Conducting an internal investigation means moving through a defined sequence — scope the matter, preserve evidence, interview the right people in the right order, protect privilege at every step, and close with a written report the company can defend. Get the sequence right and the investigation supports whatever action follows. Skip a step and the company risks spoliation sanctions, waived privilege, or a retaliation claim that outgrows the original misconduct.
Scope the Matter Before You Touch Anything
Write the scope down before anyone reviews a document or schedules an interview. That means pinning down the specific allegations, the time period, and the departments or business units involved. A written scope keeps investigators from drifting into unrelated issues and gives the company a defensible record of what it chose to examine and why.
The team usually draws from legal, human resources, and sometimes IT or forensic accounting, depending on the type of misconduct. Every team member should disclose personal or professional relationships with anyone likely to be a witness or a subject. One undisclosed conflict can discredit the entire investigation later. Authorization from a senior executive or the board gives the team clear authority to access company systems, personnel files, and financial records.
Legal counsel should lead or closely supervise the work so the findings fall within attorney-client privilege and the work-product doctrine. In Upjohn Co. v. United States, the Supreme Court held that communications between a company’s employees and its lawyers, made at the direction of management and for the purpose of obtaining legal advice, are privileged.1Legal Information Institute. Upjohn Company v. United States That protection covers interview notes, questionnaire responses, and the analysis built on top of them. Lose it and everything the investigation generates could become discoverable.
When to Hire Outside Counsel
In-house lawyers handle routine matters well. Some situations call for outside counsel anyway. The clearest trigger is when senior management is implicated, because in-house lawyers report to the same executives they would be investigating. Other strong signals: allegations that could lead to criminal prosecution, expected regulatory scrutiny where the government will judge the quality of the investigation, and situations where the company’s own legal department gave advice connected to the conduct under review. An outside firm with no prior relationship to the company carries more credibility with prosecutors, regulators, and auditors precisely because it has no one to protect.
Preserve Evidence Immediately
Evidence preservation begins the moment the company has a reasonable basis to anticipate litigation or a regulatory inquiry. Waiting for a lawsuit is too late. The first practical step is a litigation hold notice to every person who might possess relevant documents, emails, or data.
A litigation hold is a written directive telling employees and data custodians to stop deleting, overwriting, or modifying potentially relevant records.2United States District Court District of Nebraska. Litigation Holds Ten Tips in Ten Minutes The notice identifies the relevant date ranges, the types of records covered, and specific keywords or topics, and it names the individuals whose files are being preserved. Everyone who receives it must confirm they have suspended automatic deletion on email, messaging platforms, and file systems.
Failing to preserve electronic records invites serious consequences. Under Federal Rule of Civil Procedure 37(e), a court that finds a party failed to take reasonable preservation steps and that the lost information cannot be recovered may order measures to cure the resulting prejudice. If the court finds the destruction was intentional, sanctions escalate: the court can instruct the jury to presume the missing information was unfavorable, or dismiss the case entirely.3Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery; Sanctions Courts have also imposed substantial monetary sanctions for spoliation under their inherent authority. An inadequate hold can do more damage than the underlying misconduct.
Once the hold is in place, collect the relevant materials: personnel files, financial records, access logs, email archives, chat and messaging logs. Digital evidence should be exported using forensic imaging tools that copy without altering the originals, with IT coordinating closely with legal so nothing is changed during collection. Every item goes into a master evidence log with a unique identification number, a description of the source, and the date of acquisition. That log is the chain of custody, and a clean chain is what keeps evidence admissible if findings later reach a courtroom.
Accessing Employee Communications and Devices
Investigators routinely need to review emails, chat messages, and files on company-issued devices. On company-owned systems the employer generally has broad access rights. The federal Stored Communications Act prohibits unauthorized access to stored electronic communications but carves out an exception for the entity providing the communication service.4Office of the Law Revision Counsel. United States Code Title 18 Section 2701 When the company runs the email server or provides the devices, it typically qualifies. A clearly written acceptable-use policy telling employees they have no expectation of privacy on company equipment strengthens the position further.
Personal devices are different. Accessing an employee’s personal phone or personal email account without consent raises serious legal risk, even where the employee used that device for work. If relevant evidence sits on a personal device, the safer route is voluntary cooperation or, in litigation, formal discovery.
Conduct Interviews in the Right Order, With the Right Warnings
Interviews are where the investigation lives or dies. Documents tell you what happened. Interviews tell you why, and whether people are being truthful about the documents.
Interview Sequence
Start with background witnesses who can explain the relevant business processes and identify the key players. From there, interview fact witnesses in ascending order of involvement, saving the person most central to the alleged misconduct for last. That sequence lets the team build a complete factual picture before confronting the primary subject. The order isn’t rigid. If there’s a risk other interviewees will tip off the subject, or the subject is about to leave the company, moving that interview earlier makes sense.
The Upjohn Warning
Before every interview, company counsel must deliver an Upjohn warning. This is the single most important procedural step in the interview process, and skipping it can destroy the company’s privilege over the entire investigation. The warning covers:
- Who the lawyer represents: the company, not the individual employee.
- Who owns the privilege: the company alone, which can waive it later without the employee’s consent.
- Confidentiality: the employee should not discuss the substance of the interview with coworkers, because doing so could undermine the privilege.
- Right to personal counsel: the employee may hire their own attorney at their own expense.
- Cooperation expectations: the employee is expected to cooperate, and failure may result in discipline up to termination under company policy.
The employee must acknowledge they understand all of this before the interview starts.1Legal Information Institute. Upjohn Company v. United States Without the warning, an employee can later argue they believed the lawyer was acting on their behalf, which jeopardizes the company’s ability to claim privilege over the conversation. Get the acknowledgment in writing, or at minimum have a second person in the room documenting that it was given.
Public and Union Employees Have Extra Rights
Two categories of employees carry protections that private-sector, non-union workers do not, and investigators need to know when they apply.
Public employees are protected by Garrity v. New Jersey: statements compelled from a government employee under threat of termination cannot be used against that employee in a subsequent criminal prosecution.5Justia. Garrity v. New Jersey, 385 U.S. 493 (1967) If a government agency orders an employee to answer questions or face firing, anything the employee says gains automatic use immunity, and investigators need to provide a Garrity warning explaining the dynamic. If the agency removes the threat of termination and makes the interview voluntary, statements can be used in criminal proceedings, but the employee can then refuse to answer without facing discipline for the refusal alone.
Union-represented employees have Weingarten rights. If an employee reasonably believes an investigative interview could lead to disciplinary action, they can request that a union representative be present, and the employer must honor that request before continuing.6Federal Labor Relations Authority. Part 3 – Investigatory Examinations The representative isn’t there to answer questions for the employee but can consult and help clarify. Proceeding over a request for representation is an unfair labor practice.
Recording the Interview
Federal law allows recording when at least one party consents, so an investigator who is a party to the conversation can legally record under federal law without telling the employee.7Office of the Law Revision Counsel. United States Code Title 18 Section 2511 Roughly a dozen states require all parties to consent, and the penalties for violating those laws can be severe. Check the law of the state where the interview takes place before recording anything.
Many experienced investigators choose not to record even where it’s legal. A recording captures every awkward pause, every poorly worded question, and every moment where the investigator’s tone might read as aggressive on playback. Detailed contemporaneous notes taken by a second investigator in the room are often the better option. Whether recorded or not, notes should capture the substance of what the witness said rather than the investigator’s personal impressions.
Handle the Complainant Carefully
Many investigations begin because someone reported a problem. How the company treats that person during and after the investigation carries real legal exposure.
Publicly traded companies and their subsidiaries cannot fire, demote, suspend, threaten, or otherwise retaliate against an employee who reports conduct the employee reasonably believes violates federal securities or anti-fraud laws. The protection applies whether the report goes to a federal agency, a member of Congress, or an internal supervisor.8Office of the Law Revision Counsel. United States Code Title 18 Section 1514A An employee alleging retaliation must file within 180 days, and a successful claim brings reinstatement, back pay with interest, and litigation costs.
Sarbanes-Oxley also requires the audit committee of every public company to establish procedures for receiving complaints about accounting, internal controls, or auditing matters, including an anonymous submission mechanism.9Public Company Accounting Oversight Board. Sarbanes-Oxley Act of 2002 If the company lacks those procedures, that gap is itself a compliance problem.
Under the Dodd-Frank Act, the SEC operates a whistleblower program that pays awards to individuals whose original information leads to a successful enforcement action with over $1 million in sanctions, and it separately prohibits retaliation against employees who report possible securities law violations.10U.S. Securities and Exchange Commission. Whistleblower Program11U.S. Securities and Exchange Commission. Whistleblower Protections The practical takeaway for investigators: do not take any adverse action against a complainant or witness during or after the investigation without thoroughly documenting a legitimate, non-retaliatory reason. Even the appearance of retaliation can trigger a complaint, and the burden of showing the action was unrelated falls on the company.
Protect Privilege Throughout
Privilege is the shield that keeps the investigation’s internal analysis out of an adversary’s hands, and it’s surprisingly easy to lose. Upjohn supplies the core protection for employee-counsel communications, and the work-product doctrine separately protects documents prepared in anticipation of litigation, including legal analysis and strategy memos. Both evaporate if the company doesn’t handle them carefully.
Common ways privilege gets waived: sharing the investigation report with people outside the legal team who don’t need it, letting witnesses discuss their interviews with coworkers, and circulating draft findings broadly. Keep the distribution list tight. Mark documents as privileged and confidential. When the investigation wraps up, store the file in a way that maintains the privilege designation.
One point that trips up many companies: the Department of Justice’s own guidelines state that waiving attorney-client privilege has never been a prerequisite for cooperation credit. Prosecutors evaluate cooperation based on whether the company disclosed relevant facts, not on whether it turned over privileged communications.12Department of Justice. Principles of Federal Prosecution of Business Organizations – 9-28.000 A company can cooperate fully, share factual findings, and still protect privilege over legal analysis and strategy.
Write the Report and Decide What Comes Next
The report is the final product. It needs to lay out the facts clearly enough that a decision-maker can act, and it needs to be written carefully enough that it doesn’t create unnecessary liability if it’s later disclosed.
The report describes the methodology (who was interviewed, what documents were reviewed, what systems were searched), summarizes the key evidence, and states whether the allegations were substantiated, unsubstantiated, or inconclusive. Legal counsel should review a draft to flag language that oversteps the evidence or memorializes legal conclusions the company doesn’t want on paper. Once complete, the report goes to executive leadership or the board for a decision on next steps.
If misconduct is substantiated, the company acts. Remedial measures range from individual discipline — written warnings, suspension, termination — to systemic changes like revised policies, retraining, or restructured reporting lines. The response should be proportionate to the findings and consistent with how similar conduct has been handled before. Inconsistent discipline is one of the fastest ways to generate a retaliation or discrimination claim from the person disciplined.
The Self-Disclosure Decision
When an investigation uncovers potential criminal conduct, the company faces a strategic decision about self-reporting to the DOJ. Self-disclosure is generally voluntary rather than legally required. The DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy incentivizes companies to come forward by offering potential benefits including the possibility of a declination.13Department of Justice. Criminal Division Corporate Enforcement Companies that receive an internal whistleblower complaint can still qualify for self-disclosure benefits if they report to the DOJ within 120 days of receiving that complaint.
Even outside the self-disclosure framework, DOJ prosecutors weigh cooperation, compliance program quality, remediation, and voluntary reporting when deciding whether to charge a company.12Department of Justice. Principles of Federal Prosecution of Business Organizations – 9-28.000 A thorough, well-documented internal investigation demonstrates several of those factors at once. A sloppy investigation, or none at all, signals the opposite.
Closing Out the File
After the company takes action and notifies the complainant and subject that the investigation is closed, the file needs to be stored securely. No single federal rule dictates how long to keep investigation files. The safest approach is to retain the file for at least the length of the longest statute of limitations that could apply to the underlying conduct, plus a buffer. For some claims that period can stretch to ten years. Files stored under attorney-client privilege should remain clearly marked and kept separate from general business records to avoid an accidental waiver.