On November 21, 2012, the U.S. District Court for the District of Columbia rejected a contractor’s assertion that the attorney-client privilege or the work-product doctrine protected an internal audit report from disclosure. In United States v. ISS Marine Services, Inc., the Department of Defense Investigator General (DoD IG) sought to enforce an administrative subpoena that encompassed the audit report, which addressed alleged irregularities in the contractor’s billing and accounting practices. Although the contractor consulted outside counsel with respect to the audit, the court found the contractor had retained the counsel in a “watereddown capacity” that was insufficient to protect the audit from disclosure.

ISS Marine highlights the difficulty of shielding internal audits from the government’s subpoena powers under the attorney-client privilege and workproduct doctrine. The decision provides a clear warning for contractors initiating investigations of potential fraud relating to their Government contracts: A company’s failure to involve counsel at the outset and throughout an internal investigation may preclude protection of such internal investigations from disclosure in response to a subpoena.

Contractors may query whether the court’s ruling in ISS Marine impacts the Defense Contract Audit Agency’s (DCAA’s) recent efforts to enhance access to contractor’s internal audit reports, and to outline appropriate procedures when a claim of privilege is asserted by a contractor. While ISS Marine does not alter the rules by which DCAA accesses contractor internal reports, it may embolden DCAA to challenge and truly test a contractor’s assertion of privilege or to seek DoD IG’s assistance in obtaining such reports.

The Contractor’s Argument

The contractor in ISS Marine argued that both the attorney-client privilege and work product doctrine protected the internal audit from disclosure because its outside law firm had been engaged to provide legal advice in the internal audit, had suggested that the audit be conducted internally by the contractor, and had drafted a legal memorandum summarizing potential liability. According to the contractor, the internal audit contained facts that outside counsel needed to provide the contractor with legal advice. Several months after conducting the internal audit and drafting at least two versions of the audit report, the contractor sent the report to outside counsel in an email marked “Attorney Client Privileged.” Yet, counsel did not give any advice based on the report.

The Court’s Decision

The court first concluded that the contractor had not shown that it produced the audit report to seek legal advice. Non-lawyers had conducted the investigation, the company kept counsel from participating in the investigation, and the internal auditor initially sent the audit report only to non-lawyers for business purposes. The Court concluded: “At bottom, the respondent’s claim to privilege appears to be premised on a gimmick: exclude counsel from conducting the internal investigation but retain them in a watered-down capacity to ‘consult’ on the investigation in order to cloak the investigation with privilege.” Although outside counsel gave generic, preliminary advice about conducting an investigation, broadly outlined general liability principles, and eventually was sent a copy of the report, the court concluded this “consultation lite” was insufficient to protect the audit report from disclosure. The court explained:

For the results of an internal investigation to enjoy the attorney-client privilege, the company must clearly structure the investigation as one seeking legal advice and must ensure that attorneys themselves conduct or supervise the inquiries and, at the very least, the company must make clear to the communicating employees that the information they provide will be transmitted to attorneys for the purpose of obtaining legal advice.

The court likewise rejected the contractor’s claim of attorney work-product protection because the report was created by non-attorneys who never communicated directly with outside counsel. The court concluded that where an attorney is not involved in the investigation, the company faces a higher burden to show that the audit report was conducted in anticipation of litigation.

Key Takeaways from ISS Marine

1. Structuring Internal Investigations

The ISS Marine case highlights the importance of deciding at the outset of an investigation whether to involve counsel so as to cloak it with privilege. If the investigation is conducted without the true involvement of counsel, it may well not be possible to protect the results from disclosure in response to a subpoena. Although not every allegation or hot line call will justify a full-blown investigation under the supervision of counsel, for those that a company wants to keep privileged or protected, the following guidelines from ISS Marine are useful:

  • Ensure that counsel (whether in-house or external) is involved in the internal investigation for which the company would like to keep the results and report privileged and ensure that the involvement is substantive and not merely providing preliminary “how-to” advice.
  • Appropriately mark all documents and reports over which the company is claiming privilege or work-product protection. In ISS Marine, the court took note of the fact that the audit report at issue was merely marked “Confidential.”
  • When employees are being asked to provide information to non-attorneys as part of an attorney-led internal investigation, make it clear to those employees that the information ultimately is being requested by an attorney and will be transmitted to counsel for purposes of seeking legal advice.
  • Make the company’s intentions as to the internal investigation and audit report clear. If an audit report is forwarded to an attorney seeking legal advice, request such advice on the face of the communication. Likewise, if an internal investigation is being conducted in anticipation of litigation, state that purpose on the face of the report.

With these guidelines in mind, contractors should be better able to protect the results of internal investigations and other audit reports to which the attorney client privilege or work-product doctrine should apply.

2. Potential Impact of ISS Marine on DCAA’s

Access To Contractor Internal Audits

Despite having no direct legal impact on DCAA’s access to contractor’s internal audits,[1] ISS Marine could embolden DCAA to question more assertively a contractor’s claim of privilege over internal audit reports. ISS Marine is particularly significant in that it arrives at a time when DCAA has recently issued guidance to its auditors on both attorneyclient privileged documents and improving access to contractor’s internal audit reports.[2] Notably, the guidance does not attack the privilege or set out an agenda for obtaining privileged documents so long as other documents are available that permit satisfaction of the audit objective. The auditor is reminded that, in the event of a denial of access to privileged documents, his or her objective remains verification of the cost in issue, not pursuit of the privileged documents. Further conflict about the privileged document can be avoided at the point of assertion of the privilege if the contractor provides “alternative, non-privileged information” to permit verification of claimed costs or otherwise to satisfy the audit objective. The remaining guidance, regarding appropriate elevation of the claim of privilege to the DCAA’s Regional Director, applies only if the contractor withholds access to the privileged document and “does not provide alternative, non-privileged information.”


A government contractor should decide at the outset of an investigation whether the involvement of in-house or outside counsel is merited. Only some internal investigations and routine internal audits will require attorney involvement. Yet, adequate consideration of obtaining legal advice should be prominently placed in the checklist prior to initiating an investigation; otherwise, the contractor risks losing the cloak of privilege and being required to disclose the results of the investigation to DoD IG or DCAA. Once a privilege is asserted, appropriate consideration of whether non-privileged information can satisfy the DoD IG or DCAA information request should be raised so as to enhance the potential to avoid litigation over such matters.