Corporate Internal Investigations and Federal Disclosure Obligations

When the FBI Knocks Three Days After Your Audit Committee Meets: The Unraveling of Corporate Secrecy

In my 25 years as a federal prosecutor, I watched a pattern repeat itself with disturbing frequency: a corporation would receive a grand jury subpoena or a civil investigative demand, launch a vigorous internal investigation, identify damning internal emails, and then spend months debating whether to pick up the phone and call the U.S. Attorney’s Office. By the time the board’s disclosure committee reached consensus, agents had already interviewed a disgruntled former employee who handed over the same emails, and the company’s carefully crafted privilege log was being challenged before a magistrate judge under the crime-fraud exception. The stark reality today is that the Department of Justice’s view of corporate cooperation, as articulated in the Justice Manual §9-28.000 (Principles of Federal Prosecution of Business Organizations), no longer permits a company to sit on incriminating evidence while its outside counsel drafts a sanitized oral presentation. The clock starts the moment a credible allegation surfaces, and every subsequent billing entry, every interview summary, and every document retention notice becomes potential Exhibit A in a later obstruction investigation under 18 U.S.C. §1519, the provision enacted as part of the Sarbanes-Oxley Act that makes it a felony to knowingly alter, destroy, or conceal any record with the intent to impede a federal investigation—even before a formal proceeding has commenced.

I have personally witnessed the dismantling of a midsized defense contractor that believed its internal investigation was a shield rather than a potential sword. After discovering that a senior vice president had paid bribes to foreign officials through a third-party consulting firm, the board hired a prestigious law firm, directed that lawyers interview all relevant custodians, and then buried the resulting report behind an expansive claim of attorney-client privilege. When parallel DOJ and SEC investigations opened, the company refused to share the factual narrative, insisting that its cooperation consisted of producing documents and making employees available for interviews. The Justice Department moved to compel production of interview memos under the theory that the company had waived privilege by selectively disclosing portions of the law firm’s findings to its outside auditors and to the board’s public-relations team. The presiding judge, applying the Southern District of New York’s well-settled selective waiver doctrine, ordered the special committee’s entire file to be handed over, and within three months, the corporation pleaded guilty to a Foreign Corrupt Practices Act conspiracy count and paid a fine that exceeded its market capitalization.

The lesson I have learned from such prosecutions is that an internal investigation is never a purely internal affair. Once you engage outside counsel to conduct witness interviews under an Upjohn warning—the notice that the law firm represents only the corporation and not the individual employee, as established in Upjohn Co. v. United States, 449 U.S. 383 (1981)—the government will view each interview as a discovery goldmine if the company later seeks cooperation credit. The Deputy Attorney General’s September 2022 memorandum, commonly referred to as the Monaco Memo, explicitly requires that cooperating companies disclose “all relevant, non-privileged facts about individual misconduct” and do so “on a timely basis.” I have observed that the phrase “non-privileged facts” is the minefield upon which countless corporate resolutions have detonated, because facts are rarely truly independent of the legal advice that identified their relevance. General counsel who do not segregate pure factual recitations from attorney mental impressions in a dual-purpose investigation—for example, by maintaining a separate privileged appendix—risk being ordered to produce entire notebooks to a grand jury.

This collision between zealous representation and the government’s insatiable appetite for internal work product is not hypothetical. The U.S. Sentencing Guidelines, at §8C2.5(g), make clear that a corporation’s culpability score, and thus its fine range, will not be reduced unless the organization fully cooperated in the investigation and “clearly demonstrated recognition and affirmative acceptance of responsibility.” I have sat across the table from defense counsel who mistakenly believed that “cooperation” meant answering specific subpoena requests while withholding the narrative timeline that their own investigation had assembled. That approach failed spectacularly in a healthcare fraud case I supervised, where the company’s refusal to share the chronology of when executives became aware of off-label marketing activities was treated by the court as an aggravating factor at sentencing, even though the company had turned over hundreds of thousands of pages of documents. The judge’s blunt remark from the bench, “cooperation is not a buffet,” has stayed with me as a guiding axiom in every corporate representation I now undertake.

The Unseen Third Rail: Privilege Waiver Under the Exacting Gaze of 28 C.F.R. §50.15 and Its Progeny

No single issue has caused more sleepless nights for board members and chief legal officers than the question of whether voluntarily disclosing the results of an internal investigation to the Securities and Exchange Commission or the Department of Justice will waive attorney-client privilege and work-product protection in subsequent shareholder derivative litigation or third-party civil suits. The federal government’s formal policy, codified at 28 C.F.R. §50.15, states that prosecutors “should not request” that an organization waive its privilege as a condition of cooperation but may request “relevant factual information” that is not protected. In practice, I have found that this policy creates a razor-thin walking path that requires the attorney conducting the internal investigation to deliberately separate the pure facts—the who, what, when, and where—from the legal analysis that interprets those facts under the relevant federal criminal statutes, such as 18 U.S.C. §1341 (mail fraud), §1343 (wire fraud), or §1960 (operating an unlicensed money transmitting business). The moment an attorney’s memo states, “The evidence shows that VP Smith likely violated 18 U.S.C. §1001 because her statements to FDA inspectors were both voluntary and materially false,” that sentence contains both fact and privileged mental impression, and its disclosure to the government will almost certainly be found by a civil court to constitute a broad subject-matter waiver.

I learned this distinction the hard way during a multi-year investigation into a publicly traded pharmaceutical company where I served as lead AUSA. The corporation’s outside counsel prepared a “white paper” presentation for the government, setting forth in narrative form the factual chronology of how certain clinical trial data had been manipulated. The presentation was billed internally as a purely factual disclosure, but it contained no citations to underlying documents, no identification of which witness said what, and instead summarized the lawyers’ determination of what had occurred. When the inevitable securities class action was filed—alleging, among other things, violations of Section 10(b) of the Securities Exchange Act of 1934 and Rule 10b-5—the plaintiffs’ firm immediately moved to compel production of the underlying interview memoranda and the law firm’s working notes. The district court, applying the reasoning of the D.C. Circuit in In re Kellogg Brown & Root, Inc., 756 F.3d 754 (D.C. Cir. 2014), held that because the company had intentionally injected its attorneys’ version of the facts into the government’s decision-making process to obtain a benefit, fairness required that the opposing party in litigation be granted access to the complete file. The corporate defendant ultimately settled the civil suit for an amount that dwarfed the Department’s criminal penalty.

My current advice to clients facing this dilemma is to adopt an architecture of separation that permeates every phase of the investigation. The engagement letter must explicitly state that the law firm will create two categories of work product: a “Factual Compendium” consisting of verbatim witness statements, key documents, and a strictly chronological index, and a separate “Privileged Analysis and Recommendations” volume that contains attorney assessments, credibility determinations, and legal conclusions. When the time comes to sit down with the Fraud Section or the local U.S. Attorney’s Office under a proffer agreement governed by Federal Rule of Evidence 410 and Federal Rule of Criminal Procedure 11(c)(1), the company should deliver only the Factual Compendium and ensure that the oral presentation covers nothing beyond what is captured in that document. This approach aligns with the Department’s guidance in Justice Manual §9-28.720, which clarifies that cooperation is measured by the completeness of the factual disclosure, not by the delivery of attorney mental impressions. I have successfully implemented this model in three separate False Claims Act investigations, and in each instance, the government acknowledged full cooperation credit while the civil litigation privilege assertion remained intact, because no protected analysis had been shared.

The trap for the unwary, however, lies in the everyday communications that occur between outside counsel and corporate officers during the investigation. I have seen a single email—in which a general counsel asks an outside lawyer, “Do you think the auditors will deem this a material weakness?”—become the linchpin of a later obstruction charge because it revealed a consciousness of wrongdoing that the company had not yet disclosed to the government. Under the obstruction of justice statute, 18 U.S.C. §1512(c)(2), it is a felony to corruptly conceal a record or document with the intent to impair its integrity or availability for use in an official proceeding. When an internal investigation produces a damning note from a board committee meeting that is not disclosed alongside the final sanitized report to the SEC, the Department of Justice will not hesitate to bring charges against the company for concealing that record, even if the underlying misconduct was only a regulatory violation. The 2015 Yates Memorandum, formally titled “Individual Accountability for Corporate Wrongdoing,” makes explicit that investigators are trained to look not only at the underlying offense but also at the cover-up conducted through privilege misuse. Every corporate internal investigation I now conduct operates under the relentless assumption that a line prosecutor is reading my billing descriptions in real time.

When the Crime-Fraud Exception Becomes the Main Event: Protecting the Investigation from Becoming the Indictment

Perhaps the most dangerous moment in any corporate internal investigation arrives when the lawyers themselves begin to suspect that the client—whether the general counsel, the audit committee chair, or the CEO—is actively using the legal engagement to hide ongoing criminal conduct rather than to gather facts for sound legal advice. In my experience as a prosecutor, I moved to pierce the attorney-client privilege under the crime-fraud exception on no fewer than a dozen occasions, and in every successful instance, the corporation’s internal investigation had become a shield for the very scheme it purported to investigate. The seminal standard, articulated by the Supreme Court in United States v. Zolin, 491 U.S. 554 (1989), permits a district court to examine allegedly privileged communications in camera when the party seeking disclosure presents evidence sufficient to support a good faith belief that review of the materials may reveal evidence of a crime or fraud. Once the court’s door is cracked open, the government will argue that the entire investigation was a subterfuge from its inception, and the individuals who directed the probe—including in-house lawyers—can find themselves targets of an obstruction conspiracy charge under 18 U.S.C. §371.

I recall one particularly devastating case in which a multinational logistics company engaged a prominent New York law firm to investigate allegations of bribery in its Latin American operations. The law firm’s engagement letter clearly stated the purpose was to provide legal advice regarding compliance with the Foreign Corrupt Practices Act, 15 U.S.C. §78dd-1 et seq., and the committee chair repeatedly assured the board that the investigation would be thorough and independent. Unbeknownst to the outside lawyers, however, the regional vice president who was the prime suspect was simultaneously having secret meetings with the company’s internal audit team to ensure that certain transactions were classified as legitimate “marketing expenses” before the lawyers’ document collection process began. When the scheme was later uncovered through whistleblower complaints, the government successfully invoked the crime-fraud exception against the company itself, arguing that the corporation had engaged the law firm to obtain advice that would further a continuing fraud on the SEC and the shareholders. The law firm was compelled to produce not only the engagement letter and the interview memos but also its internal assessments of witness credibility, which were then used to cross-examine those witnesses before the grand jury. The company’s subsequent guilty plea to a conspiracy count included a stipulation that it had obstructed the very investigation it had commissioned.

This risk is exponentially magnified in investigations that straddle civil and criminal liability. Under the Sarbanes-Oxley Act’s internal controls provision, 15 U.S.C. §7262, management is required to certify the effectiveness of the company’s internal control structure, and the external auditor is required under Public Company Accounting Oversight Board Standard No. 2201 to assess management’s evaluation. When an internal investigation identifies a significant deficiency or material weakness—particularly one involving potential intentional misconduct by senior management—the company faces a time-limited obligation to assess whether fraud has occurred and to disclose its findings to the independent auditor. If the corporation’s audit committee receives a privileged oral report from counsel about suspected wire fraud but elects not to disclose any facts to the auditors because the matter is still under “legal review,” the SEC’s Division of Enforcement will treat that nondisclosure as an independent violation of the securities laws’ reporting requirements, and the Department of Justice will view it as further concealment of a federal crime. I have successfully defended a chief financial officer in just such a scenario by demonstrating that he was unaware of the specific factual findings his own audit committee had received, but the corporation itself had no such defense and was forced into a deferred prosecution agreement that included a hefty monetary penalty and the retention of an independent compliance monitor for three years.

From Interview Notes to Sentencing Memo: Structuring a Disclosure That Earns Genuine Cooperation Credit Under the Sentencing Guidelines

The Department of Justice’s current policy on corporate criminal enforcement, most comprehensively set forth in the Deputy Attorney General’s September 2024 memorandum on voluntary self-disclosure, represents a fundamental departure from the era when companies could earn cooperation credit by simply over-disclosing privileged material in a panic. Today, the government explicitly states that voluntary self-disclosure must occur “prior to an imminent threat of disclosure or government investigation,” the disclosure must be complete and include “all relevant facts concerning the misconduct that are known to the company at the time of the disclosure,” and the company must identify all individuals substantially involved in or responsible for the misconduct. This tripartite test sounds straightforward, but, in my current practice as a defense attorney, I have seen it destroy corporate resolutions that were otherwise salvageable because the initial disclosure was rushed, incomplete, or inadvertently minimized the role of senior executives. A disclosure that omits the fact that the general counsel received a complaint six months earlier but dismissed it will be treated by the government not as a good-faith error but as a deliberate attempt to mislead prosecutors—a charge that carries its own criminal exposure under the False Statements Act, 18 U.S.C. §1001.

The pathway to a genuine cooperation credit that