When the whistle blows: responding to an incident

However to be effective, a whistleblowing system must be accompanied by an effective process for dealing quickly and appropriately with the identified issues. Two of the most important considerations for an in-house lawyer tasked with responding to an issue will be:

• how to scope and progress the internal investigation; and
• whether to self-report the matter to authorities.

The investigation

Whistleblowing policies are typically aimed at incidents of business crime, health and safety and other regulatory and reputational issues. Business crime-related issues can take a number of forms including bribery, fraud on the company, fraud by the company, follow-on accounting issues and breaches of money laundering regulations. Often one report will include a number of elements.

The temptation is to jump straight in and start investigating. However, it is worth taking a step back to try and identify the full breadth of the potential exposure for the company together with the options that are available, and the risks they carry. Serious and long- term difficulties can arise if action is not properly thought through and planned.

First response

When a whistleblower complaint concerning potential business crime issues is received, there are a number of initial considerations, which if addressed promptly may help the company avoid, or at least limit secondary problems arising later. For example:

• ensuring the ownership and control of the company response is clear;
• putting in place the right investigation and response team;
• ensuring the aim and scope of any investigation is clear;
• considering the role, if any, of outside advisers;
• establishing and maintaining privilege where possible (and understanding the limits of privilege in relation to each jurisdiction concerned);
• considering any mandatory obligations or voluntary options to report to authorities (or other parties);
• stopping the alleged behaviour if it is on-going;
• identifying potential litigation and regulatory risk; and
• executing and controlling an internal and external communications strategy.

Gathering evidence

The effectiveness of an internal investigation will depend to a great extent on the documentation, both in hard and soft copy form, that is gathered. When gathering documents, the three common practical issues will be:

• how best to preserve the information;
• how to collect the information; and
• how to review the information.

Preservation and collection of soft copy documents is typically much easier than hardcopy. It can often be achieved without the knowledge of those who may be the subject of the investigation, and dealt with comprehensively at an early stage.

To preserve documents quickly, it will assist if you already have a good understanding of how and where information is stored, how your back-up processes work and any practical obstacles to retaining information created or stored on mobile devices.

The scale of and methodology for the review of documents will depend upon the scope and aims of the investigation. Just because material is preserved and collected does not mean it has to be reviewed.

As part of the planning for dealing with documents, consideration needs to be given to applicable data protection laws in the relevant jurisdictions. If follow-on litigation is anticipated, be aware that obligations may arise in that context requiring the preservation of documents.

Interviews: who, where and when?

A number of practical issues need to be settled before conducting any interviews. The decisions taken here should again reflect the aims and scope of the investigation.

Consider:

• Who should be interviewed?
• Who should conduct the interviews (in-house counsel, external lawyers, regulators or others)?
• When should the interviews be conducted?
• Where should the interviews be conducted (in your office, in the offices of external lawyers, or in a neutral location, such as a hotel)?

A question often arises as to the form and value of interview notes. Notes will usually need to be taken to progress the investigation and to record the interviews for any future purposes. However, those notes may not necessarily be privileged and even if they are, an authority may subsequently look for that privilege to be waived in order to demonstrate full co-operation. Bearing this in mind at the outset may influence how you conduct and record interviews.

You will also need to consider employees’ rights (particularly those relating to whistleblowers) in the interview and in relation to any separate disciplinary process which may follow.

Self-Reporting

Is there a need to self-report?

Self-reporting any issues to the authorities may help to limit the damage caused to your business, both in legal and reputational terms. In the UK, for example, the SFO has now entered into two Deferred Prosecution Agreements^[1] with organisations that self-reported, allowing those organisations to avoid damaging – and public – convictions.

In the rush to protect the company, however, a fundamental question can often be overlooked – is self-reporting mandatory, or is it a matter of discretion?

If money laundering issues do not arise, the answer will normally be that there is no positive obligation to report.

If money laundering issues do arise, it will almost certainly be sensible to submit a Suspicious Activity Report to the National Crime Agency, so that the statutory defence under the UK Proceeds of Crime Act 2002 can be relied upon, but even then there is no obligation to report.

If there is no obligation to report, you will need to consider whether to self-report on a voluntary basis. This decision may need to be re-visited if circumstances change.

Critical questions to consider:

• Does the information raised by the whistleblower suggest that criminal property has been created?
• If so, has that property, or any part of it, been dealt with by company personnel?
• Has money flowed into company accounts, or could it still do so?

What is there to self–report?

Does the evidence obtained from the whistleblower establish that a criminal offence has been committed, or is it simply information that gives rise to a concern? If the latter, will the powers available to an enforcement agency confirm the position one way or another and, if so, how long will that take?

For example, the whistleblower may have identified payments going to a third party, but it may not be possible to determine why those payments were made, and if so, whether they were corrupt.

If issues are unclear, would a report to the authorities lead to the matter being resolved conclusively? If not, how long would an enforcement agency take to conclude that it was not possible to establish that criminal conduct had occurred, and at what cost to the company?

Critical questions to consider:

• Can you establish that criminal conduct has occurred?
• If so, does it engage any relevant UK offence?
• How would a lengthy, but inconclusive external investigation impact upon the company?

To whom should a report be made?

For businesses with a global footprint or supply chain, business crime issues can engage laws in multiple jurisdictions. Legislation such as the UK Bribery Act 2010 can also have an extra-territorial reach.

If relevant payments have been made in US dollars or have involved the use of US bank accounts, the US Department of Justice (DoJ) could also seek to assert jurisdiction.

There may therefore be little point in seeking or even securing a deal with one agency only to find another potentially more aggressive agency, most obviously the DoJ, waiting to speak to the company.

Critical questions to consider:

• Which countries are involved?
• What offences are likely to have been committed in each jurisdiction?
• What sanctions may be imposed in each jurisdiction?
• Will more aggressive jurisdictions like the US allow the matter to be dealt with elsewhere and, if not, is it prudent to engage with those jurisdictions first?

Timing of any self–report

If a self–report is to be made, the objective must be to secure the most favourable outcome. Enforcement agencies will allow the company a reasonable period to ascertain whether a problem has arisen, but once that conclusion has been reached, it will expect a report to be made without delay. Neither the SFO nor DoJ are likely to react well to a long – possibly self-serving – report that follows a lengthy investigation by the company’s lawyers, particularly if the whistleblower’s claims were unambiguous.

There is no hard and fast rule – 3 months might be viewed as appropriate; 6 months or beyond might not. It may well be that the company will be asked to continue with the legwork (and cost) of the investigation, but the authorities will want to oversee that work and agree the methodology proposed.

Critical questions to consider:

• Have you reached the stage where the authorities would expect to be told of a likely problem?
• Is criminal conduct on-going? If so authorities may expect to be told immediately.
• Is the evidence gathered and any report that follows in a form that will assist the authorities?

On-going co-operation

Any self-report, if made, will not be the end of the matter. The authorities will require the company to cooperate fully throughout the investigation, and a failure to do so may result in the company receiving a more severe sanction than would otherwise have been the case.

Co-operation will require making available all relevant evidence. This is likely to include evidence for use against company personnel who may have given long service and be popular within the company.

In the UK, the authorities have to prosecute senior officers to satisfy the ‘controlling mind’ test if they also wish to prosecute a company. The US is now also taking a far tougher line against individuals. The Yates Memorandum, issued in 2015, made clear that co-operation required from a company includes providing evidence for use against individuals.

Most controversially, the authorities may require a company to waive privilege over aspects of its investigation to demonstrate “full co-operation”. This may well impact on how that investigation is conducted and underscores the importance of clearly defining the scope and remit of the investigation before it commences.

Critical questions to consider:

• Has all evidence been properly secured?
• Do you want to interview employees if the interview notes may later have to be disclosed (as discussed above)?
• Has the investigation been conducted in a way that will not lead the authorities to feel that evidential roses have been trampled on?

Learning from the investigation

Investigations may be started in the heat of a newly-revealed issue, the risks of which naturally focus minds. However, as matters progress, there is a risk
that issues can drift and the accrued benefit of a good initial response to a problem can be lost by failing to close out the matter.

Follow-up steps might include:

• Stopping any continuing behaviour (if you have not already done so);
• Applying appropriate disciplinary policies to deal with any employees involved;
• Demonstrating that the company has learnt from the experience by taking substantive remedial steps to avoid repetition of the issues;
• Following up on secondary “fall out” issues such as accounting corrections, and developing policies and procedures; and
• At every step, recording the action taken and outcome in a way which ensures the company maximises any benefit to be gained from its response to the issue.

It will also be important to consider what further communications are necessary internally and externally (if any) to bring the matter to a formal close and reinforce the steps taken in response.

The importance of getting it right

Whistleblowing and internal investigations are an increasingly common reality of corporate life and governance. When an issue is reported, in-house lawyers will often be the first port of call and will have the opportunity and responsibility to shape how the company responds.

An effective response to a business crime issue can present an opportunity for the company to quickly nip issues in the bud, and improve its ability to prevent future difficulties arising. By contrast, avoidable mistakes in responding to a whistleblower can turn manageable issues into business critical concerns.