Professional Documents
Culture Documents
Investigation: A Step-by-
Step Guide
10
Investigating a matter too zealously or not at
all carries risks. Heres how to ensure that
investigations are lawful, effective and protect
your company from liability.
Barbara E. Hoey
Barbara E. Hoey, a partner in the New York office of Kelley Drye & Warren LLP, is chair of the firms
Labor and Employment Practice Group. She can be reached at bhoey@kelleydrye.com. Jessica Beren-
broick, a law clerk at the firm, assisted in the preparation of this chapter.
able to obtain private phone records of board members and journalists, in violation
of California privacy laws. In late 2006 a disgruntled director went to the media to
complain, and the firestorm hit! Within weeks, the companys chair, Patricia Dunn,
had resigned, as had the general counsel and other senior lawyers on her staff. Senior
management were called before Congress to explain their actions. The Attorney Gen-
eral filed criminal charges against HPs chairman and in-house counsel. The company
was lambasted in the media. In early 2007, it was announced that HP settled the
matter for $14.5 million! As part of the settlement, the company was instructed to
appoint an outside expert to review its investigative practices. However, the criminal
charges against the company officers and employees are still pending.
Many regard the HP case as an anomaly but was it? Has it ever happened at your
company that, in the zeal to investigate some suspected instance of corporate espio-
nage, some manager has gone too far and suggested that the company should bug
phones, look through personal mail or otherwise invade the privacy of the employee.
Have you ever hired anyone to spy on employees? Do you know whether that is
lawful?
Lessons Learned
The HP scandal imparts a number of lessons about the proper course of action a com-
pany should take in conducting an internal investigation.
First, a company cannot completely shield itself from liability by hiring an outside
investigator. You have an obligation to closely supervise the investigators whom you
employ.
Second, it is never advisable to employ investigative methods that teeter on the edge
of being lawful the law evolves. A legally suspect investigation can lead to civil and
criminal liability, and can be devastating to a companys goodwill and morale.
Third, an improper internal investigation can create more problems than it solves.
Whatever information may have been leaked from Hewlett Packard about board
deliberations, it was probably not as harmful as the affect of this prosecution on the
companys market value and morale.
On the other side of the spectrum are investigations that are not done properly, or not
done thoroughly which can result in just as much liability to a company. Examples
of these shoddy investigations litter the case books. As one example, a secretary com-
plains that a partner at a law firm is harassing her. No real investigation is done. The
partner is transferred to another office. That partner later goes on to harass his next
secretary. She sues, and obtains a $6 million verdict against the law firm.
Do you know what to do when you are hit with one of these situations and asked
to investigate? Do you know what your legal obligations are? How do you balance
privacy concerns, with the need to be thorough? How should you go about coordinat-
ing that investigation? How do you know when you should hire an outside expert?
Should you suspend or separate the individuals involved?
are happening in real time. Whether you are looking at an employee complaint of ha-
rassment, or an instance of a fired executive who has stolen trade secrets you must
act and will be expected to act immediately. Hasty decisions are often bad decisions.
Hence, it is important to sit down with a team and develop a plan that you will follow
in doing an investigation, before you are actually called upon to do one.
What you need here is the basic outline of a plan, that will then be filled in as the
issues unfold. The plan should recognize that the scope and type of an investigation
will vary, depending upon the situation being investigated. Below are some basic
items that your plan should include.
As soon as you are made aware of a complaint or a situation that must be investigated
sit down, either alone or with you team, and map out your blueprint for this inves-
tigation. This does not have to be an elaborate analysis, it could be some notes scrib-
bled on a pad. However, this simple process of analyzing the problem and planning
before you start to investigate is essential.
In making an investigative blueprint, the first step is to analyze the triggering event,
because the issue that you are investigating will affect the type and scope of the in-
vestigation that you do. Was it an act of workplace violence or a complaint of sexual
harassment? These will often merit immediate attention and/or discipline. Or was it a
less inherently dangerous event, such that a premature or overzealous course of action
could make the employer vulnerable to a lawsuit? Is the companys aim to protect
itself as in the HP case or is the company seeking to protect its employees? How
many employees will the investigation affect?
Asking the right questions can help a company to tailor its investigation, in degree
and kind, to the problem at hand. Further, if an investigation is subject to scrutiny of
a court or agency, documentary evidence of careful planning can put the company in
good standing. This evidence can help a company demonstrate that it acted in good
faith and in compliance with the law, that the investigation was reasonable under the
circumstances, and that it had an objective basis for whatever actions were taken.
Once the basic facts surrounding a triggering event are established, you should, in
consultation with inside or outside counsel, identify the companys legal obligations.
Having a basic understanding of the law is very useful. This begins with the question
of whether the company has an affirmative duty to investigate. For example, Title VII
of the Civil Rights Act of 1964 places an affirmative duty on employers to investigate
complaints of discrimination, and under the Occupational Safety and Health Act, an
employers failure to investigate a workplace hazard can give rise to a finding of a
willful violation. Likewise, under the Sarbanes Oxley Act, companies are also obli-
gated to investigate, and possibly report to the board of directors or to a committee of
the board, the result of that investigation.
On the flip side consider whether there are laws that will regulate what you can do
in conducting the investigation. As was seen with HP, you may have a duty but you
cannot use that duty as an excuse to violate the law or overstep employees rights.
Identifying the companys legal obligations will help HR focus narrowly on what
needs to be investigated.
You have identified and defined the issue now you need to decide who should in-
vestigate. In many cases, especially where one employee has filed a complaint against
another, the best investigator is someone in the HR department. Some situations, due
to scope or complexity, may call for more than one investigator. It may be necessary
to bring in an expert, like a forensic accountant, an engineer or a doctor. If it is a
complex legal matter, HR may want a member of in-house or outside counsel to lead
the investigation. If so, keep in mind that this can affect the attorney-client privilege,
and may also create a potential for a conflict of interest.
The investigator should be fair and impartial, credible, respected and knowledgeable
about company policies; he or she should mimic the role of a mediator or a judge, not
a prosecutor. Avoid selecting someone who thrives on drama, has a tendency to abuse
authority, or makes things more complicated than they need to be.
If you decide to use an outside investigator, be sure to account for the HP factor
an outside investigators actions will be subject to increased scrutiny. Additionally,
hiring an outside investigator can expose the company to criminal liability under the
Computer Fraud & Abuse Act, the Electronic Communications Privacy Act, the Fair
Credit Reporting Act, the Wire Fraud Act, and civil liability for invasion of privacy,
trespass and infliction of emotional distress. Only hire an external investigator if ab-
solutely necessary, and be sure to closely monitor his or her actions.
The next step in the investigation process is to identify your evidence. This sounds
obvious but this is an essential part of your job. At the early stages determine what
the evidence is, and where it is located. Five or 10 years ago, this process was fairly
simple. There were two types of evidence people (the witnesses) and paper (their
records and company records). In the workplace of 2007 your evidence can be
found in many other places. Evidence will still reside in live witness memories and
paper files, but it will also be stored in a variety of electronic sources, including the
company servers, individual PCs, laptop computers, Blackberry devices, e-mails, text
messages and cell phones. You must identify all of that evidence at the earliest stages
of the investigation.
Once the evidence is identified, a strategy must be devised as to how it will be col-
lected and preserved. A companys strategy for collecting and preserving the evidence
will vary depending on the type of evidence involved. The collection of evidence is
also a sensitive matter that must be done carefully. Also, your method will vary with
the type of evidences involved. Whether you are interviewing live witnesses or scroll-
ing through employee e-mails, you need to be careful not to anger people and violate
their rights which may later affect morale, and be used as a reason to attack the
investigator.
Live Witnesses
In identifying live witnesses, it is probably best to draw up a broad list of anyone
who might have relevant information, including executives, managers, departmental
employees, company-wide employees and third party witnesses, like customers or
contractors. Make sure that none of the people involved in the investigation are also
witnesses to, or participants in, the triggering event.
Once that list is developed, anyone on the list must be excluded from the process of
the investigation. In other words, if the HR Director for that division was involved
in the incident, he or she should not be permitted to consult on the investigation or
interview witnesses. The investigator may himself be a witness, so his or her involve-
ment could taint the process. Likewise anyone else involved in the decision or the
underlying incident should not be involved in the investigation.
Also, be sure to instruct live witnesses that they should not discuss the matter with
anyone outside of the investigative interview.
Paper Records
When collecting paper records, begin by making a list of what records exist and may
be relevant. Ask all of your potential witnesses to make similar lists. Safety records,
personnel files, time and pay records, medical files, accounting expense records and
telephone records are generally among the most critical to obtain.
You need to require everyone involved in the situation (who should be on your wit-
ness list) to deliver all records concerning the employee or incident to the lead inves-
tigator as early as possible. In storing these paper files, make sure to make a copy and
keep that copy and the originals all together in one place. Do not allow the investiga-
tive team to work with or tamper with the original documents. Also, be sensitive to
the fact that many of the files are confidential, and should not be accessible to the
public. As the unfortunate legacy of the HP case makes clear, only lawful methods
should be used to obtain these records (as distinguished from not generally unlawful
methods).
Electronic Evidence
In most cases, the highest volume of evidence will be in electronic form. Electronic
evidence may be found on a PC, a laptop, or a removable storage device like a zip file,
a CD or a portable handheld device. A comprehensive search for data on an employ-
ees PC or laptop should include searches of the cookies folder, which contains text
files about the sites the user visited, and the history folder, which shows the sites the
user visited. Most companies also track this information outside of the local machine.
Other places to search for electronic evidence include building security systems, voice
mail systems and debit, credit card, and phone databases.
Preserve Evidence
Because evidence preservation is one of the more complex aspects of any investiga-
tion, this section provides a comprehensive background before detailing the steps that
HR should take at this stage of the investigation.
Once a company is aware of a potential claim, it has a duty to preserve all paper
and most electronic evidence that is under its control. If HR is running an investiga-
tion at its early stages, this obligation will fall to you.
The general rule on evidence preservation originates from a Southern District of New
York case, Zubulake v. UBS Warburg. The plaintiff, Laura Zubulake, sued UBS Warburg
for gender discrimination. UBS was directed to preserve certain e-mails discussing the
plaintiff. During the course of the litigation UBS was accused of failing to preserve its
backup tapes as ordered, which contained potentially relevant e-mails. Ultimately, the
judge hearing the case held that the company was negligent, and possibly reckless, in
failing to preserve this evidence, and ordered UBS Warburg to pay all of Zubulakes
costs for re-deposing witnesses after the evidence was destroyed. Zubulake ultimately
won a $29 million verdict against the company.
The Zubulake rule applies to all evidence, but has an especially important application
to electronic data, which accumulates quickly, and is routinely destroyed in the nor-
mal course of business. The rule has two key components:
First, a company has a duty to put a hold on the destruction of any evidence
that it knows or should know is relevant to ongoing (or reasonably antici-
pated) litigation.
Second, the companys counsel has an obligation to ensure that employees are
actually honoring the hold and not destroying discoverable data.
The legal term for failing to preserve evidence is spoliation, and it can result in
discovery sanctions. These sanctions range in force from a cost-shifting measure, as in
Zubulake, to an adverse inference jury instruction. In Coleman (Parent) Holdings, Inc. v.
Morgan Stanley, the court issued an adverse inference instruction to the jury after Mor-
gan Stanley continued overwriting e-mails, contrary to its legal obligations, and will-
fully disobeyed a discovery order to produce certain e-mails from its backup tapes. The
judge wrote that a reasonable juror could conclude that the companys misconduct was
evidence of its consciousness of guilt. The plaintiff in Coleman won a $1 billion verdict.
Contrary to what these cases may indicate, there have been some positive legal de-
velopments in the world of e-discovery. The new Federal Rules of Civil Procedure,
which became effective in December 2006, recognize that a party cannot be expected
to provide discovery of every piece of electronic data that flows through its system.
The rules do require a company to hold and preserve electronic evidence. How-
ever, Section 26(f) of the rules provides that a company must only make reasonable,
good faith efforts to preserve data. Appended notes from the rules advisory commit-
tee recognize that a business must be able to continue routine operations critical
to ongoing activities. Accordingly, this rule provides a safe harbor for companies,
limiting the sanctions that can be imposed if they make good faith efforts to preserve
evidence. Businesses do not need to shut down all systems out of fear that one e-mail
will be lost, especially if the company has a good hold policy in place.
There are also now limits on the amount of data a company will be required to pro-
duce. One of the new rules, 26(b)(2), provides that a party is only expected to pro-
duce electronic information that is reasonably accessible. Also, a court may award a
protective order against production because of the undue burden or costs that the
request will impose on a company.
First, get IT involved. Make the IT Department your partner and use their exper-
tise to become educated about the companys technology, including its hard-
ware and software systems. Enlist the help of IT professionals to help identify
all the places that discoverable data is stored, including the operating system,
back-up systems, word processing units, document storage systems, networks,
intranet, desktops, laptops, cell phones, and Blackberry, Treo and other PDA
devices.
The final step in the preservation process is a continuous one: regularly monitor com-
pliance. Speak with IT to ensure that any automatic janitorial systems for data are
turned off. Meet with the witnesses in 2 weeks, then 6 weeks, and so on, and review the
written instructions with them. Find out if anyone is unsure about their obligations,
and encourage employees to report any snafus they may have had along the way.
Once an investigator has been selected, and evidence has been put on hold, the
company must determine the methodology to be used in the investigation. Most
investigations will benefit from a combination of traditional and electronic methods.
For example, if an employee files a harassment complaint, the investigator may want
to conduct employee interviews and search the e-mails and computers of the employ-
ees involved. This section provides tips on how to stay within the bounds of the law
when using traditional and electronic methods. These tips err on the side of caution;
again, the law evolves, so it is better to use methods that are clearly lawful, and avoid
any gray areas.
Witness Interviews
Before interviewing employees, the investigator should organize a list of uniform
questions. It is important to ask all of the interview subjects to cover the same details
what time was it, who was there, what was said and so on because a single persons
account of the facts cannot be relied on as accurate, or complete. A true picture will
only emerge from multiple accounts.
The interview should be designed to elicit truthful information, not to make judg-
ments about guilt or innocence. Employees should not be interrogated, or asked lead-
ing questions that signal to them that a certain answer is expected. The investigator
should not opine about the facts of the case, or attempt to explain the law.
There is some information that an investigator has a duty to disclose. Witnesses should
be told that they have a duty to cooperate with the investigation, and are not entitled
to lie. In addition, they should be informed that the interview is not privileged. If the
employee is a member of a union and requests that a union representative be present
for the interview, under the Weingarten rule, this request must be honored.
When interviewing an accused person, the investigator should explain the accusations
and give the employee a chance to tell his or her side of the story. If the employee
refuses to cooperate, this could be grounds for discipline, up to and including
termination.
At the end of an interview, the witness should be asked to sign a statement. If a wit-
ness attempts to leave at any point before the interview has concluded, the investiga-
tor should not attempt to block the persons exit. The investigator is not a law en-
forcement officer. If a witness is physically restrained, the company could be sued for
false imprisonment.
One cautionary note if company lawyers interview witnesses be sure the witnesses
understand who the lawyer represents. The lawyer should disclose to the witness that
that he/she represents the company (not the employee), that the interview is not nec-
essarily privileged, and that what they say may be used as a basis for company deci-
sions or discipline. This is a delicate and potentially difficult process, but is absolutely
necessary.
Physical Searches
The Fourth Amendment to the U.S. Constitution protects employees from illegal
searches and seizures. In determining whether a search violates the Fourth Amend-
ment, the threshold inquiry is whether the person had a legitimate expectation of
privacy in the item to be searched. Accordingly, every company should have a policy
in place reserving the right to search company property (including areas assigned to
the employee) and the employees person and property. To ensure compliance with
the law, and to preserve morale, physical searches should be conducted in private.
Drug Testing
Drug testing is only lawful if there is reasonable suspicion that the employee has
been using drugs. The employer should have a drug-free workplace policy in place to
put employees on notice that drug use will not be tolerated. If an employee is subject
to drug testing, the company should use a professional service to administer the test.
ate how much the case is worth, the potential liability at stake and the breadth of data
to be searched. If the company has internal resources in place to conduct these search-
es, this could mitigate the cost. Ultimately, the company must balance the expense of
a search with the value of the information it can yield.
To ensure that these searches are legal, every company should have a policy in place
regarding e-mail monitoring. A good policy will provide that there is no expectation
of privacy in e-mail or other electronic communications. This policy will enable the
company to search an employees e-mail without permission, though it is important
to keep in mind that this does not entitle the investigator to search communications
that are clearly unrelated to the investigation. Once it becomes evident that an e-mail
message is of a personal nature, the investigator should stop reading. Personal e-mails
should not be saved, copied or distributed.
It is advisable that you consult with legal counsel as to the content of such a policy or
notice, and to make sure that the extent of your monitoring is lawful.
Conclusion
In the end, not every investigation can be perfect. However, if you follow the steps
outlined above, you should at least be able to ensure that any investigation you
oversee will be prompt, as thorough as possible and lawful. The key to much of this
is planning and preparation. HR should, working with counsel, IT, corporate security
and the other professionals in your firm, be proactive and make sure that policies and
plans are in place in advance, which will in turn ensure that investigations proceed
smoothly.