DOJ Provides “Best Practices” for Corporate Internal Investigations

Eugene Illovsky is a partner at Morrison & Foerster LLP. This post is based on a Morrison & Foerster publication by Mr. Illovsky.

What does the Department of Justice think is a high-quality internal investigation? How does DOJ decide whether an investigation was good enough to help a company avoid, or at least mitigate, criminal charges? In recent speeches, DOJ has provided important guidance on its view of best practices, and some useful common-sense reminders, for our clients’ counsel and their investigating board committees. Much of that guidance came in May 19, 2015 remarks by Criminal Division head Assistant Attorney General Leslie Caldwell, as well as in other recent speeches.

AAG Caldwell made clear that DOJ does indeed take the time to scrutinize and “evaluate the quality of a company’s internal investigation.” She explained that the Department does this evaluation “through our own investigation” as well as “in considering what charges to bring against a company.”

DOJ decides whether to charge a company using the Principles of Federal Prosecution of Business Organizations, also known as the nine Filip factors. The charging decision, under Filip factor 5, is based partly on “the existence and effectiveness of the corporation’s pre-existing compliance program.” U.S. Attorneys Manual 9-28.300. DOJ asks whether the company “has established corporate governance mechanisms that can effectively detect and prevent misconduct.” USAM 9-28.800.

This DOJ guidance reinforces the point that an internal investigation should be understood as part of a company’s compliance program. Here’s why. A company will get credit from DOJ only if its compliance program is “effective.” And DOJ says effective compliance programs must have procedures designed to (1) “uncover wrongdoing” in the company and (2) “expose individuals responsible for criminal behavior.” Those “procedures” are the tools the company uses in its investigation.

DOJ on Best Practices

DOJ “will not tell a company how it should conduct an investigation.” In connection with evaluating a company’s efforts, however, the AAG says that the Department “ha[s] seen some ‘best practices’ with regard to internal investigations.” On that front, the AAG has repeatedly delivered two messages: (1) companies that over- investigate do so at their own cost and peril; and (2) companies’ internal investigations must identify and deliver evidence against individual wrongdoers. The quality of the company’s investigation, then, will also determine how effectively the company is deemed to have cooperated with the government in delivering that evidence. See USAM 9-28.300 (Filip factor 5: “company’s willingness to cooperate in the investigation of its agents”).

Tailor and Target. DOJ is placing a premium on targeted investigations. A company should set out to “root[] out relevant facts, identify[] and interview[] the knowledgeable actors and captur[e] and preserv[e] relevant documents and other evidence.” If an investigation “unearths criminal conduct,” then the continued “inquiry should be thorough enough to identify the relevant facts, players, documents and other evidence, and to get a sense of the pervasiveness of the misconduct.”

Money and Time. The AAG insists it is “reasonable to take resources—time and money—into account” in tailoring the investigation. She warns that the Department has seen “needlessly costly and overbroad investigations.” It is not “necessary or productive for a company to employ its internal investigators to look under every rock and pebble.” Or, as the AAG has previously phrased it, a company will not earn extra credit with DOJ should it “aimlessly boil the ocean.” To the contrary, she stresses “doing so will cost companies much more in the end” not only in fees but “because it ultimately will delay [the government’s] investigation and delay resolution and closure for the company.” The devil, of course, resides in the details and in the judgments about scope to be made by experienced investigators.

Communicate and Cooperate. Companies choosing to cooperate with the government will reap the benefit of additional help in “appropriately targeting their investigations.” To the “extent possible, [DOJ] will make clear to those companies [its] areas of interest.” The AAG said, “I tell my prosecutors that where possible, if it would not compromise our own investigation, we should share information with a cooperating company to help focus the company’s internal inquiry.” Finally, the AAG “encourage[s] an open dialogue between company counsel and our prosecutors about the progress of the internal investigation.” This dialogue “comes easily” to companies truly committed to demonstrating cooperation.


Here are some suggestions for specific steps to consider in light of the guidance in the AAG’s speeches:

Develop Your Investigative Procedures Now. We know that a company’s “pre-existing compliance program” must have procedures designed to “uncover wrongdoing.” Of course, the precise investigative “procedures” will vary with future circumstances. But don’t wait for a crisis. General investigative procedures can be developed now and incorporated into the compliance program. If the need for an investigation arises, the company will be able to move more swiftly and smoothly.

The Compliance Program’s Investigations Playbook. Think of those general procedures, tailored to the organization, as comprising an investigations “Playbook” for the in-house lawyer’s or director’s bookshelf. Develop them after discussions with pertinent corporate constituencies and with outside counsel or advisors about what would happen in a hypothetical investigation: How would it be staffed? Who would be the points of contact and authority? What evidence collection issues might arise unique to how the company operates? The Playbook might also include information for critical IT personnel and vendors, the latest data map (an inventory of the company’s electronic and other data sources), HR policies and employment/collective bargaining agreements, templates, company policies regarding whistleblower complaints, and any other information key personnel may need for an investigation.

Prepare to Manage the Project! The AAG’s exhortation that it is “reasonable” to take “time and money” into account to avoid investigations that cause undue delay highlights the importance of actively managing the internal investigation. The company’s point of contact—the investigating board committee or in-house lawyer—should use project management techniques with the investigators: scope the project (reassess as needed); map out team responsibilities; use timelines and budgets; and schedule regular dialogue with DOJ to keep the investigation tailored and avoid the risks of under- or over-investigation.


Companies should treat an internal investigation as part of their compliance program, rather than something they must undertake as a result of having a compliance program. An ineffective investigation could prevent the company from getting full credit from DOJ for its costly and otherwise state-of-the-art compliance efforts as well as for its cooperation.

Both comments and trackbacks are currently closed.