Whistleblowing investigations – 10 things to avoid

This article sets out 10 of the most common traps that companies can fall into when investigating whistleblowing allegations.

Introduction

Putting in place an effective whistleblowing mechanism is an important component of good corporate governance and, when underpinned by a strong compliance culture, can act as an early warning system for adverse behaviours or activities and emerging risks.

However, if a whistleblower disclosure is not followed up by a competent and timely investigation, it can cause significant problems further down the line. For example, a poorly executed or delayed investigation may:

• result in a lost opportunity to identify a potential risk earlier than might otherwise be the case, or that regulatory or legal reporting deadlines or obligations are missed.
• mean that employees lose faith in the whistleblowing system if they feel that whistleblower disclosures are not taken seriously or addressed properly. This will invariably result in fewer disclosures being made in future, thus undermining the effectiveness of the company’s corporate governance systems.
• reflect negatively on the brand or reputation of a company and make its senior management and executives look incompetent.

Investigations

Well managed companies recognise the importance of responding promptly to whistleblowing allegations. They promptly triage the information and the issue described in the whistleblowing disclosure and make a timely decision to perform a full investigation. That investigation is performed in line with an up to date investigations policy using experienced resources and engaging third party specialist help where required, including where necessary legal advice and technological knowhow.

Where appropriate, independent investigators are engaged and operate with a predefined mandate from the Board. Regulatory and legal notifications are considered from the outset, so deadlines are not missed. The investigation is subject to strict confidentiality and security protocols, both to protect the anonymity of the whistleblower and the integrity of the investigation. The need for legal privilege is also considered from the start of an investigation, particularly if there is actual or potential litigation risk connected to the matter which is being investigated.

In order to maximise the chances of a successful internal investigation, we set out below 10 common mistakes that we have observed in corporate investigations.

1. Assessment - Failing to properly assess or understand the whistleblower disclosure or to recognise the seriousness of a matter – take advice if necessary and ensure that the response is proportionate to the risks identified.
2. Planning - Failing to properly plan the investigation or to include the right team and set of skills on the investigation team from the outset; especially lawyers, skilled investigators, interviewers and technology specialists. Diving headlong into an internal investigation without proper planning, scoping, resourcing and taking appropriate advice will invariably lead to a poorly executed and ineffective investigation.
3. Privilege - Not considering legal/litigation privilege and omitting to put measures in place to protect it. By the time the investigation reveals that there may be serious litigation risk, it may be too late to protect sensitive information and documents.
4. Preservation - Not issuing an information preservation order to all staff. This action helps to prevent data loss by employees inadvertently deleting data which is relevant to an investigation.
5. Evidence - Failing to ensure that servers are backed up or that they are backed up at appropriate intervals so that the investigator has access to the most up to date evidence and to mitigate the risk of bad actors deleting evidence.
6. Legal advice - Failing to take legal advice from the outset. So many simple mistakes with serious consequences can be avoided by seeking legal advice as soon possible.
7. Conflicts - Tolerating or giving the impression you are tolerating, conflicts of interest, whether real or perceived, or permitting a person who is or may be conflicted from being on the investigation team. Having a person on the legal team who is conflicted also undermines the findings of the investigation or may render it ineffective.
8. Trust - Jeopardizing the anonymity of the whistleblower or failing to protect the employee from retaliation. This can have a material impact on whether employees trust the whistleblower system and can result in a reduction in disclosures.
9. Remediation - Failing to act on the findings and recommendations of the investigation report. Always take remedial actions, communicate them with staff, and learn from the investigation.
10. Notifications - Failing to make, or delaying, mandatory notifications for regulatory purposes. This would include notifications such as:
    1. to a financial services regulator;
    2. for data protection purposes;
    3. for employee relationship management; or
    4. legal notifications to civil or criminal authorities e.g. the financial intelligence unit in AML matters.

Conclusion

If you think that one (or more) of these mistakes may occur in your whistleblowing investigation, or you face investigative challenges generally, please contact any of the authors listed below for a free and confidential discussion about how we can help you.