Warren Buffett put it best when he said, “It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you’ll do things differently.” This statement could not be more relevant today. It takes only one person to tarnish an organization’s reputation. Not only is the current turbulent economy affecting the corporate bottom line, but if past history is any indicator, businesses can anticipate it to lead to an increase in incidents of fraud. As a result of the SEC, regulators, stakeholders and the public paying closer attention to the way an organization functions, organizations and corporate directors need to be diligent when conducting internal investigations.
It is important that an organization have a mechanism in place to alert the company’s Board of Directors and management about incidents of suspected employee misconduct and the need to conduct an internal investigation. To comply with the Sarbanes-Oxley Act of 2002, many organizations have implemented a whistleblower hotline or an anonymous reporting mechanism; however, often the process implemented is ineffective in encouraging individuals to report instances of misconduct. For example, one organization’s “anonymous” reporting process specifically stated that an individual could either write a confidential and detailed memo to the Audit Committee Chairman or leave an in-depth complaint message on his cell phone. This organization did not receive a single complaint since the mechanism was implemented. An organization should evaluate its reporting method and confirm that it is designed effectively and communicated appropriately throughout the organization to promote its effective use. In addition, although not all complaints should be routed to the Board, the notification process for complaints received through hotlines should be structured so that the Board is aware of the number and types of complaints received and how these complaints were handled.
Once an issue has been identified and a decision has been made to conduct an internal investigation, the organization should make sure that it is managed appropriately and common pitfalls are avoided. An improperly managed investigation can lead investigators to calculate monetary loss inaccurately, fail to identify all the individuals involved in the perpetration of the scheme, inadvertently contaminate or destroy potential evidence, cause additional costs to be incurred due to violation of employee contracts and company policies and increase the possible reputational damage due to harsh public criticism from shareholders. In one such mismanaged internal investigation, an employee accused of misconduct was terminated before completion of the internal investigation and without being offered an opportunity to explain his actions as required by his employment contract. As a result, in spite of the compelling evidence that this employee was negligent in his fiduciary duties and intended to use the company’s assets for his personal benefit, the company was held liable for breach of the employment contract, the ultimate findings against the employee were inadmissible in court and the company was required to pay severance costs to the individual.
An organization must be aware of—and make appropriate effort to avoid—certain potential missteps when conducting an internal investigation. The following are some of the most common mistakes made in internal investigations:
- improper selection of the investigative team
- inadequate triage of the potential evidence and target
- incorrect gathering, preservation and analysis of evidence
- limited scope of background checks
- inappropriately conducted interviews
The Board and Senior Management should establish policies and procedures to avoid these pitfalls when responding to allegations.
1. Improper Selection of the Investigative Team
After receiving a complaint, one of the first steps that an organization should take is to identify who is best suited to lead the investigation and who will be privy to the resulting information. During this process, one commonly overlooked factor is whether the investigative team is far enough removed from the situation to assure independence. The person(s) conducting the investigation should be qualified, properly trained in conducting investigations and independent of the allegations. When selecting the investigative team, the following should also be considered:
- The investigative team’s relationship with the suspect and/or the whistleblower. A long-standing or reporting relationship with either party can affect the objectivity of the team.
- The investigative team’s position within the organization. Are the individuals conducting the investigation “high” enough within the organization to obtain the required information?
- The role of the suspect’s supervisor in the investigative team. The suspect’s supervisor should not lead the investigation, as the supervisor may be too close to the allegation. Certain information uncovered during the investigation may indicate that the supervisor did not perform his/her duties completely and, therefore, failed to uncover the misconduct on a timely basis.
To ensure independence, the Board should also consider engaging external counsel, forensic accountants and other investigative consultants to conduct the internal investigation.
2. Inadequate Triage of the Potential Evidence and Target
Often, the target of the investigation is not isolated and restricted from accessing potential evidence on a timely basis. As a result, valuable information may be contaminated or lost due to the deletion or destruction of files. Triage of the situation should include placing the target on a leave of absence and restricting his/her access to the organization’s internal computer network and to its books and records during the course of the investigation. By doing so, the company will have protected the integrity of the potential evidence. As this is often a sensitive process, the organization should exercise caution and verify that these steps are taken in accordance with the company’s policies and procedures.
3. Incorrect Gathering, Preservation and Analysis of Evidence
Not surprisingly, some of the significant errors in an investigation occur during the collection and analysis of evidence. Prior to the commencement of the investigation, the investigative team should obtain and review the organization’s privacy policy to confirm that evidence collection is done in accordance with these policies. In addition, if all the documents and facts uncovered are not treated as if they will be subject to applicable rules of evidence, the evidence may be compromised and, therefore, inadmissible in future criminal or civil litigation.
Preservation Order
One of the first actions an organization should take is to determine which documents may be relevant during the investigation. Depending on the scope of the investigation, an organization may need to issue a document preservation order. If an organization neglects to issue a preservation order in a timely manner, a possibility exists that pertinent information and evidence may be destroyed.
Collection of Evidence
A crucial component of evidence gathering is ensuring that the chain of custody is documented. This documentation should include a description of how the information was obtained, when it was collected, who has handled it, where and how it was transported, and where it is stored and maintained. Improper documentation of the chain of custody during the collection process may result in information becoming inadmissible in court.
The individuals responsible for collecting electronic evidence should be aware of the following:
- Hard Drive Image: There are two ways an image of a hard drive can be created—a ghost image and a forensic image. A ghost image creates an exact copy of all files on the hard drive of the computer, excluding the free space. A forensic image, on the other hand, is an exact copy of the hard drive, including the free space. Deleted files, which sometimes can be retrieved using specialized tools and programs, are located in the free space of a hard drive. These files may hold valuable information that can assist in the investigation and may be missed if only a ghost image is obtained.
- Copying of Files: When copying selected files from a target’s hard drive, a common mistake can be to “click and drag” the files to another location. The use of this technique causes the metadata of the copied files to be altered. Metadata maintains and identifies the administrative properties of a file, such as the name of the person who created the file, creation and modification dates, number of revisions made to the file, and the most recent access date for the file. This is especially important because courts may deem evidence where the metadata was changed as inadmissible.
- Comprehensive Collection of Evidence: During the collection phase, some of the possible places from which electronic evidence can be gathered may inadvertently be overlooked. When retrieving electronic data, often only e-mail and documents from the hard drive of the target are collected. In reality, there are many other places where relevant data can be stored, such as flash drives, PDAs, backup files on network drives and servers, additional servers or other computers previously used by the target.
Analysis of Evidence Collected
A common mistake committed by investigators when conducting document review is the use of only a Windows search tool on the files of the target. This tool will not allow searches to be conducted on scanned PDF images and password-protected files. A scanned PDF is merely an image of a document. This file must undergo a process called Optical Character Recognition (OCR) for the file content to be searchable. The use of various computer forensic tools that can facilitate the review of evidence collected should also be considered.
Another common flaw when performing a document review is having an overly narrow focus when developing search terms or search parameters. For example, in one investigation which called for an e-mail review to identify collusion between two employees, the search was limited to e-mail communication between the two targeted employees. This search did not yield any results. After discussions with experienced investigators, the e-mail search was expanded to include all e-mail communication from the targets. This approach identified email that was sent by one of the targets to a third party and then routed from the third party to the second target. As a result of the expanded search, the company was able to prove the collusion between the two employees.
4. Limited Background Checks
Although a background check is often conducted on an alleged perpetrator, investigators often do not inquire about or know the exact parameters of the search. Inexperienced investigators may also limit a background check to an Internet search or to a compilation of raw data obtained from a search engine. A limited search may result in missing pertinent information about the target’s lifestyle or his/her criminal and civil litigation history and can be detrimental to the investigation.
An important consideration is whether a criminal background check is conducted on a local, state or federal level, as well as what specific jurisdictions are included in the search. A background check for civil court records should also be considered because these records can yield information about the criminal conduct of an individual. Criminal proceedings may not always be filed, and an individual who commits a criminal act may only be named as a party in a related civil suit.
In most cases, a background check requires the investigator to review large quantities of data obtained from various public records. This information should be analyzed in the context of the facts surrounding the fraud allegations being investigated so that the investigation stays focused on the allegations at hand.
5. Inappropriately Conducted Interviews
Interviews are one of the most valuable sources of information during an investigation, and interviewers must be experienced and skilled in eliciting information. Inexperienced investigators may act in a combative or unknowledgeable manner that ultimately may undermine the purpose of the interview.
At times, the target of the investigation is interviewed too early in the process. To the extent possible, the investigators should review applicable evidence and interview individuals who may have knowledge related to the allegation prior to interviewing the suspect. This will assist the investigators in asking pertinent questions when they interview the subject and allow them to refer to relevant and potentially incriminating documents during the interview.
It is recommended that two investigators be present during an interview so that one can act as a witness and be responsible for documenting the findings from the interview. The investigative team should also ensure that interview notes are documented in writing, are sufficiently detailed and capture the relevant content of the conversation.
In an era of increasing scrutiny of alleged corporate and employee misconduct, Directors should be aware of potential pitfalls when conducting an internal investigation. The investigative team should make certain that care is taken to avoid these missteps and develop a comprehensive and organized approach to the investigation.
To ensure that allegations are addressed appropriately and in a timely manner, the Board should develop an investigative policy and have a process in place to shorten the response time to a complaint and to mitigate problems encountered during the investigative process.
Tim Mohr is a principal in the New York office of BDO Consulting. He can be contacted at tmohr@bdo.com. Nidhi Rao is a director in the New York office of BDO Consulting. She can be contacted at nrao@bdo.com.