Corporate Fraud Investigation: Reporting Duties and Legal Risks

Under New York Business Corporation Law § 717, directors must exercise good faith and appropriate care in performing their duties. The statute does not impose one reporting deadline for suspected fraud, but governance policies and fiduciary obligations influence the response.

When senior management is implicated, independent board oversight may be appropriate. A corporate misconduct inquiry should distinguish unverified allegations from established findings before assessing individual responsibility.

A fraud allegation alone does not trigger Form 8-K. Most reportable events require filing within four business days, subject to the applicable item's instructions and exceptions.

Item 4.01 addresses changes in certifying accountants, while Item 5.02 covers specified director and officer changes. Regulation FD separately governs certain selective disclosures of material nonpublic information rather than establishing a general fraud-reporting duty.

Retaining counsel does not automatically make an investigation report privileged. Attorney-client privilege generally covers confidential communications for legal advice, while work-product protection concerns materials prepared because of anticipated litigation.

Federal privilege rules generally govern federal-question cases, while state law generally governs privilege for state-law claims under Federal Rule of Evidence 501. Sharing findings with regulators can create waiver disputes, depending on the governing law and the information disclosed.

When litigation is reasonably anticipated, relevant records may become subject to preservation duties. Companies may need to suspend routine deletion practices for documents and electronic information within the preservation scope.

A government and internal investigations review can identify relevant custodians, communication systems, and records. Intentional destruction can raise obstruction concerns when the applicable statutory elements are satisfied.

Form 8-K Item 4.02 generally applies when an authorized decision-maker concludes that previously issued financial statements should no longer be relied upon because of an error. A qualifying notice from the independent accountant creates a separate reporting trigger.

The filing deadline is generally four business days after the triggering event. The company must also assess auditor communications and required corrections to previously filed financial reports.

Sarbanes-Oxley Act §§ 302 and 906 establish distinct certification requirements for covered periodic reports. Criminal liability under § 906 depends on the statutory knowledge requirements, not merely an accounting error.

SOX § 304 addresses CEO and CFO reimbursement following qualifying misconduct-related restatements, including specified compensation and securities profits during a 12-month period. Exchange Act Rule 10D-1 separately requires covered listed issuers to recover excess incentive-based compensation following qualifying restatements, generally without proving individual fault.

Rule 10D-1 generally covers qualifying compensation received during the three completed fiscal years preceding the required restatement date. Limited impracticability exceptions apply, but the rule does not establish a universal employee notice or appeal procedure.

The issuer's recovery policy and applicable exchange standards govern implementation. Disputes may concern executive status, compensation calculations, the relevant period, or whether an exception applies.

A regulated business may have to report specified disciplinary events, financial irregularities, or licensing changes. The responsible agency's rules determine the reporting trigger, recipient, and deadline.

For example, financial institutions supervised by the Department of Financial Services must assess their applicable industry rules. Cybersecurity notifications under 23 NYCRR § 500.17 concern qualifying cybersecurity events involving covered entities, not ordinary fraud allegations.

Under CPLR § 213(8), a civil fraud claim generally follows the longer of six years from accrual or two years from actual or reasonably discoverable fraud. Claims by a corporation against its directors or officers may involve separate provisions, including CPLR § 213(7).

Federal criminal charges follow their applicable federal limitation statutes, and tolling depends on the governing law. A business fraud inquiry must also address evidence preservation separately because an internal investigation does not automatically suspend filing deadlines.

Potentially, but delay alone does not establish liability. The analysis depends on the directors' duties, their knowledge, their response, and the requirements for the underlying claim.

Yes, under applicable Rule 10D-1 recovery policies. Recovery generally does not require proof that the executive caused the accounting error, but it depends on a qualifying restatement and covered incentive-based compensation.