Tips On Preparing For And Conducting Compliance Investigations

Abiding by the Code of Conduct

Alleged violations of the Code of Conduct (Code), policies/procedures, laws and regulations must be acted upon immediately by someone authorized to decide on an appropriate course of action. Carrying out this responsibility will require an initial analysis and evaluation of the allegation to determine: credibility; actionable steps available; the best person to investigate the allegations; and the best person to bear responsibility for overseeing and conducting an internal investigation.

The Compliance Officer (CO), human resources management (HRM), Privacy and Security Officers, legal counsel (LC) and others each may bear responsibility to resolve issues and problems arising from concerns, complaints and allegations.

Accordingly, this blog lists key roles in compliance investigations and specific investigative principles, guidelines and processes. What is provided herein is just the tip of a very big issue.

Conducting effective and successful compliance investigations warrants the consultation of properly trained people to ensure optimum results and avoid costly mistakes. Although the roles described below can be titled in many different ways, the idea is that there needs to be an understood division of responsibility to avoid confusion and serious mistakes.

Key Roles in Compliance Investigation

1. The Predicating and/or Responsible Investigative Authority

   The predicating and/or responsible investigative authority is the designated party or parties authorized to initiate and/or oversee an internal investigation. They evaluate the complaints and allegations to determine whether the information adequately warrants action against named parties or corrective action measures.

2. The Responsible Investigator(s)

   This refers to the individual or individuals charged by the Predicating and/or Responsible Authority to conduct an investigation of a verified complaint or allegations. In many cases this role is given to the Compliance Officer, but frequently HRM, Privacy Officers, Security Officers, or LC may function in this capacity. Once an investigation has been authorized, the Responsible Investigative Authority will establish the scope of the investigation based on several factors including the availability of individuals who may have been involved; the time frame of the possible irregularity; whether the irregularity appears to be an isolated incident or a pattern of improper conduct; whether the irregularity indicates a systemic or procedural deficiency in a unit’s operation; and the time needed for conducting the inquiry. All of this will be included in an Investigative Plan. The Responsible Investigative Authority shall assign a qualified person(s) to carry out the investigation, who is organizationally removed from any of the parties directly involved in the matter being investigated. They will gather all facts and evidence as promptly as possible, including relevant documents, physical evidence and interviews. It is advisable that all the functions that may become involved in an internal investigation under go basic investigative familiarization training. Although this training will not create professional investigators, it will provide guiding principles to avoid some of the more common errors.

3. The Deciding Authority

   The deciding authority is the party who has the authority to act and make findings and recommendations arising from an internal investigation. This role is critical since this party receives the results of the investigation and therefore, needs to be satisfied that all the key steps have been followed and all the relevant evidence has been gathered.

4. Legal Counsel

   Legal counsel may be either an inside or outside attorney acting on behalf of the organization when the matter to be investigated involves potential violations of law or regulation. In most case they will not conduct the investigation but, in cases involving regulatory and legal issues, they play an indispensable role.For allegations of violations of the Code and noncompliance with laws and regulations, the Compliance Office may have the role of being the Predicating and/or Responsible Investigative Authority and the Responsible Investigator. For allegations relating to harassment, discrimination and related issues, HRM will be the Predicating and/or Responsible Investigative Authority and the Responsible Investigator. The Privacy and/or Security Offices will be the Responsible Investigative Authority for allegations related to violations related to “Protected Health Information.” The CFO may be the Predicating Authority for issues involving financial management. Where the allegation is a criminal violation of law or other issues that may create a legal liability, LC must be notified to determine whether to conduct the investigation under the direction of LC or whether there is sufficient evidence to support referral to a duly authorized law enforcement agency.

Investigative Principles, Guidelines And Process

1. Ensure all communications, evidence, and reports are stamped, logged, sequentially numbered upon receipt and properly maintained in the investigation case file.
2. All information gathered during the investigation must be held in confidence, following a “need to know” standard.
3. Every effort must be made to protect the privacy of those contacted during the investigation.
4. Interviews should be conducted in person and privately with one interview at a time. They should follow professional interview principles and techniques.
5. Anyone subject of an investigation should be reminded that they are free to retain independent counsel if they so choose.
6. If someone requests the presence of an attorney, the interview should be conducted only with the presence of Legal Counsel.
7. If the interview subject is suspected of serious misconduct, Legal Counsel should advise the employee of the seriousness of the matter and the organization’s policy to disclose the result of its investigation to the government.
8. A written report must be made for all interviews that cover all key points derived from the contact.
9. Investigations should be completed expeditiously with a report going to the Deciding Authority.
10. The investigation report should include a summary of the individual’s complaint, a chronology of events, the investigator’s findings/conclusions and as appropriate, recommended actions with specific responsibilities assigned to managers to ensure implementation.
11. Before submitting a written report, the Predicating and Responsible Investigative and Deciding Authorities should be verbally briefed on the findings and recommendations for final corrective action in order to confirm completion of the investigative tasks. This will also permit taking additional needed investigative steps if needed.
12. The Investigations Report should be disseminated to the Deciding Authority with no other copies given to other parties unless requested and approved by the Deciding Authority.
13. If potential legal issues exist, the report will be provided to Legal Counsel for appropriate action.
14. If the investigation and report have been requested or directed by Legal Counsel, the report should be marked “Attorney-Client Privilege” or “Attorney Work Product” as requested by the legal counsel and furnished only to them. Under those circumstances, it will be the responsibility of legal counsel to report and advise management about the facts, circumstances and alternative courses of action.
15. The Deciding Authority is responsible for acting upon the findings and determining whether adverse actions should be taken against any parties and what those actions should be. In doing this, as appropriate, Legal Counsel can be consulted.
16. The Deciding Authority should ensure that the complainant (if known) has received general feedback on the results of the investigation, but not the details of the investigation or any specific action decisions relating to any individual. The outcome of this discussion should then be communicated to management.