How To Conduct an Internal Investigation

How To Conduct an Internal Investigation

Your company just received a complaint alleging sexual harassment by a department supervisor, or maybe internal audit flagged suspicious expense reports suggesting embezzlement, or perhaps a whistleblower reported potential securities fraud to the board. You’re the General Counsel or Compliance Officer tasked with conducting internal investigation, but you’ve never led one before – or the last one you conducted resulted in employee lawsuit claiming investigation was biased, incomplete, or used as pretext for retaliation. Here’s what you need to understand immediately: proactive internal investigations in 2025 are essential for mitigating risks and maintaining compliance, but DOJ consistently takes the position that companies have affirmative duty to respond to potential wrongdoing through effective investigation process. Failure to investigate adequately when regulators later scrutinize the same conduct can result in criminal prosecution of the company, civil fines, shareholder lawsuits claiming board breached fiduciary duties by ignoring red flags, and regulatory sanctions arguing your compliance program was ineffective because it didn’t detect or address violations.

Thanks for visiting Spodek Law Group – a second generation law firm managed by Todd Spodek, with over 40 years of combined experience conducting internal investigations for companies facing federal scrutiny. When prosecutors evaluate corporate compliance programs, they examine whether companies actually investigate misconduct when it’s reported or detected. We’ve defended companies where properly conducted internal investigations demonstrated effective compliance and secured cooperation credit from DOJ. We’ve also seen companies destroyed by poorly conducted investigations that violated employee rights, failed to preserve privilege, missed critical evidence, and later became plaintiffs’ exhibits proving company knew about violations but failed to address them. This article explains how to conduct internal investigation using best practices while avoiding common pitfalls, what steps to take in first 48 hours versus first two weeks versus completion, and why investigation process you establish now determines whether DOJ will credit your compliance program when violations surface.

First 48 Hours: Critical Decisions That Can’t Be Reversed

Hour One: allegation received. First mistake companies make is ignoring or delaying complaints. As soon as complaint is received – whether through hotline, supervisor report, whistleblower submission to board, or regulatory inquiry – immediate action is required. Delay creates three problems: evidence gets destroyed (emails deleted, documents discarded, witnesses coordinate stories), complainant reasonably concludes company doesn’t take allegations seriously (creating retaliation claim foundation), and prosecutors later argue delay demonstrates management’s deliberate indifference rather than good-faith compliance.

Within 24 hours: preliminary assessment. Is complaint credible on its face? Does it allege conduct that, if true, violates law, regulation, or company policy? Is immediate action needed to prevent ongoing harm or evidence destruction? This preliminary assessment determines investigation scope and urgency, but it’s not investigation itself – you’re assessing whether formal investigation is warranted, not determining whether allegations are true.

Decision One: Who investigates? Three options. Internal legal team leads investigation, invoking attorney-client privilege and work-product protection. Outside counsel conducts investigation, maximizing privilege protection and demonstrating independence. HR or compliance department investigates as business function without privilege protection. This decision is permanent and must be made before investigation begins – you can’t start with HR investigation, discover serious violations, and retroactively claim privilege by bringing in counsel.

Decision Two: Investigation scope. Frame scope in as much detail as possible to set boundaries for what subjects or issues will be investigated. Narrow scope limited to specific allegations against identified individuals? Broader scope examining whether violations are systemic rather than isolated? Scope determines timeline, cost, and what findings you’ll uncover. Constitutional due process principles require that investigations be reasonably scoped – you can’t use harassment complaint as pretext to investigate employee’s entire work history searching for justification to terminate.

Immediate Evidence Preservation

Within 48 hours: implement legal hold. Consider implementing preservation protocols early and strategically to prevent document destruction. IT department suspends auto-delete policies for email and messaging apps, disables routine document destruction schedules, preserves backup tapes. All employees potentially involved receive written legal hold notices instructing them not to delete any potentially relevant documents – emails, messages, files, handwritten notes. Failure to implement hold immediately creates spoliation liability if relevant evidence is destroyed after investigation begins.

Document the hold: who received notices, when they acknowledged, what systems were preserved. If prosecutors later investigate same conduct, legal hold documentation proves you acted responsibly to preserve evidence from investigation’s beginning. Lack of documented hold suggests company didn’t take allegations seriously or deliberately allowed evidence destruction.

Week One: Investigation Plan and Team Assembly

Day 3-7: Draft detailed investigation plan. Investigation plan should address: What specific allegations will be investigated? What evidence sources exist (documents, emails, witnesses)? What is investigation timeline and budget? Who will conduct interviews? How will findings be documented and reported? Who receives final report? This written plan becomes roadmap for investigation and demonstrates systematic approach if methodology is later challenged.

Assemble investigation team. If outside counsel is directing investigation, they select team members – associate attorneys for document review, forensic accountants if financial irregularities alleged, industry experts if technical issues involved, HR consultants for employment matters. If internal investigation, General Counsel or Chief Compliance Officer leads, supported by legal, compliance, internal audit personnel. Team composition must avoid conflicts – you can’t have supervisor accused of harassment participate in investigating their own conduct.

Best practice: use more than one investigator for all key activities. Having more than one interviewer in room prevents disputes about what was said during interviews. Having multiple document reviewers reduces risk of missing critical evidence. Having independent oversight ensures bias doesn’t affect findings.

Weeks 2-4: Document Collection and Witness Interviews

Document collection: IT collects electronic data from identified custodians based on investigation scope. Emails, Slack/Teams messages, shared drives, personal devices if used for work communications. Search terms developed to identify relevant communications without collecting everything – overly broad collection creates massive review burden and cost. Poor case intake with incomplete information creates evidence gathering challenges according to 2024 data showing two-thirds of investigators face this problem.

If privilege is asserted, counsel reviews documents before investigators see them. Privilege review identifies attorney-client communications, work product, and materials covered by other privileges. Non-privileged responsive documents provided to investigators. Privileged materials withheld, described on privilege log. This process takes time but is essential if company wants to maintain privilege protection for investigation findings.

Interview Sequencing Strategy

Interview sequence matters strategically. Start with overview witnesses who have general knowledge but limited direct involvement – they provide context without defensiveness. Move to fact witnesses who observed relevant events or have documentary evidence. Interview central figures and potential subjects last, after collecting documents and witness statements revealing what they knew and when. Best practice is interview complainant first, accused employee, witnesses, then complainant again using information revealed in other interviews.

Before each interview: Upjohn warning if privilege is asserted. “I represent the corporation, not you personally. This conversation is protected by company’s attorney-client privilege, which company controls. Company can waive privilege and disclose this conversation to government or adverse parties. You should consider whether you want separate counsel.” Document that warning was given and employee understood. Without documented Upjohn warning, privilege claim for interview likely fails.

Interview best practices: Prepare outline of topics to cover based on documents reviewed and other witness statements. Ask open-ended questions allowing witness to provide narrative rather than yes/no answers. Confront witness with contradictory documents or statements – “This email from you on March 15 says X, but you just testified Y, can you explain?” Take detailed notes or record with consent. Prepare written summary immediately after interview while memory fresh. Have witness review summary for accuracy, though don’t require signature which might make witness reluctant to participate.

Common Mistakes That Destroy Investigations

Conducting poor interviews is common pitfall when inexperienced investigators act combative or unknowledgeable. Interrogating employees as if they’re criminals creates hostility and incomplete information. Professional, neutral questioning elicits better evidence and protects against retaliation claims.

Rushing investigation due to internal pressure to close cases quickly. 2024 ACi White Paper data shows over half of investigators cite pressure for speed as major challenge. Speed over accuracy creates long-term risks – missed evidence, incomplete documentation, overlooked witnesses. When regulators later investigate same conduct, rushed investigation becomes evidence of inadequate compliance rather than effective self-policing.

Inadequate documentation throughout investigation. Under deadline pressure, investigators skip documentation of interview summaries, document review analyses, investigative decisions. Later, when findings are challenged in litigation or regulatory inquiry, investigators can’t reconstruct what they did or why. Constitutional due process requires investigation findings be supported by documented evidence – conclusions without supporting documentation are arbitrary decisions vulnerable to attack.

Bias or predetermined outcomes. Investigation conducted by supervisor who is friends with accused, or by HR manager who has already decided termination is warranted before investigation begins. Impartiality is essential – investigation must follow evidence wherever it leads, not confirm predetermined conclusion. Courts examining whether investigation was adequate focus on whether investigator was neutral, whether both sides were heard, whether evidence was objectively evaluated.

Weeks 4-6: Findings, Recommendations, Closure

Investigation complete: all relevant documents reviewed, all witnesses interviewed, all evidence analyzed. Now prepare findings and recommendations. Investigations should conclude with written report containing description of alleged violations, summary of evidence reviewed and witnesses interviewed, findings regarding whether allegations are substantiated, and recommendations for remediation including discipline, process changes, policy enhancements.

If investigation was privileged: mark report “Attorney-Client Privileged and Confidential – Prepared in Anticipation of Litigation.” Address to General Counsel, Audit Committee, or board as appropriate. Limit distribution to those with need to know. Separate factual chronology can be prepared if company anticipates needing to share facts with regulators without waiving privilege over legal conclusions.

Remediation and discipline: Investigation findings trigger action. If violations occurred: terminate or discipline responsible employees, implement policy changes preventing recurrence, enhance training addressing identified deficiencies, consider whether self-disclosure to regulators is warranted. If allegations unsubstantiated: communicate findings to complainant explaining investigation was thorough and what evidence showed, document investigation file showing good-faith inquiry, monitor for potential retaliation against complainant.

At Spodek Law Group, we’ve conducted internal investigations for companies facing federal enforcement actions, employment litigation, and shareholder derivative suits. The investigation process you establish becomes evidence prosecutors and plaintiffs examine when evaluating whether your compliance program is effective or mere window dressing. Constitutional principles require investigations be fair, thorough, and well-documented. Investigations that fail those standards create more liability than conducting no investigation at all. Contact us at 212-300-5196.