Checklist: Conducting an internal investigation into suspected criminal activity (USA)

Introduction

This checklist will assist in-house counsel, private practice lawyers, and compliance professionals in conducting internal investigations of suspected criminal activity within a company. This checklist is designed to cover suspected criminal activity including but not limited to fraud, theft, and corruption that is committed by employees, non-employees, and other third parties of an organization.

This checklist addresses the following steps:

1. Determining the conduct of the investigation
2. Carrying out the investigation
3. Considering findings and next steps

This checklist can be used in conjunction with the following How-to guides: Mitigating the risk of criminal activity and Understanding white collar crime.

Step 1 – Determining the conduct of the investigation

Step 2 – Carrying out the investigation

Step 3 – Considering findings and next steps

General Notes

Companies may be alerted to potential criminal activity within their organization in a number of ways. Aside from internal audits, security mechanisms, and business processes that may expose illicit conduct, a company may be alerted to potential criminal activity through various other means, including:

• Internal/whistleblower reports – reports of suspected misconduct may be reported internally by someone working for the company. A person who makes such a report is commonly referred to as a ‘whistleblower.’ Employees today expect their employers to take swift action in the face of illegal activity and are more familiar with the laws that help protect their rights. The Whistleblower Protection Act of 1989 protects employees of the federal government from retaliation for reporting wrongdoing so long as their report has a reasonable basis. Whether an employee is the party who lodged a complaint of criminal conduct or merely participates in the investigation as a witness or otherwise, it is critical that companies avoid engaging in any retaliatory conduct towards that employee. It is likewise critical that all employees understand that they are protected from retaliation by either the employer or by other employees, and that the employer will enforce this protection.
• Customer/consumer complaints – every year, millions of complaints are made by consumers against companies. While many consumers file complaints with the business entity they allege committed a violation, an increasing number of consumers are taking the initiative to file complaints directly with governmental authorities. Companies that become aware of consumer complaints of illicit conduct must take those complaints seriously. Leaving consumer complaints unaddressed carries the risk that the consumer may bring their complaint to a regulatory agency that has authority over the subject matter, in addition to the possibility that the issue may attain wider media exposure.
• News/media reports – alleged criminal activity on the part of a company or its employees can leave the company subject to judgment not just by the actual court system, but by the court of public opinion as well. Becoming the subject of adverse attention in the media can ruin a company. Even if the company and its personnel are cleared of wrongdoing in a court of law, losing public favor can do immense harm to a business.
• Law enforcement inquiries or investigations – companies may be contacted directly by local, state, or federal law enforcement agencies regarding potential criminal activity. These inquiries can range from requests for information or documents to formal subpoenas or search warrants, indicating an active investigation into the company or its employees. Prompt and proper legal counsel is essential when responding to such inquiries to ensure compliance and protect the company's interests.

It is critical that companies give credence to any report of alleged illegal activity to ensure that the issue is properly investigated. Conducting an internal investigation may help shield the company from criminal responsibility, by revealing wrongdoing before it becomes criminal, or it may mitigate the penalties imposed. The best-case scenario, of course, is that the investigation will find that the suspicions of criminality are not well-founded and can be dismissed as rumors or gossip.

Legal framework

Although a private business is not always bound by the same constitutional and statutory strictures as government law enforcement would be, there are still legal and practical limitations on an investigation of employees. Many jurisdictions have laws that limit or prohibit monitoring employees in some situations. For example, the federal Stored Communications Act prohibits employers from accessing an employee's personal email account without their consent even if that access is obtained by using a password stored on an employer-issued device. State common law related to privacy may also impose limitations on an employer’s investigation. A collective bargaining agreement, employment contract, or employee handbook may also place restrictions on investigations. Companies should ensure that they familiarize themselves with any applicable legal limitations in relevant jurisdictions before commencing an investigation.

Step 1 – Determining the conduct of the investigation

Before carrying out an investigation, it is important to understand its potential scope and goals. This will help a company to put in place the necessary resources to support an effective internal investigation.

1.1 Understand the nature of the suspected criminal activity

The first step in conducting an internal investigation is understanding the nature of the suspected criminal activity in issue (while understanding that once an investigation begins, the subject matter of the investigation can be multifaceted and may evolve as the investigation ensues).

Understanding the nature of the suspected criminal activity will assist in deciding whether an investigation should be performed by outside counsel or an outside investigator, or by internal personnel. Where the suspected criminal activity involves serious allegations of misconduct, there is a higher likelihood that the investigation will be more closely scrutinized by lawyers, arbitrators, and the courts. In such instances, it is valuable to hire an outside investigator with the necessary training and experience to conduct a thorough investigation.

Companies should develop a classification system to categorize alleged criminal activity. A classification system can help determine which experts and other resources are needed to perform an investigation. The bases for the classification system may include, but are not limited to, the following:

• the laws, regulations, or directives violated by the suspected criminal activity;
• the parties involved in the suspected criminal activity;
• the types of issues implicated by the suspected criminal activity (eg, fraud, corruption, information security, security of physical property and assets, etc) and the potential liability of the company;
• the function or department of the company generally responsible for the issues implicated by the suspected criminal activity (eg, health and safety, cybersecurity, corporate responsibility/governance, human resources, etc);
• the potential financial impact or loss to the company; and
• the potential reputational damage or public relations implications.

There is no one-size-fits-all system, and companies should assess the value of utilizing one or more of these bases to best determine the resources and skillsets needed to perform an internal or external investigation.

1.1.1 Employee or agent activity that could implicate the business

A company may be liable for the criminal conduct of its employees or agents when such employees or agents were acting within the scope and nature of their employment when they engaged in the criminal conduct with the intent to benefit the company. In these instances, companies must have the ability to recognize the circumstances and types of behavior that may implicate the business.

For more information, see How-to guide: Understanding corporate criminal liability.

Well-founded allegations of criminal conduct on the part of an employee or agent often carry considerable consequences – for the employee/agent and the company. Criminal conduct may lead to severe penalties. In addition, the reputations of the employees and the company may be at stake, which can affect the future success of the business. Additionally, the more significant the alleged conduct, the more likely that law enforcement authorities, lawyers, and courts will scrutinize the investigation processes and procedures utilized. Where investigation processes or procedures lacked diligence or were otherwise flawed, this can result in legal exposure for the company by leading to an inference that the criminal conduct uncovered by another subsequent investigation was condoned or willfully ignored.

Companies may have distinct internal departments to address different types of potential wrongdoing. Certain internal departments may be well-equipped to investigate activity related to employment. Utilizing these established internal departments to investigate relatively minor violations is usually efficient and economical. However, in cases where the alleged conduct involves serious violations, companies should consider hiring external experts who will be objective and thorough in their investigation (and, equally important, will generally be perceived as objective and unbiased) and whose practices can withstand scrutiny if regulators or courts become involved.

For more information, see How-to guide: Understanding white collar crime.

1.1.2 Unrelated employee activity

There may be instances in which employees are suspected of engaging in criminal activity that goes beyond the scope of their employment. For instance, an employee’s unauthorized use of business facilities, theft, embezzlement, or commission of economic espionage would generally fall outside the activities normally deemed to fall under employee activity and therefore would not attract liability for the company. Companies must be able to make the distinction between related and unrelated employee activity to properly assess any potential liability that may fall on the company and develop an appropriate investigative plan.

1.2 Determine the goals of an investigation

One of the most important factors to consider is the ultimate goal(s) of an investigation into suspected criminal activity. In some instances, the goal may be simply to prove or disprove an allegation or suspicion of criminal conduct. In other instances, the goal may be to probe into conduct that may be criminal and that is believed to be affecting the operations and reputation of the company.

While the specific goals of an investigation may vary depending on the circumstances, the ultimate goal of any investigation should be to uncover the truth of what occurred during an incident or series of incidents. No matter the specific issue or course of conduct being investigated, companies should focus on getting a full understanding of events. The potential for civil or criminal liability should be recalled, but should not guide the investigation – that is, possible wrongdoing should not be covered up or minimized. Let the picture of the events be ‘warts and all.’

Below, a number of possible end-goals of investigations are explored.

1.2.1 Providing information to law enforcement

While businesses are generally not required to coordinate with law enforcement before conducting an investigation, some laws and regulations may require certain disclosures to law enforcement and government regulatory bodies with enforcement powers. For instance, federal regulations require financial institutions that suspect criminal activity to report such activity by electronically filing a Suspicious Activity Report (SAR) with the Financial Crimes Enforcement Network (FinCEN) within the Department of the Treasury. Additionally, depending on the language of the contracts a company has entered into with third parties, it may have obligations to adhere to affirmative disclosure requirements as a function of those agreements.

A company should consider the benefits of informing law enforcement of internal criminal activity, as well as to provide information regarding the investigation being conducted by the company. Cooperation with authorities may help companies highlight exculpatory evidence for law enforcement and regulators and will often help to minimize any consequences to the company from the illegal activity (eg, voluntarily self-reporting a breach of the Foreign Corrupt Practices Act (FCPA) may eliminate or mitigate penalties or sanctions, see How-to guide: How to self-report a suspected FCPA breach). Additionally, coordination can help protect the company against liability for illegal acts of its employees by eliminating any perception that the company is concealing illegal conduct or otherwise obstructing an investigation conducted by enforcement authorities.

1.2.2 Reputational damage control

Reputational damage can result in lost revenue, lost opportunities for business partnerships, rapid turnover of employees, and the loss of trust in the company by the board or other stakeholders. Additionally, customers and potential customers who become aware of negative publicity surrounding a company may turn away from that company to avoid any affiliation or perceived support of a company embedded in controversy.

Company investigations should be conducted in a manner that allows the company to uncover the truth whilst also upholding its reputation in the public. If disclosure is necessary (as, for example, in the case of a publicly traded concern), the disclosure should note that responsibility for the investigation has been delegated to unbiased, competent professionals from within or outside of the company.

1.2.3 Ensuring compliance

An important goal of any investigation should be to ensure the company is compliant with any laws and regulations applicable to the company’s business. If non-compliance is uncovered, the company will be in a position to take steps to mitigate the damage from a violation, and also to minimize the possibility of future violations.

For further information, see How-to guide: How to build a culture of antitrust law compliance.

1.3 Decide who will conduct the investigation

While a company may select internal or external personnel to conduct an investigation, ultimately, the company must ensure the investigator has the requisite training, experience, discretion, and perseverance to perform in their investigatory role.

1.3.1 Management – directors

Managers and directors will often come up against issues in the workplace that require an investigation.

Managers and directors must promptly respond to allegations of criminal activity. In many instances, problems that arise can escalate over time and have a significant impact on productivity and morale within the workplace. Therefore, management should take a proactive approach to coordinating investigations of criminal activity, as opposed to expecting that the issues will be resolved on their own.

Depending on the severity of the alleged activity, management may be able to conduct an internal investigation on their own or choose a neutral individual or team within the company that can conduct an investigation. Having managers or directors conduct an investigation is appropriate for low-level offenses that will not result in serious implications for the company as a whole. If the investigation should uncover potentially more serious misconduct, the manager or director should refer the investigation to other departments.

Companies should ensure that managers and directors are accountable for initiating the established investigation protocols as soon as possible. Where the matter is sufficiently low level for the conduct of the investigation to be led by a manager or director, they should treat all personnel with fairness and respect throughout the process. Companies should also make certain that management keeps the focus of the investigation only on those issues relevant to the suspected conduct, instead of using the investigation as a vehicle to conduct a ‘fishing expedition’ into the employee at issue.

1.3.2 Legal counsel

In certain cases, it may be most appropriate for in-house counsel to conduct the investigation into criminal activity. When in-house counsel has expertise in the subject matter of the investigation, and when the relationships they have with the implicated employees are not likely to impact the quality or results of their investigation, directing in-house counsel to investigate the matter may be the most prudent course of action.

However, where close or long-standing relationships have been formed with the employees alleged to have committed illegal activity or where there may be potential conflicts of interest, it may be more appropriate to utilize outside counsel to conduct the investigation. In such instances, the role of in-house counsel should be limited to advising on issues related to the investigation and the protection of the business (eg, supervising outside counsel’s activities and billable hours).

1.3.3 Human Resources (HR)

The HR department often plays a crucial role in internal investigations, particularly when the suspected criminal activity involves employees and impacts workplace conduct, policy violations, or employee relations.

HR professionals are typically well-versed in company policies, employee rights, and the nuances of workplace dynamics. They can ensure that investigations are conducted fairly, consistently, and in compliance with labor laws and internal guidelines. HR's involvement is especially valuable for:

• Handling employee interviews: HR can conduct sensitive interviews with employees, ensuring they understand their rights and that the interview process is respectful and compliant.
• Addressing employee concerns: they can manage any employee welfare issues arising from the investigation, such as concerns about retaliation or workplace disruptions.
• Maintaining confidentiality: HR is accustomed to handling sensitive information discreetly, which is vital in criminal investigations.
• Implementing corrective actions: should misconduct be confirmed, HR can lead the process of administering appropriate disciplinary actions or other resolutions in line with company policy and legal requirements.

However, for allegations involving senior leadership, or those requiring specialized legal or forensic expertise, HR may need to collaborate closely with legal counsel or external investigators to maintain objectivity and ensure the investigation's thoroughness and defensibility.

1.4 Decide whether external forensic experts are needed

Forensic experts can be invaluable to an investigation into suspected criminal activity. Forensic experts apply scientific methods and principles to the identification, analysis, and categorization of evidence related to a crime. The practices and procedures used by these experts can assist not only in uncovering evidence of criminal behavior, but also in embedding standards of integrity in the company, which may help protect the business long term.

A company will probably need to decide whether to hire a forensic expert depending on the nature and extent of the criminal activity alleged. In deciding whether to hire a forensic expert, assess what type of crime may have occurred and whether internal personnel have the knowledge and experience necessary to investigate that type of crime. The use of the following types of forensic experts might be relevant, depending on the nature of the suspected misconduct:

• forensic accountants – forensic accountants can play a pivotal role in an investigation related to potential financial crimes and can help readily identify financial misconduct so that a company can quickly address and resolve the wrongdoing;
• technical/scientific forensic experts – forensic experts typically have access to forensic data analytics tools, which enable them to identify, preserve, and review large volumes of information to uncover crime and achieve legal and regulatory compliance. Forensic engineers, evidence technicians, and crime scene forensic specialists are some of the forensic professionals whose work focuses on physical evidence recovery and preservation. Based on the particular type of criminal acts being investigated, companies should assess whether one or more of these specialists may be useful in preserving and fully examining any physical evidence that may be available; and/or
• digital forensic experts – digital forensics involves the application of scientific methodology to discover evidence from digital devices (eg, work computers, laptops, USB drives, disks, and mobile phones). When a company needs to locate, recover, and preserve digital data, it is wise to consider hiring a digital forensic expert who can perform these functions.

Selection of an expert requires evaluation of a proposed expert’s professional credentials (including licenses or certifications), experience, and reputation.

1.5 Determine which internal resources will be required

A key issue for a company to consider is the type of internal resources that will be necessary to investigate potential criminal activity. This consideration should begin with an assessment of the individuals within the company who may need to be involved in the investigation. This assessment will help guide the determination of whether to conduct an internal investigation or hire outside experts to investigate.

1.5.1 Management and directors

Managers and directors may serve as a resource for an external team hired to investigate the matter. They may be the party that raises a suspicion of alleged criminal activity, may be an important witness, or they may be helpful in ensuring that employees are able to participate in and comply with an investigation. Managers or directors may also provide helpful information about the departmental or corporate culture that will inform internal investigators and give ideas about how to proceed with the investigation.

1.5.2 Current employees

A current employee may be the party who initially brings the allegation of criminal activity to management or files a complaint regarding such activity. Current employees can also serve as key witnesses who provide their observations concerning the criminal activity, which can help the company promptly investigate and resolve the matter.

1.5.3 Former employees

Ascertaining the circumstances surrounding the suspected criminal activity may require the involvement or investigation of a former employee. Companies should consider whether they are bound by any legal duties that necessitate action or whether investigating such issues or former employees may simply amount to good business practices. The value of involving or investigating former employees must be weighed against the fact that the investigation will require the participation of those former employees and that the company no longer possesses any control over them.

A company may encounter situations where a former employee files a complaint or is the subject of a complaint filed by a current employee. Any obligations a company has to investigate the complaint of a former employee or a complaint against a former employee will depend upon the applicable laws, the particular conduct alleged, and business realities. For instance, where a former employee alleges that a current employee committed harassment or discrimination against them, the company has a duty to investigate and take corrective action. However, a company may not have the same duties if a former employee files a complaint for misconduct that occurred so far in the past that legal action cannot be taken and the employee who committed the misconduct is no longer employed by the company.

1.5.4 Company security team

Depending on the size and resources of a company, it may be valuable to employ an internal security team. Security teams can assist with an investigation of crime and may operate in cybersecurity for the protection and security of information and intellectual property.

Step 2 – Carrying out the investigation

An organization’s investigation team should have in place a clear (but flexible) plan for the conduct of the investigation. The nature and conduct of each internal investigation will vary depending on the nature and scale of the suspected misconduct. Internal investigations are likely to consist of two main avenues of exploration – document collection and review, and interviews.

How to proceed, and in what order, will vary from case to case. Some allegations may require exploration with witnesses before being able to review for relevant documentation, whereas others may begin with documents which are then put to individuals in interviews. As the interview evolves, re-interviews or further document collection and review may be required as new information comes to light. The need to adapt and respond to new developments over the course of the investigation will be important.

2.1 Establish what information from the interview will be privileged or protected

Companies often fail to conduct investigations in a way that allows them to safeguard the information gathered during interviews and certain communications as being privileged or protected information. Protecting this information is critical for the investigation, as this protection gives the company and the parties involved in the investigation the best opportunity for open and honest communication.

2.1.1 Attorney-client privilege

Generally, attorney-client privilege protects communications between individuals in confidence as a means to seek, obtain, or garner legal assistance, so long as the attorney-client privilege is not waived. In determining whether communications are privileged, the following questions must be answered:

• Has there been a communication?
• Was the communication made in confidence?
• Was the communication made to or made by an attorney?
• Was the reason for such communication related to the client’s (ie, the company, not the individual's) purposes in seeking representation?
• Was privilege waived?

In assessing the answers to these questions, it is useful for companies to keep in mind the fact that there are limitations to waiving attorney-client privilege that can help protect the company. For example, where a written legal memorandum is labelled as ‘Confidential – Protected by Attorney-Client Privilege’ but is inadvertently included with other, non-privileged material sent to a public relations consultant, this would be an inadvertent waiver of privilege. If, however, the consultant sees the memorandum and calls the attorney to ask what they should do with the memorandum, the attorney says to return it immediately, and the consultant does so, there has been no waiver of privilege.

At the same time, companies must consider some of the exceptions to privilege that may exist (eg, when disclosures of harm or the threat of imminent harm to people, or disclosures regarding the planning of any ongoing crime, are made).

2.1.2 Other evidentiary privileges

Outside of attorney-client privilege, other privilege exists to potentially protect communications made during the course of an investigation. The ‘common interest privilege’ extends attorney-client privilege to situations in which communications are disclosed to third parties, as long as the third parties share a common legal interest with the party that disclosed the communication. Companies should take into account the additional protections that may be offered under the common interest doctrine, as it may be particularly useful in situations where a disclosure has been made between joint defendants in a legal proceeding.

2.2 Decide who to interview

As interviews are a key part of an investigation into criminal activity, companies need to understand the parties who should be interviewed. This requires careful planning, the creation of a welcoming environment, the assessment of the initial complaint regarding the alleged criminal conduct, and the creation of specific questions to be addressed by specific parties during an interview.

The general aim of an investigative interview is to obtain accurate, reliable, and actionable information from a party (eg, a witness or the suspect, etc) to determine the truth of the issues being investigated.

The various subjects for interview might include:

• employee/person who reported activity – where suspected misconduct has been reported, interviewing the person who reported it is usually a good place to start in an investigation. Companies have a legal duty to protect the individual who reports suspected criminal activity from retaliation, such as adverse employment actions (eg, demotion, denial of overtime or promotion) and safety threats;
• employee(s) under suspicion – following an interview of the complainant, in most cases, the next step should be to interview the employee under suspicion. To ensure the company’s ability to take the appropriate corrective action, it is important that companies avoid predetermining the employee’s guilt or innocence;
• associates/subordinates of suspected employee – aside from the complainant and the employee under suspicion, it is also important to interview associates and any subordinates of the suspected employee. Interviewing associates and subordinates is typically done after interviewing the complaining party and the suspect employee. The process of interviewing associates and subordinates may shed new light on facts unknown to both the complainant and the subject of the investigation; and
• former employees – former employees may know critical information about the suspected criminal activities under investigation. It is important for companies to recognize that former employees have no duty to cooperate in an interview or larger investigation unless they are contractually or otherwise legally bound to do so (eg, if their professional licensure requires them to cooperate). Companies should also seek advice from counsel if there is a need to share confidential or privileged information with the former employee to gain their full cooperation in the investigation.

While a private organization is generally not subject to any legal requirement to ensure an employee has access to independent counsel, allowing representation during an interview may encourage cooperation and mitigate concerns about fairness.

After interviewing employees and other parties, it will be important to determine the credibility of each witness to have the ability to make accurate conclusions to be used in resolving the investigation.

2.3 Interview and investigate employees

An investigator must approach interviews through a procedural lens to ensure the information received is not only helpful to the investigation but also credible. These procedures include protecting against coercion, keeping a record of the interview, and properly limiting the scope of the interview to the potential criminal activity being investigated.

2.3.1 Protect against coercion/coercive atmosphere

As a first step, investigators should refrain from engaging in threatening language, promises, or rewards, all of which can give the impression of coercion. If an interviewee is represented by counsel, an invitation for the interviewee’s attorney or other representative to be present should also be extended.

As a best practice, interviewers and the company should not make promises regarding the confidentiality of the information provided. While it is permissible to state the company’s goal of protecting privacy, the interviewee may be hesitant to cooperate further at a later date if they believe they were falsely led to believe their responses would be kept confidential. Making a statement regarding the fact that no guarantees can be made about the confidentiality of the information provided by the interviewee may also help develop an environment of transparency, which may aid in the interviewee’s ability and willingness to provide honest answers to the questions asked.

If legal staff members are involved, at the outset of the interview employees who are being interviewed should be advised that the legal counsel for the company represents the company and not the employee. Communications with counsel will be privileged; however, that privilege belongs to the company and may be waived or asserted only by the organization, at its discretion. See Upjohn v United States, 449 US 383 (1981).

2.3.2 Keep record/transcript of interview

It is important to create a transcript or other record of each interview conducted throughout an investigation. Keeping a correct and detailed record of the interviews will ensure that no information gathered during the interviews is lost during the course of the investigation. Where an investigator opts to keep notes or a written record of an interview, the interviewer should request that the interviewee reviews and signs the record prior to leaving the interview. Alternatively, if notes from the interview will be finalized at a later time, the interviewee should be informed before leaving that the interviewer will reach out to them within a certain number of days to have them verify the accuracy of their recorded statements. It is important to note that issues of privilege and work product may arise with regard to records or reports of interviews conducted. Organizations should consult with legal counsel to ensure that, if interview records are created, those records will be protected as privileged materials.

If an audio or video recording will be made of the interview, be sure to obtain the consent of the interviewee and their counsel before proceeding. Not every jurisdiction requires the consent of both parties before a recording may be made, but it is best practice to obtain consent beforehand, to avoid any subsequent complaints.

After an interview is performed and the record of the interview is verified, the company should maintain this record in a secure location to help preserve privacy and ensure that it can be utilized throughout the investigation and in any subsequent legal proceedings.

2.3.3 Limit the scope of the interview to suspected activity

The scope of any interview should be kept to the facts and circumstances related to the suspected criminal activity. To do so, it may be necessary to conduct preliminary interviews of witnesses who are unconnected to the suspected activity (eg, document review and retention personnel and personnel in control functions who have a thorough understanding of company policies and norms). Conducting preliminary interviews will ensure that the individuals conducting the investigation gain clarity and context regarding the suspected criminal activity, as well as the ability to properly narrow the investigatory interviews to only those issues related to the suspected criminal activity.

Depending on the size and resources of the company, and the extent of the criminal activity alleged, companies should strategically make a decision about whether preliminary interviews are necessary before interviewing the key parties and witnesses.

2.4 Determine whether other means of gathering information are required

Besides gathering information from interviews, the other major task involved in any corporate investigation into criminal activity is gathering documentation or other evidence of a crime. Common and useful methods of doing this include conducting physical searches of the company’s premises and monitoring employees. Monitoring employees has become increasingly important, especially since the emergence of remote work. While most companies use some basic form(s) of monitoring to ensure productivity amongst employees, companies should be familiar with applicable laws before monitoring employees in the context of an investigation into criminal activity.

Documentation and other evidence may come from a number of sources:

• Physical search of premises – conducting a physical search of premises can support or nullify allegations of wrongdoing. A physical search can be conducted by security personnel (either internal or hired from outside the company) to locate documents, objects, and other information essential to the investigation. Depending on the type of criminal activity alleged, a company may want to consider executing a physical search of workspaces, offices, common areas, or other spaces that may reveal information about the alleged crime.
• Review of CCTV – for companies that utilize surveillance cameras, the footage from those cameras should be reviewed by security personnel and management to assess whether a crime was committed.
• Physical search of employee belongings – if a company suspects criminal activity, companies usually may request to search the belongings of employees before they enter, and prior to leaving, company premises. However, the company should request the consent of employees before physically checking their personal effects on business premises and should avoid singling out any one employee.
• Search of electronic documents and physical notes – under the Copyright Act, companies generally have ownership over documents and written works prepared by employees within the scope of their employment. This may include physical and written documents, as well as employee notes that are maintained by an employee.
• Search of employee emails – a search of an employee’s work emails may also turn up evidence. The federal Electronic Communications Privacy Act makes it clear that workplace email is the property of the employer, and the employee has no expectation of privacy in their work email. If the employer owns the computers and operates the networks, the employer may read and monitor an employee’s email, as long as there is a valid business purpose for doing so. Note that the National Labor Relations Board has held that work email may be used for union-organizing activity, so an employer’s right to monitor emails could be limited by a Board order. Whether an employer may monitor or read an employee’s personal emails depends on state privacy laws. Note that many state laws prohibit employers from requiring employees to provide employers with their social media log-in information.

2.5 Evaluate the interviews and other information gathered

After conducting interviews and gathering other evidence, investigators must evaluate the information obtained. With respect to interviews, the evaluation may entail, for example, a review of any recordings made or notes taken during the interviews, the parties present during the interviews, and any observations or impressions of the interviewees (eg, their demeanor, whether they were forthcoming in their responses, whether the information they provided is readily known to be true or false or able to be confirmed, etc). With regard to other evidence collected, this evaluation may entail, for example, a review of what information was gathered, whether the evidence was corroborated by interviews (or vice versa), and whether any conclusions may be drawn from the evidence obtained. This evaluation process is essential in determining whether any new or relevant information was discovered in relation to the larger investigation, and whether and how such information corresponds to the facts already gathered. This evaluation process is also pivotal to the determination of whether subsequent interviews, searches, or other investigative steps may be necessary.

Step 3 – Considering findings and next steps

The final step in an investigation is determining what to do with the outcome of the investigation.

3.1 Review the results of the investigation

Once the investigation is complete, the results should be reviewed. The review should include legal counsel and senior management who can determine the outcome of the investigation. Generally, the outcome of an investigation will include a finding that there was either no misconduct or that there was misconduct and that further action is needed (eg, employee disciplinary action). If misconduct is found, the company should consider whether the employees or supervisory personnel who are immediately responsible for the employees who committed the misconduct, or the part of the company in which the misconduct occurred, should be included in the review (unless they are directly or indirectly involved in the misconduct as accessories or co-conspirators). However, companies should ensure that counsel assesses issues of privilege over any investigative evaluations or reports made before including the offending employee’s larger department or other personnel.

The review should attempt to determine the exact criminal laws that were or that may have been, broken. The review should also look for possible defenses to criminal charges or mitigating factors that would lower the impact of any potential criminal sentence.

3.2 Check whether a report should be made

Companies generally do not have legal obligations to monitor for criminal conduct. However, once they become aware of such conduct, a company may have duties to report criminal conduct. Understanding whether, how, and to whom a report of criminal activity should be made is crucial for properly addressing potential violative activity.

3.2.1 Required reporting

In some circumstances, organisations must report suspected criminal activity. A financial institution, for example, is required to file a Suspicious Activity Report (SAR) no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing such a report. See further How-to guide: How to identify suspicious activity and make a Suspicious Activity Report (SAR).

3.2.2 Discretion to report

In many cases, a company is under no legal obligation to report suspected criminal activity. Many companies refrain from reporting relatively minor crimes, fearing the negative publicity that may come from such a report. Others prefer to handle the matter internally, by terminating the employment of dishonest employees. In deciding whether to report suspected criminal activity, some considerations may include:

• whether a legal duty to report the type of misconduct discovered exists in the relevant jurisdiction;
• the potential benefits to be gained by self-reporting versus the likelihood that the misconduct would otherwise come to light and the ensuing potential financial, reputational, or other damage to the company if not self-reported and subsequently discovered by enforcement agencies;
• the company’s written policies regarding reporting misconduct; and
• whether reporting misconduct may act as a deterrent for other employees.

The benefits of self-disclosure should also be considered. Sentencing guidelines often consider self-reporting to be a mitigating factor in calculating a sentence. For an example in the context of the FCPA, see How-to guide: How to self-report a suspected FCPA breach. Self-reporting also has the advantage of making the process conclude more quickly than it might otherwise.

3.3 Contact and negotiate with law enforcement

Reporting a criminal offense is a decision that should not be taken lightly. Negotiations regarding the terms of the reporting – for example, negotiating immunity, if possible – should be undertaken before any final report is made.

3.4 Consider whether the matter can be resolved without law enforcement intervention

Not every offense requires the intervention of law enforcement. Some misconduct may be dealt with adequately, and to the satisfaction of the company, by other means. For instance, companies may, instead, elect to discipline the employee who committed the misconduct, or form an agreement with the employee that involves closer monitoring of their workplace conduct.

3.4.1 Settlement of civil claim

Many crimes also give rise to civil causes of action. A resolution with the victim of a potential tort claim may cause the criminal case to be deemed unnecessary. For example, a victim of fraud on the part of the company may decline to assist in a prosecution if the matter is resolved by a private settlement of a civil claim for fraud.

Note that settlement of a civil claim will not be a defense to a criminal prosecution, even if the victim or prosecutor is less willing to pursue the claim. Note also that a non-disclosure agreement in a civil settlement will not prevent a witness from being called to testify in a criminal matter.

3.4.2 Employee suspension or termination

If an investigation leads to the conclusion that one or more employees are responsible for criminal activity, they should be suspended or their employment terminated. If the company plans to self-report the employee’s misconduct, it is typically preferable to place the employee on a suspension, so that the employee is still obligated to cooperate with any further investigation. A non-disclosure agreement, preventing the employees from commenting publicly about the occurrences, should be obtained if needed.

Additional resources

Related Lexology Pro content

How-to guides:

Understanding white collar crime
Understanding corporate criminal liability
Mitigating the risk of criminal activity
How to protect your company from violations of the United States Foreign Corrupt Practices Act
How to protect your organization from third party liability under the FCPA
How to self-report a suspected FCPA breach

Checklists:

Anti-bribery risk assessment
What to include in a FCPA compliance program
FCPA due diligence of third-party intermediaries
Charitable and political donations and gifts, travel, entertainment compliance 
Completing criminal background investigations

Reliance on information posted:

While we use reasonable endeavours to provide up to date and relevant materials, the materials posted on our site are not intended to amount to advice on which reliance should be placed. They may not reflect recent changes in the law and are not intended to constitute a definitive or complete statement of the law. You may use them to stay up to date with legal developments but you should not use them for transactions or legal advice and you should carry out your own research. We therefore disclaim all liability and responsibility arising from any reliance placed on such materials by any visitor to our site, or by anyone who may be informed of any of its contents.