Criminal obstruction charges (intentional destruction) --- ## INTERVIEW PROTOCOLS ### Pre-Interview Preparation **Review**: - Relevant documents - Prior statements - Background information - Legal issues implicated - Interview objectives **Planning**: - Question outline - Interviewers assigned - Location and logistics - Recording decisions - Interpreter needs ### Interview Conduct **Opening**: - Introductions and roles - Upjohn warning (if appropriate) - Purpose of interview - Ground rules **Questioning Techniques**: - Open-ended questions first - Chronological approach - Follow up on details - Document-based questioning - Clarify inconsistencies - No leading questions (initially) **Documentation**: - Detailed notes - Second person note-taker preferred - Verbatim for key statements - Note demeanor observations - Document exhibits shown **Closing**: - Ask if anything to add - Request relevant documents - Explain follow-up process - Confidentiality reminders - Provide contact information ### Special Interview Considerations **Represented Employees**: - Coordinate with personal counsel - Provide reasonable preparation time - Allow counsel to attend - Avoid interference with representation **Non-Employees**: - Consider formal subpoena process - Voluntary vs. compelled testimony - Different privilege considerations **Potentially Culpable Individuals**: - Enhanced Upjohn warnings - Consider timing in investigation - Prepare for Fifth Amendment assertion - Document invocation --- ## DOCUMENT REVIEW ### Review Workflow 1. **Collection**: Gather documents from custodians and systems 2. **Processing**: De-duplicate, extract text, apply metadata 3. **Culling**: Date filters, search terms, file type exclusions 4. **Review**: Privilege review, relevance review, issue coding 5. **Analysis**: Identify key documents, develop timeline, assess findings ### Privilege Review **First-Level Review**: - Identify potentially privileged documents - Apply privilege tags - Escalate unclear documents **Second-Level Review**: - Senior attorney review of tagged documents - Final privilege calls - Clawback identification **Privilege Log**: - Document identification - Author and recipients - Date - Privilege type claimed - Description (without waiver) ### Technology-Assisted Review (TAR) - Continuous active learning - Predictive coding - Quality control sampling - Validation protocols - Documentation of methodology --- ## INVESTIGATION REPORT ### Report Considerations **Written vs. Oral Reports**: | Factor | Written | Oral | |--------|---------|------| | Documentation | Complete record | Limited notes | | Privilege protection | Higher risk of disclosure | Better protected | | Discoverability | More likely discoverable | Less likely | | Regulatory expectations | May be required | May be sufficient | ### Written Report Components **Privileged Report**: 1. Executive summary 2. Scope and methodology 3. Factual findings 4. Legal analysis 5. Conclusions 6. Recommendations 7. Appendices (as appropriate) **Non-Privileged Summary** (if needed): - High-level factual findings - Remediation steps taken - Process improvements - No legal conclusions ### Presentation to Board/Audit Committee - Oral presentation often preferred - Privileged setting - Document in minutes with care - Approval of remediation plan --- ## COOPERATION WITH GOVERNMENT ### Voluntary Disclosure Considerations **Factors Favoring Disclosure**: - Mandatory reporting obligations - DOJ cooperation credit - Regulatory expectations - Ongoing conduct requiring intervention - Risk of independent discovery **Factors Against Disclosure**: - No legal obligation - Limited exposure - Ability to remediate internally - Privilege concerns - Employee relations issues ### DOJ Cooperation Credit **Requirements for Full Credit**: - Timely disclosure - All relevant facts - Identify individuals involved - Preserve and produce documents - No selective disclosure **Individual Accountability**: - Must identify all individuals substantially involved - Provide all relevant facts about individual conduct - May not limit disclosure to protect individuals ### Regulatory Cooperation - Understand specific agency expectations - Coordinate disclosure strategy - Document cooperation efforts - Maintain privilege where possible --- ## REMEDIATION ### Remediation Planning **Personnel Actions**: - Discipline proportionate to conduct - Consistent with past practice - Document rationale - Consider separation agreements **Process Improvements**: - Root cause analysis - Control enhancements - Policy updates - Training modifications - Monitoring improvements **Documentation**: - Remediation plan - Implementation timeline - Responsibility assignments - Completion tracking ### Demonstrating Remediation to Regulators - Concrete steps taken - Accountability demonstrated - Controls implemented - Ongoing monitoring established - Culture improvements --- ## SPECIAL INVESTIGATION TYPES ### Government Subpoena Response **Immediate Steps**: 1. Verify authenticity of subpoena 2. Engage outside counsel 3. Issue legal hold 4. Assess scope and burden 5. Identify privilege issues 6. Consider challenge/negotiation 7. Prepare privilege log **Production Process**: - Responsive document collection - Privilege review - Bates numbering - Production in required format - Certification if required ### Search Warrant Response **During Search**: - Verify warrant authenticity - Review warrant scope - Request agent identification - Designate company representative - Document everything - Assert privilege claims - Request receipt for items seized **Post-Search**: - Debrief witnesses - Assess scope of seizure - Evaluate privilege issues - Consider motion to return property - Issue legal hold - Engage outside counsel ### Whistleblower Investigations **Special Considerations**: - Anti-retaliation protections - Confidentiality requirements - Potential qui tam exposure - Regulatory notification issues - SEC/OSHA protections --- ## INVESTIGATION METRICS ### Tracking and Reporting | Metric | Purpose | |--------|---------| | Time to commence | Response speed | | Investigation duration | Efficiency | | Substantiation rate | Reporting accuracy | | Repeat allegation rate | Remediation effectiveness | | Disciplinary actions | Accountability | | Process improvements | Learning culture | --- ## KEY CITATIONS - **Upjohn v. United States**, 449 U.S. 383 (1981) - **FRCP Rule 26(b)(3)** - Work Product - **FRCP Rule 37(e)** - Spoliation - **DOJ Cooperation Guidance** - Monaco Memo (2022) - **SEC Cooperation Program** - Seaboard Report - **USSG ยง 8C2.5** - Cooperation credit in sentencing --- *Last Updated: March 2026* *This reference is for informational purposes only and does not constitute legal advice.*