Who decides and who is told
The first question is often who should be overseeing the response, especially if senior managers may be involved. Boards commonly assign the matter to a committee of directors who are not implicated, and that committee retains counsel who reports to it. Auditors, lenders, insurers, and in some cases regulators may need to be told, and the timing of each notice can matter. Public companies face disclosure obligations that private companies may not, but private companies still owe duties to owners and lenders. Reporting to law enforcement is often a judgment call, though some companies such as banks or government contractors may have duties to report, and once a referral is made the company does not control the pace.
Investigation and insurance notice
An internal investigation should be scoped, documented, and run through counsel if the company wants to protect its work product. Employees interviewed by company counsel should be told that the lawyers represent the company, not them, and that the company may decide to share what it learns. Lock down relevant email, accounting systems, and devices before they are reimaged or reassigned. Review crime, fidelity, and directors and officers policies right away, since they often require prompt notice and set conditions for proving a loss. Avoid confronting a suspected employee before evidence is secured and a plan for that conversation is in place.
Setting the plan early
Our early review covers what has been found, who knew about it, and how far it might reach across the business. We talk through which notices are due and which can wait for more facts. We consider whether the company's accounts or prior statements may need to be corrected, and how that is coordinated with auditors. We also look at recovery, including insurance claims and civil claims against those responsible or against third parties who helped. Getting this order right protects the company's credibility with every audience that will later review what it did.
