Formulating and drafting the investigation plan checklist (internal investigations)

This checklist is a best practice guide to formulating and drafting the investigation plan for a successful internal investigation. Not every suggestion will apply to your investigation, so you should tailor your investigation plan to the issues specific to your investigation and be sure to document your procedures. Topics discussed include scope and privilege, vendors, preservation, collection, and review of documents, interviews, analysis, government strategy, and the final work product.

Purpose

Investigation plans are a useful internal roadmap as you conduct an internal investigation. Typically drafted as a memorandum to be shared with your client, investigation plans are important for setting expectations and critical for protecting legal privilege. A quality investigation plan helps ensure alignment on the scope, proposed steps, and planned work product with your client.

Scope and Privilege

• Identify the client, scope, and tasks. The introductory paragraphs of the investigation plan should identify who the client is, the scope of the investigation, and tasks required to undertake the investigation, as requested by the client. Note the following example:

Example. A client, the audit committee of a public company, has asked a law firm to assist a company in conducting an independent, internal investigation into various issues related to suspected workplace misconduct, including possibly harassment, discrimination, retaliation, or other misconduct. The misconduct apparently involves one employee but may also involve at least the knowledge of or the misconduct by one or more members of senior management.

â—‹ The client in this example is the audit committee, not the company itself or company management, so the investigation plan should clearly identify the audit committee as the client.

â—‹ The audit committee is seeking an investigation into workplace misconduct, including possibly harassment, discrimination, retaliation, or other misconduct. The scope of the plan should:

â–ª Identify those issues, as well as whether the apparent misconduct may have involved more than one employee; others at the company, including management, knew (or should have known) about the misconduct; and company management participated in or tolerated the misconduct.

â–ª Be as specific as possible, given the mandate at hand, but bear in mind that the scope of the investigation may change as the investigation develops and more information is learned.

â—‹ The tasks performed to address the issues in the above example likely will be varied, but should include:

â–ª Engaging vendors, as necessary

â–ª Preserving, collecting, and reviewing documents

â–ª Interviewing witnesses and drafting post-interview memoranda

â–ª Creating a final work product

• Protect legal privilege. Cleary identifying the scope of the investigation and memorializing the investigation plan helps protect legal privilege and retain confidentiality. To the extent that an internal investigation is being conducted with potential litigation or government enforcement exposure in mind, you should:

â—‹ Memorialize the scope and purpose of the investigation as precisely as possible in the investigation plan.

â—‹ Mark the investigation plan clearly as "Privileged and Confidential" and "Attorney Work Product."

Vendors

Another key aspect of an investigation plan is ensuring and documenting that you have the right team assembled.

• Consider and engage necessary vendors. You should consider whether the following vendors are needed given the scope of the investigation and make those recommendations in your investigation plan:

â—‹ E-discovery specialist. Arrange for an e-discovery vendor to assist with the collection and host your document review platform if a significant amount of electronic data needs to be collected.

â—‹ Language expert. Engage a legal staffing agency (including some e-discovery vendors) to provide extra headcount or specific language expertise if the document review is expected to be significant, or the materials are likely to be in a foreign language.

â—‹ Forensic accountant. Engage forensic accountants if you are dealing with allegations related to accounting improprieties, complex financial transactions, or asset misappropriation. For guidance on retaining and working with forensic accountants related to internal investigations, see Internal Investigations: Retaining and Working with Forensic Accountants and Internal Investigations: Retaining and Working with Forensic Accountants Checklist.

â—‹ Other subject matter experts. Consider retaining other subject matter experts, such as a cybersecurity expert in a data breach investigation, or a duties and fees specialist in a customs fraud investigation, if the facts and circumstances of the investigation recommend such expertise.

• Protect legal privilege. When you do retain a vendor, it is important to protect legal privilege. You should:

â—‹ Engage the vendor directly, rather than the client, to preserve privilege.

â—‹ Specify in the engagement letter that the vendor is being retained under legal privilege and that all the work performed or generated by the vendor in this matter shall be legally privileged to the maximum extent permitted by law.

Document Preservation, Collection, and Review

In your investigation plan, outline the required steps for the preservation, collection, and review of documents, along with ownership for each task (e.g., in-house counsel). Consider including the following workstreams.

• Secure background documents and any key materials or communications that have already been collected. If you need specific documents for the investigation, such as personnel records or data exports, you should identify those as early as possible. You also should ask your client at the outset whether any data is in foreign jurisdictions so you can research the relevant data privacy laws as needed.

• Coordinate with the client to identify the relevant custodians. Note that once you start reviewing more documents or interviewing witnesses, you may discovery other relevant custodians.

• Document the relevant date range of the investigation for scope clarity with the client. At the beginning of the investigation, the client will have the best information on the appropriate date range so you should confirm with the client the scope you believe appropriate or that the client believes is warranted, given the known facts and issues to date.

• Coordinate with the client to institute a litigation hold on the company's electronic records. This hold preserves data beyond the regular retention schedules. If the investigation relates to potential misconduct (as is typically the case with internal investigations), rather than a proactive "culture" audit, the in-house attorney typically will send out litigation hold notices. Also, you should:

â—‹ Ensure the notice outlines what types of documents must be preserved, the subject matter of those documents, and a relevant time period

â—‹ Keep a record of who received the notice and when –and–

â—‹ Consider whether to send additional notices, including for a change of scope, to employees

• Confirm the data sources, collection procedures, and next steps needed to collect and process the materials.

â—‹ Data sources include:

â–ª Email

â–ª Hard copy materials

â–ª Personal network folders

â–ª Shared drives –and–

â–ª Text messages

â—‹ Procedures and next steps should be broken down into specific tasks. For example:

â–ª If the client already approved using a vendor, are you waiting for the engagement letter to be executed?

â–ª Do you need to set up a meeting for the company's IT team, the vendor, and you to coordinate logistics and provide access to the company systems?

â–ª To the extent you are collecting data from foreign jurisdictions, do you need to research and confirm that your collection plan complies with the data privacy laws of those jurisdictions?

• Run search terms through the collected materials, particularly for an email review. This is an iterative process, as you likely will find other terms that will be useful to add once you begin document review and interviews. You should:

â—‹ Draft the initial list of terms and send to the client for review and feedback

â—‹ Run the terms through the collection to identify whether any terms appear to be over- or under-inclusive –and–

â—‹ Then revise the terms as needed

• Consider using Technology Assisted Review (TAR) and Artificial Intelligence (AI) to find relevant or key materials. TAR, or predictive coding, and AI can save time and expense, so you should test these tools for your investigation. You should discuss these options with your client and include them in your investigation plan, as appropriate.

• Review materials for privilege. If you risk sharing documents at any point with a third party, including the government, you should consider screening documents and communications for privilege.

â—‹ Draft a list of privilege terms at the outset of the investigation.

â—‹ Ask the client for a list of its in-house and outside counsel and include the names, law firms, and email handles of those individuals, along with generic privilege terms (e.g., "privileged" and "legal") as search terms.

â—‹ Ask your e-discovery vendor to use red "persistent highlighting" to flag documents with these terms as a signal that the materials may be privileged.

• Draft a document review protocol before you begin reviewing documents. You should:

â—‹ Draft a protocol that outlines the following:

â–ª Background

â–ª Types of documents considered relevant or not relevant

â–ª Key issues

â–ª Types of documents considered significant –and–

â–ª Approach to legal privilege

â—‹ Assemble and lead a protocol team, including:

â–ª Meeting to train them on the protocol –and–

â–ª Welcoming questions and dialogue

• Draft a review pane. If you are reviewing materials on an electronic platform, you should draft a review pane consistent with your document review protocol. The review pane should include tags for the appropriate categories, such as:

â—‹ Relevance

â—‹ Issues

â—‹ Significance –and–

â—‹ Privilege

• Track key documents. As you review documents, you should track the key materials that you identify. You can do this electronically through tagging on your review platform, but it can be helpful for you to maintain a key document log, with summaries, as well.

Interviews

From the start of the investigation, you should consider your interview strategy, logistics, and tasks.

• Prepare questions for the client for the interview process. In coordination with your client, you can identify and gather preliminary information for interviews for your investigation plan with the following questions and selective strategies:

â—‹ Will the interviews be conducted virtually or in person? If in person, where will you conduct the interview to ensure confidentiality and minimal business disruption?

â—‹ Who will conduct the interviews? Best practice is to have more than one interviewer in the room in case there are any disputes about what was said.

â—‹ Will you conduct any preliminary, scoping interviews prior to completing document review or will interviews begin after the document review is substantially complete?

â—‹ Are there any custodians that you can identify now as interview witnesses?

â—‹ Who will coordinate the interview logistics (e.g., setting up conference rooms, sending calendar invitations). Who is best situated to contact the witnesses? How will the meeting be messaged?

â—‹ How should the witnesses be ordered? Typically, you should start with the lower ranking individuals and/or those ancillary to the potential misconduct, funneling into the key personnel, but you may have a strategic reason to depart from that practice.

â—‹ Will you need to arrange for interpreters for any of the expected witnesses?

• Prepare an interviewee list. Often, you will begin with a preliminary list of expected interviewees. Then, after you review documents and/or begin the interviews, you may learn about and add other individuals to your list.

• Prepare interview outlines. With respect to interview outlines and preparation for the interviews, you should consider all of the following:

â—‹ Draft a comprehensive list of questions for each witness, even if you deviate from the questions during the interview.

â—‹ Think through difficult questions from the witness in advance.

â—‹ Include an Upjohn warning in the outline, either a reminder to deliver one, or a full, written out statement, depending on your preference.

For a written Upjohn warning notice, see Upjohn Warning Script.

• Draft post-interview memoranda. Drafting interview memoranda is a helpful tool for retaining and organizing information but can be a costly exercise, so you should discuss expectations with your client. Consider the following:

â—‹ Discuss whether your client prefers formal memoranda in narrative format, or simply cleaned up, bulleted notes.

â—‹ With either format, you should include a formal introduction on all interview memoranda to help protect attorney work product.

Example. On [date], Attorney 1 and Attorney 2 interviewed Witness A regarding [subject]. The interview began at approximately [time] and lasted approximately [length of time]. It was conducted [in person at [location] / virtually via Zoom/Teams/WebEx]. This memorandum is a summary of that interview based on notes taken contemporaneously but does not constitute a verbatim transcript. This memorandum represents the thoughts, impressions, and analyses of the author and constitutes attorney work product. This memorandum has been prepared in anticipation of litigation and for the purpose of advising our client, [X], in connection with the ongoing internal investigation.

Analysis

Legal and factual analysis will run throughout the course of the investigation.

• Conduct and identify legal research. Specifically:

â—‹ Conduct at least preliminary legal research in the early stages of the investigation as you consider the legal risks and potential scope of the review.

â—‹ List the known research inquiries in your investigation plan, acknowledging the fact that this is a preliminary list of research issues that may expand over the course of the investigation and you likely will not be able to predict all of the research needs that will arise.

â—‹ Assess more deeply the legal issues, including consulting with other subject matter experts (e.g., an employment lawyer), once you have your preliminary factual findings.

• Organize and evaluate facts. Specifically:

â—‹ Organize and evaluate facts in your preferred and practiced way, including drafting a chronology.

â—‹ Include key events from documents and interviews in a timeline with source citations and maintain the timeline for internal use only or finalize for a client-facing presentation, if needed.

Government Strategy

At the start of an investigation as you are developing your investigation plan, you likely will not know whether your client will need to self-disclose findings to the government. Depending on the subject and scope of the investigation, you should consider the following:

• Evaluate the relevancy of approaching the government if your investigation is limited to a culture review at a company.

• Prepare for self-disclosure if you are investigating accounting fraud, customs violations, or other potential violations of law as:

â—‹ Voluntary disclosure of misconduct to the Securities and Exchange Commission and Department of Justice, for example, is a key component of the government's analysis when considering cooperation credit for offending companies. E.g., United States Attorneys' Offices Voluntary Self-Disclosure Policy.

â—‹ A valid prior disclosure to the U.S. Customs and Border Protection provides reduced penalties for companies who believe they have violated certain customs provisions. See Prior Disclosure.

Work Product

At the end of your investigation plan include your proposed approach for the final work product, being mindful of the following:

• Consider including a note suggesting work product options for future consideration, such as a formal memorandum or oral presentation, because at the beginning of the investigation you may not know what approach is best for your client.

• Include any known or projected deadlines.

Conclusion

Preparing a comprehensive internal investigation plan will keep your team organized and coordinated, but, because often even the best laid plans go awry you should:

• Stay flexible –and–

• Change course and update your investigation plan as needed

This excerpt from Practical Guidance, a comprehensive resource providing insight from leading practitioners, is reproduced with the permission of LexisNexis. Reproduction of this material, in any form, is specifically prohibited without written consent from LexisNexis.

Authored by Ann C. Kim and Jennifer Brechbill.