Corporate Internal Investigations: Privilege, Disclosure, and Officer Exposure

Corporate internal investigations are a company’s structured response to suspected misconduct inside its own walls, run to understand what happened before regulators force the question. Done well, the process can lead the Department of Justice to decline prosecution outright. Done poorly, it can waive attorney-client privilege, trigger spoliation sanctions, and turn a contained problem into a public one. The core steps are consistent: assemble an independent team, preserve evidence, interview witnesses under the right legal protections, and decide whether to disclose what you find.

What Triggers an Investigation

Investigations start with something concrete. Internally, the most common trigger is a whistleblower complaint. Public companies are required under the Sarbanes-Oxley Act to maintain procedures for receiving complaints about accounting, controls, or auditing concerns, including anonymous employee submissions.¹ Employees who report suspected securities, wire, or bank fraud are protected from retaliation, and a company that fires or demotes one faces reinstatement orders, back pay, and litigation.²

External triggers move faster. An SEC subpoena, an informal DOJ document request, or notice that the company is a grand jury target all mean regulators are already looking. The SEC can compel testimony and records through formal orders of investigation.³ At that point, launching an internal inquiry is both a diagnostic step and a positioning move for any later cooperation credit.

The audit committee is the standing internal watchdog. SOX gives it explicit authority to hire independent counsel and outside advisers when a concern needs real scrutiny.¹ Once a red flag is confirmed, the question becomes who runs the investigation.

Who Runs the Investigation

When allegations reach senior management or the board itself, the board cannot credibly investigate its own ranks. The usual answer is a special committee of independent directors, generally at least two and preferably three, with one serving as chair. Independence is strict: a director with any tie to the alleged conduct, with potential liability from a supervisory role, or who sat on a compensation committee that approved payments connected to the misconduct, should not serve. A member chosen despite one of those conflicts can cost the company business judgment rule protection and sink the investigation’s credibility with regulators.

The board should pass a formal resolution establishing the committee, defining scope, specifying whether the committee decides or recommends, and stating that its findings are not subject to board approval. That last point preserves the committee’s independence from the executives it may need to scrutinize.

Why Outside Counsel

Serious investigations are run by outside law firms, not in-house legal departments. When conduct touches company leadership, in-house lawyers face a structural problem: they routinely advise the same executives whose actions are now under review. Courts also scrutinize whether in-house communications were genuinely legal advice or business guidance, which can determine whether investigation work stays privileged.

Outside counsel brings separation. Their engagement is clearly for legal purposes, which strengthens privilege claims when work product is later challenged. The Supreme Court held in Upjohn Co. v. United States that attorney-client privilege in the corporate setting reaches beyond executives to lower-level employees, so long as the communications concern their duties and are made to obtain legal advice for the corporation.⁴

Investigations also pull in non-lawyers: forensic accountants to trace transactions, IT specialists to secure digital evidence. To keep communications with those experts privileged, counsel executes what practitioners call a Kovel agreement, after a Second Circuit decision extending privilege to a non-lawyer who functions as an interpreter helping the attorney understand complex information to provide legal advice.⁵ The engagement letter must say the expert is assisting counsel in rendering legal advice. Letters that describe the work as business consulting or tax preparation lose the privilege.

Preserving Evidence

Preservation is the first operational step, and getting it wrong is expensive. A litigation hold notice goes out to every employee who might hold relevant material, telling them to stop any routine deletion of records. It covers email, Slack and Teams messages, texts, and any other communications reflecting business decisions or the conduct under review.

Collection means forensic imaging of hard drives, metadata capture to prove files were not altered, and cataloging of physical documents like handwritten notes and signed contracts. Chain of custody has to be documented for everything. The factual foundation of the investigation rests on whether the data is complete and authentic.

Federal Rule of Civil Procedure 37(e) governs the fallout when electronic information disappears because a party did not take reasonable preservation steps. If the loss causes prejudice, a court can bar certain evidence, allow argument about the failure, or deem specific facts established. If the court finds the destruction was intentional and meant to deprive the other side of the information, the sanctions escalate: an adverse-inference jury instruction, or dismissal.⁶

Interviewing Employees

Witness interviews are where documents become stories. They surface context, identify inconsistencies, and establish who knew what and when. The lawyer running the interview represents the company, not the employee across the table, and the employee has to understand that.

That is the function of the Upjohn warning. The Supreme Court’s Upjohn decision did not require a specific script; it established that corporate privilege reaches employee communications made to obtain legal advice for the company.⁴ The warning became the best practice for protecting that privilege. It tells the employee three things: the lawyer represents the company and not the individual, the company owns the privilege over what the employee says, and the company can waive that privilege and share the statements with anyone, including the government.

Skipping or garbling the warning creates problems in both directions. An employee who believed the lawyer represented them personally can later claim a conflict that destabilizes the investigation. And if the company hands interview notes to the DOJ as part of a cooperation deal, an unwarned employee has a stronger argument that the statements were improperly obtained.

What Employees Can and Cannot Refuse

Employees in a private corporate investigation do not have the constitutional protections they would in a government interrogation. A company can require cooperation and discipline or terminate those who refuse, because the Fifth Amendment restricts government compulsion, not private employers. An employee who fears personal criminal exposure can still decline specific questions, and the company cannot legally compel self-incriminating testimony. In practice, refusal often results in termination for violating company policy.

There is a narrow exception. If prosecutors effectively outsource their investigation to corporate counsel by directing questions or managing the process, courts may treat the employee’s compelled statements as the product of government coercion, raising genuine Fifth Amendment concerns. That is why a clear boundary between the internal investigation and any parallel government inquiry matters.

Unionized employees have one additional right. Under NLRB precedent, a union-represented employee who reasonably believes an investigatory interview could lead to discipline may request a union representative be present. Denying a valid request violates federal labor law, though employers are not required to tell employees the right exists.⁷ Non-union employees do not currently have this right.

Protecting Privilege

Privilege is the legal armor around the investigation. Lose it, and interview memos, strategy discussions, and draft findings become discoverable by plaintiffs, regulators, or both.

The foundation is Upjohn: communications between employees and company lawyers are privileged when made to obtain legal advice and kept confidential.⁴ The work product doctrine adds a second layer for materials prepared in anticipation of litigation, with special protection for documents revealing attorney mental processes and strategy.

Waiver When Disclosing to Regulators

The hardest privilege call comes when the company decides to share findings with the DOJ or SEC in exchange for cooperation credit. Federal Rule of Evidence 502 limits the scope of waiver that results from disclosure to a federal agency: generally only the material actually disclosed loses protection, not every related document. Subject matter waiver, which opens up everything on the same topic, is reserved for unusual situations where fairness demands it to prevent a misleading presentation.⁸

Courts have sometimes gone further. Handing interview memoranda and investigation summaries to prosecutors can be found to destroy the confidentiality those documents depended on, especially when the disclosure was voluntary rather than compelled. Before producing anything to the government, counsel has to make a strategic judgment about exactly what to turn over and how to structure the disclosure to limit waiver.

Shareholders pursuing derivative claims may also try to pierce privilege under the Garner doctrine, first recognized by the Fifth Circuit. The exception allows access to otherwise privileged corporate communications on a showing of good cause, but courts have kept it narrow: the claim must have merit, specific documents must be identified, and the information must be genuinely unavailable through other discovery.

Reporting Findings and the Self-Disclosure Decision

The investigation produces a written report synthesizing evidence, witness accounts, and factual conclusions, delivered to the board or the special committee that commissioned the work. The report lays out methodology, findings, and recommended next steps. The weightiest recommendation is usually whether to disclose what the investigation found to the government.

Under the DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy, a company that voluntarily reports misconduct, cooperates fully, and remediates in time is eligible for a complete declination of prosecution when no aggravating circumstances exist.⁹ Aggravating circumstances include involvement of executive management, significant profit from the misconduct, pervasive wrongdoing, and criminal recidivism.

When aggravators block a full declination but the company did self-disclose, the DOJ recommends a 50% reduction off the low end of the Sentencing Guidelines fine range.¹⁰ Companies that narrowly miss the voluntary disclosure criteria can still receive reductions of 50% to 75% off the low end.⁹ Companies that skipped self-disclosure but later cooperated fully and remediated may receive up to 25% off. The dollar gap between tiers is why the self-report decision is often the most consequential call in the whole process.

External Auditors

Companies running internal investigations also have to think about their external auditors. PCAOB standards require auditors to inquire about unusual activity, interview personnel in areas of identified fraud risk, and understand the business purpose of significant unusual transactions. Fraud involving senior management, or fraud causing a material misstatement, must be reported directly to the audit committee before the auditor issues its report.¹¹ In certain illegal-act situations with material financial impact, auditors have a further obligation to report to the SEC. Trying to wall the auditor off from the investigation creates a separate legal problem on top of the one being investigated.

Fixing What the Investigation Found

An investigation that exposes misconduct but changes nothing accomplishes nothing with regulators. The DOJ evaluates whether a compliance program is actually working. Prosecutors look at whether the company performed a genuine risk assessment, directed compliance resources to the highest-risk areas, trained employees on specific risks rather than generic ethics content, and maintained a reporting structure employees actually used.¹²

Discipline against the individuals responsible is a baseline expectation, ranging from reprimand to termination depending on severity. The DOJ increasingly looks past individual discipline to structural change. Under the Criminal Division’s compensation incentives and clawback pilot, companies resolving cases with the DOJ have to build compliance performance into their compensation structures. Employees who fail compliance standards lose bonus eligibility, and supervisors who knew about or ignored misconduct face discipline.¹³

Companies can earn a dollar-for-dollar fine reduction for compensation successfully clawed back from culpable employees. Even a good-faith attempt that fails can earn a credit of up to 25% of the amount sought.¹³ The point is a direct financial incentive to pursue the individuals who profited, not just to rewrite a policy.

When a Government Investigation Is Already Running

Many internal investigations run alongside active government inquiries. The SEC may be pursuing enforcement while the DOJ builds a criminal case, and the company is trying to get its own facts straight at the same time. The overlap creates friction at every stage.

Witness interview sequencing is the biggest operational issue. Interview a key employee before prosecutors do, and the government may accuse the company of coaching or contaminating the witness. Let the government go first, and the company loses the chance to build its own factual record independently. The DOJ’s enforcement policies treat de-confliction of witness interviews as a cooperation-credit factor.¹⁰ In practice, outside counsel communicates with prosecutors about timing to avoid interference.

Parallel proceedings also multiply privilege risk. Documents produced to the DOJ in a criminal matter may become available to SEC enforcement staff, and anything disclosed to either agency may later be argued as waived in private litigation. A disclosure strategy has to account for every front at once, not only the one that feels most urgent.

Officer Certification and Personal Criminal Exposure

Many investigations are triggered by concerns about material misstatements in financial reports. Under SOX, the principal executive and financial officers of a public company must personally certify in each annual and quarterly filing that they have reviewed the report, that it contains no material misstatements or omissions, and that the financial statements fairly present the company’s financial condition.¹⁴

Those certifications carry criminal weight. Section 906 of SOX, codified at 18 U.S.C. § 1350, attaches criminal penalties to knowing or willful violations. A knowing violation carries a fine of up to $1 million and up to 10 years of imprisonment. A willful violation doubles the exposure to up to $5 million and up to 20 years. When an investigation reveals that certified financials may have been materially misleading, the personal criminal exposure of the officers who signed them becomes an immediate factor in every subsequent decision about disclosure and remediation.

1
Public Company Accounting Oversight Board. Sarbanes-Oxley Act of 2002 – Section 301
2
Office of the Law Revision Counsel. 18 USC 1514A – Civil Action to Protect Against Retaliation in Fraud Cases
3
U.S. Securities and Exchange Commission. How Investigations Work
4
Justia. Upjohn Co v United States, 449 US 383 (1981)
5
Justia Law. United States v Kovel, 296 F2d 918 (2d Cir 1961)
6
Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery
7
National Labor Relations Board. Weingarten Rights
8
Legal Information Institute. Federal Rules of Evidence Rule 502 – Attorney-Client Privilege and Work Product, Limitations on Waiver
9
U.S. Department of Justice. Corporate Enforcement and Voluntary Self-Disclosure Policy
10
U.S. Department of Justice. FCPA Corporate Enforcement Policy
11
Public Company Accounting Oversight Board. AS 2401 – Consideration of Fraud in a Financial Statement Audit
12
U.S. Department of Justice. Evaluation of Corporate Compliance Programs
13
U.S. Department of Justice. The Criminal Division Pilot Program on Compensation Incentives and Clawbacks
14
Office of the Law Revision Counsel. 15 USC 7241 – Corporate Responsibility for Financial Reports