During an internal investigation, in-house counsel must move quickly, make difficult decisions and be alive to a range of issues. In-House Perspective assesses the role of the in-house team within these investigations, across areas such as when to report, privilege and jurisdictional considerations.

Picture the scene: you are general counsel of a multinational corporation and you’re told that the call all business leaders dread has just come in. Several employees in your UK and US arms have been accused of paying bribes to secure deals across the African continent. The authorities haven’t yet been informed, but the assumption is that if you’ve been, they will be soon too. What should you do?

For Alex Swan, Website Officer on the IBA Business Crime Committee and of counsel in the London office of Greenberg Traurig, the very first thing a legal chief should do is ensure there’s a core team – either in-house only or a combination of internal and external counsel – tasked with handling a preliminary investigation into the issue, which at this stage should be kept as confidential as realistically possible. That team should immediately establish which departments or business units are potentially affected.

‘What is OK in one jurisdiction might not be okay in another but also when you are gathering and processing data you have to consider whether feeding something through to another jurisdiction could cause an issue because it has a different approach to confidentiality’, Swan says. ‘In-house lawyers need to be alive to that. The UK Bribery Act can bite if you carry on operations in the UK or you have an office in the UK, even if none of the conduct happened in the UK. The bribery allegations might have happened somewhere in West Africa but do you only need to be worried about X number of West African operations or will there be a UK angle? If the alleged bribes were paid in dollars will there be a US issue?’

Some of these questions came to the fore when the UK’s Serious Fraud Office (SFO) launched an investigation into Swiss-headquartered natural resources company the Glencore group in 2019. At the time the SFO said it was ‘investigating suspicions of bribery in the conduct of business by the Glencore group of companies, its officials, employees, agents and associated persons’. The fraud office later announced that its investigation, which focused on the activity of the company’s London-based West Africa desk, uncovered ‘a trail of text messages, large cash withdrawals and deliberately concealed payments that showed Glencore paid bribes worth a total of $29m to secure its access to oil in Cameroon, Equatorial Guinea, Ivory Coast, Nigeria and South Sudan’.

Following a case at Southwark Crown Court, the group’s subsidiary Glencore Energy UK, which pleaded guilty to seven counts of bribery, was fined £280m for what the judge, Mr Justice Fraser, called ‘sophisticated offending that was sustained over prolonged periods of time’. Following the penalty being issued, Kalidas Madhavpeddi, Chairman of Glencore, stated that ‘the conduct that took place was inexcusable and has no place in Glencore […] the Company has taken significant action towards implementing a world-class Ethics and Compliance Programme built around risk assessment, policies, procedures, standards and guidelines based on international best practice, associated training and awareness initiatives as well as monitoring systems’.

In the Glencore case, it was the SFO that notified the company that an investigation had been launched, but in some instances, organisations will be made aware of potential wrongdoing before any authorities have become involved. But, given that many cross-border investigations will involve more than one regulatory body, knowing when and how to liaise with authorities is key.

‘A lot of regulators expect to be informed immediately and that’s one of the issues that you have to keep on your to-do list’, says Ciarán Egan, a senior associate in the Dublin office of Arthur Cox. ‘Sometimes you can delay reporting because you are investigating the matter, but typically regulators will not permit that as an excuse if there is what they would see as an unnecessary delay. You can say “we know about this and are investigating and will tell you once we’ve concluded our initial investigation” – that’s seen as being a good corporate citizen, but listed companies might have to make a market notification immediately.’

Egan explains that, in Ireland, there’s a statutory obligation to report what you suspect to be a crime to the Irish police, but this can be done in a way in which a company can fulfil its obligations without exposing the company by saying too much or pointing to certain findings that haven’t been investigated fully.

Utmost discretion

Stéphane Eljarrat, North American Regional Representative on the IBA Anti-Corruption Committee and Head of Norton Rose Fulbright’s Canadian White Collar Crime Practice, says that when carrying out initial investigations, it’s imperative that a company’s in-house legal team handles it as discreetly as possible. ‘When a general counsel learns that the company has an allegation of foreign corruption, whether from an internal audit or a whistleblower report, the first thing they have to do is find out whether the allegation is founded’, he says. ‘They have to do it at this stage in the most discreet way. People have all kinds of reasons to allege things and all kinds of motivations – you can get a very detailed report only to learn it was from a disgruntled employee wanting to cause trouble.’

Eljarrat says that it’s necessary to protect the reputation of the company or the person being accused until it’s discovered that it’s sufficiently founded to warrant an investigation. ‘You need to verify whether or not it’s founded. If it’s not founded at all you need to document all the steps you took in order to get there in case it comes back – you never know,’ he adds.

If the allegations are founded, Eljarrat says it’s incumbent on general counsel to ‘determine which jurisdictions are involved and understand the facts and the potential liabilities’ as quickly as possible. ‘If it’s a serious allegation like foreign corruption you’ll want to hire external counsel who specialise in investigations and who have a background in criminal law’, he says. ‘Give them a mandate to investigate and report back’.

Eljarrat says consideration must be given to a wide range of issues at this stage, such as who from the corporate side should be involved in steering the investigation – something that will be dependent on who in the company has been accused of the wrongdoing – and ensuring that no documentary evidence is destroyed. Yet, while at this stage the point of conducting a probe is to enable corporations to self-report should it become clear there has been a breach of the law, he notes that care should be taken when determining who to report to and when.

‘You either have a problem or you don’t and if you have a problem you have to make decisions’, he says. ‘Some jurisdictions, like the UK, France and Canada, have deferred prosecution agreements [DPAs] and public companies have obligations around disclosure. You might decide that you don’t want to go to the authorities or you might decide that you have to go to the authorities because you want to clean up the issue, and you might want a DPA. They’re very different from one jurisdiction to another.’

‘One thing you don’t want to do is say “I have a problem in the US, I’ll rush to resolve it”’, says Eljarrat. One must ask if the company has an issue in other jurisdictions too. If the issue is multijurisdictional in nature, it’s essential to conduct analysis so whatever approach the counsel takes to resolve matters is carried out holistically. ‘Most jurisdictions are becoming understanding that most companies won’t plead guilty in ten jurisdictions and there are provisions that say if you plead guilty in one you can’t be charged in another’, Eljarrat adds.

The power of privilege

Authorities in the UK and US are generally open to giving companies credit for self-reporting once the basic facts of an investigation have been established. That can involve entering into DPAs, which enable the organisation to make reparations for criminal behaviour, generally through monetary fines, without suffering the collateral damage of a criminal conviction. Self-reporting is not always possible, though. Simone Nadelhofer, Anti-Corruption Committee Liaison Officer on the IBA Business Crime Committee and a partner at Swiss firm Lalive, says there’s no obligation to self-report in Switzerland and no official means of doing so. Yet Swiss companies with operations elsewhere must tread carefully to ensure they don’t anger authorities in other jurisdictions, she says.

‘According to Swiss law there’s no obligation for a former employee to make themselves available if the employee relationship has ended, unless they have contractually agreed to make themselves available’, she says. Nadelhofer often has to remind clients of this, as, ‘when they are facing misconduct they are tempted to terminate the employment agreement immediately. They forget that once that happens there’s no obligation for the employee involved to provide any information. That can make authorities angry. If you are a Swiss company and there’s also an investigation in the US, the US authorities would expect the Swiss company to have their employees participate.’

Both Nadelhofer and Eljarrat say it’s vital that lawyers carrying out early-stage investigations ensure all the information they’re gathering is legally privileged. However, Egan highlights that when multiple jurisdictions are involved, it can be tricky to establish what’s privileged and what’s not. ‘Being in Ireland, which has an open economy, we deal with a huge amount of international clients where maybe only part of the investigation is in Ireland’, he says. ‘Of the big issues we always see where there are different approaches from regulators in different jurisdictions, privilege is a pretty significant element that can differ quite substantially’.

One of the more obvious difficulties would be privilege in the US, where there’s a much narrower approach, explains Egan. ‘In certain jurisdictions there won’t be regulatory or investigative privilege so companies need to be very careful about who is defined as the client. Things like the investigation report will not be privileged in the UK or Ireland in a lot of circumstances, particularly if it’s a fact-finding investigation. The conclusions report would have to be redacted rather than making the entire thing privileged.’

Privilege entered the spotlight back in 2017, when the UK High Court ruled that documents produced as part of an internal investigation carried out by the Eurasian Natural Resources Corporation (ENRC) weren’t covered by legal professional privilege. The case was brought because the SFO believed the mining company should hand over all the documents its lawyers and forensic accountants had produced after being tipped off about allegations of bribery and financial wrongdoing at its Kazakh subsidiary (ENRC denies the allegations). The High Court agreed, dismissing ENRC’s claims that the documents should be protected by privilege because the company had produced them in the expectation that litigation between itself and the SFO would ensue. The Court also dismissed ENRC’s claims that all the documents should be covered by legal advice privilege, noting that only updates produced to enable the company to take a view on whether further advice was required would qualify.

The finding was thought to be so controversial that the Law Society of England and Wales intervened in ENRC’s subsequent appeal. The entire SFO investigation ultimately fell apart in 2023, with the organisation concluding after ten years of work that there was ‘insufficient admissible evidence’ to bring a prosecution against ENRC. However, the Court of Appeal’s 2018 decision in the privilege case, which reversed the original decision on litigation privilege but upheld the High Court’s ruling on legal advice privilege, brought some clarity for organisations conducting internal investigations in the UK.

Respecting the jurisdiction

Yet, as Karla Lini Maeji, Webinar Officer on the IBA Anti-Corruption Committee and a partner at Brazilian firm TozziniFreire Advogados, says, the position can vary greatly from country to country. ‘There’s no hard law on how to conduct an internal investigation in Brazil’, she explains. ‘It’s much more about whether you’re respecting labour laws, which are very strict in Brazil, and necessary best practices. However, if I’m interviewing an employee from the Brazilian subsidiary of a US company I know that Upjohn applies.’

Named after the 1981 case Upjohn Co v United States, a so-called Upjohn warning must be given to employees to inform them that while the interview they’re giving as part of an internal investigation is privileged, the privilege belongs to the company, not them. That means the privilege could be waived at the behest of the company and any information disclosed passed to the authorities. Ultimately, with Upjohn, employees may be required to cooperate with their employer’s lawyers, but those lawyers are representing the company in the matter under investigation, not its staff. ‘When you’re doing these kinds of cross-border interviews you can never look at it from your own country’s perspective’, Maeji says. ‘Never assume that the way you do things in your country is the only way to do it. It’s always a puzzle.’

Maeji also warns that the disparities between jurisdictions won’t always be purely legal, with cultural differences having a bearing on how cross-border investigations are handled.

‘When you have an allegation that something went wrong the first thing you have to do is understand the legal landscape because you can’t assume that what you do at home is going to work abroad’, she says. ‘It’s not just legal issues, though, but cultural issues as well’.

She outlines the example of when US companies first began conducting internal investigations in Brazil, they went straight to the point and Brazilians, she says, aren’t used to that. ‘They would come to Brazil, put an employee in a room and say “I’m doing an investigation, everything you say is privileged”. The US is still much more to the point – “Did you pay a bribe? Did you employ a third party to do it?” – but that doesn’t work in Brazil. You won’t get someone to co-operate or volunteer information like that. You want to follow procedure, but more than anything you want to get people to talk to you.’  

Ultimately, says Laurent Cohen-Tanugi, Monitorship Officer on the IBA Anti-Corruption Committee and Founder and Managing Partner of French firm Laurent Cohen-Tanugi Avocats, while the regulatory burden may differ from country to country and continent to continent, when it comes to complex cross-border investigations, the best rule of thumb is to abide by the standards set by the strictest jurisdiction. Though there will be nuances when it comes to areas such as privilege, this approach should ensure the majority of requirements are being complied with.

‘The first thing is obviously to be aware of the laws in the various jurisdictions where the investigation is taking place – laws around data and labour, and also the rules governing investigations – but also be aware where there aren’t specific rules’, he says. ‘Even France a few years ago didn’t have any rules [on how to conduct an investigation] so there were a lot of conflicts of interest, but I would recommend in countries that do not have rules on internal investigations to abide by the highest international standards’.