Investigate: Part of Internal Investigations for Control and Compliance Violations (4 of 5)

tag:blogger.com,1999:blog-29863993.post-53852290184200764832008-02-09T15:44:00.000-07:002008-02-09T15:46:26.193-07:00Investigate: Part of Internal Investigations for Control and Compliance Violations (4 of 5)In a recent <a href="http://www.complianceweek.com/index.cfm?fuseaction=article.viewArticle&article_ID=3739">column</a>, I illustrated the key components of a strong internal investigations capability to address compliance and internal control violations. In fact, I've done a number of these 11x17 illustrations and they can all be found on the <a href="http://www.oceg.org/view/illustrations">OCEG</a> site or on the <a href="http://www.complianceweek.com/">Compliance Week</a> site. This is Part 1 of a 5-Part Series: <ol><li><a href="http://grc360.blog.oceg.org/2007/11/investigations.html">Capture</a> </li><li><a href="http://grc360.blog.oceg.org/2007/11/filtering-issues-part-of-internal.html">Filter</a> </li><li><a href="http://grc360.blog.oceg.org/2007/11/internal-investigations-for-control-and.html">Plan & Assign</a> </li><li>Investigate <- THIS POST </li><li>Resolve (future post) </li></ol> Investigate<o:p></o:p> At this point, the right people are in place to conduct the investigation using predefined protocols given the tier to which it was assigned. Regardless of which tier, some common questions must be answered:<o:p></o:p> <ul style="margin-top: 0in;" type="disc"><li class="MsoNormal" style="color: rgb(13, 13, 13); margin-bottom: 0.0001pt; line-height: normal;">What happened / is happening?<o:p></o:p></li><li class="MsoNormal" style="color: rgb(13, 13, 13); margin-bottom: 0.0001pt; line-height: normal;">Who is involved? How many are involved? How senior are they?<o:p></o:p></li><li class="MsoNormal" style="color: rgb(13, 13, 13); margin-bottom: 0.0001pt; line-height: normal;">For how long has this been going on?<o:p></o:p></li><li class="MsoNormal" style="color: rgb(13, 13, 13); margin-bottom: 0.0001pt; line-height: normal;">What was the motive?<o:p></o:p></li><li class="MsoNormal" style="color: rgb(13, 13, 13); margin-bottom: 0.0001pt; line-height: normal;">What other activities are under this person’s purview? What is their span of control?<o:p></o:p></li><li class="MsoNormal" style="color: rgb(13, 13, 13); margin-bottom: 0.0001pt; line-height: normal;">Has anything similar happened with this person in the past? Anything at all?<o:p></o:p></li><li class="MsoNormal" style="color: rgb(13, 13, 13); margin-bottom: 0.0001pt; line-height: normal;">Why did they do it?<o:p></o:p></li><li class="MsoNormal" style="color: rgb(13, 13, 13); margin-bottom: 0.0001pt; line-height: normal;">Was it carelessness? Was it a mistake in judgment?<o:p></o:p></li><li class="MsoNormal" style="color: rgb(13, 13, 13); margin-bottom: 0.0001pt; line-height: normal;">Was it a lack of training or clarity in policy, procedures or controls?<o:p></o:p></li><li class="MsoNormal" style="color: rgb(13, 13, 13); margin-bottom: 0.0001pt; line-height: normal;">Was it pernicious?<o:p></o:p></li><li class="MsoNormal" style="color: rgb(13, 13, 13); margin-bottom: 0.0001pt; line-height: normal;">Were there “perverse incentives” in place that led this person to commit these acts?<o:p></o:p></li><li class="MsoNormal" style="color: rgb(13, 13, 13); margin-bottom: 0.0001pt; line-height: normal;">What else could be affected?<o:p></o:p></li><li class="MsoNormal" style="color: rgb(13, 13, 13); margin-bottom: 0.0001pt; line-height: normal;">How much harm was caused? Who was hurt?<o:p></o:p></li></ul> <o:p> </o:p> To answer these questions, the investigations team should follow predefined protocols for gathering evidence including interviews, surveillance and other methods. Try to conduct all interviews in person so that nonverbal queues can be analyzed. Review all relevant documentation prior to the interview so that you can corroborate what you already believe to be factual as well as to direct questions to fill in gaps. At the beginning of the interview it is important to provide appropriate warnings:<o:p></o:p> <o:p> </o:p> <ul style="margin-top: 0in;" type="disc"><li class="MsoNormal" style="color: rgb(13, 13, 13); margin-bottom: 0.0001pt; line-height: normal;">Upjohn Warning. An employee should be told at the beginning of every interview that the interviewer is representing the company’s interests and not theirs, and that the information being obtained is to provide legal advice to the company. The employee should be told that the interview is covered by attorney-client privilege and that the company, not the employee, may decide to either keep the information confidential and privileged or to waive this privilege in the future. Although there is no ethical obligation to legally advise the employee to obtain an attorney, it is an increasingly common practice to make this suggestion at the beginning of the interview. While, Upjohn is specific to interviews directed by counsel, this protocol is helpful for non-legal interviews as well. In some ways, it is common courtesy to let employees know that the intention behind the questions is to serve the company and not to serve them.<o:p></o:p></li></ul> <o:p> </o:p> <ul style="margin-top: 0in;" type="disc"><li class="MsoNormal" style="color: rgb(13, 13, 13); margin-bottom: 0.0001pt; line-height: normal;">Zar Warning. To the extent that internal investigations are part of, or contemplated to be part of, a government investigation or government disclosure, employees should be informed that information obtained in the interview may be turned over or filed with the government. This is important because any false statements provided as part of an interview that is ultimately filed or disclosed to the government could result in obstruction charges. Some argue that this warning may actually cause more obstruction, or at least less cooperation as discussion about potential felonies can quickly chill a conversation.<o:p></o:p></li></ul> <o:p> </o:p> As the investigation progresses, it will often take twists and turns. An issue may transform into a different or even multiple issues. At one global technology firm, the chief internal investigator found that, “Last year, two allegations about financial misconduct ended up being little more than lovers’ quarrels. While these are still important issues, they were nothing like what was initially reported.” The opposite can happen as well. Sometimes more minor allegations about a single issue may transform into more pervasive misconduct. At any point during the investigation the team may consider changing the tier and thus approach to the investigation. Always think about whether it needs to be escalated and self-reported to regulators.<o:p></o:p> <o:p> </o:p> It is important to not make premature predictions until the investigation has concluded as they provide nothing more than interesting (or more likely uninteresting) gossip. Reserve and report final judgment once the investigation has concluded.<o:p></o:p> <o:p> </o:p> Know When to Stop<o:p></o:p> The art of the investigation is knowing when to stop. Knowing when the issue has been thoroughly investigated. Knowing when there are no credible loose ends. Be aware that outside consultants and counsel, through no perniciousness of their own, have an incentive to pursue every last possibility. However, at some point you have to stop digging. Instead of asking “Is it possible?” begin asking “is it probable?”<o:p></o:p>Scott L. Mitchell, CEO (www.oceg.org)http://www.blogger.com/profile/06182779518123146033noreply@blogger.com