Gary Hughes
Britomart Chambers, Auckland; Communications Officer, Regulation of Lawyers' Compliance Committee
gary@garyhughes.nz

Brief overview of the New Zealand approach to regulatory and similar investigations

Regulatory and similar investigations are typically undertaken by a business in response to some trigger which brings to light a regulatory problem, ethical challenge, allegation of misconduct, legal breach or even potentially criminal behaviour.

In the modern era, allegations often come with media, and social media, regulatory and reputational elements. A firm must pay attention to those risks as much as it does to considerations purely of lawfulness and liability.

Overview and triggers of an investigation

There are many different ways in which an investigation may be commenced or become seen as necessary. That context may have significant bearing on the way in which the investigation is conducted, and the outcomes or aims it seeks to achieve. The most common types of trigger event that lead to an investigation include these scenarios:

• a regulator or law enforcement agency opening an investigation or contacting the business:

–     most often by letter or written statutory notice demanding information/documents;

–     although sometimes by an on-site inspection whether scheduled, or unannounced (‘dawn raid’ or search warrant);

• disclosure of a problem by a staff member or other whistleblower mechanism;
• enquiries by a media agency or journalist into an apparent problem or incident of misconduct;
• issues uncovered by an auditor or external person engaged to review some aspect of the business;
• an industry-wide development such as announcement of a political initiative, independent Commission of Inquiry, or thematic review by a regulator of an issue in the same sector.

For a lawyer seeking to handle or assist the firm with an internal investigation, there might be three over-arching areas of expertise that need to be drawn upon.

First, some familiarity with the legal topic of the investigation, and the field of misconduct under inquiry, is desirable. The legal obligations in New Zealand will frequently be located in an Act of Parliament, but supplemented by case law as judges interpret those obligations and fill gaps over time. The legal practice areas can vary enormously, from workplace health and safety to competition law to police investigations into fraud or cyber-crime areas.

Second, allied to that, a sound understanding of the working practices, priorities and key powers of the particular agencies or regulator who enforces that legal practice area. Having one eye on possible enforcement action that may arise is vital.

Third, it is important to have a clear understanding of administrative law principles in conducting a fair investigation, due process, evidential considerations, including scoping out and considering legal privilege privacy rights, and possible civil or criminal law ramifications once the investigation has come to completion and findings are made.

Typical activities or steps in an investigation

There is no single procedure or set of rules that must be followed in an investigation. The practical process adopted and steps in the investigation vary widely depending on the trigger event (see above) and also the output or overall objectives for an investigation.

However, there are a number of steps that are usually carried out as a matter of good practice. They are based upon administrative law, the need to avoid giving a basis for somebody to judicial review the investigation, and a strong desire in New Zealand for principles of natural justice to be respected at each step.

• Clarifying scope, or terms of reference – if commenced by a regulator or external trigger, the scope of the internal investigation will closely resemble that of the external investigation, or at least be based upon it. In other situations, a company board of directors, or authorised public service agency officers, may determine the scope and procedure for themselves.
• It is best practice to draw up written terms of reference, delineating the allegations and matters to be investigated, but is not essential in all cases. A degree of informality may be sensible particularly when the matter is focused on internal cultural or employment issues.
• Documenting the procedure and time frame, including aims and output expected of the investigation.
• As an inquisitorial or fact-finding process, identifying where relevant information or documents resides, and how to get hold of it.
• Clarifying the people most relevant as witnesses, and deciding on what format (for example, in writing, verbally, face-to-face interview or online meetings) those fact-finding steps will proceed.
• Then meeting with affected parties or interviewing all witnesses who can inform upon the issues under enquiry.
• Managing confidentiality and legal privilege, expectations of privacy and fairness.
• Preparing a draft report, seeking feedback, then a final report to be produced.

Protection of legally privileged information

New Zealand generally respects traditional common-law concepts of legal professional advice privilege and litigation privilege. However, it is not automatic that internal investigations will attract such privileges to withhold material from later disclosure. So careful thought and legal advice may be necessary at the outset when structuring the investigation.

The identity of the investigator is important. An external independent barrister or law firm will be amenable to privileged communications, as may an in-house lawyer if they hold a current practising certificate issued by the NZ Law Society. But an accountant, forensic or cyber specialist, or lay consultancy involved in the investigation is unlikely to accrue privilege.

Under the Evidence Act 2006, confidential communications made for the purpose of obtaining or giving legal advice, and in the course of that process, are privileged. So too are communications in reasonable anticipation of litigation, where the dominant purpose of the communication is preparing for such proceedings. The likelihood of related third-party agent or intermediary correspondence being privileged is greater when litigation is reasonably anticipated.

Privilege can be lost or waived, either expressly or in some situation implicitly.

More formal public or royal commissions under the Inquiries Act 2013 may have special immunities, and the same witness protections as in court proceedings, but a corporate internal investigation seldom falls under that Act.

Data management and evidence-gathering considerations

Getting to grips with a lot of factual material in short order is often a key challenge with internal investigations. Along with proper handling of that data, much of it probably electronic and email-based, come a range of other issues that may need to be considered at the same time. That may include a need to preserve evidence, or record it in a particular way, to confirm whether any whistleblower data has special need for protections, or where self-reporting or external disclosure obligations exist (for example, to a stock exchange as part of continuous disclosure by listed companies).

Sometimes investigation specialists may be engaged to assist interviewing in a workplace capacity, who then pass information to the lawyers involved. It all depends on the size, scope and resourcing of the investigation, but interviewers must be trained to approach things with an open mind, present and weigh up the allegations carefully, speak to all relevant witnesses or seek information from all the relevant sources (and not taking into account irrelevant considerations or sources).

There should ideally be no disparity in treatment across employees, and interviews should be conducted with appropriate notice, allowing a legal representative or support person to be present, and with adequate warnings and clear record-keeping at all stages.

Although a draft report is not essential in all investigations, it is considered an important step towards avoiding errors of fact or breaches of natural justice. A draft report would normally be circulated to key internal stakeholders, company directors, and parties directly affected or core participants in the investigation. The draft should effectively seek comment and correction of any inaccuracies, as well as offering those facing adverse findings a final opportunity to be consulted and make a submission or provide other context.

Privacy rights and whistleblowing

Individuals who assist with the investigation or provide information will have expectations that their privacy is being protected. The Privacy Act 2020 sets out a number of key generalised ‘information privacy principles’ that need to be applied to each situation, including internal investigations.

Particular care must be taken if investigations require liaison with other jurisdictions or engage cross-border issues. The Privacy Act may prevent personal information about individuals being freely shared across borders, unless the receiving nation has privacy protections (eg, GDPR) at least as strong as New Zealand.

A new whistleblower protection law has come into force, the Protected Disclosures (Protection of Whistleblowers) Act 2022, although limited in its coverage to only the public sector. This improves procedures from past customs, such as now allowing people to report misconduct directly to an authorised person/agency other than their employer or direct boss, and other protective mechanisms to prevent retaliation and victimisation of whistleblowers.

For private sector businesses, compliance processes under that new law are not mandatory, although there are hopes it will become voluntarily adopted more widely as part of strong corporate governance policies.

Employment law and employee rights

Where employment relationships are likely to be affected, or there is a risk of somebody being disciplined or dismissed afterwards, the statutory framework governing employee protection laws is an important overlay that must be followed.

It is beyond the scope of this article to address in detail, but this includes a general obligation of good faith owed to employees under the Employment Relations Act 2000, as well as fair process aspects to ensure evidence is collected scrupulously, evaluated fairly against all balancing points or mitigating features, records are transparently shared before drawing conclusions, and affected employees are consulted about the draft conclusions.

New Zealand courts expect, and imply as matter of law, that the principles of natural justice apply. This is designed to keep an investigation impartial and independent, and afford employees reasonable opportunity to respond and provide their point of view.

Further, there are duties under the Health and Safety at Work Act 2015 to take reasonable care and practicable steps to safeguard employees from various types of harm. In more complex or sensitive types of allegations, discrimination or harassment for instance, this can extend to duties around elements of mental harm, stress, bullying or psychological illness.

Employees have a clear right to silence (that is, not to self-incriminate) during an internal investigation – although, when external regulators seek information, this right can be overridden by specific statutory powers. Dealing with an employee who refuses to participate or answer, and taking care not to draw unreasonable adverse inferences, usually requires special effort and legal advice.

Investigations that follow a poor process, especially if ending with disciplinary outcomes, are a source of personal grievance or unjustified dismissal claims by affected employees.

Dealing with a regulator, and self-reporting

An internal investigation might take place on its own, or in parallel with an external regulatory investigation which the business must also deal with at the same time.

If the external investigation is criminal in nature, involving the NZ Police or Serious Fraud Office, there may be reason to prefer that inquiry process to take priority in timing or evidence gathering. However, wheels can turn slowly, and sometimes an employment situation may need to be addressed before a criminal law resolution arrives.

It may be imperative for the internal investigation to reach its findings in such a way that the criminal process is not compromised, either for any staff member or executive, or the corporate itself.

It is particularly important towards the end of the process to take care in considering what its preliminary or factual findings may mean for other related processes – possible employment action, public disclosure of misconduct, licensing or vocational disciplinary measures, a police complaint or civil or potentially criminal court action.

A particularly vexed question in New Zealand is the likelihood of reporting or sharing information with an external regulator. Some businesses with specific licences, such as under the Financial Markets Conduct Act 2013, may find licensing conditions that require a material breach to be reported. Beyond that, there is no general compulsion to self-report, but it may be in the organisation’s interests to do so and seek leniency or a reduced penalty from the regulator. The pros and cons should be carefully weighed up. The High Court (in FMA v ANZ Bank [2021] NZHC 399) recognised the value of self-reporting action, as a mitigating factor when setting a civil penalty for mis-selling insurance policies.

Insurance cover considerations

Investigations may be covered by a suite of different insurance products, although typically only when there is an assertion of breach by a regulator or other government agency, or allegation of negligence. Employer’s liability, management liability, directors and officers policies, or a statutory liability cover may be engaged.

Many insurance covers turn upon a claim event or potential circumstance of breach being suggested. A purely internal or employee matter may not be covered. Early notification of an actual claim received or commencement of regulator investigation is essential, if cover exists.

Statutory liability policies are a relatively unique New Zealand form of cover. They provide defence costs cover if a strict liability regulatory offence is alleged, or pecuniary penalty (civil in nature, not criminal) is sought. In some situations they may also recompense payment of such civil penalties, although a number of statutes (competition law, workplace health and safety, conduct of financial institutions laws) specifically forbid this type of indemnity being offered.

Traditionally, it was routine for insurers to appoint the same defence counsel for a company facing regulatory investigation as may be advising the insurer directly. However, it is becoming more common in complex or high-value cases to have separate defence counsel and coverage counsel engaged, especially where the law firm may otherwise face potential conflicts of interest in discharging both roles.

Settlement or non-trial outcomes

Criminal consequences or civil penalty outcomes are an ever-present risk following investigations. Depending on the circumstances, many of those will end up with an agreed penalty resolution or some type of plea-bargain outcome.

However, in New Zealand it is rare for a regulator to have power to impose a penalty itself, or agree a final conclusive deal without court approval. Those mostly end up as joint applications asking the court to order an agreed recommended level of pecuniary penalty which the parties have previously negotiated.

Formal deferred prosecution agreements are not (yet) an option in New Zealand.

Investigations engage a range of interrelated and complex issues that might need to be considered at high speed, because of the time frame to get to the bottom of something quickly, in order that decisions can be made on what is then in the company‘s best interest or necessary to meet legal obligations. Lawyers for the business must also keep an eye on growing third-party or litigation-funded class action claims. It may not always be possible to resolve this follow-on damages risk when settling with a regulator.