Concluding the investigation: Reporting
Focus on investigations: Part 6Effectively concluding an investigation requires appropriate reporting to internal audiences within the organization and in some instances, may also require self-reporting to external entities such as regulators or law enforcement. In Part 6 of Focus on Investigations, we review these steps and the necessary considerations for reporting.
Internal and external reporting
In Part 2 of Focus on Investigations, we discussed the importance of considering internal and external reporting obligations early in the development of the investigation plan. Who receives an investigation report, what the report contains, and how, when, and to whom the report is provided are critical considerations to ensure compliance with legal or policy obligations while also protecting the rights and interests of the organization and its actors.
Presenting the investigation findings and conclusions
The investigation findings and conclusions may contain confidential or privileged information, or the report itself may be subject to certain non-disclosure obligations. It is imperative to identify any limitations on disclosure at the outset prior to presenting investigation findings to various internal or external entities.
Once limits on disclosure are identified, the specific audience or entity receiving the findings and the function of that audience or entity will help inform the contents of the report and mode of reporting. Different reports may be provided for different purposes: for example, a report to the Board of Directors is likely to contain information or conclusions different than that which may be provided to an investigated employee, an auditor, or a regulator. Some reports may need to address potential future remediation measures, while other versions may focus only on whether the facts reveal misconduct. In many investigations, more than one report is necessary in order to provide reporting specific to the focus or function of the recipient. There is no “one size fits all” report.
The form of the report given to each entity should also be considered in advance. A written report has the benefit of providing clear documentation of the investigative process, findings, legal conclusions and remediation options for both current and future use. Some reporting entities require written reports and may have standard content that must be included. A written report may aid in defending against future regulatory proceedings or litigation and may assist the Board of Directors in discharging their fiduciary duties and implementing remedial measures. In such instances, it is important to have a well documented written report.
However, a written report elevates the risk of potential disclosures (intentional or inadvertent). Further, a written report that describes criminal or improper conduct may become the subject of a future disclosure request by law enforcement, regulators, prosecutors, opposing counsel, counterparties or legislators (as was recently the case in the Hockey Canada inquiry). As a result of these risks, pre-emptive implementation of procedures directed at preserving confidentiality and maintaining a strong claim of privilege over the report to the extent possible is essential, which was discussed in greater detail in Part 3 of Focus on Investigations.
Where a report is not required by law or policy to be in writing, verbal or hybrid reporting of the investigation findings and conclusions may assist in preserving confidentiality. Hybrid reporting, such as a verbal report accompanied by a PowerPoint presentation, allows sensitive, privileged, or confidential aspects of an investigation to be presented verbally, with less sensitive elements committed to writing.
Regardless of the mode and content of reports to internal or external entities, comprehensive documentation of the investigative steps, evidence, and outcomes should be maintained.
Self-reporting
Once an investigation is concluded, the investigation findings may identify potential legal or regulatory non-compliance. Depending upon the nature of the non-compliance, organizations need to consider whether self-reporting of such misconduct is appropriate. In some instances, self-reporting early may limit potential future liability or enable the organization to leverage alternative resolution options, such as a deferred prosecution agreement.
When considering self-reporting, the following non-exhaustive list of factors should be assessed and weighed against competing interests:
- any obligations for, or benefits to, self-reporting within the regulatory regimes;
- self-reporting requirements in other jurisdictions that may apply if the organization is extra-provincial or multi-national;
- the best interests of the organization and its stakeholders, including fiduciary duties owed to each;
- relationships with consumers and contractual parties;
- whether the investigated conduct is likely to result in criminal charges or regulatory proceedings;
- potential reputational damage should the investigation become public;
- whether the subject of the investigation is likely to be disclosed through whistleblowers or by media; and
- whether potential security, code of conduct, or ethical considerations warrant prompt action.
Remediation
Internal policies and procedures
Following an investigation, organizations should proactively review their policies and procedures to identify any areas for improvement in order to prevent similar misconduct in the future. The organization should leverage the investigation findings and conclusions in order to assess how it can improve its practices.
Remedial and disciplinary action
In addition to investigation findings and conclusions, the investigation report should include recommendations for remedial action where warranted. Remedial action may take the form of employment action against culpable employees, or civil or criminal action. In addition to the recommended actions, the report should provide the steps to be taken to execute the remedial action and any necessary risk mitigation strategies. Importantly, remedial action against employees or other culpable entities should only be taken following clear investigative outcomes and recommendations for the same.
Remedial employment action against culpable employees may range from warnings, mandatory training, and suspensions, to relocations, demotions, and even termination. Organizations should ensure ongoing monitoring of the employee not only to guarantee adherence with policies and procedures, but to protect the organization from retaliatory actions and prepare for the possibility of forthcoming litigation. Where an employee is terminated, steps should be taken to ensure the employee understands their on-going duties and obligations to the organization such as the duty of confidentiality.
Remedial action against persons involved may also take the form of a civil claim or criminal complaint to the appropriate law enforcement agency. Similar to considerations surrounding reporting, it is important to weigh various factors to determine the most appropriate course of civil or criminal remedial action and the timing of that action. In particular, if civil litigation is initiated, consideration should be given to the appropriate timing of any criminal complaint. The organization must identify the objective of the planned remedial action to ensure that the approach taken best serves the interests of the organization and its stakeholders.
