Everyone likes to focus on how to conduct an internal investigation.  In the face of the new SEC whistleblower law and regulations, companies need to design a system to assess and respond to an initial allegation of a corruption violation.  Not all complaints are equal – indeed, most allegations have little merit.  But occasionally a complaint can be significant and uncover a significant potential violation.

The first step in responding to a complaint is to assess the seriousness and credibility of the complaint.  If the complaint is anonymous, it may contain information which reveals the position of the complainant.   Based on the nature of the complaint, an objective review of the complaint needs to be completed, along with the credibility of the complainant.  

The company needs to establish a working group in the company to conduct the initial assessment of the complaint.  In most cases, companies follow established fraud protocols for assessing a complaint and then deciding how to respond.  Senior management should be represented on the committee.  One person on the committee should be designated with ultimate authority to determine how to respond – the General Counsel or Chief Compliance Officer, or possibly the head of Internal Audit or Chief Financial Officer.

If the committee determines that the complaint warrants a serious response, the Audit Committee should be alerted and briefed on the matter.  In assessing a complaint, a number of factors need to be determined:

1.  The position of the complainant;

2.  The complainant’s access to information contained in the complaint;

3.  The accuracy of the information in the complaint compared to known facts;

4.  The level of specificity in the complaint;

5.  Review of any additional information or clarifications the complaint (if known) provides to the committee.

6.  Review of any internal audits, due diligence reviews, work performance, evaluations  or other sources of information relating to the allegation or any individuals named in the allegation.  

If the company determines that the complaint warrants further investigation, the company needs to take affirmative steps to preserve data, develop an investigation plan, and respond to the complainant (and his or her counsel).  Even in those cases where the company decides not to conduct any further investigation, the company should preserve data relating to the allegation and keep very detailed records of how it assessed the matter and resolved the complaint.  In responding to a serious allegation, the company needs to tackle many difficult issues: who should supervise the investigation; should outside counsel be retained; what type of forensic accounting review is needed; who should review the data and documents; who should conduct the interviews, and how will the investigation be reported to key stakeholders.