Internal Investigations

An internal investigation is a structured factual inquiry conducted by outside counsel on behalf of a company, board of directors, audit committee, or special committee in response to allegations of fraud, regulatory violations, financial misconduct, executive wrongdoing, or whistleblower complaints. The investigation typically involves witness interviews under Upjohn warnings, document and communications review, forensic accounting coordination where appropriate, and a written or oral report of findings.

The end product is a factual record and findings the company, the board, or the appointing committee can use to discharge its fiduciary duties, respond to regulators, decide on discipline and remediation, address public disclosure obligations, and position the company in any related litigation or government enforcement matter.

Companies typically retain outside counsel for internal investigations when there is a credible allegation of misconduct that warrants independent factual development. Common triggers include a whistleblower complaint filed internally or with a federal regulator, a Civil Investigative Demand or grand jury subpoena directed at the company, an SEC, CFTC, or OIG inquiry, a qui tam complaint filed under seal under the False Claims Act (31 U.S.C. § 3730), a financial restatement issue, an internal audit finding, a media inquiry into specific conduct, or an indictment or arrest of a company employee.

The board may also direct an investigation when management cannot credibly investigate the conduct, when shareholders make a derivative demand, or when the company faces a Caremark-type oversight claim. See In re Caremark Int’l Inc. Derivative Litig., 698 A.2d 959 (Del. Ch. 1996); Marchand v. Barnhill, 212 A.3d 805 (Del. 2019).

For investigations involving allegations against management or board members, allegations that may result in regulator scrutiny, or allegations that may form the basis for litigation, outside counsel is generally required. Regulators discount the credibility of investigations conducted by individuals who report to the executives whose conduct is at issue. Boards and audit committees discharging their fiduciary duties similarly need independent factual development.

The choice of outside counsel matters. Federal regulators give weight to investigations conducted by counsel who built and tried federal cases of the same type. Scott Armstrong and Drew Bradylyons supervised and tried federal fraud cases at DOJ’s Fraud Section and at EDVA, including healthcare fraud, securities and commodities fraud, cryptocurrency market manipulation, and procurement fraud. The firm conducts internal investigations across those same subject areas.

Under Upjohn Co. v. United States, 449 U.S. 383 (1981), the attorney-client privilege between corporate counsel and corporate employees belongs to the corporation, not to the employee. Before an interview, counsel must give the employee an Upjohn warning making clear that counsel represents the company (not the employee), that the privilege belongs to the company, and that the company may waive the privilege and disclose the employee’s statements to regulators or others.

Failure to give a proper Upjohn warning can lead to disputes about whether the employee was misled about counsel’s role and can taint the underlying interview, as recognized in United States v. Ruehle, 583 F.3d 600 (9th Cir. 2009), and related cases. The firm gives Upjohn warnings at the outset of every interview.

Communications between the company and outside counsel for the purpose of providing legal advice are protected by the attorney-client privilege. Documents prepared by counsel in anticipation of litigation or regulator action are additionally protected by the attorney work-product doctrine. The privilege is held by the company. The company may waive the privilege by disclosing privileged communications or work product to third parties, including regulators.

The firm advises companies on the scope of any disclosure, the form in which findings are presented, and the implications for downstream civil litigation, derivative actions, and parallel regulatory proceedings.

A special committee is a committee of independent directors formed to investigate a specific matter on behalf of the board. Special committees are typically formed when allegations involve members of management or a controlling shareholder, when the company receives a shareholder derivative demand under Federal Rule of Civil Procedure 23.1 or its state-law analogue, when the company faces a derivative action that management cannot impartially evaluate, or when a Special Litigation Committee is formed under Zapata Corp. v. Maldonado, 430 A.2d 779 (Del. 1981), to seek dismissal of a derivative claim.

Special committees retain their own outside counsel, conduct the investigation independent of management, and report directly to the board. Their findings support board decisions on discipline, disclosure, remediation, litigation, and settlement. The firm represents special committees and audit committees in independent investigations.

On March 10, 2026, the Department of Justice announced its first department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP), replacing the patchwork of component-specific policies that previously governed corporate self-disclosure. The unified policy applies to all corporate criminal matters resolved with DOJ (with the exception of criminal antitrust). Under Part I of the CEP, DOJ will decline to file criminal charges if the company (1) makes a qualifying voluntary self-disclosure, (2) fully cooperates with the investigation, (3) timely and appropriately remediates the misconduct, and (4) no aggravating circumstances exist (or aggravating circumstances exist but prosecutors recommend declination after weighing severity against other factors).

A disclosure is “voluntary” if DOJ did not previously know about the misconduct, there was no preexisting obligation to disclose, the report comes before an imminent threat of disclosure or government investigation, and the company reports within a reasonably prompt time. The policy adds a new safe harbor: if a whistleblower reports to both DOJ and the company, the company’s subsequent disclosure still qualifies if made within 120 days of the whistleblower’s report. The firm advises companies on whether a matter qualifies for self-disclosure under the CEP, structures disclosures to satisfy the “full cooperation” standard, and coordinates the remediation that the policy expects.

In most serious matters, no. A law firm that has represented the company on the underlying business or compliance issues has potential conflicts of interest that compromise the credibility of any investigation it conducts. The firm may have provided advice that bears on the conduct at issue. The firm may have interviewed or counseled the executives whose conduct is now in question. The firm may face reputational or financial concerns about findings that implicate work it advised on. Regulators discount investigations conducted by counsel with these entanglements when evaluating cooperation credit and declination under the DOJ Corporate Enforcement Policy.

Boards and audit committees commonly retain investigations counsel different from the company’s general corporate counsel for this reason. Independent investigations counsel can reach uncomfortable conclusions without the financial or relational pressures that affect long-time corporate counsel. The firm conducts internal investigations as independent outside counsel, with no other engagements with the company that could compromise the independence of the work.

Whistleblower complaints may come through internal compliance hotlines, direct reports to management or the board, or external filings with regulators under the Dodd-Frank Act SEC whistleblower program (15 U.S.C. § 78u-6), the Sarbanes-Oxley Act (18 U.S.C. § 1514A), or the False Claims Act anti-retaliation provision (31 U.S.C. § 3730(h)). All of these statutes prohibit retaliation against the employee for raising the concerns.

Employees interviewed during an internal investigation may need separate counsel. Investigations counsel represents the company, not the individual. Under Upjohn, the privilege belongs to the company, which may waive it and disclose the employee’s statements to regulators. Employees who face potential personal exposure (subjects of the investigation, employees who may receive target letters, employees whose conduct is at the center of the matter) typically need their own counsel. The firm identifies these conflicts at the outset and advises the company on which employees should be encouraged to retain separate counsel.

The first 48 hours after an allegation surfaces shape the investigation. The company should preserve documents and electronic data, suspend automatic deletion policies, identify the custodians whose records are likely relevant, and issue a written litigation hold. The company should limit who is told about the allegation to those with a need to know and ensure that any internal discussions occur under counsel direction to preserve the privilege. The company should not interview the accused or any potential witnesses before retaining counsel; informal interviews conducted before the privilege is established can taint the investigation and create discoverable records.

Where the allegation involves potential exposure to DOJ, the SEC, the CFTC, OIG, or other regulators, the company should engage outside investigations counsel within the first 48 hours. Early decisions about scope, document preservation, and the sequencing of witness interviews have downstream consequences for cooperation credit under the March 2026 DOJ Corporate Enforcement Policy, for the credibility of any voluntary disclosure, and for parallel civil litigation. The firm engages immediately on these matters.

An internal investigation runs as long as the underlying facts require. Narrow, well-scoped investigations of a single allegation involving a small number of witnesses can be completed in four to eight weeks. Investigations involving multiple business lines, voluminous documents and communications, foreign jurisdictions, or parallel regulator engagement routinely run several months. Investigations driven by a grand jury subpoena, a Civil Investigative Demand, or a regulator’s document request typically follow the schedule the government sets.

Cost is a function of scope, the volume of documents and ESI to review, the number of witnesses interviewed, the use of forensic accountants and other experts, and the level of regulator engagement. The firm scopes engagements with the board, audit committee, or general counsel before work begins. Because Scott Armstrong and Drew Bradylyons handle the substantive work directly (without associate teams layered on top of senior counsel), the firm completes investigations more efficiently than a comparable large-firm engagement with the same scope.

Federal regulators evaluate internal investigations through the lens of how they would build the case themselves. Counsel who built and supervised federal fraud cases from inside the government bring direct perspective on what regulators look for in a credible investigation: the scope, the rigor of the document review, the structure of witness interviews, the independence from management, and the form of the findings.

Scott Armstrong served as an Assistant Chief at DOJ’s Fraud Section and tried high-profile federal jury trials in fraud and market manipulation cases involving hundreds of millions of dollars in alleged losses. Drew Bradylyons served as Chief of EDVA’s Financial Crimes and Public Corruption Unit. At DOJ, Drew investigated a conspiracy to pay bribes to foreign officials for insurance business that resulted in multiple individual guilty pleas and corporate resolutions with three companies, supervised the investigation of two multinational companies for paying bribes to foreign officials in Africa that resulted in fines and penalties in excess of $500 million, and supervised the investigation of an international bank for tax violations that resulted in over $500 million in penalties and fines. Both partners reviewed company-side internal investigations as senior federal prosecutors in deciding whether to charge, decline, or settle matters.