As the economic, legal and regulatory environments in which companies operate become more complex, boards of directors are devoting greater attention and resources to their corporations’ management of enterprise risk. The role of the board remains to oversee, as opposed to directly manage, the variety of risks confronting the modern business enterprise. However, still consistent with their oversight function, directors are becoming more proactive in assuring themselves that in-house and external counsel are conducting effective corporate investigations into significant potential misconduct or violations of law. Key considerations for directors in overseeing any such investigation follow.

Identify the need for and nature of an investigation. As an initial (though sometimes overlooked) inquiry, the board of directors should confirm that an investigation which reports to the board of directors or committee thereof is indeed required or optimal. The purposes of an investigation include, among others:

• to determine the nature and extent of any misconduct and the responsible corporate executives and employees;
• ascertain any shortcomings in the corporation’s compliance program and internal controls;
• and determine an appropriate response, defense strategy, or remedial steps.

Conducting a thorough, independent investigation may also be a condition to receiving credit under various laws and policies, such as the US Department of Justice’s Foreign Corrupt Practices Act’s Corporate Enforcement Policy, mitigating potential punishment and sanctions against the corporation.

Directors should determine whether any investigation must be independent, as greater independence in conducting the investigation may enhance the defensibility of any findings against scrutiny from third parties, such as governmental authorities, and signal a strong commitment to compliance. If an independent investigation is to be conducted, the board of directors should determine whether the investigation is to be led by attorneys from the corporation’s own legal and compliance functions, or external legal counsel reporting directly to the board of directors or a committee thereof. Although in-house may be more familiar with the company’s business and employees, and would present cost savings, governmental authorities and others may more readily question the objectivity, effectiveness, and independence of in-house counsel, and in cross-border investigations certain non-US jurisdictions may not extend legal privileges to in-house counsel. In addition to deciding who should conduct the investigation, the board of directors should also consider how its composition may impact the investigation’s actual and perceived independence, and thus whether a committee of independent directors should be formed to oversee the investigation.

Clearly establish the structure of and board’s expectations for reporting. Directors should assess at the outset of the investigation how the investigation team’s structure and processes promote timely reporting of all relevant information not only to the directors, but also to other stakeholders, including outside auditors and, if applicable, regulatory bodies. Accurate, objective information will better inform the directors’ decision making, particularly in identifying the root cause of any detected problem. Reporting to the directors should be regular, and a standing agenda should cover key issues to be continuously updated. Directors should be engaged and ask questions of the investigation team. The form of reporting should maintain applicable legal privileges, allow for robust interaction between directors and the investigation team as well as the corporation’s general counsel (GC) and chief compliance officer (CCO), and provide the directors with the opportunity to deliberate on sensitive issues in executive session.

Approach delegation of tasks to a committee with diligence. Although overseeing the corporation’s compliance with laws remains the responsibility of all directors, the board may determine that use of a special committee promotes the independence of and effective reporting in an investigation. In some investigations, such as those reviewing the conduct of members of the board, the use of a committee may be advisable to protect legal privileges. The delegation of the board’s authority to any committee overseeing an investigation should be clearly memorialized in written board resolutions or the committee’s charter. Nevertheless, and especially when multiple committees oversee different substantive areas or investigations, the full board of directors must avoid problems arising from silos and remain mindful of the total magnitude and types of risk faced by the company.

Clearly define the scope of the investigation. Directors should ask the investigation team to identify the scope of any investigation, and then carefully evaluate that scope. Too narrow, and the investigation may not identify instances of similar misconduct or other issues arising from the same root cause, potentially discrediting the investigation’s findings and requiring a costly repeat of the investigation. Too broad, and the investigation team may needlessly “boil the ocean,” resulting in an unduly expensive investigation that lacks focus and therefore fails to identify salient facts and issues. Further, directors should remain flexible to change the investigation’s scope in light of facts learned during its course, and should instruct counsel to promptly and expressly communicate any recommended changes in scope for the directors’ approval.

Request from the investigation team a work plan, and monitor the team’s progress. Directors should insist that the investigation team provide a work plan, identifying in detail the steps that are to be undertaken and progress towards completing the investigation in accordance with its scope. The work plan should allocate responsibility to respective parties for accomplishing each step, and the target date by when to do so. A work plan may also be tied to a budget for phases of the investigation, and directors should insist that tasks be performed efficiently. Material delays and cost overruns should be openly addressed when they arise. Increasingly, for significant investigations, directors and the investigation team may find it useful to engage a dedicated project manager to monitor the execution of the investigation plan. Directors may also ask the team to describe how it will use available technologies to speed and enhance a targeted document review process.

Critically, directors should also monitor whether the investigation team is effectively and appropriately collaborating with other departments and resources within the corporation, particularly if the investigation team is led by outside counsel. The GC and CCO are uniquely situated to act as intermediaries among company management, external legal counsel, and the board of directors. The investigation team should, to the extent appropriate (especially if independence and privilege are to be maintained), draw upon the knowledge and expertise of the GC and CCO and their teams, as well as resources from internal audit and human resources.

There are many important considerations for directors during an investigation beyond those noted above, including nuanced questions about self-disclosing to and cooperating with government authorities, waiving legal privileges, and interacting with other third parties such as external auditors, key business partners and customers. Moreover, both before and after an investigation, directors should undertake actions that ultimately increase the corporation’s compliance with laws, such as establishing an effective compliance program and strong tone at the top, informing themselves of critical legal risks of the corporation and its business and industry, and monitoring the implementation of remedial enhancements. Every investigation is different, with highly contextual challenges. But by addressing the points set forth above, directors will be positioned to more effectively oversee investigations in any number of diverse circumstances.