CAPITAL MARKETS & CORPORATE GOVERNANCE © Ocean Photography/Veer THE GOVERNANCE COUNSELOR Board-Driven Internal Investigations In her regular column on corporate governance issues, Holly Gregory discusses the circumstances that may necessitate a board-driven investigation into allegations of corporate wrongdoing. HOLLY J. GREGORY PARTNER SIDLEY AUSTIN LLP H  olly counsels clients on a full range of governance issues, including fiduciary duties, risk oversight, conflicts of interest, board and committee structure, board leadership structures, special committee investigations, board audits and self-evaluations, shareholder initiatives, proxy contests, relationships with shareholders and proxy advisors, compliance with legislative, regulatory and listing rule requirements, and governance best practice. 32 May 2016 | Practical Law I n an environment of heightened federal enforcement activity and employee whistleblowing, corporate boards and their counsel must be especially attuned to circumstances that may give rise to the need for an internal investigation and, increasingly, the need for the board to take the reins in an internal investigation. In particular, federal regulatory interest in identifying and holding accountable the senior individuals responsible for corporate compliance failures has implications for the board’s approach to its oversight of internal investigations. In addition to attending to internal controls, financial reporting, and the compliance and ethics programs that help set the tone for corporate culture, the board must be prepared to take action if a red flag indicates that more specific board attention to a compliance matter is required. Red flags that raise concerns about corporate misbehavior or misconduct of directors or officers can necessitate undertaking an internal investigation regarding a potential violation of law, regulations, or corporate policy.

These red flags or allegations may have civil, regulatory, or criminal implications for the company and require that the board or a board committee direct and oversee an internal investigation. © 2016 Thomson Reuters. All rights reserved. . Against this background, this article discusses: „„ The Department of Justice’s (DOJ’s) policy on individual culpability for corporate wrongdoing and the implications for boards. „„ The board’s role in directing and overseeing an internal investigation. „„ Key practice pointers related to board-driven investigations. DOJ POLICY AND IMPLICATIONS FOR THE BOARD In September 2015, US Deputy Attorney General Sally Quillian Yates issued a memorandum, Individual Accountability for Corporate Wrongdoing (Yates Memo). The Yates Memo emphasizes a renewed focus by the DOJ on criminal and civil prosecution of individuals in cases involving corporate compliance failures and corporate malfeasance. For companies to get any credit for cooperating with the DOJ, they must provide information about individual wrongdoers identified in the course of the investigation. The policy set forth in the Yates Memo has implications for the board with respect to oversight of compliance and independent investigations. Directors must exercise reasonable care to ensure that the company is being managed in compliance with law, regulations, and corporate policies.

The Yates Memo does not change fiduciary duties, but it is part of the framework that a board should consider in connection with its good faith obligation to see that the company has in place appropriate compliance systems and related information systems, reporting systems, and internal controls. The Caremark case and its Delaware progeny remind boards to pay attention to the framework of prosecutorial and sentencing guidelines relating to corporate compliance failures and the opportunities they provide to mitigate corporate penalties. Compliance and ethics programs, information and reporting systems, and related controls all need to be designed in light of this framework to deter compliance violations and provide senior management and the board with “timely, accurate information sufficient to allow management and the board, each within its scope, to reach informed judgments concerning the [company’s] compliance with law and its business performance” (In re Caremark Int’l Inc. Deriv. Litig., 698 A.2d 959, 970 (Del. Ch.

1996)). As then-Chancellor Allen observed, “[a]ny rational person attempting in good faith to meet an organizational governance responsibility would be bound to take into account” this framework, including the US Federal Sentencing Guidelines, and “the enhanced penalties and the opportunities for reduced sanctions that it offers” (Caremark, 698 A.2d at 970). The Yates Memo’s emphasis on identifying individuals involved in corporate misconduct means that boards will need to ensure that information and reporting systems and related investigation processes are designed to support the identification of facts regarding the individuals responsible for corporate misconduct. This includes establishing a corporate culture and tone at the top that encourages cooperation and avoids an unduly defensive “circle the wagons” mode at the expense of identifying © 2016 Thomson Reuters. All rights reserved. Internal Controls, Financial Reporting, and Compliance Oversight of internal controls, financial reporting, and compliance and ethics programs continues to be important for boards.

Boards need to: „„ Understand and oversee the internal controls and procedures that management has put in place to assure that financial reporting is accurate and the company complies with applicable law and regulations. „„ Attend to corporate culture, emphasizing expectations that management will abide by and further ethical behavior, fair dealing, and integrity within the company. „„ Oversee management’s efforts to educate personnel about the corporate code of conduct and expected standards of ethical behavior, encourage internal reporting (whistleblowing), monitor compliance, and identify and respond as appropriate to red flags or a series of yellow flags. „„ Pay special attention to related person transactions and other conflicts of interest that involve board members or senior management. „„ Attend to issues of, and set standards and policies regarding, sustainability and social responsibility, including environmental issues, involvement in the political arena, and human rights. Search A Board Roadmap for 2016 for more on the board’s role in attending to internal controls, financial reporting, and compliance. individuals responsible for corporate misconduct when a problem does arise. The ethical tone should continue to emphasize that compliance is essential for the company and directly related to achieving business priorities, and that all directors, officers, and employees are responsible for compliance. From a practical perspective, regular review and ongoing emphasis of anti-retaliation provisions is also important. Regarding oversight of actual investigations, the board, or an appropriate standing or special committee, will need to ensure that investigation processes are designed to support the identification of facts related to individual culpability. Management reports or reports from counsel should include sufficient information to enable the board to assess whether appropriate steps are being taken to provide the benefits of cooperation under the Yates Memo, or explain in a focused manner why a different approach has been taken and the The Journal | Transactions & Business | May 2016 33 .

THE GOVERNANCE COUNSELOR CAPITAL MARKETS & CORPORATE GOVERNANCE risks associated with it. As in the past, boards will need to be prepared to take difficult actions to address any non-cooperation by officers and senior managers or directors. The number of these instances may increase as key individuals understand the increased focus on “naming names.” In addition, the Yates Memo’s focus on individual culpability could lead to heightened scrutiny of individual directors, particularly those with specialized expertise who arguably may have been in a position to identify a compliance issue within their area of expertise. Senior executives and even directors may also decide to “lawyer up” individually more frequently or at an earlier stage than in the past as a result of the Yates Memo. This could expand the instances in which there is a need for, and further add to the complexity of, board-driven investigations. civil action (for example, a shareholder derivative lawsuit, a securities class action, a products liability claim, or an EEOC proceeding). „„ Consumer or competitor complaints. „„ Media reports. Generally, the purpose of an internal investigation is to promptly ascertain the facts and circumstances surrounding the allegations of misconduct, including: „„ Uncovering the facts of what happened and whether misconduct did in fact occur and to what extent. „„ Determining who was involved and the extent of their personal culpability. „„ Identifying any failures of internal controls associated with the misconduct. Search Criminal and Civil Liability for Corporations, Officers, and Directors for more on the Yates Memo. CONDUCTING A BOARD-DRIVEN INVESTIGATION Credible allegations of misconduct by or within a company need to be carefully evaluated.

This evaluation is often conducted through an internal investigation that is driven by the general counsel, with or without assistance from outside counsel. However, in certain circumstances it is critical for the board or a board committee to drive the investigation. Events that may trigger an internal investigation include: „„ Complaints received through a company whistleblower hotline or other compliance program vehicle (which may or may not be anonymous). „„ Allegations from a terminated employee. „„ Matters raised by a compliance audit or by the company’s auditor. „„ Issues identified through a subpoena or other notice of law enforcement or regulatory action or a qui tam claim or Conducting an internal investigation when allegations of misconduct arise helps position the company with information about whether there is a potential regulatory compliance problem that needs to be addressed, and whether there is a risk of potential liability that needs to be managed. A wellconducted internal investigation can help signal to prosecutors, regulators, and courts that the board and senior management take compliance matters seriously and can help avoid or mitigate penalties. However, to reap these benefits an internal investigation should be designed to maintain objectivity in the fact-gathering process. An internal investigation will provide less protection to the company if concerns about defending the company or culpable individuals overtake that objectivity.

At the same time, internal investigations can be costly and may disrupt management. There is also the potential for additional problems to be uncovered, which will need to then be addressed. Therefore, care is necessary to assure that internal investigations are appropriately targeted in scope. The risks to the company, the level of potential involvement in the misconduct by senior decision-makers, the substance of A well-conducted internal investigation can help signal to prosecutors, regulators, and courts that the board and senior management take compliance matters seriously and can help avoid or mitigate penalties. 34 May 2016 | Practical Law © 2016 Thomson Reuters.

All rights reserved. . the allegations, and the way the allegations arise will influence decisions regarding the most efficient and effective way to conduct the investigation. These decisions include whether the board should provide general oversight of a management-directed investigation or should itself be actively engaged in supervising the investigation with the assistance of outside counsel. While there are no absolute rules for when a board-driven investigation is required, as a general matter active board oversight and control of an internal investigation regarding allegations of misconduct is typically called for if the allegations: „„ Relate to actions of the board members, in which case consideration needs to be given to whether comprising a board committee of disinterested directors is appropriate. „„ Relate to actions of the CEO, the CFO, the general counsel, or other key executive officer. „„ Involve conduct that could reasonably implicate one or more executive officers. „„ Could otherwise call into question the objectivity of a management-directed investigation. A board-driven investigation may also be warranted if the fact of a board-driven investigation will improve credibility with prosecutors, regulators, stock exchanges, courts, or other key constituents. ORGANIZING THE BOARD COMMITTEE In organizing a board-driven investigation, it is typical for a standing or special committee to provide oversight to the outside counsel hired for the matter. The composition of the board committee should be independent of the company and the potential investigation targets and key witnesses. In addition, the directors should be disinterested to the extent possible.

They should not be directly involved in the actions that are the subject of the investigation. While the delegation of authority for the investigation should define the scope of the delegation, flexibility needs to be allowed for the board committee to further determine the scope of the investigation. Changes in scope should be approved in writing. The delegation of authority, whether in the form of a board resolution or committee charter adopted by the board should provide for minutes to be kept and for reporting to the board, and allow for the reports to be made in an executive session with recusal by any interested directors. Consideration should be also given in advance to whether and how the chair and board committee members will be compensated for their efforts. COUNSEL FOR THE INVESTIGATION In addition to delegating clear authority to the board committee to direct the investigation, the board should provide the board committee express authority to hire appropriate legal counsel and to approve the hiring by legal counsel of forensic and other experts as needed (which helps retain privilege over the investigation).

Where a board-driven investigation is appropriate, for example because senior management is implicated or significant accounting or other issues are alleged, it is highly © 2016 Thomson Reuters. All rights reserved. likely that the board will rely on outside counsel who will report directly to the board or the applicable standing or special board committee. The role of in-house counsel in these circumstances varies, although in-house counsel is expected to cooperate and may be authorized to work with outside counsel. Prosecutors, regulators, and courts may have concerns about the objectivity of in-house counsel where allegations involve senior officers or allegations of pervasive misconduct.

In these circumstances, outside counsel is typically hired directly by, and will report directly to, the board or board committee, and the board or board committee will retain decision-making authority regarding the investigation. The determination that a board-driven investigation is necessary will imply that outside counsel (rather than in-house counsel) should conduct the investigation. In-house counsel has advantages in terms of a superior understanding of the internal landscape, but may be perceived by outsiders to lack the requisite objectivity, may have an actual conflict due to its role in advising on the underlying matter and, in some cases, may not have the level of resources and experience for the particular matter at hand. Reliance on in-house counsel may also undermine privilege claims where business and litigation roles are combined. There are similar issues regarding the company’s regular outside counsel, who often has the advantage of familiarity with the company and its practices and is generally able to act quickly and efficiently.

However, consideration should be given to whether they have the specialized legal expertise required regarding the particular matter and whether the subject matter involved relates to an area where they have provided legal advice to the company that could create an issue. In addition, the objectivity of outside counsel should be considered, given their other business relationship with the company. Another option to consider is hiring independent counsel solely to conduct the investigation, with the requisite specialized expertise, including experience in both the subject matter of the investigation and counseling in the context of a board-driven investigation. While this is likely to be a more costly approach because independent counsel will need to become familiar with the company, the involvement of independent counsel may help to establish maximum credibility with prosecutors, regulators, courts, and other key parties. PRACTICE POINTERS FOR BOARD-DRIVEN INVESTIGATIONS Key areas of consideration for a board-driven investigation relate to: „„ Delegating authority and defining scope.

The delegation of authority to the independent board committee and the scope of the investigation should be set forth in a formal board resolution or committee charter. This formal description should provide both real authority and some flexibility while describing, to the extent possible, realistic limits. The scope should be neither too narrow nor too broad.

Otherwise, the The Journal | Transactions & Business | May 2016 35 . THE GOVERNANCE COUNSELOR CAPITAL MARKETS & CORPORATE GOVERNANCE investigation may, by design, overlook relevant misconduct or lead to unnecessary disruption and expense. The board committee should have the ability to further refine and even expand the scope of the investigation should the need arise within reasonable parameters, and these adjustments should be memorialized in writing by the board committee. Consideration should be given to specifying that among the purposes of the investigation, the investigation is being conducted to: The DOJ’s Foreign Corrupt Practices Act (FCPA) Pilot Program In April 2016, the DOJ announced in a memorandum from Andrew Weissmann, Chief of the DOJ’s Fraud Section, a new one-year FCPA enforcement pilot program, primarily designed to motivate companies to voluntarily self-disclose FCPA-related misconduct (Weissmann, The Fraud Section’s Foreign Corrupt Practices Act Enforcement Plan and Guidance, April 5, 2016). The pilot program is also intended to increase the DOJ’s ability to prosecute individual wrongdoers, consistent with the Yates Memo’s focus on individual culpability for corporate misconduct. identify persons responsible for misconduct if any misconduct is found; zz identify any failures of internal controls associated with misconduct if misconduct is found; and zz position the board committee to recommend appropriate remedial action. zz Under the pilot program, companies are eligible to receive additional cooperation credit in FCPA-related matters. To receive additional credit, a company must: „„ Document preservation.

One of the first communications that must be circulated internally in an internal investigation is a notice to preserve relevant documents, including emails and other electronic documents. In a board-driven investigation, care should be taken to determine who should receive the notice and the scope of information to be protected. Too broad a distribution risks inadvertent disclosure and the distraction that comes from conjecture and rumor.

Too narrow a distribution risks allowing documents to be compromised. The scope of the document preservation notice relates closely to the scope of the investigation and is a matter for discussion between counsel and the board committee. Coordinating document preservation efforts with the company’s IT department is also an important part of this process. Many IT systems may provide for automatic deletions or other automatic processes that need to be quickly suspended as part of the preservation process. „„ Confidentiality.

Concerted efforts should be made to keep the information regarding the investigation as closely held as possible, unless and until there is a reason for wider disclosure. The circle of those persons within the company that “need to know” should be tightly defined. Persons with knowledge within that circle and persons who are likely to be interviewed regarding the facts should be expressly discouraged from discussing the investigation and the underlying facts and circumstances with anyone outside the presence of counsel. „„ Interviews of board committee members.

Members of the board committee should expect to be interviewed at the outset by counsel to ensure that there are no disqualifying circumstances that could taint the independence of the investigation. More substantive interviews may also be conducted during the course of the investigation where appropriate. „„ Work plan. The board committee should expect counsel to consult with it regarding a work plan for the investigation that will be designed in accordance with the agreed scope.

The work plan will reflect a variety of considerations, including: how the concerns about the potential misconduct arose; zz the seriousness of the allegations; zz 36 May 2016 | Practical Law „„ Voluntarily self-disclose its misconduct. „„ Fully cooperate with the DOJ in the investigation. „„ Timely and appropriately remediate flaws in its controls and compliance programs. At the end of the one-year period, the DOJ’s Fraud Section will determine whether to extend, modify, or end the pilot program. Search DOJ Launches FCPA Self-Reporting Pilot Program for more on the pilot program. the broader context (such as any regulatory investigation or other known legal action relating to the matter); and zz the timeframe in which the investigation should be undertaken. zz „„ External auditors. Typically the company’s independent auditor will expect to be informed of an internal investigation, and the timing and extent of this disclosure should be discussed with counsel at an early stage. Consideration must be given to how to provide information without waiving the attorney-client privilege and work product protection. „„ Whistleblower protections.

Whistleblowers are often, but are not always, disgruntled employees, and special care is needed to ensure that there is no retaliation against employees who bring forward their concerns. In a board-driven investigation that involves a whistleblower who is a current employee, methods of ensuring this protection should be considered. „„ Internal reporting. It should be determined whether the report from counsel to the board committee will be in writing or delivered orally.

While an oral report avoids a potentially discoverable document that could be used against the company, there may be circumstances where a written report may be preferable, for example if disclosure regarding the investigation would better position the company with regulators or is otherwise inevitable due to the circumstances. © 2016 Thomson Reuters. All rights reserved. . „„ Cooperation. Depending on the circumstances, consideration should be given to the pros and cons of voluntary disclosure and specifically whether, and if so when and how, to provide voluntary disclosure (self-reporting) to the government and otherwise cooperate. The Yates Memo’s requirements regarding disclosure of facts related to individual culpability will need to be considered as part of this assessment. „„ Attorney-client privilege. To protect privilege, it should be determined who will be present when outside counsel reports to the board committee on the investigation.

The presence of persons who do not need to know the information or who have a conflict of interest can cause an inadvertent waiver. Counsel should hire forensic experts and other advisors in anticipation of litigation to provide, where possible, privilege protection to the work of these experts and advisors. to whether the investigation was thorough and objective and whether the board committee providing active oversight and direction, and its counsel, were untainted by conflicts of interest. Having a clear record of independence and lack of conflict of the board committee, its delegated authority and the scope of responsibilities, and its ability to hire counsel and make decisions, is key to establishing credibility. A clear record of the findings of the investigation and the outcome with respect to remedial measures is also crucial. The views stated above are solely attributable to Ms.

Gregory and do not necessarily reflect the views of Sidley Austin LLP or its clients. „„ Intentional waiver. Special consideration should be given to the considerable pressures for waiver that may come from prosecutors and regulators. For example, the Yates Memo’s emphasis on corporate disclosure of evidence against individuals for cooperation credit may lead to pressures to waive privilege that belongs to the company, and since selective waiver may not be permitted depending on the jurisdiction, this could have implications for other litigation involving the same subject matter.

If disclosure is contemplated, consideration should be given to the extent to which disclosure can be limited to facts only. If a waiver is contemplated, consideration should be given to a written agreement addressing the scope of the waiver and limitations on its use. „„ Public disclosure. Public companies must consider the extent to which SEC reporting of material information will be required. „„ Remedial measures.

Where misconduct is found, the board committee must determine appropriate remedial action. If individuals are found culpable, the board committee should consider appropriate action, which could include disciplinary action and potentially dismissal. Disciplinary action should be fair and consistent with the level of the individual’s wrongdoing. Consideration should also be given to whether and how internal controls need strengthening, and whether the company’s code of conduct and ethics requires amendment, with ethics training adjusted accordingly. Remedial measures can be expected to be reviewed by the relevant government agency and stock exchange as they assess the adequacy of the company’s response.

Failure to take remedial action with respect to an executive officer found to have breached the company’s code of ethics may give rise to a waiver of the company’s code of ethics that must be disclosed. „„ Reporting. In appropriate circumstances, the board committee will need to determine whether the culpable individuals should be identified to prosecutors or regulators, in line with the expectations of the Yates Memo. Whether prosecutors, regulators, and courts find the conclusions of an internal investigation to be credible will relate directly © 2016 Thomson Reuters. All rights reserved.

Use of Practical Law websites and services is subject to the Terms of Use (http://us.practicallaw.com/2-383-6690) and Privacy Policy (http://us.practicallaw.com/8-383-6692). The Journal | Transactions & Business | May 2016 37 .