Key Legal Steps in Conducting Effective Internal Investigations

Lesley Brovner & Mark Peters
February 5, 2025

Internal investigations are an important tool for companies and nonprofits that either think something may have gone wrong at their organization or are already threatened with government or private action as the result of alleged wrongdoing. Such investigations can determine the scope of the problem, allow organizations to take proactive steps to fix the problem before it becomes a crisis and take steps to prevent future problems. In order for an internal investigation to be effective, it is crucial to adhere to certain basic legal steps and procedures. These are important not only to make the investigation (and subsequent written report) complete, but to allow it to stand up to challenge if necessary.

Understanding the Need for an Internal Investigation

Effective internal investigations are vital in a number of circumstances: First, if a company or nonprofit believes that wrongdoing has occurred within the organization, even if no government or private action has yet been threatened, it is important to understand the full scope of the problem (or whether a problem exists), take remedial measures quickly, before external action is taken and prevent future problems to the extent possible. Second, if a company or nonprofit receives a whistleblower complaint (or any other complaint about internal organizational activity) that must be investigated thoroughly and professionally once received. Third, if the government or private actors have already complained about your organization’s conduct (either through a subpoena or a lawsuit) an internal investigation is key to determining potential liability.

Establishing a Clear Investigation Plan

The first step in the investigative process is creating a clear investigation plan. Hiring lawyers with experience in conducting such investigations is key here as they will know how to quickly draft such a plan. The plan will: (1) Identify the issue(s) to be investigated; (2) Identify the documents that will need to be retrieved and reviewed; (3) Identify the witnesses who need to be interviewed. The plan may need to be modified as the investigation goes forward – for example, a review of documents may suggest additional witness interviews that are needed – but a clear plan at the outset will allow your lawyers to move quickly and efficiently, avoiding needless detours that are time consuming and expensive.

Maintaining Confidentiality and Legal Privilege

There are a number of complex issues relating to confidentiality and legal privilege of investigations and subsequent investigative reports. This is part of the reason to hire experienced investigative counsel who can advise you on all of these issues as they will differ from case to case.

The first thing to keep in mind is that an obligation of confidentiality and privilege belongs to the organization that hired the investigating counsel. That means that witnesses, even witnesses employed by the organization, do not necessarily have any rights of privilege and confidentiality if the organization chooses to waive them. Experienced investigative counsel will know how to handle this.

Another issue is whether the investigation (and any notes and reports that come out of the investigation) are privileged. The answer to this question is nuanced and heavily context specific and so you should consult with investigative counsel before beginning any work on the investigation to see whether, and to what extent, the privilege applies. Just because a lawyer is conducting the investigation does not, of itself, make the investigation privileged. Other factors – such as a view that the lawyer is conducting the investigation in anticipation of litigation – must also be present in order to protect any notes and reports. Experienced investigative counsel should be able to take steps that increase the chances that the investigation remains privileged, though such claims of privilege are often challenged legally and cannot be guaranteed.

Preservation, Collection and Review of Evidence

Document review is often one of the first steps in an internal investigation. It is vitally important to identify relevant documents and preserve the integrity of such documents and other physical evidence at the outset of any investigation. This is particularly important as to electronic data which must be preserved (and any automatic deletion functions disabled) and not altered. Usually a “hold notice” will be sent around informing employees of the relevant organization not to destroy, alter or delete any electronic or other documents in their possession. Also, in some cases it may be necessary to secure individual electronic devices until all data can be harvested from the device. Further, for physical evidence, there should be a well documented chain of custody as to who has handled the evidence etc. Finally, many documents may be confidential and steps should be taken to safeguard who has access to such documents.

Conducting Fair and Thorough Interviews

Once documents have been collected and reviewed, the next step is to interview relevant witnesses. Experienced investigative counsel will know how to structure these interviews to make sure they are thorough, and get to the important points with maximal efficiency. In some instances, it will be necessary to make credibility determinations about the claims of certain witnesses — this is especially so where there are conflicting accounts — it is important to be clear where credibility determinations are being made and the basis for making them. Additionally, it is important when interviewing witnesses who have undergone a traumatic experience, such as sexual abuse or assault, that the interviewers understand how to conduct trauma informed interviews. Again, experienced investigative counsel should know how to handle that process.

Analyzing Findings and Ensuring Compliance

Conducting a detailed and effective internal investigation can help an organization determine whether they are in compliance with all relevant City, State and federal laws and regulations, and if not, how to get and stay in compliance.

Businesses and nonprofits need to make sure that they are in compliance both with general regulatory requirements (i.e. sexual harassment training and prevention and wage and hour laws, which every entity needs to stay in compliance with) and industry specific requirements (i.e. rules regarding construction safety). To achieve full regulatory compliance, an entity must be cognizant of and responsive to all of these requirements and the regulatory landscape overall.

Preventative Measures to Reduce Future Risks

After the completion of an internal investigation, it is important to take measures to reduce future risks.

Compliance failures must be addressed as they can lead to serious problems for businesses, including legal, financial, and reputational harm.
Compliance plans are key to ensuring that organizations achieve compliance with necessary rules, regulations, policies, laws, and standards. A compliance plan should do the following:

• Outline a set of guidelines and best practices that a company’s employees must follow that covers all relevant laws and regulations.
• Create a training program on those guidelines.
• Set up a system of ongoing monitoring to ensure the guidelines are followed.
• Provide for optimal communication between employees and those who oversee the program.
• Create a clear corrective action plan for if the compliance program is breached.