News & Insights

Client Alert

April 29, 2021

Internal Investigations

Many of our clients are increasingly faced with internal investigations, some with complex compliance or whistleblowing features.  Our April client alert looks at some of the key considerations before embarking upon any investigation.  We also highlight some of the recent developments in case law and legislation in these areas.  Finally, we leave you with a Flowchart for conducting a compliance investigation ending in a disciplinary process and some Golden Rules.


Legal professional privilege is always the first issue to consider in this process.  Does the process need to be open and ‘on the record’ for the purposes of fact gathering for a disciplinary process or are there details which you would rather not share with external authorities, regulators or need to disclose in any subsequent litigation?

If the investigation is carried out by internal audit, HR or even a compliance team, it is only in very limited circumstances where there is ‘litigation privilege’.  This is where the communications are for the dominant or sole purpose of litigation which is in progress or reasonable contemplation.  Litigation privilege is unlikely to cover early stage inquiries or purely internal investigations.

If the investigation is carried out by lawyers – external or internal – it has a better prospect of attracting ‘legal advice privilege’.  Legal advice privilege is there to protect communications between a client and its lawyer that have come into existence for the dominant purposes of giving and receiving legal advice.

Remember always, however that even an interview in a privileged investigation does not transform facts into privileged information.  Privilege in these circumstances can only cover the interview and any follow up.  Witnesses may still be required to speak to a regulator about information they have.

The Upjohn Warning – Investigate or Advise?

It is vital at the outset of any privileged employee interview that the employee is informed of the following:

  • The role of the lawyer and specifically that the lawyer is there to advise the employer and not the employee in any personal capacity.
  • The interview and follow up are confidential and privileged, and the privilege belongs to the employer – not the employee. The employer may choose to waive the privilege including, for example, by disclosing the matters discussed to the authorities or regulators.

Even where external counsel is retained to investigate under legal privilege, it is vital to make it very clear to the employee the nature of the lawyer’s role.  A major bank and its external legal counsel recently ran into criticism at an Employment Tribunal for failing to do just that and then for ‘cherry picking’ extracts of a ‘privileged report’ to share with the employee.  In that case the judge found that the external law firm had been brought in to investigate – not advise –and the report was not privileged.


Employers or their counsel should send document preservation notices to those who might hold relevant electronic or hardcopy records, asking them to keep and not destroy those records until further notice. If there is a risk of tipping off the subject of an investigation, their notice could be delayed or made more general. Other steps should also be taken to preserve documents, for example IT can be asked to place mailbox holds on relevant individuals’ emails, stop routine deletion and keep back-ups.

Documents including mailbox data should be collected, reviewed and analysed. However, the UK has stringent data privacy rules (pursuant to the General Data Protection Regulation or “GDPR”) which dictate whether and how employee data can be collected and reviewed for internal investigations, as well as placing requirements and restrictions around the transfer of data from the UK/Europe to the US. External legal advice should therefore be sought before mailbox data is collected or transferred.

Disciplinary Action to Follow

If an investigation makes factual findings that potential misconduct has occurred, the investigation may lead to disciplinary action being taken against employees.  Remember that the disciplinary process is separate to the investigation and the disciplinary decision maker should not have been involved in the investigation in any capacity.

A disciplinary process is ‘on the record’ and cannot be conducted under privilege.  Careful consideration should therefore be given as to what documentation will be provided to the employee as part of the disciplinary process in order for them to be able to fully respond to the allegations against them.  A privileged report may be able to be withheld from the employee but be mindful of the judge’s comments in the recent case described above about ‘cherry picking’ details to share.

Remember also that the role of the investigator in a disciplinary context is to make factual findings and decide whether there is a disciplinary case to answer.  Investigating managers should not stray into evaluative opinions as to the seriousness of the employee’s conduct.

WhistLeBlowing news

Public Interest Disclosure (Protection) Bill

The UK has a new bill proposing to strengthen whistleblower protection and reform the Public Interest Disclosure Act.  If passed in its current form, the bill would establish an independent body that would set, monitor and enforce standards on how whistleblowing cases are handled.  The proposed ‘Whistleblowing Commission’ would publish standards for employers and regulators who receive protected disclosures, including investigation methods and information to be provided to the whistleblower.  It would also potentially have the power to order redress of detriments suffered by whistleblowers.  The proposed bill also seeks to extend the definition of protected whistleblowers to self-employed contractors, job applicants and shareholders (similarly to the EU Whistleblowing Directive).

The new bill comes off the back of an All-Party Parliamentary Group (APPG) on whistleblowing established in 2018, with the aim of enhancing whistleblower protection.  The APPG produced a report in 2019 that found that the UK whistleblowing framework is complicated, overly legalistic and fragmented.  The APPG issued a ’10-point plan’ on reforming whistleblowing legislation, which included the establishment of an Independent Office for the Whistleblower, the introduction of mandatory internal and external reporting mechanisms, and meaningful penalties for those who fail to meet the requirements. The bill is currently before a select committee.

Employment Appeal Tribunal (EAT) considers ‘public interest requirement’ in whistleblowing detriment case

In other recent news regarding the topic of whistleblowing, the EAT has recently looked at the public interest test and clarified that a worker may be protected as a whistleblower even if the public interest is not the worker’s only – or even primary – motivation.  The UK’s whistleblowing legislation requires the worker to act “in the public interest” in order to be legally protected from retaliation.  An employee or worker acting purely in self-interest will not be protected.  

The alleged whistleblower in this case was a consultant solicitor who had made disclosures about his firm overcharging a client.  One of these disclosures related to his own fees being disproportionately written off, compared to other fee earners.  The solicitor also claimed his consultancy contract had been terminated because of these disclosures.  The Tribunal initially held that the solicitor had not reasonably believed that the disclosure was in the public interest – he believed it to be a private matter relating to the individual client.

On appeal, the EAT held that the tribunal had misapplied the public interest test.  The tribunal had limited its reasoning to considering the numbers in the group whose interests the disclosure served (in this case, just one client) and appeared to have introduced a requirement for a group to be protected.  The EAT held that the disclosures could have enhanced the protection of a wider public interest in the context of solicitors complying with their regulatory obligations.  The EAT also held that even if the solicitor’s primary motivation was personal (relating to his own remuneration rather than concerns regarding the overcharging), the disclosure could still potentially meet the public interest test, if this formed part of his motivation.  The decision highlights that disclosures can still be held in the public interest even if that is not the whistleblower’s predominant motive.

  • Establish clarity of roles – investigator or decision maker? Make sure those involved ‘stay in their lanes’.
  • Early coordination between legal, HR, audit and compliance teams is crucial.
  • If it is a whistleblowing complaint and the identity of the complainant is known, throw a ‘protective ring’ around the complainant to avoid any retribution or detrimental treatment.
  • Do not make any guarantees of confidentiality. Whilst the process is confidential, if there is subsequent litigation or a regulatory investigation, anonymity cannot be guaranteed.
  • Is there an obligation to brief an external regulator? If it is a serious allegation against a senior employee in a regulated function the FCA/PRA may expect to be briefed verbally even before an investigation has concluded.
  • If the complaint being investigated could also amount to a grievance, ensure that the employee has all of the protections of your grievance policy. We have seen complaints raised via a hot line under a Global Code of Conduct.  The complaint then gets dealt with centrally by committee without any opportunity for the complainant to be heard or given any right of appeal.  Ensure that your Code of Conduct (and all other policies under which investigations are carried out) respects the rights and protection under English law afforded to all of those employees involved, including the complainant, any witnesses and the subject of any disciplinary action.
  • Contemporaneous notes are essential but brief all of those involved about the importance of document production, privilege and data security.