A Very Bad Day

Investigations are stressful for everyone, but especially the Chair of the Audit Committee, so consider advance planning.

by Edward Imperatore, Craig Martin, Nicole Serfoss, Christine Wong, and Anissa Chitour

_{FALL 2024 |}_{IN DEPTH}

^{A Very Bad Day}

Investigations are stressful for everyone, but especially the Chair of the Audit Committee, so consider advance planning.

by Edward Imperatore, Craig Martin, Nicole Serfoss, Christine Wong, and Anissa Chitour

You are the Chair of an Audit Committee investigating a seemingly benign accounting issue. And you are having a bad day.

The investigation began a month ago, three weeks after an anonymous complaint to the company’s whistleblower hotline. Today, with the investigation ongoing, you’ve concluded the company will miss its 10-Q filing deadline. When you share the bad news with the Board Chair, he complains that he’s “in the dark” and that the investigation is taking too long.

After trying to reassure him that it’s under control, you receive an all-caps email from the CEO, complaining that lawyers want to image her phone. Why, she asks, must the Audit Committee collect the entire contents of her phone, including pictures of her children? The firm leading the work assures you this is standard, adding that they also need access to emails from your personal account. After you warn that the account holds confidential emails for the multiple boards on which you sit, they promise to “get back to you.”

Distressed, you vent to another committee member in a hyperbolic text. She calls immediately, saying such texts may not be privileged and that she hopes neither of you is ever deposed.

Investigations are often difficult and unpleasant for the Board members asked to lead them. But could this day have been avoided? Or at least made less awful?

Before that stressful day ever comes, you can minimize the pain by preparing for an investigation in the following ways.

Identify Potential Risks: The Audit Committee is the primary way that directors discharge their duty to monitor compliance with financial and disclosure requirements. Well-run committees consider the regulatory environment and challenges peer companies have faced, in addition to their company’s peculiar risk factors.

Understand Attorney-Client Privilege: Every board can benefit from a primer on the scope of attorney-client privilege and how to protect it. Not all communications resulting from, or relating to, an investigation are protected by attorney-client privilege. For example, as noted above, a director’s colorful email or text message venting frustration may not be privileged and could draw scrutiny (or cause embarrassment). Further, the privilege’s protections may be illusory where a company makes disclosures about an investigation to third parties, such as regulators or auditors. Work with counsel to refresh the board on the scope of attorney-client privilege and how it can be preserved should an investigation arise.

Define Procedures for Internal Escalation (and Confirm They Work): In the wake of an allegation of financial or disclosure misconduct, every day is precious. That’s because the clock may be ticking toward a public event, such as a scheduled earnings release or SEC filing deadline. It is critical that the company establish well-defined lines of communication with the board and Audit Committee and ensure that serious financial or disclosure matters are escalated promptly to the Audit Committee’s attention.

Those procedures must be understood within the organization, particularly in functions more likely to receive a complaint, such as whistleblower hotlines. The company must adopt and implement policies to address whistleblower complaints or employee allegations and escalate them promptly.

In the hypothetical, the three-week delay in the complaint reaching the Audit Committee may have cost the company its chance to meet its 10-Q filing deadline. That will almost certainly inject uncertainty into the market and cause otherwise avoidable damage to shareholder value.

Adopt and Explain the Communications Plan: Audit Committees, with the assistance of counsel, are most often called upon to conduct investigations when management itself has been implicated in alleged wrongdoing. Accordingly, the Committee’s ability to discuss the procedures or facts is constrained, lest the Committee jeopardize the investigation’s independence or attorney-client privilege.

Preparing the Board and Audit Committee

This dynamic can be uncomfortable, both for management and for directors not participating in the investigation. The reaction of the Chair in the hypothetical, who feels uninformed and anxious about the pace of the investigation, is understandable. These feelings can be exacerbated when executives and directors learn that third-party constituencies, such as auditors or regulators, are receiving substantive updates. Educating everyone well before an investigation about the anticipated cadence and form of updates can help build a reservoir of trust and understanding.

Adopt Clear Policies for the Collection of Business Information: Many companies have “bring your own device” policies that permit the use of personal devices for work. If an investigation arises, counsel to the Audit Committee may need to image these personal devices to collect information relevant to the investigation. The board should ensure that the company has appropriate policies in place to allow collection of business-related information from personal devices. Set expectations now about a process that, during the stress of an investigation, can feel unnecessarily intrusive.

Directors themselves are not immune to such concerns. Indeed, it is not uncommon for directors to commingle business communications in a personal account or an account maintained by an unrelated business. But this practice poses risks to the confidentiality of information about companies unconnected to the investigation and may cause unrelated privileged or personal communications to be exposed. This is precisely the risk the Audit Committee Chair in our hypothetical faced when the Committee’s lawyers asked for access to his email account.

The board should explore policies and training aimed at segregating company-related information. For example, companies often establish company email addresses for independent directors to use for board matters. Alternatively, companies sometimes encourage independent directors to create a personal email account specifically dedicated to matters of that single board or company.

Consider Government Whistleblower Programs and Self-Reporting: A prompt response to allegations is likewise important to meet the expectations of the U.S. Department of Justice (DOJ) and the Securities and Exchange Commission (the SEC) and maintain the company’s eligibility for voluntary disclosure credit if it self-reports the matter to the government.

In 2024, DOJ amended the Criminal Division’s Corporate Enforcement and Voluntary Self-Disclosure Policy (VSD) to provide that a company that voluntarily self-reports to DOJ within 120 days of receiving a whistleblower report is eligible for a presumption of a declination from DOJ, even if the whistleblower already made a report to DOJ. DOJ also launched its Criminal Division Corporate Whistleblower Awards Pilot Program, which provides a monetary incentive to individuals to report allegations of misconduct to DOJ.

The Pilot Program and amendment to the VSD add a layer of complexity to a company’s sensitive decision of whether to self-report a matter to DOJ. A company must assess the risk that an employee will use the Pilot Program to report conduct to DOJ before the company is able to complete an investigation or otherwise be in a position to report it to DOJ.

Likewise, in recent remarks, the SEC’s Director of Enforcement asserted that the best way to ensure a favorable outcome in a potential SEC investigation is to “self-police” and support a “culture of compliance.” When deciding whether to pursue an enforcement action or grant leniency to a company, the SEC says it evaluates a company’s remediation efforts, timely self-reporting, and cooperation. The company should carefully weigh the benefits and risks of self-reporting.

Conclusion

Even under the best of circumstances, investigations are stressful and pose serious risks. They usually arise unexpectedly, and they can unfold unpredictably. The best way to mitigate the risks faced by our unfortunate Audit Committee Chair is to plan for the investigation now, before it arises. ■

EDWARD A. IMPERATORE is a partner in Morrison Foerster’s Investigations + White Collar Defense practice group.

CRAIG MARTIN serves as co-chair of Morrison Foerster’s Investigations + White Collar Defense and ESG + Sustainability practice groups.

NICOLE SERFOSS is a partner in Morrison Foerster’s Securities Litigation, Securities Enforcement, and Investigations + White Collar Defense Group.

CHRISTINE WONG is Global Co-Chair of Morrison Foerster’s Litigation Department.

ANISSA CHITOUR is an associate in the Litigation Department of Morrison Foerster’s San Francisco office.