Summary. An internal investigation is a legal proceeding the company runs against itself, and it fails in predictable ways: scoped too narrowly to find the real problem, conducted by people who report to the executives under scrutiny, documented in a way that destroys privilege, and concluded without remediation that anyone can verify. The threshold decisions are who the client is, who conducts the work, and what the deliverable will be, and each has consequences that are difficult to reverse later. This guide runs the process from the triggering complaint through scoping, document collection, interviews, findings, and remediation, with attention to the privilege mechanics that determine whether the work product can be protected and to the disclosure decision that frequently follows. It also covers the cross-border complications that arise the moment employee data must move across a border.

The complaint arrives through the hotline, or from a regulator, or in a resignation letter that says more than resignation letters usually do. Something may have happened. Someone has to find out.

That sentence conceals four decisions that will shape everything: what "something" means, who "someone" is, what "find out" produces, and who receives it. Investigations go wrong at the beginning far more often than in the middle.

Step one: decide whether to investigate, and how much

Not every complaint warrants a formal investigation, and treating every one as though it does exhausts the resources needed for the ones that matter.

Triage against these questions:

  • How serious is the alleged conduct? Financial reporting, bribery, fraud, safety, harassment by a senior person, and anything implicating a regulator sit at the top.
  • How senior is the person implicated? The more senior, the more independent the investigation must be, and the higher the reporting line.
  • Is there a legal obligation to investigate? Harassment complaints trigger a duty to take prompt and appropriate corrective action. Certain regulated sectors have mandatory inquiry obligations. A whistleblower complaint to the audit committee under Sarbanes-Oxley § 301 and 15 U.S.C. § 78j-1(m)(4) requires a procedure for handling it.
  • Is there external exposure? Government inquiry, litigation, media interest, or an auditor's question.
  • How credible and specific is the allegation? Anonymous, vague, and unverifiable complaints still warrant a documented assessment — but not necessarily a full investigation.

Document the triage decision even where the answer is no further action. An unexamined complaint that later proves accurate is far worse than an examined one that was reasonably closed.

Do not let the subject of a complaint decide whether it is investigated. This sounds obvious and is violated constantly, usually by routing the matter to the department head whose conduct is at issue.

Step two: identify the client and the reporting line

The client is the organization. ABA Model Rule 1.13(a) states it, and everything follows from it. Counsel does not represent the executives, the complainant, or the witnesses.

The reporting line depends on who is implicated:

  • Ordinary conduct issues: general counsel, with reporting to management.
  • Conduct involving senior management: the audit committee or a special committee of independent directors, which retains counsel directly.
  • Conduct involving directors: a special committee excluding anyone implicated, with independent counsel and independent forensic accountants.

The reason is not formalism. A prosecutor, a regulator, an auditor, or a court asked to credit the investigation will look first at who directed it and to whom it reported. An investigation of the CEO commissioned by the CEO is worth nothing regardless of how well it was conducted.

Rule 1.13(b) requires a lawyer who knows that a constituent is engaged in conduct that is a violation of law reasonably likely to result in substantial injury to the organization to refer the matter to higher authority, up to and including the board. This is a duty, not an option.

Step three: choose the investigators

In-house or outside? In-house counsel is cheaper and knows the business. Outside counsel is more credible to third parties, has cleaner privilege, and can investigate people who outrank in-house counsel.

Use outside counsel where the matter involves senior management or the board, where a regulator or prosecutor may evaluate the investigation, where the conduct is potentially criminal, where the amounts are material, or where in-house counsel has any prior involvement in the underlying facts.

Conflicts. Counsel who advised on the transaction being investigated cannot credibly investigate it. Nor can the firm that drafted the policy alleged to have been violated. This is a genuine constraint and it eliminates the firm that knows the company best more often than clients like.

Forensic accountants, data forensics, and industry experts should be retained by counsel, not by the company, so their work falls within privilege and work product. The engagement letter should say why.

Step four: scope it in writing

A short scoping memorandum, approved by whoever commissioned the work, stating:

  • Who the client is and to whom counsel reports.
  • The questions to be answered — specific, factual, and answerable. "Did the company violate the FCPA" is a legal conclusion; "what payments were made to the consultant, on whose approval, and what services were rendered" is a question.
  • The time period and the business units covered.
  • What is out of scope, and the process for expanding scope if the facts require it.
  • The deliverable — oral report, written summary, or full written report.
  • Confidentiality and privilege protocols.
  • Budget and timeline, with the understanding that both will move.

Scope creep is the norm and should be planned for. Investigations that begin with one expense report frequently end somewhere else entirely. The scoping memorandum should provide that counsel will inform the client promptly if facts outside scope suggest a broader problem, and the client should expect that call.

Under-scoping is the more common failure. An investigation that examines only the reported conduct, finds it, remediates it, and never asks whether the same thing happened elsewhere leaves the company exposed to the discovery that it did.

Step five: preserve

Immediately, and before interviews.

  • Written litigation hold to all relevant custodians and a margin.
  • Suspend automatic deletion — email, chat, ephemeral messaging, backups, device recycling.
  • Preserve departing employees' accounts and devices.
  • Confirm suspension in writing from someone technical.

Preservation failures convert a manageable problem into an obstruction or spoliation problem, and they are entirely self-inflicted.

Be careful about the notice the hold itself provides. A hold naming the subject of the investigation tells them they are under investigation. Where that is a genuine concern, counsel can scope the hold more broadly or issue it to a wider group so that the signal is diffused — but the hold must still issue.

Step six: collect and review the documents first

Interviews conducted before the documents are reviewed waste the only opportunity to ask an unprepared witness about a document they did not know you had.

Collect from the identified custodians and systems: email, files, chat, texts, calendars, accounting records, contracts, approvals, and the systems specific to the conduct — expense platforms, payment systems, CRM, access logs.

Do not permit self-collection by anyone with potential exposure.

Review for the facts, not for a conclusion. Build a chronology as you go; the chronology is the most useful artifact an investigation produces and it should be maintained from day one.

Watch for the documents that decide these matters: approvals that were not obtained, approvals granted by someone without authority, contemporaneous complaints that went nowhere, drafts showing what was removed, and the message where someone says the thing out loud.

Step seven: interviews

The Upjohn warning

At the start of every interview, in substance:

  • I represent the company, not you.
  • This conversation is privileged, but the privilege belongs to the company.
  • The company may waive it and disclose what you say, including to the government, without your consent.
  • Please keep this conversation confidential.
  • You may wish to consult your own lawyer.

Upjohn Co. v. United States, 449 U.S. 383 (1981), establishes that the corporate privilege reaches employee interviews. ABA Model Rule 1.13(f) requires the explanation when the organization's interests are adverse to the constituent's.

Document that it was given. United States v. Ruehle, 583 F.3d 600 (9th Cir. 2009), is the case where a CFO successfully argued he believed counsel represented him personally. Some firms use a signed acknowledgment; others consider that too adversarial. Either is defensible; no record at all is not.

Give it every time, to everyone, including the executive you have worked with for a decade. Especially to them.

Sequence

Peripheral witnesses first, to establish the baseline. The subject last, after you know what the documents show.

Two interviewers

One asks, one takes notes. The note-taker's memorandum should record what was said, not counsel's conclusions — or, if it records conclusions, it should do so knowingly, since opinion work product receives stronger protection but a memorandum blending both invites a fight over redaction.

Conduct

  • Open-ended questions before specific ones.
  • Confront with documents after the witness has given their unaided account.
  • Do not tell witnesses what others said. It contaminates the account and looks like coordination.
  • Do not promise confidentiality you cannot deliver, or immunity you have no power to grant.
  • Assess credibility but record the basis: internal consistency, consistency with documents, demeanor described factually.

Rights and refusals

An at-will employee generally may be required to cooperate as a condition of employment, and may be disciplined for refusing. But note:

  • Weingarten rights entitle a union-represented employee to request a representative at an investigatory interview they reasonably believe may result in discipline. NLRB v. J. Weingarten, Inc., 420 U.S. 251 (1975). The extension to non-union employees has been reversed repeatedly by successive Boards; check the current state of the law.
  • Section 7 of the NLRA, 29 U.S.C. § 157, protects concerted activity, and blanket instructions not to discuss an investigation with anyone have been found unlawful in some circumstances. Confidentiality instructions should be justified by a legitimate business need in the specific investigation.
  • Retaliation. Complainants and witnesses are protected under numerous statutes, and an adverse action following participation is the claim that survives even when the underlying complaint fails. Brief managers accordingly.

Employees with exposure

Offer separate counsel to anyone who may face personal liability. Where the company advances fees, do so under the charter, bylaws, or an indemnification agreement, and do not treat the request as an admission.

Step eight: privilege, and how it is lost

Privilege in an internal investigation is fragile and its loss is usually self-inflicted.

The predominant purpose test. The privilege protects communications for the purpose of obtaining legal advice. Where an investigation serves both legal and business or regulatory-compliance purposes, courts ask whether obtaining legal advice was a primary purpose. In re Kellogg Brown & Root, Inc., 756 F.3d 754 (D.C. Cir. 2014), is the leading modern decision protecting an investigation conducted under a compliance program where legal advice was a primary purpose, and it is the case to build the record toward.

What protects it:

  • Counsel directs the investigation; non-lawyer investigators work at counsel's direction.
  • Engagement letters state the legal purpose expressly.
  • Documents are marked privileged and attorney work product.
  • Distribution is restricted and tracked.
  • Experts are retained by counsel.

What destroys it:

  • Wide internal distribution of the report.
  • Sharing with auditors, insurers, or business partners without a common interest or confidentiality framework.
  • Using the report as a business document — attaching it to a board deck circulated broadly, quoting it in a press release.
  • Disclosing it to the government.

Selective waiver is not recognized in most circuits. Producing a report to a regulator or prosecutor generally waives privilege as to everyone, including civil plaintiffs, and frequently as to the subject matter under Fed. R. Evid. 502(a). Confidentiality agreements with the government have been held not to preserve the privilege. This is the central reason companies disclose facts rather than documents.

Fed. R. Evid. 502(d) orders and 502(b) inadvertent-disclosure protection help with production mechanics but do not solve the deliberate-disclosure problem.

Write with production in mind. Assume the report may be read by an adversary. Do not editorialize, do not speculate about legal conclusions you have not tested, and do not characterize employees in language you would not want quoted.

Step nine: findings and the deliverable

Choosing the form

Oral report. Nothing to produce. Least useful to a board that wants a record, and unpersuasive to a regulator who wants to see the work.

Short written summary plus oral detail. The common compromise: findings and recommendations in writing, supporting interview memoranda held separately as work product.

Full written report. Necessary where a regulator or prosecutor will evaluate it, where an audit committee needs a formal record, or where the auditors require it. Highest value and highest exposure.

Decide at scoping, not at the end. A team that writes detailed memoranda for six months and then decides to deliver orally has created the documents anyway.

What findings should look like

  • Facts, separated from conclusions. What happened, established by what evidence, with the chronology attached.
  • Where the evidence is inconclusive, say so. Investigations that resolve every ambiguity in the company's favor are not credible, and a regulator reading one will assume the worst about what was smoothed over.
  • Credibility determinations with reasons.
  • Legal analysis clearly labeled as such, and only where counsel is prepared to defend it.
  • Recommendations — discipline, control changes, disclosure, further investigation.

Discipline

Consistency is the standard by which discipline is judged. A company that terminates a junior employee and issues a warning to a senior one for the same conduct has created the evidence for the discrimination claim and the cooperation-credit problem simultaneously.

Document the basis. Coordinate with employment counsel on the separation terms, and remember that a release cannot bar an employee from communicating with a government agency — the SEC has brought enforcement actions under 17 C.F.R. § 240.21F-17 against employers whose agreements impeded whistleblower communication.

Remediation

What regulators actually credit: discipline of responsible individuals including senior people, compensation clawbacks, structural changes to the control that failed, investment in compliance staffing and testing, and a mechanism to verify the change took hold.

What they do not credit: a new policy, a training deck, and a press release.

The disclosure decision

Whether to disclose to a regulator or prosecutor is a board-level decision, made on a written analysis addressing: the likelihood the government learns independently, the discount available for voluntary disclosure, the collateral consequences, the privilege consequences, and the civil exposure that disclosure creates.

It is one of the few genuinely irreversible steps, and it should never be made by the people whose conduct is at issue.

Cross-border complications

The moment employee data must move across a border, a second body of law attaches.

GDPR. Personal data of EU-based employees processed for an investigation requires a lawful basis under Article 6 — usually legitimate interests, with a documented balancing test — and transfers outside the EEA require a transfer mechanism under Chapter V, in practice standard contractual clauses plus a transfer impact assessment after Data Protection Commissioner v. Facebook Ireland Ltd. (Schrems II), C-311/18 (CJEU 2020), or reliance on an adequacy decision where one applies. Data subjects have access rights under Article 15 that may reach investigation materials, subject to limited exemptions.

Works councils. In Germany, France, the Netherlands, and elsewhere, employee representative bodies have consultation or co-determination rights over monitoring and investigation measures. Proceeding without them can invalidate the evidence and generate separate liability.

Blocking statutes. France's blocking statute and analogues elsewhere restrict production of evidence to foreign authorities outside treaty channels.

Employee protections. Interview practices lawful in the United States may not be elsewhere. Some jurisdictions require notice, a right to a representative, or restrict recording.

Practical guidance: involve local counsel in every affected jurisdiction before collection begins, not after; keep data in region where possible and review in region where required; document the lawful basis and the transfer mechanism; and build the works council timeline into the schedule, because it is measured in weeks.

Primary authority

A worked investigation: the hotline complaint

An anonymous hotline report alleges that a regional sales director has been approving distributor rebates for a customer whose owner is the director's brother-in-law, and that the rebates exceed program terms.

Week one: triage and scope. The allegation is specific, involves a mid-level manager rather than an executive, alleges self-dealing rather than a regulatory violation, and is quantifiable. The general counsel commissions the investigation and reports to the audit committee chair informally, on the view that escalation is warranted if the amounts prove material or if anyone senior appears involved. Outside counsel is engaged because the general counsel signs off on rebate policy exceptions and is therefore adjacent to the facts.

The scoping memorandum asks four questions: what rebates were approved for this customer, by whom, under what authority, and how they compare to rebates for similar customers.

Week one: preservation. Hold issued to the sales director, two analysts, the finance approver, the regional VP, and the customer master data owner — a group broad enough that the director does not read it as directed at him. Deletion suspended on email, Teams, and the expense system.

Weeks two to three: documents. The rebate approvals themselves, the customer master record, the program terms, the approval workflow logs, and the email and chat of the six custodians. A forensic accountant retained by counsel builds a comparison of rebate rates across all customers in the region.

The data shows the customer received rates roughly forty percent above the regional median, approved in eleven instances, four of which exceeded the director's authority and were approved by a finance analyst who reported to him functionally but not formally.

Week four: interviews, periphery inward. The analysts first. The finance approver. The regional VP. Each opened with a documented Upjohn warning. The finance analyst says she raised the pattern once, verbally, and was told the customer was strategic.

Week five: the subject. Interviewed last, confronted with the approvals after giving an unaided account. He discloses the family relationship, which was never disclosed on the annual conflicts questionnaire, and says the rates were justified by volume commitments that the data does not support.

Findings. Undisclosed conflict of interest, approvals exceeding authority, and roughly $340,000 in excess rebates over three years. No evidence of involvement above the regional level. No evidence the customer knew the approvals were irregular.

Scope question that arose. The comparison data showed one other region with anomalous rates. Counsel reported this promptly as outside scope, and the audit committee authorized an extension. This is the call that distinguishes a real investigation from a confirmatory one.

Remediation. Termination for cause. Recovery pursued against the customer under the rebate agreement. Approval workflow changed to require a second approver outside the requesting reporting line. Conflicts questionnaire revised to require disclosure of relationships with counterparties, not merely with competitors. Analysts retrained on escalation, and the escalation path changed so that a concern raised verbally is documented by the recipient.

Deliverable. Written findings and recommendations to the audit committee; interview memoranda retained separately as work product; no disclosure to any regulator, because none was implicated.

Working with auditors

The external auditors will learn about the investigation, and the interaction is one of the most delicate parts of the process.

They are entitled to know. AU-C Section 250 and PCAOB standards require auditors to consider illegal acts and fraud, and management and those charged with governance must communicate matters affecting the financial statements. An investigation into conduct with financial reporting implications will be a topic in every audit committee meeting until it closes.

Disclosure to auditors is a privilege problem. Auditors are not clients and generally share no common legal interest with the company. Most courts hold that providing a privileged report to the external auditor waives the attorney-client privilege. The work product doctrine fares somewhat better — several courts have held that auditors are not adversaries and that disclosure to them does not substantially increase the likelihood that an adversary obtains the material — but the outcome varies by circuit and the protection is not reliable.

The practical approach most companies use: provide the auditors with the facts and conclusions orally or in a summary prepared for that purpose, rather than handing over the privileged report and the interview memoranda. Document what was provided. Where the auditors insist on more, escalate to the audit committee, because the trade-off — an unqualified opinion against a privilege waiver that reaches every future civil plaintiff — is a governance decision rather than a legal one.

Audit response letters. Requests for information about litigation, claims, and assessments are governed by the ABA Statement of Policy Regarding Lawyers' Responses to Auditors' Requests for Information, which limits what counsel may disclose and is itself a negotiated accommodation between the professions. Responses are not privileged. Draft them narrowly and consistently with what has been said elsewhere.

Timing. An investigation that is open at a reporting deadline creates real pressure: the auditors may be unable to complete their work, the filing may be delayed, and a delayed filing is itself a disclosable event with consequences under listing standards and credit agreements. Build the audit calendar into the investigation timeline at scoping, and tell the audit committee early if the dates will not work.

Internal audit. Where internal audit performs investigation work, its reports are ordinarily not privileged, since internal audit's purpose is business rather than legal. Investigations intended to be privileged should be directed by counsel from the outset, with internal audit resources working at counsel's direction under a documented engagement.

Common failure modes

Investigations fail in a small number of recognizable ways. Each is avoidable.

The confirmatory investigation. Scoped to examine the specific allegation and nothing else, conducted by people who understand what conclusion is wanted, concluded before anyone asks whether the same thing happened elsewhere. It produces a clean report and leaves the exposure intact. The tell is a scope that was never expanded and a chronology that stops at the reported conduct.

The investigation nobody owns. Commissioned in a meeting, assigned to two departments, and stalled when both assume the other is proceeding. Six months later the complainant sues for retaliation and the company cannot say what it did.

The privilege that was never real. Non-lawyers running the work, a consultant retained by the business under a pre-existing master agreement, the report circulated to forty people, and the whole thing produced in the first document request. Privilege is built at the beginning or not at all.

The interview that created a witness. No Upjohn warning, an employee who reasonably believed counsel was representing them, and a later motion to disqualify or to block disclosure.

The retaliation claim. The complainant is reassigned "for their own comfort," excluded from a project, or given a poor review by the manager they complained about. The underlying complaint may fail; this claim will not. Brief every manager who learns of a complaint, and route personnel decisions affecting a complainant through counsel for the duration.

The findings nobody acted on. The most damaging document a company can create is a report identifying a control failure, followed by no evidence of remediation, produced three years later in litigation about the same failure. Track every recommendation to closure, or document a considered decision to accept the risk.

The leak. Investigations conducted with dozens of people aware of them do not stay confidential. Restrict knowledge to those with a need, and prepare a holding statement before it is needed rather than after.

The scope that never closed. Some investigations run indefinitely because no one will declare them finished. Set a decision point: what would we need to know to conclude, and what would we do if we learned it. If the answer to the second question is nothing, stop.

Counsel who became a witness. In-house counsel who participated in the underlying facts, or who conducted the interviews, may be deposed about them. Use outside counsel where that risk is real, and it usually is.

Budget, staffing, and telling the client what it will cost

Investigations are among the least predictable engagements in legal practice, and clients who are not told this at the outset become clients who lose confidence in the middle.

What drives cost. Custodian count and data volume dominate. An investigation with six custodians and modest email volume can be completed for a fraction of one with sixty custodians, chat platforms, and structured data extracts. Interview count matters less than people expect; document review matters more.

Give a phased estimate, not a single number. Phase one: preservation, scoping, and collection. Phase two: review and initial interviews. Phase three: subject interviews, findings, and reporting. Estimate each, with the explicit statement that phase two's cost depends on what phase one collects and that scope may expand.

Staff it correctly. A partner who conducts every interview personally is expensive and slow; an investigation staffed entirely with junior associates misses things and lacks credibility with a regulator. The workable model is a small senior team for interviews, findings, and judgment calls, with review conducted by a leveraged team or a managed review provider under clear protocols.

Use technology proportionately. Search term negotiation, threading, and analytics reduce review volume substantially. Technology-assisted review is well accepted and appropriate for large populations. What matters is documenting the methodology, because a regulator evaluating the thoroughness of an investigation will ask how the population was culled.

Watch for the scope expansion conversation. When facts outside scope emerge — and they will — the cost conversation and the substantive one arrive together. Separate them. Report the facts first and let the client decide; a client who suspects counsel is expanding scope for economic reasons will make a bad decision for the wrong reason.

Report on the budget as often as on the substance. Monthly, in writing, with the current estimate to complete.

Know what the deliverable costs. A full written report frequently consumes as much time as the investigation that preceded it, because every sentence must be supportable. Decide the form at scoping and price it there.

And tell the client the honest timeline. A serious investigation takes months, not weeks. A client told four weeks and delivered in sixteen has lost confidence in work that was in fact done well.

Related articles

This guide is provided for general informational purposes and does not constitute legal advice. Privilege outcomes in internal investigations are fact-specific and vary by circuit, and disclosure of a report to a government agency generally waives privilege as to all parties. Cross-border investigations implicate data protection, works council, and blocking statute requirements that must be addressed before collection begins. Consult qualified counsel before commencing an investigation, and separate counsel where individuals face personal exposure.