Recent Decision Reminds Companies to Use Best Practices to Protect Their Internal Investigations

by Pillsbury Winthrop Shaw Pittman LLP

The DC Circuit recently heard oral argument regarding a mandamus petition filed by defendants in a qui tam action. The case sheds light on the best practices that companies should utilize to increase the odds that the attorney-client and work product privileges will shield their internal investigation records.

In United States ex rel. Barko v. Halliburton, filed in 2005, the plaintiff-relator alleges that various Kellogg Brown & Root entities and the Halliburton Company (KBR, collectively) violated the False Claims Act by incurring excessive or fraudulent contract costs and passing those costs onto the U.S. government. The United States declined to intervene, and the case was unsealed in 2009. In February 2014, the plaintiff-relator moved to compel KBR to produce documents related to KBR’s Code of Business Conduct (COBC) investigations of the alleged misconduct. COBC investigations commence upon receipt of a report or anonymous tip of potential wrongdoing from an employee. In the facts of this case, the reports or tips are sent to the COBC director, a company attorney, who determines whether to investigate. If so, the COBC director refers the matter to a non-attorney Security Department manager who, in turn, directs a non-attorney Security Department employee to conduct an investigation. An investigation typically consists of employee interviews and witness statements, and reviewing of documents. The investigation report is then transmitted to the legal department.

KBR refused to produce the COBC investigation records, claiming protection under the attorney-client and attorney work product privileges. After an in camera review of the documents, Judge James Gwin of the U.S. District Court for the District of Columbia disagreed, holding that they were ordinary business records created to satisfy U.S. defense contractor requirements—not to obtain or receive legal advice—and ordering production of the documents. The key facts on which Judge Gwin relied are discussed in two opinions—his Order granting the motion to compel and his subsequent Order denying KBR’s motion for certification of an interlocutory appeal. They include the following:

  • The COBC investigation was a routine corporate and ongoing compliance investigation required by regulatory law and corporate policy and would have been conducted regardless of whether legal advice was sought.
  • None of the documents requested legal advice or provided legal advice.
  • Investigators, not attorneys, conducted the interviews and wrote the reports.
  • The investigation was conducted between 2004-2006, but the complaint in this litigation was not unsealed until 2009.
  • The employees who were interviewed were never informed that the purpose of the investigation was to assist KBR in obtaining legal advice.
  • The confidentiality agreement employees were asked to sign did not mention that the purpose of the investigation was to obtain legal advice.

In its mandamus petition to the DC Circuit, KBR argued that the company’s attorney-supervised efforts to comply with Federal law—i.e., determining if it needed to report wrongdoing to the Federal government—constituted quintessential legal advice and attorney work product. Otherwise, companies would be inhibited from implementing internal controls, voluntary investigations and self-reporting. In his opposition, the plaintiff-relator argued that KBR sought to create a privilege merely by passing internal investigation documents through the hands of counsel. He also argued that KBR’s policy provided a special procedure for investigations whose specific purpose was to obtain legal advice, but KBR did not follow that procedure here.

At oral argument on May 7, 2014, the DC Circuit panel (Judges Griffith, Kavanaugh and Srinivasan) expressed some support for KBR’s position, with Judge Srinivasan suggesting that it would not be possible to separate legal advice from the internal investigations conducted here; they were used to determine the applicability of federal regulations and whether a company needed to make a report under those regulations. However, the Court may not rule on the underlying merits because it must also address whether the matter is properly before it in a mandamus action.

Best Practices

However the DC Circuit rules, the facts of this case provide a road map of the best practices to follow to preserve the attorney-client privilege and work product privilege for internal investigation records:

  • At the outset, evaluate the purpose of the investigation and assess the privileged nature of the investigation in light of that purpose.
  • If you choose not to conduct a privileged investigation, keep in mind that the subsequent communications between client and counsel concerning the results of the investigation, and any work product generated on those results, can remain separate and privileged and should be clearly marked as privileged.

  • If you embark on a privileged investigation:
    • Attorneys should memorialize the investigation’s purpose in writing, making it clear that the investigation is being undertaken for the purpose of assessing legal issues and for the provision of legal advice to the company.
    • Attorneys should determine the scope of the investigation—i.e., which allegations are investigated and which witnesses are interviewed.
    • Attorneys should oversee the investigation and document such oversight, making it clear that the attorneys are directing and running the investigation.
    • It should be made clear to all involved with the investigation (investigators, witnesses, etc.) that the investigation is being undertaken at the direction of counsel for the purpose of the provision of legal advice to the company.
    • All witnesses should be provided an Upjohn warning—that the interview is being conducted for the purpose of providing legal advice to the company (and not the witness) and is protected by the attorney-client privilege.
    • All materials should be marked as attorney-client privileged and treated as such. If appropriate to mark materials as attorney work product, include that label as well.
    • Document any threat of litigation to help establish when the attorney work product privilege is to apply.
  • Keep in mind that no investigation is guaranteed to be privileged, and you should always be prepared to produce investigation documentation.
  • Companies should consider seeking advice from outside counsel for assistance in determining the purpose and treatment of the investigation and involving outside counsel in their investigations. Outside counsel are traditionally viewed in solely a legal role whereas in-house counsel are sometimes viewed as performing more of a “business” than “legal” role. Accordingly, a reviewing court may be more inclined to sustain a claim of either attorney-client or work product privilege if the underlying work was performed and/or supervised by outside counsel.


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Pillsbury Winthrop Shaw Pittman LLP | Attorney Advertising

Written by:

Pillsbury Winthrop Shaw Pittman LLP

Pillsbury Winthrop Shaw Pittman LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at:

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.