Summary. An internal investigation is the moment a company decides how much protection its findings will have, and most of that is determined in the first two days. This checklist covers the sequence that preserves privilege and produces a usable result: confirming who directs the investigation and why, scoping it in writing, issuing a hold, engaging consultants through counsel, giving and documenting Upjohn warnings, writing memoranda that qualify as opinion work product, recording findings, taking proportionate action, and making the disclosure decision deliberately.

What this checklist is for. Running an investigation that is privileged where it should be, defensible where it is disclosed, and actually useful to the decision-makers who commissioned it. For the doctrine, see Attorney-Client Privilege and Work Product for Businesses.

Phase 1 — Intake and the first decisions (day one)

  • Record the date and source of the allegation and the exact allegation.
  • Assess urgency: safety risk, ongoing harm, evidence destruction risk, regulatory reporting deadline, market disclosure obligation.
  • Decide who directs the investigation. Counsel must direct it from the outset if privilege is intended. An investigation begun by HR or internal audit and handed to legal later is far weaker.
  • Decide inside or outside counsel. Use outside counsel where the accused is senior, where the allegations are severe, where a regulator may become involved, or where internal impartiality would be doubted.
  • Assess conflicts: does counsel represent anyone whose conduct is at issue?
  • Identify the client — the entity, and who within it will receive the report (board, audit committee, general counsel).
  • Consider interim measures (separation of parties, system access suspension) that do not disadvantage a complainant, which would be retaliation.

Why this matters. In re Kellogg Brown & Root, Inc., 756 F.3d 754 (D.C. Cir. 2014), held that an investigation conducted under a compliance program, using non-lawyer investigators, was privileged because a significant purpose was obtaining legal advice. Courts split between "the primary purpose" and "a significant purpose" formulations, and the Supreme Court dismissed In re Grand Jury as improvidently granted without resolving it. Under either test, the investigation must be counsel-directed from the start.

Phase 2 — Scope it in writing

  • Engagement letter (for outside counsel) or memorandum to file (for in-house) stating the investigation is conducted to provide legal advice to the company and in anticipation of litigation or government inquiry.
  • Define the allegations, the time period, the business units, and the questions to be answered.
  • Identify witnesses and documents and systems to review.
  • Set a timeline and a reporting cadence.
  • State who may receive the findings and in what form.
  • Address whether an oral report or a written report is contemplated — that choice affects both usefulness and disclosure risk.

Why this matters. The scope memorandum is the document that establishes purpose. Without it, the company is arguing about purpose from inference two years later.

Phase 3 — Preserve

  • Issue a litigation hold covering the custodians, systems, and date range. See Litigation Hold and Evidence Preservation Checklist.
  • Suspend auto-delete for affected accounts, through IT, with a ticket.
  • Preserve devices before reimaging, especially for anyone departing.
  • Pull logs (access, badge, VPN, email, chat, code repository) in native form with hashes.
  • Image, do not examine. Amateur review alters metadata.

Phase 4 — Engage consultants correctly

  • Retain forensic, accounting, and technical consultants through counsel, under an engagement letter running from the law firm and stating the purpose is to assist counsel in rendering legal advice (the Kovel structure, from United States v. Kovel, 296 F.2d 918 (2d Cir. 1961)).
  • For incident response, retain the vendor under a litigation-specific engagement — vendors with pre-existing business relationships or dual remediation roles have had their reports ordered produced.
  • Keep the remediation workstream separate from the investigation workstream, with separate deliverables.
  • Confirm the consultant will not deliver findings directly to the business.

Why this matters. A consultant engaged by the business is a business consultant whose work product is discoverable. The distinction is the engagement letter and the actual reporting line, not the label.

Phase 5 — Interviews and the Upjohn warning

At the start of every interview, deliver and document:

  • "I represent the company, not you personally."
  • "This conversation is privileged, but the privilege belongs to the company, which may choose to waive it and disclose what you tell me, including to the government."
  • "Please keep this conversation confidential."
  • "Do you understand? Do you want to proceed?"
  • Record that the warning was given, in the memorandum and in a contemporaneous log.
  • If the employee has separate counsel, coordinate. If a conflict emerges (the employee may have personal exposure), stop and consider whether they need independent counsel.
  • Do not give blanket confidentiality instructions; provide a case-specific justification, because blanket instructions have been challenged under labor law.
  • Interview witnesses before the accused where feasible; interview the complainant first.
  • Use two interviewers where possible — one asking, one taking notes.

Why this matters. Upjohn Co. v. United States, 449 U.S. 383 (1981), makes communications with employees at any level privileged where they are made at the direction of superiors, to secure legal advice, about matters within the employee's duties, with the employee aware of the purpose, and treated as confidential. The warning establishes the fourth element and prevents the employee from later claiming they believed counsel represented them personally.

Phase 6 — Memoranda and the report

  • Write interview memoranda capturing counsel's mental impressions, selections, and assessments — not a verbatim transcript. Verbatim notes are more likely to be treated as ordinary work product and are more vulnerable to a substantial-need showing.
  • Mark documents "Privileged and Confidential — Attorney Work Product — Prepared at the Direction of Counsel" — accurately, and only where true.
  • Address the report to the client representative (board, committee, or general counsel), and state that it was prepared to provide legal advice and in anticipation of litigation.
  • State findings on a preponderance standard, tied to evidence.
  • Distinguish facts from legal analysis, because facts were never privileged and often must be shared for remediation.
  • Control distribution and maintain a distribution log.
  • Do not circulate drafts widely.

Phase 7 — Act, and decide about disclosure

  • Take corrective action proportionate to the findings, and document the decision.
  • Verify effectiveness: follow up with the complainant at 30 and 90 days.
  • Assess reporting obligations: regulator notifications, securities disclosure, breach notification, product safety reporting, and auditor inquiries.
  • Make the disclosure decision deliberately. There is no selective waiver in most circuits — producing the report to a regulator generally waives privilege as to everyone, including private plaintiffs.
  • Consider an oral download of facts, without producing the report or the interview memoranda, where cooperation credit is the objective. Practices vary and the risk is real; get specialist advice.
  • Understand at-issue waiver: using the investigation defensively (advice of counsel, adequacy of response) waives privilege over it.
  • Handle the audit response carefully; disclosing analysis to auditors generally waives privilege, though work product may survive.
  • Confirm no retaliation against the complainant or witnesses, and monitor for at least a year.
  • Retain the file per the retention schedule and any preservation obligation.

Why this matters. The disclosure decision is usually the largest single decision in the matter, and it is frequently made under time pressure by people focused on the regulator rather than on the private litigation that follows.

Common mistakes

  • Starting in HR and handing it to legal later, which forfeits the purpose argument.
  • No scope memorandum, so purpose must be reconstructed from inference.
  • Retaining the forensic vendor directly, making its report discoverable.
  • Skipping the Upjohn warning, or giving it inconsistently.
  • Verbatim interview transcripts instead of impression-laden memoranda.
  • Labeling everything privileged, which destroys credibility on the genuinely privileged material.
  • Blanket confidentiality instructions without case-specific justification.
  • Waiting weeks to act, which is what converts a manageable incident into an institutional-indifference narrative.
  • Producing the report to a regulator without analyzing the waiver consequences.
  • Failing to monitor for retaliation, which frequently produces a larger claim than the original allegation.

Primary authority

Related

This checklist is educational and not legal advice. Privilege law varies by jurisdiction, and disclosure decisions have consequences that cannot be reversed. Consult qualified counsel before beginning an investigation or disclosing its results.