Companies struggle to put in place an effective program for conducting internal investigations and meting out discipline.  One of the first questions which internal stakeholders struggle with is who is responsible for the internal investigation issue.

Auditors claim they are on the front lines and should be the primary investigators; lawyers claim they need to run the show to protect the privilege; and compliance officers argue they need to know what is going on in the company and why the compliance program may not be working.  Each constituent has a good argument – to a point.

Whatever the company decides on locating the internal investigation program, there are certain steps that have to be taken.  The three most important principles for any internal investigation program are: (1) protecting the privilege when necessary; (2) timely resolution of complaints; and (3) fair and even-handed disposition of investigations.

The privilege has to be protected in most cases, but not all.  In the serious internal investigations involving potential government enforcement or civil litigation, the privilege has to be preserved.  That does not mean that the investigation is run entirely by the lawyers.  The legal department can oversee and authorize the investigation to protect the privilege but others can carry it out.

Between compliance professionals and auditors, I always recommend that compliance professionals conduct the investigations.  Why?  Compliance officers have the best handle on the global operations, the problem areas from a compliance perspective and the related risks.  They are – and should be – trained for conducting investigations, gathering important information and funneling this information back into the overall compliance program.

Auditors are good at what they do – but in most cases, they do not have a focus on compliance issues.  They follow the money which is critical but they work best when they work with compliance officers not separately from Compliance officers.  Auditors have enough to do to keep the company SOX compliant and they do not need the extra responsibility of conducting internal investigations on non-finance related issues.

Too little attention is paid to making sure the internal investigation process works.  Human resources is a key player in this process and they tend to resist integration into the process because of the volume and nature of employment-related complaints.  Nonetheless, when it comes to designing a system and implementing a fair procedure, the more centralized the process, the better.

Aside from the privilege issue, it is critical that investigations be resolved timely.  Justice delayed is justice denied, especially when it comes to resolving internal complaints and investigations.  Routine matters should be resolved within 60 days and more difficult issues within 120 days.  These are realistic goals and should be followed except in extraordinary cases.

Finally, if the internal investigation process is viewed as unfair or skewed to favor senior managers or employees from profitable lines of business, employee morale and overall compliance will sink.  To guard against this, I have advocated for an internal review committee which reviews and each case and is guided by the principles of fairness and consistency.