Latham & Watkins operates worldwide as a limited liability partnership organized under the laws of the State of Delaware (USA) with affiliated limited liability partnerships conducting the practice in the United
Kingdom, France, Italy and Singapore and as affiliated partnerships conducting the practice in Hong Kong and Japan. The Law Office of Salman M. Al-Sudairi is Latham & Watkins associated office in the
Kingdom of Saudi Arabia. In Qatar, Latham & Watkins LLP is licensed by the Qatar Financial Centre Authority. Under New York’s Code of Professional Responsibility, portions of this communication contain
attorney advertising. Prior results do not guarantee a similar outcome. Results depend upon a variety of factors unique to each representation. Please direct all inquiries regarding our conduct under New York’s
Disciplinary Rules to Latham & Watkins LLP, 885 Third Avenue, New York, NY 10022-4834, Phone: +1.212.906.1200. © Copyright 2014 Latham & Watkins. All Rights Reserved.
Latham & Watkins White Collar Defense & Investigations Practice
December 11, 2014 | Number 1774
How to Protect Attorney-client Privilege in Internal Investigations
While attorney-client privilege can protect many internal documents, recent court decisions highlight the need to explicitly invoke this protection.
As many US policies now require an increased level of internal investigations and self-reporting, companies should ensure their communications and documentation explicitly preserve their right to invoke the attorney-client privilege. Healthcare providers, financial institutions, public companies and organizations operating under Corporate Integrity Agreements or other government settlement terms that require mandatory disclosures should follow a few simple precautions to avoid becoming the targets of internal investigation related litigation.
A cornerstone of the attorney-client privilege is that for the privilege to apply to a communication, the communication must have been made for the purpose of obtaining legal advice. Corporate internal investigations are routinely protected from disclosure under this principle. But when company counsel asserts the privilege to protect an internal investigation that was conducted under standing corporate policies or pursuant to certain regulatory requirements, the privilege assertion may be challenged in court. In these cases, civil litigants or other third parties who are trying to obtain company records regarding an internal investigation (such as emails, memos and other reports) contend that the investigation is not privileged because it was conducted for business purposes, and not for the purpose of obtaining legal advice.
For a company to insulate against these challenges and to preserve the attorney-client privilege,1 company counsel must be able to demonstrate that the internal investigation was conducted for the purpose of obtaining legal advice.
There are three steps every company can take to accomplish this:
• Update Corporate Policies and Procedures: Corporate policies and procedures should include a specific statement that all internal investigations are to be conducted for the purpose of obtaining legal advice.
• Ensure Attorney Direction and Oversight: Attorneys, whether in-house or external counsel, should initiate and direct every internal investigation. Investigative work can be delegated to non-attorneys agents, as long as an attorney is directing and overseeing their work.
Latham & Watkins December 11, 2014 | Number 1774 | Page 2
• Document and Communicate the Legal Purpose: Companies should memorialize in writing that the investigation is being conducted for the purpose of obtaining legal advice. The legal nature and purpose of the investigations also should be communicated to all witnesses and to all non-attorney personnel who are assisting company counsel.
We expand on this guidance in the following sections. We also walk through a recent case that highlights why it is important for companies to take these measures, and that illustrates how this guidance can be applied in practice.
As in other corporate contexts, for the attorney-client privilege to apply in an internal investigation the company must establish four elements: (1) the person who sought or received the legal advice is (or sought to become) a client of the attorney; (2) the person to whom the communication was made is a qualified attorney (e.g., a member of the bar) or is an attorney’s subordinate acting on the attorney’s behalf (e.g., a paralegal); (3) the communication at issue relates to the securing or rendering of legal advice; and (4) the communication was confidential.2
The attorney-client privilege allows a client to seek and receive legal advice from an attorney in confidence. The purpose is to promote adherence to the law, by encouraging a client to seek legal advice in the first instance and by fostering full and frank discussions in the course of the attorney-client relationship.
US courts have recognized that the privilege covers confidential communications between a company (through its employees) and its lawyers (whether in-house or external counsel) regarding legal advice. The resulting longstanding rule allows attorney-client privilege to protect confidential employee communications in internal corporate investigations.3
Of central importance to company counsel is the distinction between legal advice (which is generally protected by the attorney-client privilege) and business advice (which is not).4 The line between business and legal advice is, however, neither clearly articulated nor consistently drawn by the courts.5 The line is particularly hard to draw with respect to in-house lawyers with dual roles in a company, who are more likely to mix legal and business functions.6
Internal Investigations Pursuant to Corporate Policy or Regulatory Law
In recent years, the number and frequency of internal corporate investigations, as well as in the likelihood that an investigation will be disclosed in some form to a third party has increased. These trends have helped to open the door for litigants to argue that an internal investigation is not covered by privilege because it was conducted for business purposes, and not for purposes of securing legal advice.
This is a troubling development for company counsel in two respects.
First, internal investigations are necessary to ensure a company’s compliance with laws and regulations. The attorney-client privilege, in turn, is critical to the integrity of internal investigations. Companies simply cannot conduct prompt, efficient and accurate investigations without this protection. Privilege creates a zone of confidentiality in which a company’s in-house lawyers and outside counsel can fully assess the facts, reach accurate conclusions about potential wrongdoing, and make informed decisions about disclosures to regulators, law enforcement authorities and shareholders.
Latham & Watkins December 11, 2014 | Number 1774 | Page 3
Second, there are important policy reasons why companies now commonly conduct internal investigations pursuant to corporate policy or regulatory law. In fact, formal corporate policies and procedures regarding internal investigations generally are necessary components of an effective compliance program. Many companies have implemented such policies and procedures at the express encouragement of US law enforcement authorities and regulators. The U.S. Department of Justice, for example, may offer leniency to a company that has designed and implemented a compliance program that effectively prevents and detects violations of applicable law; the Justice Department likewise may reward a company that has conducted internal investigations and voluntarily disclosed violations. As another example, both importing and exporting companies often have strong regulatory incentives to investigate and voluntarily disclose customs and export controls violations to the relevant agencies in order to minimize penalty exposure. And pursuant to the “Mandatory Disclosure Rule” enacted in December 2008, any company contracting with federal agencies subject to the Federal Acquisition Regulations, such as the defense industry, are required to investigate and self-report any “credible evidence” of certain criminal violations, violations of the civil False Claims Act or a “significant overpayment.”7 Government contractors are additionally required to provide “full cooperation with any Government agencies responsible for audits, investigations, or corrective actions.”8
In addition, in many instances the day-to-day investigative work is handled by personnel who themselves are not lawyers, but who report ultimately to the company’s in-house legal function. Although involving non-attorneys in conducting an internal investigation — subject to the parameters we discuss below in Section III — is perfectly appropriate, involving non-lawyers can add weight to a third party’s argument that the investigation was conducted for business (as opposed to legal) purposes.
A Recent Illustration: Barko / In re KBR
A recent case highlights the trends and challenges discussed above, and illustrates how companies can insulate themselves from attempts by third parties to compel disclosure of internal investigation materials.
In United States ex rel. Barko v. Halliburton Co. (Barko), the U.S. District Court for the District of Columbia in March 2014 ordered Kellogg, Brown & Root (the Company) to turn over privileged communications to a plaintiff in civil litigation because the Company’s internal investigation was conducted “pursuant to regulatory law and corporate policy rather than for the purpose of obtaining legal advice.”9
Three months later, the U.S. Court of Appeals for the District of Columbia Circuit reversed and vacated the district court’s controversial order on mandamus in In re Kellogg Brown & Root (In re KBR).10 The D.C. Circuit held that the materials were privileged because “one of the significant purposes of the [Company’s] internal investigation was to obtain or provide legal advice.”11
The Defense Department regulations then in place required government contractors, such as the Company, to implement a compliance program that would “[f]acilitate timely discovery and disclosure of improper conduct in connection with Government contracts.”12 The regulations also required the Company to have a “written code of business ethics,” as well as “[t]imely reporting to appropriate Government officials” and “[f]ull cooperation with any Government agencies.”13 The Company adopted a written Code of Business Conduct (COBC), which (in the district court’s view) “merely implement[ed] these regulatory requirements.”14
The investigation at issue in Barko / In re KBR stemmed from allegations that one of the Company’s subcontractors in Iraq engaged in fraud and received kickbacks; the subcontractor had been performing work in connection with one of the Company’s contracts with the U.S. Department of Defense.
Latham & Watkins December 11, 2014 | Number 1774 | Page 4
When the Company received reports in 2006 that the subcontractor in Iraq had engaged in fraud and received kickbacks, therefore, the Company triggered an internal investigation under the COBC. Like other COBC investigations, these reports were initially transmitted to designated attorneys in the Company’s legal department, who then coordinated and directed the investigation. As a fraud investigation, the COBC required involving certain non-attorney specialists outside of the Company’s legal department, including employees of the internal audit function.
Because the investigation also necessitated in-country work in Iraq (which at the time was an active conflict zone), the Company’s legal department delegated certain investigative work, including witness interviews, to non-attorney investigators.15 The investigators asked interviewees to sign confidentiality forms, which informed the witness that the investigation was “sensitive” and advised that unauthorized disclosures could have an adverse impact on the Company’s work in the Middle East.16 At the end of the investigation the non-attorney investigators sent a final memorandum to the Company’s general counsel’s office.17
District Court Order
The plaintiff/relator in Barko filed an action in 2005 against the Company under the False Claims Act. In February 2014, nearly a decade into the litigation, the plaintiff/relator moved to compel the Company to produce the results of its internal investigation.18
In March 2014 the district court granted the motion and ordered the Company to produce the results of the investigation. In the most surprising part of its order, the district court explained that the attorney-client privilege only applied where the communication at issue would not have been made but for the fact that legal advice was sought.19 Because the Company had conducted its investigation “pursuant to regulatory law and corporate policy [under the COBC] rather than for the [sole] purpose of obtaining legal advice” the investigation was not protected by the attorney-client privilege.20
The Company had argued that the investigation was indistinguishable from the one the Supreme Court had found to be privileged in Upjohn Co. v. United States.21 The district court disagreed, finding that the Company’s investigation could be distinguished from Upjohn in three respects, in addition to the fact that it was conducted pursuant to a regulatory requirement. In the court’s view, these differences further supported its conclusion that the Company had conducted the investigation for business, not legal, purposes:
• In Upjohn, the internal investigation began after in-house counsel conferred with outside counsel “on whether and how to conduct an internal investigation.”22 By contrast, in Barko non-lawyers conducted the investigation and did not consult with outside counsel.
• In Upjohn, attorneys interviewed employees, whereas in Barko the interviews were conducted by non-lawyers and “employees certainly would not have been able to infer the legal nature of the inquiry by virtue of the interviewer, who was a non-attorney.”23
• In Upjohn the interviewed employees were expressly informed that the purpose of the interview was to obtain legal advice. By contrast, the employees in Barko ”were never informed that the purpose of the interview was to assist [the Company] in obtaining legal advice,” and the confidentiality agreements which the employees signed did not mention the legal nature of the interview.24
D.C. Circuit Opinion
In In re KBR, the D.C. Circuit reversed the District Court’s decision in Barko, holding the District Court’s “‘but for’ test...[was] not appropriate for attorney-client privilege analysis.”25 Rather, the court articulated
Latham & Watkins December 11, 2014 | Number 1774 | Page 5
the correct test as whether “one of the significant purposes of the [Company’s] internal investigation was to obtain or provide legal advice.”26
Accordingly, that the Company had conducted the investigation pursuant to a regulatory requirement and its COBC program was not dispositive:
In the context of internal investigations, if one of the significant purposes of the internal investigation was to obtain or provide legal advice, the privilege will apply. That is true regardless of whether an internal investigation was conducted pursuant to a company compliance program required by statute or regulation, or was otherwise conducted pursuant to company policy.27
The D.C. Circuit also specifically rejected the considerations that the district court relied upon to distinguish Upjohn from the Company’s COBC investigation:
• First, “Upjohn does not hold or imply that the involvement of outside counsel is a necessary predicate for the privilege to apply.”28 Indeed, the “lawyer’s status as in-house counsel ‘does not dilute the privilege.’”29
• Second, non-attorneys may conduct interviews and other activities, as long as counsel oversee the overall investigation because “communications made by and to non-attorneys serving as agents of attorneys in internal investigations are routinely protected by the attorney-client privilege.”30
• Third, interviewed employees need not be expressly informed that the purpose of the interview is to obtain legal advice; that is, “nothing in Upjohn requires a company to use magic words to its employees in order to gain the benefit of the privilege for the internal investigation.”31
Maximizing and Maintaining Privilege in Investigations
Company counsel can take a number of steps to maximize and preserve the applicability of the attorney-client privilege to internal investigations. Some of these are measures that most companies already do very well, such as:
• Marking written materials as “Privileged and Confidential”
• Appropriately restricting the distribution of investigation materials, both outside and within the company
• Delivering Upjohn warnings in connection with witness interviews32
The opinions in Barko and In re KBR illustrate three additional steps that companies should take to ensure that internal investigations will be protected by the attorney-client privilege:
• Update written corporate policies and procedures
• Ensure attorney direction and oversight
• Document and communicate the legal purpose of the investigation
These steps are described in further detail below.
Latham & Watkins December 11, 2014 | Number 1774 | Page 6
Update Corporate Policies
Written corporate policies that govern internal investigations should include a specific statement that all investigations are to be conducted for the purpose of obtaining legal advice and at the direction of company counsel (whether in-house or external lawyers).
Ensure Attorney Direction and Oversight
Company counsel (whether in-house attorneys or external lawyers) should initiate internal investigations.33 In practice, however, a company’s lawyers are often not the first to learn of potential misconduct. For example, companies with standing compliance policies and personnel who are responsible for investigations may learn of misconduct through a hotline call or a non-attorney investigator. Thus, involving company counsel from the very moment the company learns of the need for an internal investigation may be difficult. In these situations, once apprised of misconduct, company counsel should formally initiate the investigation — even if non-attorneys have already gathered some facts — and document the investigation’s legal purpose.
Company counsel should also take care to oversee each stage of the investigation, especially when non-attorneys are involved. For reasons of cost and efficiency, it may make sense for many corporate compliance programs to allow non-lawyers to conduct investigative work. As the D.C. Circuit made clear in In re KBR, non-attorneys may conduct investigations without jeopardizing the attorney-client privilege if they are acting as agents of attorneys. From an organizational standpoint, non-attorney personnel (e.g., Internal Audit) should report to the company’s Legal department for the purposes of the internal investigation.
Document and Communicate the Investigation’s Legal Purpose
At the outset of an internal investigation, and in a contemporaneous writing, companies should document that the investigation is being conducted for the purpose of obtaining legal advice and at the direction of internal or outside counsel. This writing should include a statement, set forth as succinctly and as narrowly as possible, describing the specific issue(s) on which the company is seeking legal advice in that investigation. To the extent the precise issues may expand or otherwise shift over time, the company should update this document to reflect such changes.
Companies should also take certain formal precautions to ensure the attorney-client privilege, which attached at the beginning of the investigation, continues to attach to every stage going forward by communicating the investigation’s legal purpose. Non-attorneys who are involved in conducting the internal investigation should be appraised of the investigation’s legal nature and general purpose. Companies should also inform witnesses — in writing — that the purpose of interviews is ultimately to obtain or render legal advice. As noted above, company counsel (or any non-attorneys working at counsel’s direction), should always deliver proper Upjohn warnings.
In hindsight, it is perhaps not surprising that privilege issues arose in Barko in connection with the Company’s internal investigation, which was initiated and conducted pursuant to Department of Defense regulations.34 Among other things, the existence of the investigation and certain of its results had to be disclosed under the Defense Department’s FAR rules and KBR’s compliance policies, and therefore may have been attractive targets for a plaintiff in civil litigation. Government contractors are particularly likely to confront these privilege issues, as the mandatory disclosure rules enacted in 2008 now require government contractors to investigate and self-report credible evidence of certain violations.35
Latham & Watkins December 11, 2014 | Number 1774 | Page 7
In re KBR illustrates that corporate counsel in regulated industries with similar disclosure requirements should be especially mindful of privilege pitfalls in corporate internal investigations. Such industries include:
• Healthcare providers that are subject to compliance program requirements under the Affordable Care Act36
• Financial institutions which are required to design and implement compliance programs to prevent and detect potential violations of the Federal Bank Act and the Bank Secrecy Act37
• Public companies
• Organizations operating under Corporate Integrity Agreements or other government settlement terms that require mandatory disclosures
Internal investigations in these industries are more likely to draw scrutiny, corporate counsel in these industries should be particularly vigilant in adhering to the principles and best practices outlined above.
If you have questions about this Client Alert, please contact one of the authors listed below or the Latham lawyer with whom you normally consult:
Alice S. Fisher
Barry M. Sabin
William R. Baker, III
Timothy H. McCarten
Michael P. McCarthy
Latham & Watkins December 11, 2014 | Number 1774 | Page 8
You Might Also Be Interested In FATCA Violation Underlies Latest US Tax and Securities Fraud Charges Managing Legal and Business Risks Under the Russia/Ukraine Sanctions How to Respond to CFPB Civil Investigative Demands IRS Eases Access to Offshore Voluntary Disclosure Programs
Client Alert is published by Latham & Watkins as a news reporting service to clients and other friends. The information contained in this publication should not be construed as legal advice. Should further analysis or explanation of the subject matter be required, please contact the lawyer with whom you normally consult. The invitation to contact is not a solicitation for legal work under the laws of any jurisdiction in which Latham lawyers are not authorized to practice. A complete list of Latham’s Client Alerts can be found at www.lw.com. If you wish to update your contact details or customize the information you receive from Latham & Watkins, visit http://events.lw.com/reaction/subscriptionpage.html to subscribe to the firm’s global client mailings program.
1 The work product doctrine, which protects materials prepared in anticipation of litigation (including against government), is a separate and distinct doctrine. There is often an overlap between the work product doctrine and the attorney-client privilege, and in some circumstances a particular document may be protected by both. Although a full discussion of the work product doctrine is beyond the scope of this paper, we note that the guidance outlined above will help companies to ensure that materials generated in an internal investigation (such as reports, memos and other analyses) are covered by both the attorney-client privilege and the work product doctrine.
2 See Upjohn Co. v. United States, 449 U.S. 383 (1981).
4 See Anaya v. CBS Broad., Inc., 251 F.R.D. 645, 650 (D.N.M. 2007) (holding that the attorney-client privilege does not attach due to the mere fact that an attorney was involved in the communication); United States ex rel. Baklid-Kunz v. Halifax Hospital Medical Center, 2012 WL 5415108 at *3-4 (M.D. Fla. Nov. 6, 2012) (holding that attorney-client communications about business matters or business advice are not privileged unless they solicit or predominantly deliver legal advice).
5 Courts in the US have conducted fact-intensive inquiries and decided on a case-by-case basis whether an internal lawyer’s communications are privileged. See, e.g., TVT Records v. Island Def Jam Music Group, 214 F.R.D 143, 145 (S.D.N.Y. 2003) (considering both the job title of the attorneys in question and the content of communications (e.g., strictly legal advice versus corporate strategy or negotiations which may involve predominantly business matters); Bank Brussels Lambert v. Credit Lyonnais SA, 220 F. Supp. 2d 283, 286 (S.D.N.Y. 2002).
6 See, e.g., TVT Records, 21 F.R.D. 143, 144 (observing that it is more complicated to apply privilege to communications from internal counsel as opposed to outside counsel because internal attorneys are more likely to mix legal and business functions).
7 48 C.F.R. 52.203-13. This requirement applies only to government contracts with a value greater than US$5 million and more than 120 days duration, the “value [of which]...is expected to exceed $5,000,000 and the performance period [of which] is 120 days or more.” 48 C.F.R. 3.1004.
8 48 C.F.R. 52.203-13(c)(2).
9 United States ex rel. Barko v. Halliburton Co., 2014 WL 1016784 at *3 (D.D.C. Mar. 6, 2014).
10 In re Kellogg Brown & Root, 756 F.3d 754 (D.C. Cir. 2014) (“In re KBR”).
11 Id. at 760.
12 Barko at *3. While the relevant regulations have been amended since this time, these requirements are still in place. In fact, self-reporting is now mandatory, at the risk of suspension or debarment from contracting with the government. 48 C.F.R. 52.203-13; 48 C.F.R. 9.406-2, 9.407-2.
Latham & Watkins December 11, 2014 | Number 1774 | Page 9
15 Barko, 05-cv-01276, ECF No. 139 at 3.
16 Id. at 13.
17 Barko, 05-cv-01276, ECF No. 155 at 4.
18 Barko, 2014 WL 1016784 (D.D.C. Mar. 6, 2014).
19 Id. at *13 (emphasis added).
21 Upjohn, 449 U.S. 383 (1981).
22 Barko, 2014 WL 1016784 at *3.
25 In re KBR, 756 F.3d at 759 (emphasis added).
26 Id. at 760 (emphasis added).
28 Id. at 758.
32 In certain circumstances, companies will need to take additional precautions to ensure that the attorney-client privilege continues to apply. When communicating with regulators regarding internal investigations, corporate counsel should take care to secure confidentiality or “no-waiver” agreements, and otherwise limit their discussions to non-privileged aspects of the investigation until such time as the company is prepared to waive the privilege and make a disclosure. Subject to limited safe harbor provisions (including, e.g., 12 U.S.C. § 1828(x), under which a disclosure to a banking regulator generally does not waive the attorney-client privilege), disclosing privileged materials to a regulator is generally considered a privilege waiver.
33 In certain cases, it may also be appropriate for a company to set out some or all of these points in the company’s written policies and procedures.
34 Barko, 2014 WL 1016784 at *3.
35 48 C.F.R. 52.203-13. The prior regulations merely provided that defense contractors “should” have these investigation and disclosure requirements in place.
36 For example, Medicare regulations require providers to maintain compliance programs to prevent and detect violations of federal law. See 42 C.F.R. §§ 422.503 (Medicare Advantage organizations), 423.504 (Part D providers).
37 Regulations implementing the Federal Bank Act require “[e]ach banking entity [to] develop and provide for the continued administration of a compliance program reasonably designed to ensure and monitor compliance with the prohibitions and restrictions” under the Act. 12 C.F.R. § 44.20(a). The Bank Secrecy Act and its implementing regulations require banks to develop controls and monitoring programs to ensure compliance with the Act. Id. § 21.21.