Chief Compliance Officers are truth-tellers.  It comes with the territory.  Each and every CCO knows whether its internal investigation program is effective or not.  There is not a lot of grey in this area – CCOs know what an effective internal investigation program looks like and they can quickly spot a weak one.  This comes from experience.

Too many companies fail to understand how valuable an effective internal investigation program can be to the overall health of a company.  When operating on all cylinders, an effective internal investigation program will encourage employee reporting, triage employee concerns to prioritize those based on importance and risks to the organization, promptly resolve employee concerns in a fair and consistent manner, and inform the compliance program, the company’s risk profile and result in demonstrable compliance program improvements.  Now that is more than a mouthful, but it is an important set of principles that can advance a company’s culture and protect the company’s most important intangible asset – its reputation. 

Internal investigations provide valuable lessons learned that can be used to identify potential gaps in internal controls, weaknesses in a company’s culture and steps needed to remediate and prevent future misconduct. 

As a basic initial requirement, every company should adopt an internal investigation protocol that can be published and promoted internally to demonstrate a commitment to transparency.  The investigation procedures should be followed.  Aside from a comprehensive set of procedures, the internal investigation protocol should address common situations that may arise and include a strong statement of protection of employees and whistleblowers from retaliation. 

DOJ has stressed the importance of incorporating a “root cause” analysis into an internal investigation program.  This sounds good on paper.  In practice, however, this requires careful analysis of “contributing factors” to an overall set of events underlying an instance of misconduct.  As part of the “contributing factor” analysis, investigators may have to assign percentage factors that contribute in part to an overall pattern of misconduct.  Such a determination requires discretionary judgment and may inject potential inconsistencies into root cause analyses.

An internal investigation program has to begin with a coordinated team to triage employee concerns as they are reported within the employee reporting system.  A triage team, consisting of representatives from legal, compliance, human resources, finance, internal audit, should review each concern to determine who should staff the investigation with appropriate expertise, the relative seriousness of the allegation, and establish a time frame and expectation for resolution.

After the initial assignment, the progress of the investigation should be tracked internally and oversight of the investigation should occur on a regular interval.  Deadlines should be set and follow-up meetings should be established for consultations. 

To ensure consistency across internal investigations, companies have to define specific procedures and documentation requirements that ensure consistent execution.  A comprehensive training program for investigators should be conducted.  Additional staff resources may be needed to supplement existing investigation staff.  Again, a training program should include supplemental staff to assist the investigation function.

A training program should be crafted in line with the internal investigation policies and procedures to ensure that internal investigations are properly scoped, accurately categorized as to seriousness, properly documented using available templates and planning documents, including investigation checklist, witness interview forms, and investigation reports.  An essential check on internal investigation performance is an internal oversight committee that is responsible for monitoring progress, ensuring proper conduct of investigations, and then resolving investigations in a consistent and fair manner. 

As a further check on the company’s internal investigation program, a compliance review should be conducted periodically through random sampling of completed internal investigation.  The periodic reviews should focus on adherence to procedures, proper scoping, documentation, quality assessment and proper resolution.  Such a review should not be conducted to second guess the internal investigation but to make sure the investigators conducted a proper investigation and documented the steps they took, the reasons underlying their determination, and the basis for the investigator’s conclusion as to whether the allegation was substantiated.