Best Practices for Virtual Internal Investigations

However, violations of law, regulations, and company policies will continue. As such, internal investigations will need to proceed, albeit under different circumstances. In order to ensure that remote internal investigations are probative and effective, companies and their outside counsel should employ a few simple and practical practices. This article discusses some of these best practices, which will assist companies and outside counsel to develop a successful process for managing internal investigations in a virtual world.

Witness Interviews

Without a doubt, the most significant impact of COVID-19 on internal investigations has been on how witness interviews are conducted. Interviews have traditionally been one of the most important aspects of an internal investigation, and, for a variety of reasons, practitioners typically preferred to conduct witness interviews in person. However, with advancements in videoconferencing technology, remote witness interviews can be an adequate alternative. If companies and their outside counsel elect to conduct remote witness interviews as part of an internal investigation, they should keep the following tips in mind:

• Logistics: An interview conducted via videoconference is preferable to a telephonic interview because it allows the interviewers to better assess the witness's credibility and demeanor. Videoconferencing also provides greater assurances against the participation in the interview of unauthorized third parties. Prior to the interview, the company should select and familiarize itself with an appropriate and secure videoconferencing platform. Inform the witness that the interview will be conducted via videoconference, and ensure that all participants have the ability to access and participate fully in the interview. Finally, establish clear ground rules for speaking during the interview in order to minimize interruptions and confusion.
• Confidentiality and privilege: Remote interviews present unique challenges to preserving confidentiality. Witnesses should be instructed to participate in the interview in a private space and outside the presence of any third parties. This will minimize distractions, and it will help preserve the attorney-client privilege, which does not protect communications made in the presence of third parties. As such, the presence — even inadvertent — of unauthorized third parties may risk a waiver of the attorney-client privilege. At the beginning of the interview and periodically thereafter, the witness should confirm that no third parties are present or able to hear the interview. To the extent that the company is not comfortable with the witness's confirmation, other strategies — e.g., use of multiple cameras — can and should be considered.
• Recording: Witnesses should be instructed that they are not permitted to record the interview and that the company does not consent to a recording by the witness. While most platforms offer an option to record videoconferences, companies should consider whether a recording is likely to have to be produced to the government or to an adverse party in civil litigation. In addition, the company should determine whether applicable laws and regulations require obtaining the consent of the witness before recording. Many U.S. states and foreign countries require that all parties to a conversation consent to it being recorded. In order to avoid potential liability, typically it will make sense to obtain the consent of the witness before recording and, if the witness does not consent, the interviewers should resort to note taking.
• Documents: Plan in advance how documents will be shared with witnesses. In certain instances, it may be preferable to share documents in advance of the interview. The downside of this strategy is that it eliminates the element of surprise and will allow the witness to prepare responses in advance of the interview. It also increases the risk that the witness may share documents with unauthorized third parties. Alternatively, most videoconferencing platforms allow for real-time sharing of documents via screen-sharing. If this strategy is utilized, the interviewers must ensure that the witness has full and complete access to the documents and that they are permitted to review them sufficiently during the interview.

Document and Data Collection

Most electronic documents and data can be collected remotely. However, travel and other restrictions may still make it difficult for companies to collect all relevant hard-copy documents. In addition, data protection laws may prevent certain records from being collected and/or transmitted remotely. Companies should consider the following tips when coordinating a remote document and data collection:

• Hard-copy documents: Many businesses still maintain records in hard-copy format. At the beginning of an investigation, companies must determine whether a review of such records can be delayed. Companies also should determine whether, in light of relevant local health guidelines and restrictions, a review of the hard-copy records can be completed safely. If not, it may be necessary to document the existence of additional relevant records and then wait until it is safe to conduct an in-person review. If relevant documents cannot be identified and collected in a timely manner, companies should ensure that the relevant records are secured in order to prevent inadvertent loss or destruction. And if a review of the relevant materials cannot be delayed, companies should be prepared to direct local personnel to identify and collect records pursuant to a clearly written document collection protocol.
• Preservation: If local restrictions make it difficult to collect documents in person, companies must ensure that all relevant data is securely preserved so that it can be reviewed as soon as it is safe to do so. Companies should examine the sufficiency of their preservation notices and ensure that employees are reminded via repeated re-issuance of such notices of the continuing obligation to preserve relevant documents and records.
• Documentation: In situations where investigators are coordinating document and data collection remotely, companies should thoroughly document their collection process. Companies should ensure that all personnel involved in document and data collection comply with an agreed-upon process, and any deviations from the process also should be documented. In addition, if a company is cooperating with the government in connection with the investigation, it should consider whether the document collection process should be previewed for or discussed with the government in order to ensure that all interested parties are in agreement with the contours of the process being employed.
• Data Protection Laws: Particularly in situations where internal investigations involve foreign jurisdictions and where relevant records include personal identifying information (PII) or personal health information (PHI), companies must be aware of rules and regulations governing the transfer of data between jurisdictions. Notably, in some jurisdictions, it may be necessary to obtain an employee's consent before collecting, reviewing, or transmitting sensitive data. In addition, some jurisdictions have enacted restrictions about how sensitive personal information can be collected and transmitted to other jurisdictions. Financial penalties for violations of these laws can be severe, so companies must ensure that they are familiar with any restrictions that would be applicable in a particular investigation before the document collection process begins.

Reporting to Government Authorities

COVID-19 has changed how companies coordinate with and report to government authorities who are conducting their own investigations. Not surprisingly, in-person meetings with prosecutors and regulators have in large part been replaced by an increased reliance upon videoconferences, calls, and email correspondence. In this environment, companies must ensure that their communications with the government are clear, accurate, and complete. In addition, companies should ensure that the government understands any logistical impediments to the ability to interview key witnesses and/or collect relevant records. Companies also must be clear with government authorities about how and when they can comply with information requests and legal process, and they should ensure that the government understands and agrees with the proposed timeline.