Key Points

• If a company needs to disclose information from an internal investigation to auditors, regulators or shareholders, it must be alert to the risk that it could waive the legal protections for confidentiality.
• Providing high-level summaries or pure facts sometimes suffices and avoids a waiver of privilege.
• Throughout the internal investigation process, boards and audit committees need to bear in mind how documents could be used against the company later in litigation.

A whistleblower has triggered a race against time: An internal inquiry, directed by the audit committee and overseen by external counsel, has been launched in response to allegations that revenue was recorded without proper support. The catch? It is four weeks before quarter close, and the company’s external auditors want real-time updates from the investigation. Without these downloads, the auditors will not sign off on the financials.

The audit committee faces a critical decision: How to share up-to-date information with auditors without compromising legal privilege. Share too little, and the auditors could halt its quarter-end process, potentially leading to a dreaded delayed filing announcement to the market. Share too much and regulators and shareholders may later claim any privilege was waived.

Internal investigations are a critical tool for companies to address potential misconduct, regulatory violations, or other issues that may threaten their operations, accurate financial reporting and reputation. These investigations often involve a delicate balance between providing necessary information to third parties like auditors, consultants, regulators and shareholders, all while preserving the attorney client privilege and protections for the work product of the company’s lawyers. This article provides a framework for understanding that balancing process.

Understanding Attorney Client Privilege and Work Product Protection

First, it’s crucial to understand the two key legal protections involved: attorney client privilege and work product protection.

Attorney-Client Privilege

Attorney-client privilege shields communications between an attorney and their client from disclosure to third parties. To establish this privilege, the communication must be made in confidence between an attorney and client in order to obtain legal advice. If other people who are not essential to the purpose of obtaining legal advice are privy to the conversation, it may not be protected. Privileged communications are generally exempt from discovery in legal proceedings.

Work Product Protection

Work product protection applies to materials prepared by an attorney (or in some cases a consultant) in anticipation of litigation. Work product includes attorney’s mental impressions, opinions, conclusions and trial strategy, and may include compilations or analysis of facts. The material need not be communicated to the client to receive protection.

Sharing Information With External Auditors

External auditors play a crucial role in ensuring financial transparency and accountability for public companies, but sharing information with them can waive the attorney-client privilege. What is more, anything shared with the auditors could be included in their workpapers, and a regulator like the Securities and Exchange Commission (SEC) could subpoena those. Thus, it is vital to strike a balance between providing necessary information and safeguarding the privilege.

At the outset, the company and the external auditors should discuss what information the auditors need and why they need it. Often by discussing concerns about privilege with the auditors, solutions can be found that satisfy the auditor’s requirements while protecting the company’s interest in confidentiality. A company may, for instance, use redactions and high- level summaries, or rely on oral communications to convey information and provide transparency while protecting sensitive or privileged content.

It is important to keep detailed records of what was shared, and when and why, in case of future disputes or challenges to privilege.

Sharing Information With Regulators

A company may also need to share information from an internal investigation with regulators like the SEC or the Department of Justice (DOJ) in order to obtain credit for cooperation that could reduce any penalties and make it easier to reach a satisfactory resolution. Providing too little information runs the risk of the government arguing that the company is not cooperating; sharing too much information runs the risk of waiving the privilege.

For instance, one court held that a law firm waived its work-product privilege over interview memoranda and notes when it provided detailed oral summaries that were seen as equivalent to disclosing the lawyers’ memoranda and notes of interviews. But that court and others have indicated that providing the government with high-level conclusions or impressions from the interviews would not result in work product waiver.

Disclosing information to a governmental authority can constitute a waiver vis-à-vis other parties. Take, for example, the case of a company under investigation for allegedly paying foreign bribes to obtain business. It cooperated with the DOJ, making voluntary self-disclosures from its internal investigation, including detailed accounts of interviews it conducted and documents reviewed in those interviews. The government did not charge the company, but when it indicted two former executives, the executives sought information from the internal investigation. A court concluded that the company waived its privilege over its interview memos, notes, summaries and the underlying documents and communications conveyed through those summaries by selectively sharing these materials with the DOJ.

This case highlights the balancing acts and complex decisions companies face when trying to cooperate with the government. As with auditors, one solution may be to provide high-level summaries based on the interviews as a whole, rather than detailed summaries of individual interviews. Moreover, the actual facts are not privileged, so another strategy is to produce documents that contain the underlying facts, rather than summaries of documents, which may include an attorney’s conclusions and impressions.

Sharing Information With Experts and Consultants

Many internal investigations involve collaboration with experts and other consultants, including forensic accountants or subject matter experts. To effectively safeguard this privilege when working with third-party experts and consultants, it is advisable for them to be directly retained by the law firm overseeing the investigation, with a written agreement. By structuring the relationship this way, any exchange of information occurs within a framework designed to uphold work product protection.

In these situations, it is crucial that all communications and shared documents are clearly marked as privileged and confidential and that the consultants understand the importance of maintaining this confidentiality.

Sharing Information With Shareholders

A board may want to share information from a privileged internal investigation in response to a shareholder demand letter, but this, too, poses the risk of waiving the attorney-client privilege, which then exposes that information to third-party legal threats. Moreover, if the information does not resolve the shareholder’s demands, they may disclose it publicly or use it in a lawsuit.

Companies may be tempted to mitigate the risks by obtaining a non-disclosure agreement (NDA), but the act of disclosing privileged information can be viewed as waiving the privilege notwithstanding an NDA. Like the other situations discussed above, companies facing shareholder requests are best to focus on sharing factual information rather than conclusions that may contain attorney mental impressions.

Keeping the Possibility of Litigation in Mind

Throughout the internal investigation process, careful thought must be given to the preparation of reports, presentations, board minutes and other documents. Audit committees and others involved in in investigations need to ask: Should this be written down? How would this look if it had to be turned over? Is more context or nuance needed in this document to provide a complete picture? How would this affect potential or pending litigation claims or the company’s reputation?

To minimize the risk of disclosure of privileged communications, it is crucial for boards and managers to expressly request legal advice (and for their attorneys to make sure that they state that they are providing legal advice), limit distribution of legal advice to those within the organization to those that need to be aware of it, and clearly and consistently mark privileged advice — but not in such a wholesale manner that a court might think the company is making a blanket assertion of privilege.

Conclusion

By carefully considering the scope of disclosure, the audience for it, by using redactions and summaries, and by maintaining control over who has access to information, companies can protect legal interests and confidential materials while fulfilling their obligations and ensuring necessary transparency.

Download PDF