Conducting an Internal Investigation After an SEC Subpoena.

First, Here are Some Important Things Companies Must Understand

• Preservation Duties. A subpoena ordinarily makes litigation “reasonably foreseeable.” This triggers a company’s preservation duties.
• Negotiations are Common. Companies can (and often should) negotiate the scope of the subpoena, including date ranges, custodians, and production deadlines.
• Subpoena Challenges are Possible. Companies may also be able to challenge the subpoena (though not always). Under 17 C.F.R. § 203.8, challenges must be served within five days of the subpoena date, or by the designated compliance date (if earlier).

Second, Companies Need to Determine the Status of the SEC’s Inquiry

When dealing with the SEC, it’s important to know what stage of the inquiry you’re at. Here are some key questions that companies’ outside counsel must be able to answer quickly:

• What is a “Matter Under Inquiry”? The term “Matter Under Inquiry” (MUI) is still widely used. The SEC Enforcement Division continues to open MUIs as a preliminary, less formal inquiry that may later be converted into a formal investigation.
• Is an SEC Investigation Public? SEC investigations generally remain non-public unless the Commission ultimately brings charges. However, companies should be aware that this confidentiality is not absolute.
• What Triggers SEC Investigations? SEC investigations can be triggered by whistleblower reports, investor complaints, market surveillance, routine SEC examinations, or referrals from other government bodies (or other authorities).
• How Long Do SEC Investigations Take? These inquiries can be quite protracted, and they can stay open for several years.

Can a Company Challenge or Negotiate an SEC Subpoena?

Yes. A company’s outside counsel should work to narrow the scope of an SEC subpoena, extend the production deadline, and ensure the company can effectively preserve evidence before production. It will also determine whether the company should challenge the subpoena, or a specific demand under the subpoena, on factual or legal grounds (and, if so, what is the likely outcome).

To Answer the Question of How the SEC Is able to Issue a Subpoena, it is Important to Understand What a Formal Order Is.

A formal order is a document executed by the Commission and issued in response to staff requests authorizing the issuance of subpoenas to third parties. In order to issue a subpoena, the SEC must designate staff members to conduct the investigation. If a company has been subpoenaed, it should request access to the relevant formal order from the SEC staff promptly. If it is denied, it may be entitled to access the formal order through the Freedom of Information Act (“FOIA”). Formal orders typically identify the potential violation(s) at issue (including the specific section of the federal securities laws involved), but they usually reveal little about the investigation at hand.

The SEC serves subpoenas to compel the production of documents and to compel individuals to testify under oath. SEC administrative subpoenas are similar to civil subpoenas, but they are different in a few key respects.

SEC Administrative Subpoenas and Federal Rule 45

Federal Rule 45 does not automatically govern the scope and enforcement of SEC administrative subpoenas (and there are important differences between the two). With respect to scope, the Federal Rules and the SEC’s regulations both include broad language, but the scope of civil discovery under the Federal Rules is limited by Rule 26(b)(1) to nonprivileged matter that is relevant to any party’s claim or defense and proportional to the needs of the case, whereas the scope of an SEC investigation is not. With respect to enforcement, the SEC may seek to enforce an administrative subpoena in federal district court, and the grounds for challenging the subpoena’s scope and validity in federal court are essentially the same as under the Federal Rules.

Can a Company Negotiate a Subpoena Production Deadline?

The subpoena may specify a production date; however, SEC staff may be willing to accept rolling productions instead of one complete production on a single date. Staff will generally be willing to negotiate a compliance date in order to afford the company reasonable time to comply. However, even if the SEC staff accepts a request for more time to comply informally, it does not automatically modify the date on the subpoena.

Can a Company Negotiate the Scope of a Subpoena?

Yes. SEC staff will often accept rolling productions in exchange for a shorter initial production deadline, and companies may also be able to negotiate the scope of the subpoena’s demands. Staff will typically be willing to limit the scope of a subpoena if it is “overbroad” in that it requests more information than is necessary to advance the investigation. Staff will also generally be willing to limit the scope of a subpoena if compliance will impose an undue burden.

Who Should Control the Internal Investigation and Its Scope?

Who Should Control the Internal Investigation?

If the company’s senior management could be implicated, independent board oversight is critical. While a board subcommittee can formalize the investigation’s authorization and oversight, the board can also designate an ad hoc committee of independent directors to oversee the investigation as necessary.

In either case, before launching the investigation, the company needs to define the investigation’s scope, reporting lines, authority, and escalation rules. This involves adopting an investigation charter that establishes who is responsible for making decisions about:

• Scope;
• Preservation, collection, and production of records;
• Communications with the SEC;
• Waiver of the attorney-client privilege and the work product doctrine;
• Waiver of immunity or other constitutional protections (for individuals);
• Disclosure;
• Discipline;
• Remediation; and
• Termination of the investigation.

The company should also designate an authorized official for purposes of cooperating with the SEC. While investigating counsel will frequently have a significant role, they should report directly to the board or other disinterested body authorizing the investigation.

What Should be the Internal Investigation’s Scope?

The company’s independent body will be responsible for determining the internal investigation’s scope. When determining the scope of the investigation, the board or other independent body should address any related red flags, and it should not limit the investigation’s scope to the questions asked by the SEC (as the internal investigation may need to uncover additional issues to avoid disclosing them to the SEC in response to the SEC’s own investigation).

As the investigation unfolds, the company will want to keep an eye on the investigation’s scope. Material scope expansions should be documented in the internal investigation’s file and approved through the company’s established reporting lines.

Will the SEC Defer to the Company’s Internal Investigation?

As discussed above, SEC investigations can expand beyond the conduct that originally prompted them, and it is important for companies to mitigate this risk as effectively as possible. In some cases, the SEC Enforcement Division will defer to a company’s internal investigation to avoid duplicating efforts, while the SEC staff will conduct its own inquiry in others. As noted, the SEC has no obligation to defer to the company’s internal investigation.

What Evidence Must the Company Preserve and Document?

What Evidence Must a Company Preserve?

Along with all other documents in its possession, custody, or control, a company will need to preserve:

• Electronic Communications. This includes company-administered and personally-administered email, business and social media messaging, company-administered and personally-administered text messaging, and any other electronic communication.
• Other Data on Personal Devices. This includes data on personal devices that are used for personal and/or business purposes, including company-administered cloud computing platforms, other company-controlled cloud computing platforms (e.g., Box, Dropbox), and any other business application.
• Physical Documents.
• Physical Hard Copy Documentation.
• Work Product Documents. While documents that establish the work product of conducting the internal investigation are not directly responsive to an SEC subpoena, companies should still maintain documentation of their investigations.

Although the SEC can impose civil monetary penalties for failure to comply with its preservation obligations, companies will also need to think about other consequences of failing to preserve evidence, namely, evidence spoliation claims (and subsequent claims for adverse jury instructions, lost-evidence sanctions, or other sanctions).

A legal hold should be issued immediately, and it should suspend all automatic deletion policies regarding information that could be potentially responsive to the subpoena. A company needs to take reasonable steps to ensure compliance as well as suspend all automatic deletion policies regarding documents held in the company’s “possession, custody, or control,” including data in the company’s cloud vendors’ custody.

How Should a Company Collect Evidence?

The internal investigation team should use reasonable measures to collect potentially responsive evidence. To avoid issues with spoliation and authenticate the evidence (i.e., prove the evidentiary record is what the investigator claims it to be), it is important for the company to:

• Collect and preserve the evidence’s metadata.
• Collect and preserve the evidence’s provenance (i.e., the information about where the evidence was located and who accessed it).

A key step in determining how to collect evidence is conducting an in-depth assessment of where potentially relevant information resides. With this in mind, the following will be extremely important:

• Data Maps. Data maps help identify custodians, devices, applications, retention settings, backup protocols, and vendors involved in storing the company’s data.
• Collection Logs. When collecting data, companies should maintain collection logs to record the custodians and sources from which evidence has been collected, the dates and methods of collection, the individual(s) who operated the system, the software(s) used for collection, and the metadata handled.
• Chain-of-Custody Records. When collecting electronic evidence, it is also important to maintain chain-of-custody records that identify and track the evidence’s transfer from the custodian to the investigator, the storage medium on which the evidence is stored, and every subsequent transfer of the evidence to another individual or party.
• Evidence Logs. As identified evidence is identified and processed by the company’s internal investigation team, companies should maintain evidence logs to track and store metadata for every document in the company’s internal investigation file.
• Cross-Border Transfer Analysis. If the company has data stored in foreign countries, the company must assess the applicable foreign privacy and blocking laws to determine whether providing a cross-border production will trigger civil or criminal sanctions.

Todd Spodek is the managing partner of Spodek Law Group, a second generation criminal defense firm that has been practicing since 1976.

How Should Counsel Handle Employee Interviews During an Internal Investigation?

Parallel Civil and Criminal Investigations

In many cases, the SEC and DOJ conduct investigations that are separate in nature and run on separate tracks. However, SEC and DOJ investigations can run parallel to each other, especially in cases where the conduct being investigated is the same. When this is the case, it can put the company and its executives and employees at risk of facing both civil and criminal charges.

When facing parallel SEC and DOJ investigations, companies must ensure that they are prepared to handle both investigations simultaneously, including ensuring that they are prepared to respond to subpoenas from both agencies and that they are preserving, collecting, and producing information for both agencies as well.

What Is an Upjohn Warning?

When launching an internal investigation, it is critical for the company’s outside counsel to clearly identify who they represent and how they handle information. With this in mind, it is critical for counsel to provide what is called an “Upjohn warning” during internal interviews. An Upjohn warning informs employees that:

• The investigating counsel represents the organization, not the individual.
• The organization possesses the attorney-client privilege and the work-product privilege.
• The organization intends to waive these privileges (i.e., use its privilege waiver) as it determines necessary.
• The organization will determine if and when to inform the employee about its decisions to waive these privileges.

Does Company Counsel Represent All Employees?

By default, the company’s outside counsel represents the company as a whole, and not the executives and employees who may be involved in a federal investigation. When conducting internal interviews, counsel must clearly communicate that their representation is for the organization and not the individual, and that employees are encouraged to retain separate legal counsel if they have concerns about potential individual liability.

When Should Individual Employees Retain Separate Legal Counsel?

Individuals should generally retain separate legal counsel in situations where the organization’s and individual’s interests are, or could become, divergent. As noted above, this could be the case during federal investigations, as those investigations can lead to both civil and criminal charges, which may mean that the organization’s and individual’s interests may not align.

SEC Testimony and the Fifth Amendment

When facing compelled testimony from the SEC, individual employees will be entitled to invoke their Fifth Amendment right to remain silent. This will apply regardless of whether the employee’s legal representation is paid for by their company.

However, the Fifth Amendment ordinarily protects individuals from testifying only when the government “interrogates” them. This generally doesn’t apply to questioning conducted by private employers during internal investigations. That said, if the government is involved to the extent that it is effectively “coerced” or “requires” an employer’s questioning of an employee, that scenario may raise Fifth Amendment state-action issues.

Indemnification and Advancement of Defense Expenses

Companies can also protect themselves and their employees by ensuring that employees are properly indemnified and that their defense expenses are covered. With this in mind, the following are key factors companies should keep in mind when determining who is entitled to indemnification and advancement of defense expenses:

• The Type of Entity Involved. The type of legal entity that is involved will affect its authority to indemnify employees. For example, Delaware corporations have a statutory right to indemnify employees for the full amount of the judgments and costs in favor of defending against lawsuits and other legal proceedings under DGCL § 145(i).
• The Specific Actions Taken. Companies’ ability to indemnify will depend on whether the employee’s conduct entitles the individual to indemnification (and how much the company is willing to pay for defense expenses). Under DGCL § 145(e), advancement of defense expenses is subject to certain conditions, such as that (i) the company has a statutory or other obligation to indemnify the employee, (ii) the company is willing to indemnify the employee, and, (iii) the employee provides an undertaking to repay any advanced expenses.

How Can the Company Cooperate Without Waiving the Attorney-Client Privilege and the Work-Product Doctrine?

When Do the Attorney-Client Privilege and Work-Product Doctrine Apply to Internal Investigation Materials?

The attorney-client privilege and work-product doctrine can both play a critical role during internal investigations. When preparing for these investigations, it is critical for companies to make informed decisions about where and when to invoke these protections, and for what purposes.

As a general rule, materials collected during an internal investigation are not privileged simply because a lawyer was involved in the investigative process. With this in mind, companies’ outside counsel must be able to identify and document the attorney-client privilege or work-product protection in each case.

When Does the Attorney-Client Privilege Apply to Confidential Communications?

The attorney-client privilege typically applies to confidential communications with attorneys that are made for the purpose of providing legal (as opposed to business or other types of) advice. While the privilege is a valuable tool during internal investigations, companies’ outside counsel must be able to clearly identify the subject matter of their legal advice in order to avoid unintentionally waiving the privilege.

When Does the Work-Product Doctrine Apply to Internal Investigation Materials?

The work-product doctrine typically applies to materials that are prepared by or for an attorney in anticipation of litigation or in preparation for trial. This protection applies regardless of whether the material was prepared with the advice of the client or was the result of the lawyer’s independent judgment. While the work-product doctrine can provide valuable protection for internal investigation materials, it is critical for companies’ outside counsel to clearly document that the materials were prepared in anticipation of litigation.

Does Voluntary Disclosure to the SEC Waive the Work-Product Doctrine?

Voluntary disclosure to the SEC triggers the work-product doctrine’swaiver in most cases. However, there is some debate in the federal courts about whether a voluntary disclosure that constitutes a selective waiver (i.e., a waiver intended to apply only with respect to the government but not with respect to private litigants) will trigger the work-product doctrine’s waiver against private litigants. While some federal courts recognize selective waivers in limited circumstances, courts in different jurisdictions have different interpretations of the rules.

How Can a Company Effectively Mitigate Waiver Risks?

While avoiding waiver risks altogether is nearly impossible, companies can mitigate these risks with the assistance of experienced outside counsel. Among the most important risk mitigation strategies are:

• Ensuring that all communications are conducted with the privilege in mind (i.e., in anticipation of potential litigation).
• Relying on oral reporting rather than written reporting as appropriate.
• Working closely with the SEC to determine what is necessary for a company to earn “cooperation credit.”

What is the Trade-Off for Providing the Internal Investigation’s Findings to the SEC?

Providing the internal investigation’s findings to the SEC can be the best choice for some companies. In some cases, a company’s findings may support an SEC decision to close its investigation, and it may be in the company’s best interest to cooperate with the SEC without waiver concerns. However, providing the internal investigation’s findings to the SEC also increases a company’s risks. These risks include the risk that the SEC will rely on the internal findings to continue its investigation, the risk that the SEC will ultimately bring charges, and the risk that waiver will trigger a need for disclosure to private litigants.

Does Oral Reporting and Remediation Eliminate the Need for Discovery?

Not necessarily. While oral reporting and prompt remediation of alleged wrongdoing may reduce discovery risks, they may not necessarily eliminate them. In many cases, private litigants (e.g., shareholders) can still seek access to the company’s internal investigation records if their claims involve issues that the SEC investigated.

Can a Company Earn “Cooperation Credit” from the SEC Without Waiving the Attorney-Client Privilege or the Work-Product Protection?

Yes. As explicitly noted in the SEC’s Enforcement Manual, the SEC does not condition receiving cooperation credit upon a company’s waiver of the attorney-client privilege or the work-product protection. However, while waiver is not required, companies may still be obligated to waive these protections as a result of their communications with the SEC.

What Compliance Duties Continue During the Company’s Internal Investigation?

Does the Receipt of an SEC Subpoena Require Disclosure in a Form 8-K?

The receipt of an SEC subpoena is not a “material event” that requires a Form 8-K disclosure. While there are no Form 8-K general items requiring companies to disclose mere receipt of a subpoena, the company’s receipt of a subpoena may also trigger disclosure obligations under other Form 8-K items. For example, Item 103 requires companies to disclose “any pending or contemplated governmental proceedings that are not subject to the exemptions provided in this Item.” Companies’ outside counsel will need to assess their company’s specific circumstances to determine whether this, or any other, disclosure is warranted.

When Are Companies Required to Accrue for Inquiries?

Under ASC 450, companies must accrue a loss if it is probable the loss will occur and the amount of the loss is reasonably estimable. As a general rule, companies’ outside counsel will determine the likelihood and the amount of a loss based on information obtained during the internal investigation. If the company’s obligations are to advance money or otherwise make payments to the government, it must also ensure that it accrues these obligations if it is probable it will need to make these payments.

Will the Company’s Internal Investigation Require the Correction of Materially Inaccurate Prior SEC Filings?

While reviewing the relevant information gathered during an internal investigation, the company’s outside counsel may find that previous SEC filings were materially inaccurate. In this situation, the internal investigation may lead to additional work efforts focused on reissuing SEC filings, conducting a full “re-do” of the internal investigation, and other additional efforts.

If the company determines it must file a corrective SEC filing (e.g., Form 8-K, Form 10-K/A, or Form 10-Q/A), it must also ensure that any corresponding internal controls-related statements in prior filings are corrected as well.

Can the Company Impede the Communication of Individuals to the SEC?

No. In SEC Enforcement Division v. Tally, a federal district court found that impeding a company employee’s direct communication with the SEC constitutes a violation of Exchange Act Rule 21F-17(a), which prohibits companies from “taking any action to prevent any individual from communicating directly with Commission staff.”

What Protections Are Qualified Whistleblowers Entitled to Against Employer Retaliation?

Qualified whistleblowers are entitled to multiple types of protection against retaliation under Exchange Act Section 21F. These include the right to pursue private lawsuits under the Sarbanes-Oxley Act (and whistleblower retaliation protections under Dodd-Frank Act Section 922(h)), and the right to pursue damages against the company in whistleblower retaliation lawsuits.

Can Companies Begin Control Remediation Before the Investigation Findings Are in Hand?

Yes. If the internal investigation’s findings substantiate a material weakness related to internal control over financial reporting, companies can pursue appropriate remediation measures to address the internal control’s identified deficiency before the formal investigation concludes.

Can Companies Self-Report to the SEC in Order to Receive “Cooperation Credit” Before the Internal Investigation Concludes?

Yes. Companies can self-report to the SEC “preliminarily” and then, later, conduct an “enhanced” voluntary disclosure that includes the results of its full internal investigation and the remediation that it has undertaken in response to its internal investigation’s findings. Both preliminary and enhanced voluntary self-reports are subject to a presumption of receiving “cooperation credit” under the SEC’s Cooperation Program.

Speak With a Federal Defense Lawyer

If you are dealing with any part of what this article describes, the next step is a conversation with a lawyer who handles these cases. Spodek Law Group is a second generation criminal defense firm practicing since 1976, representing clients nationwide from offices in New York, Brooklyn, Queens and Los Angeles. Call 212-300-5196 to speak with our team.