How-to guide: How to conduct an internal investigation into bribery allegations (UK)

Introduction

This guide proposes appropriate steps for your organisation to take when preparing for and carrying out an internal investigation into allegations of bribery. It is aimed at in-house lawyers and compliance professionals in organisations of all sizes and all sectors in the UK. Your organisation needs a strategy for conducting a thorough internal investigation promptly as soon as credible allegations of bribery come to light. If your organisation self-reports in a timely way to the relevant authorities, with full disclosure of the findings of its internal investigation, this could mitigate any penalties or action taken by the relevant authorities.

This guide considers how to identify bribery allegations, proper management of witnesses and suspects and evidence preservation. It incorporates practical tips to aid you in preparing a strategy for carrying out an internal investigation on suspicion of bribery.

The guide covers the following:

Overview of internal investigations
Considerations at the outset of an internal investigation
Conduct of the internal investigation
Output of the internal investigation

This guide can be used in conjunction with How-to guides: Understanding the Bribery Act 2010 offences, Understanding penalties for breach of the Bribery Act 2010 and How to identify and assess bribery and corruption risk and Checklist: Anti-bribery and corruption risk assessment.

Section 1 – Overview of internal investigations

1.1 Reasons for an internal investigation

There are a number of reasons to conduct an internal investigation into a suspected breach of the Bribery Act 2010 (BA 2010):

to identify whether misconduct has taken place and if so, to take steps to end the conduct in question and therefore limit potential liability;
to provide assurances that your organisation’s Anti-Bribery and Corruption (ABC) Framework is effective and adequate and to manage risk by identifying improvements to internal practices, policies and procedures to ensure compliance with laws and/or prevent a reoccurrence of misconduct;
to help the company to determine which course of action to take (including whether to report the misconduct to the relevant authorities); and
to put the company in a better position of preparedness in the event of an external investigation.

1.2 Whether or not to launch an internal investigation

Once a suspicion of misconduct has been identified, an initial consideration of whether an investigation will be required.

An internal investigation will necessarily involve a lot of time and resources and will likely divert management’s attention from other important matters. As a result, the decision to commence an internal investigation should not be entered into lightly.

Relevant considerations as to whether an investigation should be commenced may include:

the nature of the alleged misconduct, including the risk to the organisation, the potential liability, the likely size and scale of the misconduct;
the possibility that the matter might come to the attention of the regulators;
the ability to effectively conduct an internal investigation (for example, if third parties are involved, are there mechanisms in place to compel their participation in an investigation?);
the risk that any whistleblower might make a complaint directly to regulators if the organisation does not launch an internal investigation; or
the availability of any alternative routes to deal with the allegation.

If further information is required prior to being able to decide, then your organisation may need to consider whether this can be obtained and how (particularly if the allegation is raised via a whistleblower).

Section 2 – Considerations at the outset of an internal investigation

The nature and conduct of each internal investigation will vary depending on the nature and scale of the suspected misconduct. However, there are some general considerations that will likely apply to most internal investigations.

2.1 Preservation of evidence

Evidence of misconduct may be found in a variety of forms – emails, mobile phone data, audio recordings, hard copy materials etc. It is important that evidence be preserved, both to enable the full facts to be established and to allow relevant documents to be available to the company. Ideally, your organisation should have in place processes to preserve evidence in the event of litigation or an internal investigation and these should be implemented. Such measures may include technical measures (such as the suspension of normal document deletion processes) and/or the issuance of litigation/legal holds which instruct staff not to delete documents within scope.

2.2 Privilege

The possibility of maintaining privilege over documents created in respect of an investigation will be an important consideration in an internal investigation – if a document is protected by privilege then it will be exempt from disclosure, including to an investigating regulator. Privilege applies either to:

communications or other documents which were made confidentially for the purposes of legal advice (legal advice privilege); or
communications (or documents evidencing them) between parties or their solicitors and third parties for the purpose of obtaining information or advice in connection with existing or contemplated litigation, when the following conditions are satisfied: (a) litigation is in progress or in contemplation; (b) the communications are made for the sole or dominant purpose of conducting that litigation; (c) the litigation is adversarial, not investigative or inquisitorial.

Whilst a consideration of privilege will be particularly case-specific, it is clear from the high-profile case The Director of the Serious Fraud Office v Eurasian Natural Resources Corporation Limited [2018] EWCA Civ 2006, that there is the possibility to assert privilege even in the early stages of an investigation and before a formal external investigation by a regulator has been commenced.

A comprehensive discussion of privilege as it relates to internal investigations is not within the scope of this note but the complexities and importance of maintaining privilege over investigation documents mean that advice from specialist counsel should be sought at the earliest opportunity and the creation of investigation documents should be limited prior to doing so.

2.3 Responsibility for conduct of the investigation

An important initial step will be to determine who will coordinate the internal investigation and who is best placed to assist.

2.3.1 In-house or external legal advice

In order to seek to maintain privilege, lawyers should be responsible for conduct of the investigation. One of your first considerations will be whether it is appropriate to seek in-house legal advice or if the circumstances require independent external legal advice. This will be determined by the nature of the allegation and the potential issues that may arise. Where considering in-house counsel, you must consider whether they have the expertise to be able to conduct internal investigations.

2.3.2 Conflicts of interest

It is important that the individual or department investigating an alleged breach of the BA 2010 should not have a conflict of interest with the suspect(s). For example, if an allegation is made against members of the legal department, it would be more appropriate to use external counsel as individuals within that department may not be able to carry out the investigation independently.

2.4 Resources

If the investigation is to be conducted ‘in-house’ then there will need to be a consideration of the resources that will be required during the investigation. Depending on the nature of the misconduct and the scope of the investigation this might include:

forensic IT experts;
forensic accountants;
document review platform provider;
language specialists; or
specialist counsel.

2.5 Confidentiality

It is important that the investigation team involved in investigating the allegation comply with confidentiality undertakings both to help maintain privilege and maintain the integrity of the investigation. In practice this will mean:

information only being disclosed on a need-to-know basis;
a decreased risk of information leaking and evidence being deleted;
every step of the decision-making process of the internal investigation being recorded and kept confidential so the steps taken by your organisation are transparent to the Serious Fraud Office (SFO). This will demonstrate that there was no cover-up of information; and
that during the investigation, there should be a continuous review of those involved in the investigation to determine there are no conflicts of interest (eg friendships with new suspects/witnesses).

2.6 Timescales

Approximate timescales should be agreed at the onset of the internal investigation that will depend on the complexity of the evidence to be reviewed and the number of suspects and witnesses. This will allow for prompt reporting to regulators and/or the SFO (if a decision is made to do so). It will also minimise any disruption to your organisation’s business activities (for example, through the hire or redeployment of staff in areas of shortfall whilst those who are suspected and involved in the investigation are suspended).

2.7 Other considerations

Depending on the nature of the alleged misconduct, your organisation may need to consider whether any particular financial or business arrangements or practices should be suspended whilst the internal investigation is ongoing in order to limit the possibility of liability or further liability being incurred.

Section 3 – Conduct of the internal investigation

Internal investigations are likely to consist of two main avenues of exploration – document collection and review and interviews.

How to proceed, and in what order, will be vary from case to case. Some allegations may require exploration with witnesses prior to being able to review for relevant documentation, whereas others may begin with documents which are then put to individuals in interviews. As the interview evolves, re-interviews or further document collection and review may be required as new information comes to light. The need to adapt and respond to new developments over the course of the investigation will be important.

3.1 Document collection and review

3.1.1 Obtaining documents

In order to obtain documents a determination will have to be made as to who documents should be collected from, where those documents exist and any parameters which will limit the scope of documents (such as relevant time periods).

Accurate records of evidence must be collected during the investigation. Evidence might normally include emails, documents, records of telephone calls, reports prepared by consultants and meeting notes etc. Specialists may need to be engaged to collect documents within scope of the investigation.

Issues relevant to document collection include:

any legal issues around the collection of certain types of data or from certain types of devices or locations, particularly if located in another jurisdiction;
availability of documents, in particular when information and communications technology systems are not linked, merged or available;
the methodology used to obtain documents in a manner which is forensically robust and maintains the integrity of the documents collected;
record keeping. It is best practice to record all documents obtained and reviewed (including their storage location and security in line with retention schedules), including details of:
- the collection of original copies of hard copy material (if applicable);
- dates of downloads of electronic material (including location of storage and a backup); and
- the methodology for searching the documents.
access to documents collected should be limited to specified individuals and a record of those individuals should be maintained.

3.1.2 Review of documents

Depending on the nature of the allegation and scope of the investigation, the number of documents yielded may be large (even if limited to certain time periods or custodians). Where the universe of documents is large then the services of a document review platform may need to be employed in order to manage the review. Review platforms allow for various operations to be performed on the data which help to identify relevant documents:

de-duplication;
email threading;
narrowing results by time period, custodian and/or search terms; and
predictive coding through artificial intelligence.

Documents should be reviewed for relevance and a determination made as to whether the documents attract privilege.

3.2 Interviews

3.2.1 Identification of suspects and witnesses

The team coordinating the investigation should promptly seek to identify all relevant suspects and witnesses using internal reports or whistleblowing disclosures. In addition, based on current facts known and the suspect(s), your organisation will need to:

identify line manager(s) of the suspect(s);
provisionally quantify and assess any potential reputational and financial damage using internal or external auditors;
using your ABC Risk Assessment, identify which areas of your ABC Framework may have been compromised by the suspect(s); and
consider whether anyone should be suspended until conclusion of the investigation.

After identifying all known suspects and witnesses the investigators will need to consider how best to interview these individuals and have a clear (but flexible) plan for interviews in place which considers:

who is to be interviewed and the reason for their inclusion;
the order of suspect/witness interviews;
the reason for removal of a suspect/witness; and
arrangements for re-interviews or additional interviews, should they be required.

3.2.2 Considerations prior to conducting interviews

There will be several matters to consider before conducting internal interviews. The relevant considerations will likely vary depending on the circumstances but may include:

any need for mutual legal assistance from a foreign jurisdiction if the suspect/witness is in another jurisdiction;
the location of the interview(s). For example, is there a discreet meeting room within your organisation or would an external location be better?
suitability and consistency of interviewer (ideally this should be an individual who is experienced in interviewing techniques). This will help identify inconsistencies in evidence or contradictions and ensure that similar avenues are explored with witnesses;
independent representation for the interviewee at the interview;
whether an ‘Upjohn warning’ should be given at the start of the interview. Although derived from a US case, these warnings are now becoming common practice in UK investigations. An Upjohn warning informs the employee that the lawyer conducting the interview (i) represents the company, not the employee; and (if privilege applies) that (ii) the communications with the lawyer conducting the interview are protected by legal privilege, and (iii) the company may choose to waive this protection without informing the employee;
what individuals should be told about the investigation;
whether the interviewee is likely to have any queries. This may include the risk of disciplinary action if they refuse to participate in the internal investigation. Relevant information provided by the interviewer will be in accordance with your organisation’s policy. Investigators should therefore be familiar with your organisation’s internal guidance and procedures; or
which documents (if any) should be shown to the interviewee in the course of the interview.

3.2.3 During the interview

Relevant considerations during the interview may include:

what to tell the interviewee. Interviewees should be informed that the internal investigation is a fact-finding exercise, and unnamed past and present staff have been asked to assist;
the use of questions. Interviewers should be encouraged to ask open and non-leading questions. This will help to elicit more of a narrative answer that can be built upon by the interviewee and allows flexibility for the interviewer to follow up the answer with further questions;
the use of information obtained from others. The interviewer should not inform the interviewee what other interviewees have said or not said;
enough flexibility within the interview plan so questions can be modified accordingly;
the identification of others who else could assist the internal investigation through asking questions of the interviewee such as ‘who is best placed or who was responsible for managing…’. These types of question could identify potential witnesses that were not initially identified by the investigators; or
confidentiality: the interviewee should be reminded not to discuss the interview with anyone else (other than their legal representative). Witnesses should be reminded of company policy and practices in the event they are approached by third parties in relation to the issues raised by the investigation.

3.2.4 Other considerations

In cases where the interviewee may have health issues (mental or physical), a medical expert assessment may be required before conducting an interview. Legal advice is best sought in situations such as these.

Section 4 – Output of the internal investigation

4.1 Recommendations

The output of an investigation will usually be recommendations as to next steps. Recommendations may be contained in a formal report which sets out the facts which have been established through document review and interviews and an analysis of the facts within the framework of the BA 2010. Where a report is produced, careful consideration should be given as to whether this can be protected from disclosure by privilege.

Recommendations might include:

taking no further action;
making improvements to your organisation’s ABC Framework;
a decision by management to conduct disciplinary investigations;
self-reporting to the CPS or SFO; or
alerting foreign law enforcement (more than one legal jurisdiction can run investigations into bribery in parallel, such as the UK and US).

If there is no evidence to support the allegation, the suspect should be given the opportunity to return to their employment (if suspended) or continue their business relationship with your organisation.

4.2 Feedback

In some circumstances, it may be appropriate to provide feedback to the individual(s) who initially raised the internal report and made the allegations, if they have requested it. Care should be taken not to waive privilege and to manage confidentiality.

Additional resources

The UK government’s quick start guidance on the BA 2010 is here
The UK government’s guidance about procedures which relevant commercial organisations can put into place to prevent persons associated with them from bribing is here
The Serious Fraud Office
The Department for International Trade
The Organisation for Economic Co-operation and Development
Transparency International