"x x x.
So it is a good time to focus on 10 key questions audit committees should consider when faced with the prospect of an investigation.
1. Do we need to investigate?
Not every potential problem or complaint warrants an investigation. Audit committees should consider the source and credibility of the allegations, and gauge the magnitude of the potential problem.
The answer is easy in some cases; if management allegedly is involved, the dollar amounts at issue are significant, the alleged misconduct occurred as part of a pattern, or the source of the allegation is credible, the committee will likely conclude an investigation is needed. The “clearly inconsequential” threshold in Section 10A may be a useful standard when considering whether to investigate.
2. Who should conduct the investigation?
Attorneys are able to conduct an investigation pursuant to the attorney-client privilege and the work product doctrine. They also typically are best equipped to evaluate whether any laws have been broken.
Putting an in-house lawyer in charge of the investigation is usually not the best approach, especially if the allegations implicate management in any way. Credibility and objectivity should be the audit committee’s principal objectives. An investigation by in-house lawyers who report to management might be perceived as less impartial than an outside investigation. Moreover, it is harder—though certainly not impossible—to protect privilege and work product when in-house lawyers investigate.
In-house personnel and non-lawyers may still be able to help. But there should be clear documentation that such individuals are working under the direction of the outside counsel responsible for conducting the investigation.
3. What about the company’s regular outside counsel?
Here again, because regular company counsel has typically reported to management and is presumed to be loyal to the company, this is not the optimal approach given the goals of credibility and objectivity. The SEC recently sued three audit committee members for “allow[ing] senior management to investigate itself” after management picked the outside firm to investigate. Hiring independent counsel—that is, counsel who has not previously represented the company in any significant way—is also consistent with the SEC’s guidance regarding internal investigations in the Seaboard Report. And, in the context of Section 10A, many audit firms require the audit committee to retain independent counsel.
4. Have we taken measures to preserve relevant data?
Once a company is reasonably able to anticipate a government inquiry or litigation, it should preserve relevant information. That generally will include circulation of a “hold notice” to appropriate people and departments, preservation of electronic data, and/or suspension of automated data-destruction programs. In addition to causing problems with regulators and potential plaintiffs, failure to preserve relevant materials may also compromise an audit committee’s ability to perform a thorough investigation.
5. What is the scope of the investigation?
Scope is critical. It is generally unnecessary and potentially counterproductive to attempt to “boil the ocean.” But the scope should not be so restricted as to miss key causes, recurrences or consequences of a problem. At the very least, the scope should be sufficiently broad that the audit committee can determine: why the problem occurred; who was responsible; whether laws were violated; any impact on financial statements; whether there are other similar problems; and how to minimize the risk of recurrence. The committee should also be flexible and ready to expand the scope depending on the investigation findings and any new credible leads.
__________________________________________________________
FURTHER READING:
__________________________________________________________
6. Are we closely consulting with the independent auditor?
The independent auditors should generally be in the loop on any audit committee investigation early in the process. In many circumstances, including a Section 10A situation, the auditor may have the final say in whether an investigation is adequate. So it is advisable for committees to coordinate closely with the auditor, including discussing: who will conduct the investigation and whether independence is required; scope; documents to be captured and reviewed and personnel to be interviewed; and preliminary findings as they emerge. Keeping the auditor in the loop is almost always better than being second-guessed (or sent back to the drawing board) at the end of the investigation.
7. Are we mindful of other key constituencies?
In addition to the independent auditor, the audit committee should consider other constituencies, including institutional investors, regulators, stock exchanges, and perhaps even the plaintiffs’ bar. Certain circumstances may require disclosure to or coordination with one or more outside constituencies, and audit committees must avoid the risk of tunnel vision.
8. Are we protecting privileged materials and work product?
As noted, when structured correctly, investigations by audit committee counsel should be protected by privilege and work product. Sometimes, it makes strategic sense to waive privileges deliberately. Audit committees must be careful, however, not to waive inadvertently. While the law differs by jurisdiction, disclosure of information or documents to outsiders, such as the auditor or regulators, or even to management, may be considered a waiver. Committees and their counsel must be thoughtful about ways to make necessary disclosures without waiving privilege and work product protections. Oral presentations and confidentiality agreements are among the many approaches audit committees have adopted.
9. What corrective actions should we undertake?
Appropriate remedial measures should be the ultimate goal of an audit committee investigation. Those measures may include, among many other things: personnel action, including terminations; enhanced internal controls, including new compliance policies or training requirements; and/or restating or revising financial statement information.
10. Do we self-report?
In certain circumstances, the law—not to mention good corporate citizenship—requires self-reporting to the government. And while there is debate about the actual benefits, regulators and enforcement authorities often tout the cooperation credit granted to self-reporters.
But audit committees should be mindful that, however comprehensive and polished a self-report may be, the government will almost always want to know more. After a recent self-report, an SEC lawyer asked company counsel, “Is there anything else you think we would like to know?” The question’s open-endedness, counsel’s general duty to tell the truth, and the attorney-client privilege make that a difficult question to address. The point is that self-reporting, while often the right thing to do, may open new cans of worms.
Additional questions should be considered and no two investigations are alike. But given increasing audit committee workloads and regulatory scrutiny, audit committees would be well served to consider these 10 questions.
This article presents the views of the author and does not necessarily reflect those of Hunton & Williams LLP or its clients. The information presented is for general information and education purposes. No legal advice is intended to be conveyed; readers should consult with legal counsel with respect to any legal advice they require related to the subject matter of the article.
x x x."
