Practical Privilege: Risk Assessments and Internal Investigations

The interplay in the Bribery Act 2010 between potentially far-reaching extra-territorial jurisdiction and strict liability for the acts of third parties, including service providers, is spawning a new kind of anti-corruption industry that straddles and blurs the line between legal and compliance. Two key areas of activity in this new era of Anti-Bribery and Corruption (ABC) compliance are corruption risk assessments and internal investigations into allegations of corruption. In practice, these are often closely linked: whistleblower complaints can (and often should) lead a company to conduct a thorough, risk-based review of its ABC policies; and likewise, ABC compliance reviews can often uncover red flags to be investigated.

Given that both activities can uncover issues that are potentially problematic for a business, they should be conducted in a way that preserves legal privilege as far as possible so as to protect certain information, advice and decisions from external scrutiny. In many cases, litigation privilege will not be available because no external regulator or prosecutor has taken an interest in the matter, and even if they have, the situation may not have become sufficiently adversarial or confrontational for litigation privilege to be engaged. In these cases, the business will need to rely on legal advice privilege (LAP), which (broadly speaking) applies to confidential communications between a lawyer and their client which are made for the purpose of giving or receiving legal advice (or documents evidencing the content of such communications). LAP has some important limitations, but it can still be effective when deployed carefully.

LAP applies to communications between the client and lawyer, but when the client is a business, this does not mean that any employee can have privileged communications with the lawyer. Instead privilege will be limited to those officers or employees who are authorised to give instructions to, or to seek or receive advice from, the lawyers; the “client”. Generally, a smaller client will help to ensure that privilege is controlled more effectively, but this needs to be weighed against the practicalities of instructing the external lawyers on a daily basis. Within the client, the same people need not be responsible for both instructing and receiving advice from the external lawyers – but who is authorised for what should be made clear.

The membership of the “client” should be recorded in writing so that everyone involved knows the position. This will usually be included in an investigation plan, but as this is likely to be privileged it should also be included in a non-privileged document, perhaps by way of a notification to (relevant) employees explaining the remit of the investigation and people involved, which can be disclosed as evidence of who the client is. Information from the company to the external lawyers should be carefully channelled through the client rather than coming from employees directly, and employees should be made aware of this requirement.

LAP does not apply to any communications between the lawyer or the client and a third party, including (as noted above) employees falling outside the “client”. In practice this could mean the business’s own investigators, whether this is a dedicated investigation team, a compliance officer, Internal Audit or someone else. Even if these individuals carry out investigations under the supervision of lawyers, they might not be part of the “client” and the information which they provide to the lawyers may not be privileged. Businesses should consider carefully how to deploy lawyers strategically alongside investigators to preserve privilege, for example by having lawyers draft interview plans, take interview notes and write up reports (of which see more below). Finally, it is important to remember that in the context of EU competition-related investigations, even communications to and from in-house lawyers do not benefit from privilege, which makes the engagement of external lawyers especially critical.

Businesses often engage a range of external third parties to assist with risk assessments and internal investigations, including accountancy firms, professional investigators and consultants. There is no doubt that these parties can make a distinct and valuable contribution, but their communications with the client will not benefit from LAP. Unfortunately, simply interjecting a lawyer into the relationship – for example, where the lawyer engages the third party and/or the third party reports to the lawyer – will not assist because any communications between the third party and the lawyers still fall outside the lawyer-client relationship. The interaction and division of labour between third parties and lawyers should therefore be structured in a way that preserves privilege as much as possible, along the same lines as for internal investigators. For example, non-lawyers should avoid questions in interviews or language in reports which makes assessments of legal liability, even by choice of vocabulary, for example describing un-receipted cash payments as “bribes”.

Documents subject to LAP should be marked as “privileged and confidential” (not essential for the purposes of LAP but helpful nonetheless) and circulation – especially of any legal advice – should be limited to those who need to know. The decision to share any privileged information with third parties, whether another employee of the same company or an external adviser should only be undertaken with prior advice from external lawyers. If sharing is deemed necessary, the recipient should sign a confidentiality agreement first (or should otherwise be under a duty of confidentiality). Even then, the privileged material would ideally be shared orally at a meeting, without being documented. If notes of the meeting are required, they should be labelled “privileged and confidential”. Finally, businesses should be alive to situations where additional privileged material might be generated inadvertently and implement appropriate controls, for example: preparation of agenda for meetings with lawyers; or notes generated from a discussion of privileged advice at a meeting.

LAP will apply to any communication created for the purpose of seeking or giving legal advice and other material which evidences the substance of such communication. For that reason it will not apply to any communications which pre-exist the lawyer’s retainer, even if they are provided to the lawyer for the purpose of obtaining legal advice. It is not possible to “cloak” a document in privilege just by sending it to a lawyer and, along the same lines, it should not be thought that emails or letters can be made privileged just by copying in a lawyer.

Once created, where are privileged documents stored and how are they secured? This is an issue particularly for in-house lawyers. For physical documents, a few simple precautions can help to identify privileged material and protect it from prying eyes. Files or folders containing privileged material can be marked appropriately and kept in secure storage such as locked cabinets. In the most sensitive cases, it may be appropriate to create numbered copies of privileged materials and a register which records who is in possession of each copy.

In the case of electronic documents, privileged materials should not be stored in server locations where they may be accessed by anyone outside the “client”, such as network drives or shared data environments (depending on access rights). If privileged documents are transmitted electronically, then depending on sensitivity it might be appropriate to send them as passworded attachments, or make them available in password-protected areas of network drives/shared data environments. Finally, access for employees such as administrators or internal IT staff, who have administrator rights which allow them to access documents on the network should be restricted and monitored.

If a company is engaged in an internal investigation into specific allegations, it should have lawyers (internal or external) present at interviews and to take notes and/or draw up an attendance note. There is some uncertainty over whether and to what extent the notes of an interview can attract LAP because such notes reflect the content of a communication which is not privileged, i.e. between a lawyer and a “third party” employee. The received wisdom is that LAP is more likely to apply if the notes contain some form of legal input from the lawyer – for example, a focus on key issues, personal impressions and observations or legal analysis. If the note is a merely a verbatim note, LAP is less likely to apply. For the same reason, interviews should not be tape recorded. In any event, if the intention is that the interview note will be shared with the employee to agree and sign off as a witness statement, the signed version will probably not be privileged, although lawyer’s original notes and drafts of the witness statement might be.

If a business is carrying out a corruption risk assessment rather than investigating specific allegations, it is reasonable to adopt a more risk-based approach to having lawyers present at interviews. Lawyers need only be present where sensitive issues are expected to arise, and those conducting interviews should be instructed to stop an interview if a sensitive issue is revealed unexpectedly, so that lawyers might be instructed and can advise appropriately.

Businesses often conduct multi-jurisdictional internal investigations, and often with the assistance of local counsel in addition to the primary investigating lawyers. As far as English legal proceedings are concerned, as a general rule the English rules of privilege will determine which documents should be treated as privileged. This means that, in theory, a document which is not privileged in its country of origin could be held to be privileged in England (or vice versa). It is also well established that LAP will apply to advice received from foreign lawyers, provided they are admitted to practice in their country. However, prosecutors or regulators outside of the UK may take an interest in the matters under investigation. Businesses should seek advice from local counsel on how privilege is determined in those jurisdictions so that this advice can be factored into the overall privilege strategy.

One key aspect of any internal investigation or compliance review, and one which regulators and prosecutors are likely to take a particular interest in, are any written reports to the client. In practice, companies often instruct a variety of other parties, including internal audit or compliance personnel, external accountancy firms or professional investigators, to investigate an issue and report on it without involving lawyers, with the result that any written product is highly unlikely to be privileged. This is not to say that these parties cannot make a valuable contribution, but lawyers should take a lead in preparing any written product. Lawyers themselves should consider the need to preserve privilege, but also be prepared to advise on any waiver of privilege, particularly where a regulator is pressing for such a waiver.

Finally, lawyers should consider who the intended audience of any report is. In particular, if the audience is the Board, it may be that not all members of the Board fall within the “client”, and if any do not, they should only receive privileged materials on conditions of confidentiality. If a summary of a report is prepared for the Board, for example by in-house counsel, there is a risk that it will not be privileged if it amounts to commercial or administrative commentary on the report, as opposed to legal advice.

Despite its limitations, a strategy to apply LAP can be deployed effectively to protect a wide range of material. To do so, however, requires advanced planning and regular review of the position. This is particularly true where external lawyers have not yet been engaged. Internal lawyers need to think through the possible privilege issues around risk assessments and other forms of compliance review. In the case of internal investigations, the period before external lawyers are engaged can be particularly risky from the point of view of privilege, where the internal “client” may not yet have crystallised and/or non-legal internal reports or sensitive employee emails are being circulated. Norton Rose Fulbright has extensive experience in this area and can assist your business to design, implement, monitor and review practical procedures to conduct compliance reviews and internal investigations in a way that helps to keep your privilege safe.