If there is a reason to believe that misconduct or wrongdoing has occurred, the organization must respond appropriately and promptly. Failure to respond or engaging in lengthy delays to respond can have serious consequences. Violations of the organization’s policies, rules, laws, or other types of misconduct threaten an organization’s status as being reliable, credible, honest, and trustworthy.
Detected but uncorrected misconduct can seriously endanger the mission, reputation, and legal status of an organization. Ignoring a legitimate report of wrongdoing will also alienate staff—especially the person who reported the problem—and could encourage qui tam action. Cover-ups usually cause more problems than they solve. In the event of misconduct, it’s important to face the problem and fix it. No matter how daunting it may feel to face possible misconduct, remember that one of the goals of a compliance program is detection. Having found a problem is an indication your program is working.
Internal Investigations
First, conduct a preliminary assessment of the alleged wrongdoing. This includes gathering basic facts and relevant information. If you have the capability, work with a small team that you can consult with regarding next steps. This team may include HR, risk, legal, and possibly a key leader who understands the subject matter needed. If you do not have the resources for a small team to consult with on the investigation, then consider an objective individual to be your sounding board as you consider next steps. Together you can determine how serious the misconduct or wrongdoing is, clearly define the scope of your review, and develop an appropriate plan of action. An investigation is recommended any time a potential violation is identified. Therefore, your plan of action will likely begin with a timely and thorough internal investigation. Depending on the extent and seriousness of the alleged infraction, outside counsel or content experts may be needed.
Your counsel will help decide what protections, if any, can be used in the investigation. While an internal investigation is the first step, also be sure to take the necessary steps to immediately stop or modify the procedures that are the alleged source of wrongdoing. The approach to the investigation process should be consistent and credible. Any investigation will have basic elements you can follow no matter what the allegation is. The process must be objective, independent of management, and conducted by a skilled investigator. Having investigators without training or a clearly defined process can result in increased risks for the organization.
The internal investigation must be completed thoroughly and documented meticulously. When choosing an investigative team, look for professionals who are appropriately trained and knowledgeable about the area in question, as well as people who are independent and objective fact finders. The compliance officer should be a part of the team, but participation by a member of the senior staff is also desirable when possible to emphasize commitment to the program. If outside consultants are used, the compliance office still must be represented on the team. Handing the problem off to someone else is not a solution. Outside consultants need to be directed, overseen, and evaluated just as closely as an internal investigation team (if not more so).
The team should meet as a group in the beginning to delineate the problem and decide on an approach or strategy. It should also receive senior management’s guidance and support. Develop an investigative plan to define the scope of the investigation, establish what evidence is needed, identify a list of potential witnesses, and start leveraging the needed resources. Instructions on time frame, process, and documentation are also in order. At a minimum, the team should meet again as a group at the end of the investigative process to discuss findings, plan the final report, and ensure that all the necessary bases are covered before closing the investigation.
Documenting the Investigation and Its Results
As noted previously, detailed documentation is critical. If it is necessary to defend the actions of the organization, a clear paper trail makes the process much easier. Thorough documentation should include the following:
-
Description of the potential misconduct and how it was reported
-
Description of the investigative process
-
List of affected policies and procedures
-
List of relevant documents reviewed
-
Chronology of relevant dates and details
-
List of witnesses interviewed and their respective statements (you may consider employees and nonemployees to interview)
-
Interview questions and notes
-
Detailed and objective analysis explaining the findings (which would include a root-cause analysis)
-
Changes to policies and procedures, if appropriate
-
Documentation of any systemic issues
-
Documentation of control failures
-
Documentation of any disciplinary actions
-
Investigation final report with recommended remedial actions
The final report and any attached documents are sensitive materials that should be distributed in limited quantities on a need-to-know basis. This report should provide an explanation of what the investigation entailed and an analysis of how the investigator reached a conclusion.
Voluntary Disclosure
If the investigation finds that there was no violation, the allegation should be documented as unsubstantiated. However, if the internal investigation finds reason to believe the misconduct constituted a material violation of the law, then the organization must take steps to disclose the violation. After determining credible evidence of a violation, prompt reporting of misconduct to the appropriate regulatory authority within a reasonable period needs to occur, when applicable. Timely reporting may help an organization avoid fines and penalties.
Voluntary disclosure to a regulatory agency helps demonstrate the organization’s willingness to be transparent in areas within which wrongdoing was found. It may also provide certain financial advantages if the disclosure results in a reduced fine or certain administrative advantages. A good-faith effort to comply creates a more pleasant working relationship between an organization and government regulators.