What Happens During a Corporate Investigation

What Happens During a Corporate Investigation

You just received an email from HR: “We need to schedule time for you to meet with outside counsel conducting an internal investigation into accounting practices in your department.” Or maybe you’re the General Counsel who just authorized the investigation, and the board wants to know how long this will take, what it will cost, and whether findings will become public. Here’s what actually happens during the next 60 to 180 days: investigators will collect every email and document from identified custodians, interview employees in sequence from peripherally involved witnesses to central figures, document findings in privileged reports that may or may not remain confidential depending on whether the company later seeks cooperation credit from DOJ, and determine whether violations occurred that require self-disclosure, remediation, or termination of employees. The timeline, cost, and outcome depend entirely on decisions made in the first 48 hours – who leads the investigation, whether attorney-client privilege is invoked, and how broadly the scope is defined.

Thanks for visiting Spodek Law Group – a second generation law firm managed by Todd Spodek, with over 40 years of combined experience representing companies conducting internal investigations and defending employees caught in those investigations. When federal prosecutors investigate corporations, they scrutinize how the company conducted its own internal investigation – whether it was thorough, whether employees were given proper warnings, whether findings were credible. We’ve represented companies whose internal investigations resulted in DOJ declinations, and we’ve represented employees who were interviewed without counsel, made statements that later became evidence in federal prosecutions, and only then learned they had rights they should have asserted from the beginning. This article explains what actually happens during each phase of a corporate investigation, what employees should expect when notified they’ll be interviewed, and why the investigation your company conducts today determines whether DOJ prosecutes tomorrow.

Phase One: The First 72 Hours After Trigger Event

Something triggered the investigation – whistleblower complaint, internal audit finding, suspicious transaction flagged by compliance, media report, or regulatory inquiry. Proactive internal investigations in 2025 are essential for mitigating risks, but most investigations aren’t proactive – they’re reactive responses to allegations that create immediate legal exposure.

Within 72 hours, critical decisions get made. General Counsel or Compliance Officer conducts preliminary assessment: are allegations credible, is this isolated incident or systemic problem, does this trigger mandatory reporting obligations to regulators or board? If preliminary assessment determines formal investigation is warranted, next decision: who investigates? Three options. Internal legal team leads investigation, invoking attorney-client privilege by structuring inquiry as legal advice to corporation. Outside counsel conducts investigation, maximizing privilege protection and demonstrating independence. Compliance or HR department investigates, treating it as business function without privilege protection. This decision is permanent – you can’t change privilege characterization midstream when you discover violations are more serious than initially assessed.

Simultaneously: legal hold gets implemented. Steps must be taken to ensure potentially relevant documents are preserved and not deleted or destroyed. IT suspends auto-delete policies for emails and messaging apps, disables routine document destruction schedules, preserves backup tapes. All employees potentially involved receive legal hold notices instructing them not to delete anything. Failure to implement hold immediately creates spoliation risk – if relevant documents get destroyed after investigation begins, prosecutors argue obstruction even if destruction was accidental.

Investigation Scope Definition

Scope determines everything – how long investigation takes, how much it costs, whether findings will uncover violations requiring self-disclosure. Narrow scope: investigate specific allegations against identified individuals for defined time period. Broader scope: investigate entire department’s practices, review all transactions of certain type, examine whether violations were systemic rather than isolated. Constitutional tension: narrow scope might miss broader misconduct, creating liability for inadequate investigation. Broad scope might uncover violations the company would prefer not to know about, triggering disclosure obligations and remediation costs.

Investigation plan gets documented. Which custodians’ documents will be collected? What search terms will be used? Which employees will be interviewed, in what sequence? What expert analysis is needed – forensic accounting, industry compliance standards, foreign law interpretation? How will findings be documented and to whom will they be reported? The plan creates roadmap that determines whether investigation will be viewed as thorough or inadequate if later scrutinized by DOJ or SEC.

Phase Two: Document Collection and Review (Weeks 2-6)

IT collects electronic data from identified custodians – emails, Slack/Teams messages, SharePoint files, shared drives, mobile devices if investigation involves communications outside normal business systems. Document review is critical component of any investigation, as documents provide historical narrative and often tell much of the story.

If privilege protection is asserted, counsel reviews documents before investigators see them. Privilege review identifies attorney-client communications, work product, and materials covered by other privileges. Documents are categorized: relevant and non-privileged (produced to investigators), relevant and privileged (withheld, described on privilege log), not relevant (excluded from production). This process takes weeks when dealing with large data volumes – reviewing 100,000 emails for privilege and relevance requires teams of attorneys working full-time.

Document analysis reveals patterns. Email chains showing executives discussing questionable practices. Approval chains for transactions that violated policies. Messages showing employees knew conduct was improper. Gaps in documentation suggesting deliberate failure to create written record. Each pattern informs interview strategy – who to interview, what questions to ask, what documents to confront witnesses with during interviews.

Phase Three: Employee Interviews (Weeks 4-12)

Success of internal investigation often hinges on employee interviews, which require careful consideration and preparation. Interview sequence matters. Start with peripheral witnesses who have limited involvement, obtain their version of events, use that information to prepare for interviews of central figures. End with executives or employees most directly involved in alleged misconduct.

Before each interview: Upjohn warning. “I represent the corporation, not you personally. This interview is protected by the company’s attorney-client privilege, which the company controls. The company can waive that privilege and disclose our conversation to government agencies or adverse parties. You should consider whether you want your own counsel present.” Without that warning, employees might believe investigators represent their interests, creating conflicts and potentially destroying privilege protection.

What employees should understand about interview process: You have right to have personal counsel present. Investigators increasingly recognize value of allowing counsel to observe interviews. If allegations are serious – potential criminal violations, conduct that could result in termination or professional sanctions – retain counsel before the interview. Your personal attorney can advise you on Fifth Amendment rights if investigation involves potential criminal conduct, can review documents investigators ask you to produce, and can object to questions that are improper or that might waive privileges.

Interview gets documented. Some investigators audio record with consent. Others take detailed notes. Written summaries get prepared and sometimes provided to witness for review and correction. These interview summaries become evidence if investigation findings are later disclosed to prosecutors or produced in litigation. Statements made during interview can’t be un-said if they later prove damaging.

What NOT to Do During Investigation Interviews

Don’t lie. False statements made during internal investigation can become separate federal charges – obstruction, false statements under Sarbanes-Oxley Section 1519, perjury if statements are later sworn. Prosecutors view internal investigation interviews as first test of witness credibility. Witnesses who lie to internal investigators will be impeached at trial with their earlier false statements.

Don’t destroy documents after receiving interview notice. That’s obstruction. Don’t coordinate stories with other potential witnesses – that’s conspiracy to obstruct. Don’t refuse to cooperate entirely if you’re still employed – that’s insubordination that might justify termination. But you can decline to answer specific questions if asserting Fifth Amendment rights on advice of counsel.

Phase Four: Findings and Recommendations (Weeks 10-16)

Investigators analyze all collected evidence and witness statements, identify what violations occurred (if any), determine who was responsible, assess whether violations were isolated or systemic, and evaluate whether existing compliance controls failed and how they should be enhanced. Findings get documented in privileged report to General Counsel or Audit Committee.

Report addresses: What happened? Who knew about it and when? Why did internal controls fail to prevent or detect it? What remediation is necessary? Should company self-disclose to regulators? Should employees be terminated or disciplined? The report becomes roadmap for next phase – whether company remediates quietly or whether violations require disclosure that triggers government investigation.

Constitutional problem: the investigation report that was created under attorney-client privilege to provide legal advice becomes evidence prosecutors demand when company seeks cooperation credit. DOJ’s policy on corporate enforcement requires companies to disclose all relevant facts including those developed through internal investigation. Producing the report waives privilege. Refusing to produce it eliminates cooperation credit and signals to prosecutors that company is hiding adverse findings.

Phase Five: Remediation and Disclosure Decisions (Weeks 14-18)

If investigation found violations, company must decide: remediate internally without disclosure, or self-disclose to DOJ/SEC within 120-day window to preserve guaranteed declination option under May 2025 Corporate Enforcement Policy? Factors include: severity of violations, likelihood government will discover independently through whistleblowers or other sources, whether violations are ongoing or already remediated, exposure under Sentencing Guidelines if prosecuted.

Remediation includes: terminating or disciplining responsible employees, implementing enhanced compliance controls, conducting additional training, potentially clawing back compensation from executives who benefited from misconduct. Proactive oversight through internal investigations demonstrates corporate governance and reduces prosecution risk – but only if remediation is genuine and prompt.

At Spodek Law Group, we’ve guided companies through every phase of internal investigations – from initial scope definition through final disclosure decisions to DOJ. We’ve also represented employees who received interview notices and needed counsel to protect rights they didn’t know they had. The investigation your company conducts this quarter determines whether federal prosecutors investigate next quarter. And the statements you make during corporate investigation interviews can become evidence in trials years later. Constitutional protections – attorney-client privilege, Fifth Amendment rights, right to counsel – exist precisely because investigations create permanent records that have consequences long after the investigation closes. Contact us at 212-300-5196.