Deciding who investigates
The first decisions are who directs the investigation and who conducts it. Matters involving senior management or potential government exposure are often overseen by a board committee and handled by outside counsel independent of the people involved. Routine human resources complaints may be handled internally. When counsel conducts the investigation in order to provide legal advice, privilege and work product protections may apply, but they can be lost if findings are shared too widely or if the work is mainly for business purposes. Clear engagement terms and a defined scope help maintain those protections. Where the concern touches people close to management, independence also matters to the auditors and regulators who may later review the work.
Preserving and gathering facts
A legal hold should go out early to the people and systems involved, and collection of email, chat, phones, and financial records should be done in a way that will hold up later. Interviews are typically conducted by counsel, who explain to employees that counsel represents the company and not them, and that the company may decide to share what it learns. Employees should not be pressured to stay silent with regulators, and retaliating against someone who raised a concern can create separate liability. Record what was reviewed, who was interviewed, and what was decided, with care about what is put in writing.
Reporting and what comes next
An investigation ends in findings that the board or management must act on, which may include discipline, control changes, restatements, or a decision about disclosure to authorities. Government enforcement policies often give credit for voluntary self-disclosure, cooperation, and remediation, but the details change and depend on the agency. Whether the report is written or oral, and who receives it, affects privilege. We begin by learning what triggered the concern, who knows about it, and whether any government contact has occurred. From there we propose a scope, a team, and a timeline the company can defend.
