A whistleblower claims that a contract was awarded to your organisation as the result of a bribe. What do you do now? And when do you alert the awarding body?
A case study
Although based on real events, this case study and the identities of the individuals involved have been created for this article. No real company or individual is intended to be portrayed.
XSA is a French company with a UK business that grew rapidly through acquisitions. One of its UK subsidiaries, XMedical Services, was acquired in 2012 and provides specialist outsourcing services in the health sector. XMedical’s previous owner, Richard Taylor, was retained as the Chief Executive Officer.
In 2011, before its acquisition by XSA, XMedical had won a £750m a year contract from a health authority for the maintenance and operation of 15 major hospitals. Two senior health authority officers, Andrew Smythe and Graeme Stanforth, led the appointment of XMedical and were responsible for the operation of the contract within the health authority.
Then, in 2013, the XSA ethics reporting line received an allegation that “Taylor only got the hospital contract by agreeing to share the profits with Smythe and Stanforth”.
The first filter (or test before an investigation is started) of any ethics report is to check whether or not the allegation is capable of being true. In this case, subject to an investigation as to whether or not it was possible to share out profits from the contract, and the ability of people within the health authority to affect the awarding of the contract, it was adjudged possible that the allegation received could be true.
The first filter (or test before an investigation is started) of any ethics report is to check whether or not the allegation is capable of being true.”
The second stage, therefore, is to identify the objectives of the investigation and to plan accordingly. The obvious starting point for XSA was to identify whether there had been any wrongdoing and to protect the company. This suggested that two immediate aspects needed to be addressed: first, the preservation of any evidence and, second, the instigation of a confidential investigation. In this case, XSA had the option of either making a complaint, or self-reporting to the police and relevant authorities, and addressing the legal position with the health authority.
As XSA’s shares are not listed, it does not have an industry regulator. A separate question of self-reporting arose, however, in relation to the health authority and the police in both England and France, depending on advice from France.
As a matter of law, the entire contract could be avoided by the health authority if the contract was obtained by corrupt means. XSA had no obligation to report the issue to the health authority, but how much more damaging would it have been if the health authority heard about the allegation from another source, such as the whistleblower? For all that XSA knew, the whistleblower may have reported the matter to the health authority at the same time as reporting it to XSA. Informing other bodies (such as the police, awarding body or regulators - if applicable) too early, however, increases the risk of losing control of the investigation and, as a result, prevents it from being conducted confidentially. In addition, a decision to report to one external body will usually trigger a decision also to report to others. Timing is clearly crucial.
Although the allegation was capable of being true, XSA noted that it didn’t have sufficient evidence that any wrongdoing had occurred and decided to wait until the situation was clearer before it alerted the police and the health authority.
XSA debated internally whether or not to confront Mr Taylor. While it would be better to be open internally about the allegations, the risk was that - if the allegation was correct - this would provide the opportunity for the guilty parties to destroy any evidence. Sometimes it makes sense to confront an alleged wrongdoer to see how he or she reacts immediately after the meeting, but the evidence must already be preserved and such a tactic must be used with care. XSA decided not to confront Mr Taylor, so the next stage was, therefore, a covert investigation.
The covert investigation
A covert investigation balances the speed required by the investigation with the risk of it becoming known. As this progresses, certain lines of investigation involve a much higher risk of discovery. For example, electronic evidence obtained without alerting the subjects and covert monitoring of continuing e-mail communications and/or telephone calls are unlikely to be noticed. Interviewing the whistleblower, on the other hand, might only take place during the investigation’s later stages, due to the risk that he or she may reveal the investigation.
One of the first steps XMedical took was to analyse its accounts for the hospital contract. If the profits were being shared, this was likely to be by money being extracted from XMedical through a series of false invoices. These might have been submitted directly to XMedical, or the arrangement might have been more complex and involve otherwise legitimate subcontractors whose invoices to XMedical had been inflated in order to pay the individuals implicated.
The investigators identified a core set of contractors invoicing XMedical. Some of these, paid a total of £10m by XMedical, looked suspicious and were investigated for any links with the individuals implicated by the whistleblower. Before XMedical had been acquired by XSA, it had not undertaken any due diligence checks when taking on a supplier; so the first stop was Companies House, to see if there were any links between the suspect suppliers and the individuals concerned. Links might have been with each other (e.g. the same accountants or formation agents), or there might be a common address even though a director or shareholder might not have the names ‘Taylor’, ‘Smythe’ or ‘Stanforth’. The ease with which such links can be established depends on various complexities including the sophistication of those involved. If the suspect suppliers were not incorporated in England and Wales, the investigation would have to identify the country of incorporation and then obtain any records that were available in that country.
There are many examples of investigators taking the view that the ends justify the means. This approach results in a high risk that the investigation methods that are used overshadow the matters that are the subject of the investigation.”
Making sure that the investigation is lawful
There are many examples of investigators taking the view that the ends justify the means. This approach results in a high risk that the investigation methods that are used overshadow the matters that are the subject of the investigation.
XMedical monitored communications, but ensured that appropriate safeguards were used throughout. It is important to make sure that there is an audit trail of the safeguards used and, if matters are identified for further review (most obviously a continuation of monitoring), then those reviews must take place.
XSA also (lawfully) undertook bin searches outside the homes of the three individuals and identified promotional letters from overseas banks, naming the individuals as account holders. The searches also revealed other correspondence that linked the individuals with the suspect suppliers.
Time to report?
At this stage, it was apparent that there was real evidence: there were links between the three individuals and the suspect suppliers; and the payments to the company that was linked to Mr Taylor amounted to a breach of his employment contract
XSA took a risk that the health authority did not know about the matter already, and concluded that there was still insufficient evidence to justify reporting externally at this stage. From that point on, however, XSA had to review that decision frequently.
The courts as an aid to investigation
The English and overseas civil courts have a number of powers that can be invoked to support an investigation.
For court powers to be invoked, however, the investigation must have progressed to the stage where a business is prepared to commit to taking legal action and to the matter becoming public. XSA had to
determine whether or not it needed to self-report to the police and other authorities in respect of the corruption it had identified. The use of civil proceedings does not preclude making a criminal complaint, but any criminal proceedings will take priority and, as such, this has to be taken into consideration. XSA decided to pursue civil proceedings rather than a criminal complaint.
Initially, civil proceedings can be kept secret. Although XSA had substantial evidence of wrongdoing, it was not clear if the individuals were the only people involved. Neither was it clear whether other money had been stolen, nor where the bulk of the stolen money had gone.
XMedical had to co-ordinate its action across all of the countries involved in order to retain secrecy. The main action was in England, where XMedical applied, without giving notice to the individuals, for the following orders:
- A search order in respect of the individuals’ homes, requiring them to give an independent lawyer, accompanied by XMedical’s lawyers, immediate access to the premises to search for, and take away, evidence
- An order against each of the banks in England identified as holding accounts for the individuals and their companies. This meant that the banks, at XMedical’s expense, had to provide account documents including statements and correspondence.
- A freezing order against the individuals and their companies, accompanied by an order that they disclose their assets to XMedical
- An order that the banks and individuals concerned did not disclose the orders to others, in order that the initial period of secrecy could be retained
At the same time, XMedical obtained orders against the banks from local courts in other jurisdictions, which similarly instructed the banks to provide statements and correspondence relating to the relevant accounts.
Once the proceedings had been served and it was permissible to disclose the existence of these orders, XMedical informed the health authority of the position and the action that it had taken. XMedical faced a significant claim by the health authority but, being able to show the health authority that it was an honest organisation, by virtue of its response to the allegation, helped XMedical to retain the hospital contract.