Tag: investigations

Categories
Blog

How Triage and Investigations Can Drive a Culture of Speak Up

I recently concluded a podcast series with Case IQ. Over this series, I visited with Sharlyn Lauby, Jakub Ficner, Kenneth McCarthy, and Meric Bloch on the different facets of a great speak-up regime and how each of those facets will improve your corporate culture. We tackled such topics as the indicia of a great corporate culture, the importance of triage and internal investigations in improving corporate culture, non-retaliation and protections for those who speak up, tying your entire system of speaking up to improving culture, and will conclude with some thoughts on how an entire system of speaking up drives corporate culture to be better run and more profitably. This blog post series will expand on these topics. In Part 3, we consider why and how having an effective triage for reports and investigations can drive a culture of speaking up in your organization.

Jakub Ficner has over 15 years of experience in the internal investigative space and is currently the Director of Partnership Development at Case IQ. He strongly advocates for the importance of the triage process and technology in organizational compliance. He is a passionate and determined team player with experience in prospecting and implementing complex global solutions in various industries. Experience working in cross-functional and multi-cultural teams in Canada, the United States, Germany, and India. His specialties include business strategy and development, international management, ethics and compliance, investigation management, and global implementation strategy.

Jakub emphasized the need for organizations to consider the assessment and triage process before receiving complaints or allegations. This proactive approach allows for increased response time and the ability to set realistic stakeholder expectations.

One of the key points highlighted by Jakub is the importance of setting service level agreements (SLAs) to determine response times based on the nature of the allegation. This concept, borrowed from customer service practices, ensures that employees who come forward with complaints or allegations are provided with a clear understanding of the expected timeline for response and communication. By setting these expectations, organizations can foster a culture of open communication and trust.

The triage process is particularly important for multinational companies that operate across different regions. With varying compliance programs and regulations in different countries, having a well-documented process becomes essential. It allows compliance departments to navigate the complexities of compliance programs and investigations, ensuring consistency and adherence to local laws.

Technology also plays a crucial role in establishing effective compliance processes. Jakub points out that many organizations still need efficient documentation and tracking processes. Implementing technology, such as a case management solution, can help establish accountability and defensibility. It allows for establishing clear procedures monitoring performance and provides documentation that can be used to assess the effectiveness of compliance programs.

There is an overriding need for organizations to build accountability and defensibility into their compliance processes. By having a documented triage process and utilizing technology, organizations can ensure that complaints and allegations are handled promptly and consistently. This fosters a culture of speaking up and provides employees with the confidence that their concerns will be taken seriously and addressed promptly.

However, it is important to recognize the tradeoffs in balancing different factors when implementing a triage process and technology in organizational compliance. While efficiency and speed are crucial, organizations must also consider the need for thorough investigations and the protection of employee rights. Striking the right balance requires careful consideration and ongoing evaluation of processes to ensure continuous improvement.

In conclusion, the triage process and technology are vital in promoting a speak-up culture and ensuring organizational compliance. By proactively assessing and triaging complaints and allegations, organizations can increase response time and set realistic expectations for stakeholders. Implementing technology, such as a case management solution, helps establish accountability and defensibility. However, it is important to consider the impact on employee rights and the need for thorough investigations when making decisions about the importance of the triage process and technology in organizational compliance.

Join us tomorrow when we discuss closing the loop by improving your compliance program through a culture of speaking up.

Listen to Jakub Ficner on Innovation in Compliance here.

Categories
31 Days to More Effective Compliance Programs

One Month to More Effective Reporting and Investigations – The Parameters of Privileges

The concept of privilege in an internal investigation is critical. Two important privileges are the attorney-client privilege and the work product privilege. Unfortunately, both are often misunderstood, miss-applied and consequently lost. To determine whether you have a valid privilege claim, it is incumbent to understand the parameters of the attorney-client privilege. In presentation, entitled “Attorney-Client Privilege ”, David E. Keltner, Kelly Hart & Hallman LLP, Elizabeth Brummett and Adrienne Parham, both from University of Texas Law School, wrote that under U.S. federal law, the attorney-client privilege applies when the following are present:

  1.  A client is seeking legal advice or a lawyer’s services;
  2. The person to whom the communication is made is a lawyer or his or her representative;
  3. The communication relates to a fact disclosed from a client (a representative) to a lawyer (a representative);
  4. Strangers are not present;
  5. A client requires confidentiality.

In addition to the attorney-client privilege there is another privilege which can come into play around internal investigations. It is the attorney work-product doctrine. Keltner noted, “The attorney-client privilege and the attorney work-product doctrine are often asserted interchangeably. While there is some overlap between the two, the attorney-client privilege is significantly different than the attorney work-product doctrine.” Moreover as “codified in Fed R.Civ. P. 26(b)(3), [the attorney/work product] provides a qualified protection to materials prepared by party’s counsel or other representative in the anticipation of litigation.” The doctrine exists “because it permits lawyers to “work with a certain degree of privacy, free from unnecessary intrusion by opposing parties . . .””

Three key takeaways:

  1. Note the differences in the attorney-client privilege and attorney work-product doctrine.
  2. Both can be waived intentionally or through inadvertent conduct.
  3. Take care on attorney work-product outside the U.S., where there may be no privilege at all.
Categories
Daily Compliance News

Daily Compliance News: July 28, 2023 – The New Cyber Disclosure Rules Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance brings to you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News. All, from the Compliance Podcast Network. Each day we consider four stories from the business world, compliance, ethics, risk management, leadership, or general interest for the compliance professional.

  • Zelensky warns about corruption. (FT)
  • New cyber disclosure rules go into effect. (AP)
  • Najib deposed in 1MDB case. (Bloomberg)
  • Cognizant investigation not outsourced. (WSJ)
Categories
31 Days to More Effective Compliance Programs

One Month to Better Reporting and Investigations – How an Investigation Informs Remediation

There is nothing like an internal whistleblower report about a FCPA violation, the finding of such an issue or (even worse) a subpoena from the DOJ to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check.
In addition to robust investigation, a company must engage in remediation of the offending conduct. The 2020 Update to the Evaluation of Corporate Compliance Programs mandated the additional significance of this by providing that this process must be considered “both at the time of the offense and at the time of the charging decision and resolution”. When you consider the strictures around continuous monitoring and continuous improvement in compliance programs it is clear why this analysis is so important. Obviously, a key test of any compliance program is when a deficiency is found and a violation occurs. The question then becomes, what did you do about it.
But from the DOJ (and Securities and Exchange Commission) perspective, the key is to use the information to both fix the problem so that it does not occur again but also improve your compliance regime.

Three key takeaways:

  1. How does your investigation inform your remediation plan?
  2. A compliance program failure offers a way to upgrade your regime.
  3. Your investigative team must inform your remediation team.
Categories
31 Days to More Effective Compliance Programs

One Month to More Effective Reporting and Investigations – Issues in Cross Border Investigations

In an article, entitled “Internal Investigations, How to Conduct an Anti-Corruption Investigation: Developing and Implementing the Investigation Plan”, Mara Senn, now Director & Senior Counsel, Global Compliance Investigations at Zimmer Biomet  and Michelle K. Albert, former lawyer at Arnold & Porter discussed cross-border investigations. They considered the following issues.
Offer interview translations.
Avoid cultural pitfalls.
Observe data privacy restrictions.
Comply with labor requirements.
Be aware of other local requirements.
Put forms in native translations.
Preserve the attorney-client privilege.
Prepare for local enforcement actions.
Prepare for security risks.
Protect whistleblowers.

Three key takeaways:

  1. Use translators and translations of key documents in witness interviews.
  2. Use local counsel to facilitate the investigation and to help navigate any local anti-corruption investigation issues.
  3. Never, never, never retaliate. The SEC will pay whistleblower bounties for non-U.S. citizens.
Categories
31 Days to More Effective Compliance Programs

One Month to More Effective Reporting and Investigations – The Witness Interview

What are the characteristics of a good interview in the context of an internal investigation? Is there one technique you can use which will provide you the results you want to achieve? How should you think through your questions and document review prior to the investigation? At this point in time, how do such issues play out in the time of Coronavirus?
There is no one right way to prepare for and conduct an interview. What is important is that you have a plan and execute on that plan. Begin by obtaining an understanding of what the various stakeholders want answers to. This could include the Board of Directors, C-Suite executives, the GC and legal department, the CCO and compliance function or up to government regulators such as the SEC or DOJ.

Three key takeaways:

  1. There is no one right way to prepare and do an interview.
  2. The interview should not be confrontational.
  3. The interview, like the entire investigation process, is a chess match.
Categories
31 Days to More Effective Compliance Programs

One Month to More Effective Reporting and Investigations – Investigative Challenges

What are some of the top challenges you may face during an investigation? Beyond the basics, a company must consider the intake process as a starting point, which Jonathan Marks noted is one of the biggest challenges. Rather surprisingly, he noted there are still companies without a hotline or anonymous reporting system, stating “We still see organizations whereby there is no formal ethics hotline except for the fact that they might send an email to some member of management or some member of the Board.”
Planning your investigation, having the right team members involved, and meeting the challenges which inevitably arise during an investigation can be difficult. However, beginning with the DOJ’s 2015 Yates Memo, the 2016 FCPA Pilot Program, and the 2017 and 2019 versions of Evaluation of Corporate Compliance Programs, together with the 2020 Update, 2023 ECCP, and FCPA Corporate Enforcement Policy, the pressure on every CCO and company to get an investigation done quickly, efficiently and, most importantly, right is even greater now. Marks has laid out a concrete way for you to think through how to plan an investigation, staff it correctly, and meet the inevitable challenges.

Three key takeaways:

  1. The intake process may seem the most straightforward but many companies drop the ball at this initial step.
  2. You must never retaliate against employees who come forward in good faith.
  3. Always think several steps ahead.
Categories
31 Days to More Effective Compliance Programs

One Month to Better Reporting and Investigations – Selection of Investigative Counsel

Dan Dunne, in a Compliance and Ethics Professional article, entitled “Foxes and henhouses: The importance of independent counsel”, discussed what he termed a “critical element” in any investigation, which he denominated as “fair and objective evaluation.” Dunne wrote that a key component of this fair and objective evaluation is the Who question: who should supervise the investigation and who should handle the study? Dunne’s clear conclusion is that independent counsel should handle any serious investigation.

There are three reasons for a company to retain independent counsel for internal investigations of severe whistleblower complaints. First, André Agassi was right, perception is reality. Secondly, if regular outside counsel investigates their own prior legal work or legal advice, a very large and potentially messy number of loyalty and privilege issues can arise in the internal investigation. The third reason is the relationship of the regular outside counsel or law firm with regulatory authorities. If a company’s regular outside counsel performs the internal investigation and the results turn out favorably for the company, the regulators may ask if the investigation was a whitewash or at the very least, less than robust. If the SEC or DOJ cannot rely on a company’s own internal investigation, it may perform the investigation all over again with its own personnel. Further, these regulators may believe that the company, and its law firm, have engaged in a cover-up. This is certainly not the way to buy credibility.
Three key takeaways:

  1. Serious allegations demand a serious response, with seriously good lawyers leading the investigation.
  2. Credibility is the biggest thing that any person or company brings to the table when sitting across from the DOJ or SEC.
  3. The use of regular corporate counsel can negatively impact your investigation because of the issues of loyalty and privilege.

For more information, check out The Compliance Handbook, 4th edition.

Categories
31 Days to More Effective Compliance Programs

One Month to Better Reporting and Investigations – The Investigation Protocol

After the internal report comes in and you have properly triaged the matter, you need to scope out and investigate it, promptly, thoroughly, and with competent personnel. In the 2020 Update, provided these series of questions about your internal investigations:
 Properly Scoped Investigations by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation? How does the company ensure that investigations are properly scoped? What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct an investigation, and who makes that determination?
 Investigation Response – Does the company apply timing metrics to ensure responsiveness? Does the company have a process for monitoring the outcome of investigations and ensuring accountability for the response to any findings or recommendations?
 Resources and Tracking of Results – Are the reporting and investigating mechanisms sufficiently funded? How has the company collected, tracked, analyzed, and used information from its reporting mechanisms? Does the company periodically analyze the reports or investigation findings for patterns of misconduct or other red flags for compliance weaknesses? Does the company periodically test the effectiveness of the hotline, for example by tracking a report from start to finish?

In a presentation, Jay Martin, and Jacki Trevino discussed the specifics of an investigation protocol. It consisted of 1) opening and categorizing the case; 2) planning the investigation; 3) executing the investigation plan; 4) determining appropriate follow-up, and 5) closing the case. If you follow this basic protocol, you should be able to work through most investigations, in a clear, concise, and cost-effective manner. Furthermore, you should have a report at the end of the day which should stand up to later scrutiny if a regulator comes looking. Finally, you will be able to “Document, Document, and Document”, not only the steps you took but why and the outcome obtained.
Three key takeaways:

  1. A written protocol, created before an investigation, is a key starting point.
  2. Create specific steps to follow so there will be full transparency and documentation going forward.
  3. Consistency in approach is critical.
Categories
31 Days to More Effective Compliance Programs

One Month to Better Reporting and Investigations – Internal Reporting System Best Practices

What are some best practices regarding an internal reporting system? The 2012 FCPA Guidance stated, “An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation.” The 2019 Guidance further refined this basic requirement for a hotline with inquiries into the effectiveness of your corporate hotline, asking, “Effectiveness of the Reporting Mechanism – Does the company have an anonymous reporting mechanism, and, if not, why not?  How is the reporting mechanism publicized to the company’s employees?  Has it been used?  How has the company assessed the seriousness of the allegations it received?  Has the compliance function had full access to reporting and investigative information?” In this podcast, we detail some of the key best practices.

Three key takeaways:

  1. Get the word out to your employees about your company hotline through a variety of mediums and platforms.
  2. Train your employees on the use of the hotline.
  3. Use data from your hotline to continually update and improve your compliance program.