CARES Act Puts Inspectors General Back in the Spotlight

The more than 70 existing federal IGs span an array of government entities, including entire cabinet departments such as Commerce or Justice, as well as smaller and more obscure agencies like the Tennessee Valley Authority. Their staffs range as high as 1,600 at the top end. Despite growth in the overall number of IGs from the original 12 established in 1978, IG activity has trended downward in recent years. Report recommendations decreased from just under 9,000 in 2017 to fewer than 7,000 in 2019, while the estimated government savings associated with those reports declined by nearly 50%, from more than $30 billion in 2017 to barely more than $18 billion in 2019. The new mandates under the CARES Act could well reverse this trend.

IG Authority

The IG Act specifically contemplates an investigative function in addition to audits and inspections of particular agencies or programs. To fulfill their investigative missions, IGs are empowered to: access records from federal agencies; request federal, state, and local assistance; issue administrative subpoenas for documents, including to entities and individuals outside the government; and conduct interviews under oath. But currently, virtually all IGs lack the authority to compel testimony from nonfederal employees (despite repeated efforts to secure that power). The new IG committee established by the CARES Act, the PRAC, has testimonial subpoena power, but the special inspector general does not.

The scope of an IG's authority is typically limited to the activities of its particular agency. But even with that restriction, nonfederal actors doing business with an agency or under a federal program can easily fall within the appropriate IG's jurisdiction through contracts, connections, or receipt of federal funds. The majority of audits, investigations, inspections, and evaluations result in written reports with internal agency recommendations. Agency heads are not obligated to implement the IG's suggestions, but they are required to respond and their responses are included in the IG's semiannual submission to Congress. This direct dual-reporting line to Congress gives IGs substantial influence with the agencies, who are keenly aware that failures to cooperate, poor performance, or refusal to implement recommendations can impact future funding or lead to congressional investigations.

IGs also work closely with the Department of Justice (DOJ) and its U.S. Attorneys on civil enforcement matters, including under the False Claims Act. See, "5 FCA Enforcement Predictions after Coronavirus Relief Bill," Buckley.

But if an investigation leads to a reasonable belief of criminality, the IG Act requires prompt reporting to prosecutors within the DOJ. Sometimes, the IG's own special agents (who have arrest powers) remain involved in resulting criminal investigations after referral, usually in partnership with other law enforcement agencies such as the FBI. The line between civil and criminal enforcement is not always clear, and such determinations are made by the Justice Department rather than by IGs. IG staff often do not themselves know at the front end if their investigations will lead to civil or criminal cases, or any liability at all.

Special IGs

Special IGs (SIGs), created by separate legislation, are temporary and not limited to overseeing a particular government agency. SIGs have provided oversight for Iraq Reconstruction (SIGIR), Afghanistan Reconstruction (SIGAR), the Troubled Asset Relief Program (SIGTARP), and most recently, CARES Act relief (SIGPR). As these names suggest, their scope spans multiple agencies and programs. For example, a SIGIR investigation could appropriately include programs operated by the Department of Defense, the Central Intelligence Agency, the Department of State, and the Agency for International Development (USAID), whereas a USAID IG investigation would be limited to only investigating matters involving that agency.

SIGPR, PRAC and Auditing Pandemic Response Under the CARES Act

The CARES Act established SIGPR to audit and investigate the now nearly $2.5 trillion in loans and other investments to be made by the Department of the Treasury. The PRAC has a somewhat broader mandate — neither limited to the CARES Act nor to Treasury — to oversee the use of any funds appropriated by Congress as part of the government's pandemic response, including under several other recent pieces of legislation. See, "The U.S. Response to Coronavirus: Summary of the Coronavirus Preparedness and Response Supplemental Appropriations Act, 2020," KFF.org. Moreover, PRAC is not an IG but rather a committee of more than 20 existing federal IGs. It has its own staff and budget, and enjoys its own authority to conduct investigations and reviews. One key question to monitor will be how these two bodies ultimately divide up oversight responsibilities in light of the areas of overlap. Both SIGPR and PRAC will scrutinize companies and individuals involved with loans and investments under programs established by the Act, and Congress provided both with the authority to investigate and subpoena documents. Unlike SIGPR and virtually all other IGs, PRAC has also been granted the additional authority to compel sworn testimony from non-federal individuals and entities.

On its face at least, SIGPR looks very similar to its predecessor, SIGTARP, which may give a clue to its future as well. Congress created SIGTARP and several other oversight bodies following the 2008 financial crisis, and it remains in operation today. It has secured the conviction of nearly 400 defendants, including 24 institutions. Its activities, including civil settlements, have led to the recovery of nearly $11 billion.

Preparing for and Responding to SIGPR and Existing IGs

Regardless of the outcome, government investigations (criminal, civil, IG or regulatory) can be costly and embarrassing for companies and financial institutions of all sizes. Any institution that will become involved with federal coronavirus relief should prepare now for IG requests or subpoenas. Organizations can start by reviewing their internal procedures and operations to address compliance deficiencies. It is also important for companies to develop a plan for responding to an IG inquiry to avoid having to confront these issues for the first time when an IG comes knocking. When investigations arise, an entity will need to quickly navigate issues of document preservation, internal and external disclosure obligations, potential internal investigations, lining up appropriate special committees and internal points of contact, and selecting experienced outside counsel.

IGs sometimes send companies informal requests, rather than subpoenas, for documents, information, or interviews. Even though the company may not be legally obligated to comply, a casual response is never prudent no matter how informal the request may seem. The consequences of not taking a matter seriously can range from merely poor optics to the possibility of a federal civil or criminal investigation or a congressional hearing.

The best practice is for companies to react to even an informal request, and certainly an IG subpoena, similarly to how they would react to a grand jury subpoena — with the utmost seriousness. That does not mean a company should not seek to clarify or potentially narrow the scope of what an IG is requesting. If a request or subpoena seems unreasonably overbroad or seeks privileged materials, and informal discussions fail, a company can also consider whether a court challenge is advisable. Notably, IGs are subject to statutory and regulatory requirements when making requests of financial institutions that could implicate sensitive bank data or other private and confidential consumer information.

Although IGs subpoenas are not subject to the same confidentiality provisions as the grand jury process, IGs do tend to treat their investigations with a similar degree of discretion. But that comes with a significant wild card: IGs report both formally and informally to the Congress, a frequent source of information leaks, particularly when political considerations are afoot. And IG offices do not have the same well-established institutional processes for maintaining confidentiality as DOJ, much less a well-traveled path to judicial remedies for missteps.

In investigations stemming from the CARES Act, there will undoubtedly be instances where the new oversight apparatus intersects with existing investigative bodies, including other IGs — for example, the Small Business Administration IG or the Treasury Department IG — and Congress's General Accountability Office. It will, therefore, always be prudent to ask whether the requesting IG is working with other agencies, not the least of which is the DOJ.

Conclusion

Although IGs have been a fixture of government oversight for some 40 years, their interactions with the private sector have often been limited. The CARES Act will unleash them upon private actors with particularly broad powers. Corporate entities of all types and their officers must take them seriously and plan for possible interaction.

*****

Daniel R. Alonso and Preston Burton, former federal prosecutors, are white-collar defense partners at Buckley LLP. Meredith Leeson, formerly a senior auditor-in-charge with the Special Inspector General for Iraq Reconstruction, is an associate at the firm.