Summary. A civil investigative demand, an administrative subpoena, or agents at the reception desk each start a process in which the company's first week determines much of the outcome. Preservation failures become obstruction allegations, an uncounseled employee interview becomes a false statement charge, and a production assembled without a privilege protocol waives protections that cannot be recovered. This toolkit runs the sequence: the first forty-eight hours by inquiry type, the response team and preservation, scoping and conducting the internal investigation under privilege, negotiating and executing the production, managing employees and individual exposure, the cooperation and disclosure decisions, and resolution with real remediation.

What this toolkit is for, and who should use it

Investigations arrive in several forms, and the form determines the first moves. A civil investigative demand or an administrative subpoena is a document demand with a return date and room to negotiate. A grand jury subpoena signals a criminal investigation and changes everything about how employees are handled. Agents executing a search warrant is a different event again, measured in minutes rather than days.

What is constant is that the company's conduct after the inquiry begins frequently matters more than the underlying conduct. Obstruction, false statements, and spoliation are separate offenses, they are easier to prove than the original allegation, and they are what converts a manageable regulatory matter into a criminal one.

This toolkit is for general counsel, compliance officers, and outside counsel receiving an inquiry.

Roadmap at a glance

  1. The first forty-eight hours, by inquiry type.
  2. The response team and the privilege structure.
  3. Preservation — the failure that becomes a separate offense.
  4. Scoping the internal investigation.
  5. Documents — collection, review, and privilege.
  6. Interviews — Upjohn, individual counsel, and the Fifth Amendment.
  7. Negotiating and executing the production.
  8. Employees — discipline, retaliation, and indemnification.
  9. Parallel proceedings — civil, criminal, regulatory, and private.
  10. Cooperation and self-disclosure.
  11. Resolution — settlement structures and their terms.
  12. Remediation, and the questions companies ask.

Stage 1 — The first forty-eight hours

Any inquiry: notify the general counsel and senior management; engage outside counsel with the relevant regulatory experience; issue a litigation hold immediately; designate a single point of contact; instruct employees not to discuss the matter or destroy anything; calendar the return date; and notify insurers under any policy that might respond, including D&O and any regulatory defense coverage.

A civil investigative demand or administrative subpoena: read what is actually demanded, identify the statutory authority and its limits, contact the issuing office to open a dialogue, and begin negotiating scope and timing. The return date is nearly always negotiable; the obligation to preserve is not.

A grand jury subpoena: everything above, plus assume individual exposure exists, plus retain counsel with criminal experience. Do not have company counsel interview employees without Upjohn warnings, and evaluate immediately whether individuals need separate counsel.

A search warrant: call counsel immediately, and while waiting — ask to see the warrant and read its scope; do not consent to a search beyond it, and do not physically interfere; ask for and record the agents' names and agency; ask whether anyone is a target; instruct employees that they are not required to speak with agents and may have counsel present, without suggesting they refuse; observe and take notes on what is taken; request an inventory and a copy of the affidavit if available; and preserve a copy of anything seized where possible. Do not delete, move, or shred anything, and confirm that automatic deletion is suspended.

An interview request to an employee: the employee may decline, may have counsel, and should be told both — neutrally, without any suggestion of consequences, because instructing employees not to cooperate is obstruction.

Stage 2 — The response team and the privilege structure

Assemble: outside counsel leading; in-house counsel; an executive sponsor who is not implicated; IT for collection; compliance; communications; and a forensic accountant or technical expert where the subject matter requires it.

Structure for privilege from the beginning. Under the Upjohn framework, an internal investigation is privileged where obtaining or providing legal advice was a significant purpose — but the record must support that characterization. Build it with an engagement letter directing the investigation for the purpose of legal advice, counsel directing the work, experts retained by counsel rather than by the business, documents marked appropriately, and distribution limited to those with a need to know.

Understand the limits. The privilege protects communications, not underlying facts. Business advice interwoven with legal advice is vulnerable. And a decision to disclose findings to a regulator generally waives the privilege as to the subject matter — which is a decision to be made deliberately rather than by degrees.

Do not create a written chronology in the business's files. Investigative work product belongs with counsel.

Stage 3 — Preservation

The failure here becomes a separate and worse offense.

Issue a written litigation hold immediately, identifying the matter, the categories to preserve, and the obligation to suspend deletion, with acknowledgments collected.

Suspend automatic deletion across email, chat and messaging platforms, collaboration tools, voicemail, ticketing systems, and backups. Chat and ephemeral messaging are the recurring problem: platforms with default deletion have produced sanctions and enforcement findings in several matters, and the use of ephemeral messaging for business communications is now itself an issue regulators ask about.

Identify custodians broadly at first and narrow later, and include departed employees' data.

Preserve structured data and physical records, and where a device may matter, forensically image it before anyone uses it.

Reissue the hold periodically and track compliance, because a hold nobody re-sent after nine months is a hold that was not followed.

Resources

Stage 4 — Scoping the internal investigation

Define the scope in writing: the conduct at issue, the period, the business units, and the questions to be answered. Scope creep is the most common cause of an investigation that takes six months and answers nothing.

Decide who the investigation reports to. Where senior management may be implicated, it reports to the board or an independent committee, with counsel retained by that committee — and where it does not, the company will be asked why.

Decide the depth. Not every inquiry requires a full investigation; some are answered by a targeted document review and two interviews. Proportionality is legitimate, and the decision should be documented.

Consider the timeline against any reporting obligation. Several regimes impose their own clocks — the 60-day overpayment rule in health care, mandatory disclosure in government contracting, breach notification, and securities disclosure — and the investigation cannot be slower than the obligation.

Stage 5 — Documents

Collection by defensible means, with a documented chain of custody, from every identified source including cloud repositories and messaging platforms.

Review with a protocol: search terms negotiated where possible with the agency, technology-assisted review where volume warrants, and a privilege screen run before anything leaves.

Privilege log prepared as the demand requires, with enough detail to support the claim.

Confidentiality designations and a request for confidential treatment where the material is competitively sensitive or subject to a trade secret claim — recognizing that agencies' confidentiality obligations vary and that material produced may be shared with other agencies and, in some circumstances, with private litigants.

Watch for the traps: producing a privileged document waives it, and clawback agreements and Federal Rule of Evidence 502(d) orders limit but do not eliminate the damage; selective disclosure to one agency may waive as to everyone; and a production that omits responsive material because nobody searched a repository is the finding that follows.

Stage 6 — Interviews

Give Upjohn warnings at the start of every employee interview conducted by counsel: counsel represents the company, not the employee; the interview is privileged and the privilege belongs to the company, which may waive it and disclose the interview; and the employee should keep the discussion confidential. Document that the warning was given, and do not soften it — an ambiguous warning creates a risk that the employee reasonably believed counsel represented them.

Assess individual exposure before the interview, and where it exists, advise the employee to obtain separate counsel. A company that interviews an exposed employee without that step damages both of them.

Individual counsel may be paid by the company where the bylaws, an indemnification agreement, or state law permits — and advancement obligations are frequently mandatory. Consider a joint defense or common interest agreement, in writing, understanding that it constrains the company's ability to cooperate later and that the government may view it unfavorably.

The Fifth Amendment. An individual may decline to answer. A private employer may generally discipline an employee for refusing to cooperate — subject to constitutional limits for public employers and Garrity issues where the refusal is grounded in criminal exposure — and where a real criminal exposure exists, that decision should be made with criminal counsel.

Take good notes, typed the same day, and understand that interview memoranda are work product but that a decision to share findings with the government may put them at issue.

Resources

Stage 7 — Negotiating and executing the production

Engage the agency early. Most staff will discuss scope, custodians, search terms, date ranges, and a rolling production schedule. A company that shows up on the return date with a box and no dialogue has forfeited the negotiation.

Object where objection is warranted — overbreadth, burden disproportionate to the inquiry, privilege, and any limit on the agency's authority — in writing, and preserve the position while producing what is not contested.

Negotiate a tolling agreement where the limitations period is running and the investigation will take time, which is frequently in both parties' interest.

Produce in a defined format with agreed metadata fields, Bates numbering, and a production log recording what was produced and when.

Do not over-produce. Material outside the demand expands the inquiry, and a company that volunteers unrelated problems has not helped itself.

Update the agency on the search's progress and on any discovered gap, because a gap disclosed proactively is a process issue and a gap discovered by the agency is a credibility problem.

Stage 8 — Employees

Do not retaliate. Whistleblower protections attach under numerous statutes — Sarbanes-Oxley, Dodd-Frank, the False Claims Act, 41 U.S.C. § 4712 for government contractors, OSHA-administered statutes, and state analogues — and a retaliation claim is frequently easier to prove and more valuable than the underlying allegation.

Discipline carefully. Where the investigation establishes misconduct, discipline is appropriate and is a cooperation and remediation factor — but the timing and the record must show it followed the findings rather than the complaint.

Communicate. Employees will hear about an investigation. A neutral communication stating that the company is cooperating, that employees may be contacted and may have counsel, that the company will not retaliate, and whom to call, prevents most of the damage that rumor otherwise does.

Preserve the separation between the company's interests and individuals', and revisit it as the facts develop, because a joint defense arrangement that made sense in month one may be untenable in month six.

Stage 9 — Parallel proceedings

A single set of facts frequently produces several proceedings at once: a civil regulatory matter, a criminal referral, a private civil action (frequently a class action or a qui tam), state attorney general interest, a licensing board proceeding, and an insurance coverage dispute.

Coordinate them. Statements in one bind in the others. A civil deposition can create criminal exposure; a regulatory admission becomes a class action allegation; and a licensing board response is discoverable in the civil case.

Consider a stay of the civil case pending the criminal one, which courts grant on a multi-factor analysis and which protects individuals' Fifth Amendment interests.

Watch the sealed qui tam possibility in health care, government contracting, and financial services, where a civil investigative demand under the False Claims Act frequently signals a relator's complaint under seal.

Insurance — tender early, read the reservation of rights, and understand that D&O policies frequently cover investigation costs only from a defined trigger point, which may be later than the company's actual spending.

Stage 10 — Cooperation and self-disclosure

Cooperation credit is real and its terms vary by agency. The recurring elements: timely voluntary self-disclosure; full cooperation, including identifying the individuals involved; timely and appropriate remediation; and the absence of aggravating factors.

The disclosure decision is genuinely hard, and it should be made deliberately with the specific agency's framework in front of the decision-maker. Consider: whether a mandatory disclosure obligation already applies — as in government contracting under FAR 52.203-13, health care under the 60-day rule, or a sector-specific reporting rule; the likelihood the conduct surfaces anyway through a relator, an audit, or data analytics; the size of the credit available; and the collateral consequences of disclosure, including private litigation that follows a public resolution.

Where disclosure is chosen, choose the right forum — several regimes have specific protocols with materially different settlement histories — and understand that disclosure generally waives privilege as to the disclosed subject matter.

Where it is not, document the analysis, because the decision will be evaluated later against what the company knew.

Stage 11 — Resolution

Structures, from least to most severe:

  • Closure with no action, sometimes with technical assistance.
  • A civil settlement with monetary payment and an admission, a denial, or neither.
  • A corrective action plan, a consent order, or an administrative agreement with reporting obligations.
  • A corporate integrity agreement or a compliance monitorship, typically several years, with an independent review organization, board certifications, and reportable event procedures.
  • A non-prosecution or deferred prosecution agreement in a criminal matter, with a statement of facts, a compliance program, and frequently a monitor.
  • A guilty plea, with the collateral consequences — debarment, exclusion, license revocation — that frequently exceed the fine.

Negotiate the terms that matter beyond the number: the factual statement, which becomes the roadmap for private litigation; the scope of the release; whether individuals are covered; admissions; collateral consequence waivers where available; the length and scope of any monitorship or reporting; and the treatment of cooperation going forward.

Model the collateral consequences before agreeing to anything — suspension and debarment, program exclusion, licensure, and the private litigation the resolution will invite.

Stage 12 — Remediation, and the questions companies ask

Remediation is what regulators actually evaluate, and it is what determines whether a monitorship is imposed. It should address: the root cause, not the symptom; the control that failed; accountability for the individuals responsible, applied consistently; training targeted at the failure; testing to confirm the fix works; and board-level reporting on the program going forward.

Document all of it, and be prepared to demonstrate it rather than describe it.

"Can we ignore an administrative subpoena we think is overbroad?" No. Object in writing, negotiate scope, and if necessary move to quash or modify. Ignoring it produces an enforcement action and a credibility problem.

"Should we tell employees?" Yes, neutrally: that there is an inquiry, that the company is cooperating, that they may be contacted and may have counsel, that they must preserve documents, and that there will be no retaliation.

"Can we pay for an employee's lawyer?" Frequently yes, and advancement is often mandatory under the bylaws or an indemnification agreement. Confirm the terms, and confirm the arrangement does not compromise the company's independence.

"Is our internal investigation privileged?" It can be, where obtaining legal advice was a significant purpose and the record supports it — and a decision to share the findings with the government generally waives it as to that subject matter.

"What is the most damaging thing we can do?" Delete something, tell an employee not to cooperate, or produce a version of events that later documents contradict. Each of those is a separate offense, and each is easier to prove than whatever started the inquiry.

Master resource index

Articles

Guides

Checklists

Related toolkits

External and primary sources

This toolkit is educational and not legal advice. Agency practice, cooperation frameworks, and disclosure obligations vary and change, and criminal exposure requires counsel with criminal experience. Consult qualified counsel immediately upon receiving an inquiry.