CCM Compliance Investigations & Internal Reporting — Questions and Answers
Question 1: When initiating an internal compliance investigation, which action is most critical to take first to preserve attorney-client privilege?
- Retain outside legal counsel to direct the investigation (Correct answer)
- Notify all employees of the pending investigation via company-wide email
- Transfer all relevant documents to the HR department
- Begin interviewing the subject of the investigation immediately
Correct answer: Retain outside legal counsel to direct the investigation
To preserve attorney-client privilege, investigations should be directed by or conducted at the direction of legal counsel. This shields communications and findings from disclosure. Broad notifications or premature interviews without counsel can waive privilege or compromise the investigation.
Question 2: An employee reports a potential FCPA violation through the anonymous hotline. The compliance manager's FIRST step should be to:
- Immediately terminate the employee identified in the report
- Conduct a preliminary assessment to determine whether a full investigation is warranted (Correct answer)
- Self-report the potential violation to the DOJ before any internal review
- Archive the complaint and monitor for additional reports before acting
Correct answer: Conduct a preliminary assessment to determine whether a full investigation is warranted
A preliminary assessment (sometimes called a 'triage') is the appropriate first step. It determines the credibility and scope of the allegation before resource-intensive investigation or premature external disclosure. Immediate termination without investigation is legally risky, and self-reporting before internal review is premature.
Question 3: Which of the following best describes the 'Upjohn warning' in the context of a compliance investigation?
- A Miranda-style notice informing employees that company counsel represents the company, not the individual employee (Correct answer)
- A regulatory requirement to disclose investigation findings to the SEC within 30 days
- A whistleblower protection notice given to employees before they file a complaint
- A data retention hold placed on electronic communications during an investigation
Correct answer: A Miranda-style notice informing employees that company counsel represents the company, not the individual employee
An Upjohn warning (from Upjohn Co. v. United States) notifies employees being interviewed by company counsel that the attorney represents the company's interests, not theirs, and that the company may choose to waive privilege and disclose the conversation. This is a standard practice in internal investigations.
Question 4: During an internal investigation, a compliance manager discovers that a key witness has deleted relevant emails. The most appropriate immediate response is to:
- Close the investigation since evidence has been destroyed
- Issue a litigation hold notice and involve IT to attempt forensic recovery (Correct answer)
- Report the witness to law enforcement for obstruction of justice
- Disclose the deletion to the board of directors before taking any other action
Correct answer: Issue a litigation hold notice and involve IT to attempt forensic recovery
A litigation hold (legal hold) should be issued immediately to prevent further destruction of evidence, and IT forensics should be engaged to attempt recovery of deleted data. Closing the investigation or immediately going to law enforcement are premature. Board notification may follow but is not the immediate first step.
Question 5: A compliance investigation concludes that a mid-level manager engaged in expense fraud totaling $8,000. Which factor most strongly determines whether to self-disclose to regulators?
- The dollar amount of the fraud relative to company revenue
- Whether the conduct was isolated or indicative of a systemic control failure (Correct answer)
- The number of years the manager has been employed at the company
- Whether the manager has previously received compliance training
Correct answer: Whether the conduct was isolated or indicative of a systemic control failure
Regulators are most concerned with systemic issues, not isolated incidents. A single instance of fraud by one employee may not require disclosure, but if the investigation reveals that controls broadly failed or that management condoned the behavior, voluntary disclosure becomes far more relevant. Dollar amount alone is not the primary trigger.
Question 6: Which of the following is the primary purpose of documenting the chain of custody for evidence collected during an internal investigation?
- To satisfy annual audit requirements for document retention
- To demonstrate the evidence was not tampered with and is admissible if the matter becomes litigation (Correct answer)
- To allow employees to review what evidence was collected about them
- To provide a summary of the investigation for the compliance training program
Correct answer: To demonstrate the evidence was not tampered with and is admissible if the matter becomes litigation
Chain of custody documentation establishes that evidence was collected, stored, and handled properly, preserving its integrity and admissibility in legal or regulatory proceedings. Without a clear chain of custody, opposing counsel can challenge whether evidence was altered or fabricated.
CCM Compliance Investigations & Internal Reporting
When initiating an internal compliance investigation, which action is most critical to take first to preserve attorney-client privilege?