Risks and Rewards of Independent Internal Investigations

By David W. Hildebrandt and James J. McGrath IV
Featured in ACC Docket, a publication of the Association of Corporate Counsel
October 2010

Since its inception two decades ago, the corporate compliance and ethics function under the United States Sentencing Guidelines (USSG ) has become a critical component of businesses large and small. Corporate attorneys, whether in-house or outside counsel, must ensure that clients have instituted and staffed the compliance and ethics function in accordance with the USSG and industry protocols. Instituting best practices, however, is not always easy to do with a CEO or other manager whose primary concern is the revenue and profitability of the business function. This is particularly so with respect to convincing him that under certain circumstances the company needs to spend precious dollars to obtain specialized outside counsel to conduct an internal investigation.

Spending company funds on any investigation, and a presumably larger sum on one done by specialized counsel in particular, runs contrary to the instincts of most managers. After all, job one is to ensure that the product is made or the service is provided, and to do so at the healthiest of all possible margins. Necessarily, expenses that affect profitability are viewed with caution and not incurred readily, and there must be either a carrot or a stick that justifies any such outlay. Compliance and ethics, and outsourced internal investigations as a component thereof, have both. Often, the task for corporate counsel is to help management see those inducements. Re-enter the USSG.

The Birth of the USSG
The Sentencing Reform Act of 1984 birthed the USSG, which was amended by the addition of Chapter Eight in 1991 to achieve uniform criminal sentencing of business organizations. (These provisions were again revised in 2004, and are subject to continued revision.)

Chapter Eight applies to all organizations in the United States, and that term is defined as:

“Organization” means “a person other than an individual.” 18 U.S.C. § 18. The term includes corporations, partnerships, associations, joint-stock companies, unions, trusts, pension funds, unincorporated organizations, governments and political subdivisions thereof, and non-profit organizations.¹

The result of this inclusion, whether the CE O knows or approves or not, is that if the business he shepherds is operating in whole or in part in this country, it is covered by the dictates of the USSG.

The over-arching goal of Chapter Eight is to compel companies to police themselves. The incentive to do so is contained within the computation of criminal sentences meted out to organizations that have run afoul of federal law. Uncommon to non-organizational criminal law, the USSG sets forth proactive steps that companies can and should take before statutory or regulatory code violations, so as to avoid harsher penalties after the fact. Adherence to the prescriptions of Chapter Eight allows them to prefabricate their sentencing mitigation, in the event that it is someday needed.

Influencing a Potential Future Sentence
In any federal criminal case where a conviction is obtained, either by plea or verdict, Chapter Two of the USSG provides a scoring system whereby the conviction offense is assigned a Base Offense Level.² This level is set according to the offense’s type and severity, as well as the harm produced. Additional points are either added for aggravating factors or subtracted for mitigating factors, until a final sentencing total is obtained. The final point tally translates into specific incarceration times, fines, and other punitive and remedial measures that are imposed upon the convicted defendant. Chapter Eight renders these computations applicable to organizations, and it is here that effective compliance and ethics efforts, including conducting internal investigations, become so important.

The USSG intentions for Chapter Eight are made clear in its extensive preamble that states:

This chapter is designed so that the sanctions imposed upon organizations and their agents, taken together, will provide just punishment, adequate deterrence, and incentives for organizations to maintain internal mechanisms for preventing, detecting, and reporting criminal conduct.

This chapter reflects the following general principles:

Third, the fine range for any other organization should be based on the seriousness of the offense and the culpability of the organization. The seriousness of the offense generally will be reflected by the greatest of the pecuniary gain, the pecuniary loss, or the amount in a guideline offense level fine table. Culpability generally will be determined by six factors that the sentencing court must consider. The four factors that increase the ultimate punishment of an organization are: (i) the involvement in or tolerance of criminal activity; (ii) the prior history of the organization; (iii) the violation of an order; and (iv) the obstruction of justice. The two factors that mitigate the ultimate punishment of an organization are: (i) the existence of an effective compliance and ethics program; and (ii) selfreporting, cooperation, or acceptance of responsibility.

These guidelines offer incentives to organizations to reduce and ultimately eliminate criminal conduct by providing a structural foundation from which an organization may self-police its own conduct through an effective compliance and ethics program. The prevention and detection of criminal conduct, as facilitated by an effective compliance and ethics program, will assist an organization in encouraging ethical conduct and in complying fully with all applicable laws. (Emphasis added.)³

An effective compliance and ethics program will have a vital mitigating effect on punishment, should an organization be convicted of a criminal offense. And not having one will increase the sentence in no small measure. Under the USSG, organizational ignorance is as near-fatal as an aggravating sentencing factor. It is a big stick.

To avoid organizational ignorance, counsel must include an internal investigation in the compliance and ethics effort. This is explicitly set forth in Chapter Eight, which states, in pertinent part, that:

(j) An individual [is] “willfully ignorant of [an] offense” if the individual did not investigate the possible occurrence of unlawful conduct despite knowledge of circumstances that would lead a reasonable person to investigate whether unlawful conduct had occurred. (Emphasis added.)⁴

Further, the USSG says the government must afford the opportunity to conduct an internal inquiry, as a predicate to making a self-reporting determination:

Subsection (f)(2) contemplates that the organization will be allowed a reasonable period of time to conduct an internal investigation. In addition, no [self-] reporting is required by subsections (f)(2) if the organization reasonably concluded, based on the information then available, that no offense had been committed. (Emphasis added.)⁵

There is no doubt that this chance would not be afforded if it were not critical.

How the Numbers Add Up and Don’t Stop
The foregoing delineates how the USSG warrants internal investigations in the abstract. To see how they work to the benefit of organizations in practice, consider the following simplified example.

An organization owns and operates urgent-care centers throughout a given state or region of the country. It has an office manager at one site that had been stealing petty cash from the co-pay till in the amount of $200 per month for the past five years. Being resourceful, he covered his tracks by adding a few services or supplies to a handful of insurance claim forms every month and, collecting the resulting payments, replenished the petty cash drawer each 30-day cycle. An audit by one of the insurance companies caught the billing discrepancies generated by this scam and resulted in a call to the urgent-care center and subsequently to law enforcement. The urgent-care center, having submitted $12,000 worth of false insurance claims over the past 60 months, now faces significant criminal exposure in this matter.

Under federal law, Health Care Fraud is committed by: [w]hoever knowingly and willfully executes, or attempts to execute, a scheme or artifice:

1. to defraud any health care benefit program; or
2. to obtain by false or fraudulent pretenses, representation or promises, any of the money or property owned by, or under the custody or control of, any health care benefit program, in connection with the delivery of or payment for health care benefits, items, or services, shall be fined under this title or imprisoned not more than 10 years or both.⁶

Punishment for this crime includes incarceration ranging from 90 days to 20 years, and fines ranging from $1,000 to $100,000, depending on the amount of money fraudulently obtained.

Conducting an effective internal investigation will beneficially impact what happens to this company and scoring this example under the USSG yields the following results:

Health Care Fraud is a theft offense and/or an offense involving fraud or deceit. As such it is a Level 6 offense. Because the loss to the insurance companies exceeded $10,000, four points are added to the initial offense score, now making it a Level 10 offense. Assuming that the fraudulent billings went to 10 or more insurance companies, two additional points are added to the total, resulting in a Level 12 offense score. A Level 12 offense translates into possible incarceration for 10-16 months (probably for the CE O or other manager), and a baseline for fine computation of $40,000. But that is not the end of the mathematics.⁷

To arrive at a fine range for use in sentencing, a Culpability Score must next be applied to get the Minimum and Maximum [Fine] Multipliers. To generate the Culpability Score, the organization starts with five points. If it can be said that the CE O or managing partner was willfully ignorant of the ongoing fraud, or condoned it by not taking reactive steps after its discovery (in accordance with an effective compliance and ethics program), another point is added. Assuming that the organization “clearly demonstrated recognition and affirmative acceptance of responsibility for its criminal conduct” (and ultimately pleaded guilty), one point would be deducted. The organization’s Culpability Score would be 5.⁸

A Culpability Score of 5 yields a Minimum [Fine] Multiplier of 1.00 and a Maximum [Fine] Multiplier of 2.00.⁹ These two numbers are multiplied by the fine baseline, resulting in a fine sentencing range between $40,000 and $80,000. Whatever the fine imposed from within that range, restitution in the amount of $12,000, plus interest, would be added to it. At the fine and restitution’s top end, having this unfortunate scenario unfold in the organization’s lap and then failing to conduct an internal investigation would theoretically cost the company more than $92,000. For a business of its size, this is getting hit with a big stick.

What if the Company Had an Effective Compliance and Ethics Program?
Now suppose that the organization had an effective compliance and ethics program that included conducting an inquiry into this matter as soon the office manager’s activities came to its attention. While the Base Offense Level would remain at Level 12 and the Base Fine at $40,000, the Culpability Score would revise downward and with a significant benefit to the organization because an internal investigation had been conducted. Specifically, the organization would not accumulate an additional point for willful ignorance and would subtract three points for having an effective compliance and ethics program. Finally, if it eventually self-reported and accepted responsibility for the criminal conduct (pleaded guilty), two additional points would be deducted.¹⁰

Under this scenario, the practice group’s Culpability Score would be 0, resulting in a Minimum [Fine] Multiplier of 0.05 and a Maximum [Fine] Multiplier of 0.20.¹¹ This would translate into a sentencing fine range between $2,000 and $8,000. Compare that to the earlier top-end number — the company’s tab is in excess of $ 20,000. And this does not even take into account the possibility of the government being satisfied with the organization’s response to this crisis, and deferring or declining prosecution altogether in return for agreed penalties and recompense similar to that computed above. Factor in the real-life certainty of multi-count indictments and their exponential costs, and the result justifies having a hearty compliance and ethics program that includes conducting thorough internal investigations.

In truth, though, the foregoing does not fully explain why management should authorize specialized counsel to perform these inquiries. An abbreviated history of the evolution of corporate internal investigations, however, does.

At the onset of compliance and ethics, internal investigations were tasked primarily to in-house personnel. Those investigators might have been drawn from a business function, corporate security staff, audit department, general counsel’s office or an amalgam of them.¹² With self-policing the stated goal of the USSG, this composition presented a major concern for the government. It smacked of the fox guarding the henhouse. Further, the exercise of prosecutorial discretion in favor of declining or deferring enforcement actions, and in recognizing mitigating sentencing factors, depended on the independence and impartiality of these investigations, and the reliability of results that were deemed less than trustworthy.

The concern over this staffing problem was not onesided, either. Government investigators used any and all means at their disposal to ferret out information, including the issuance of subpoenae, search warrants, and, once litigation commenced, discovery requests. Particularly with respect to internal investigation materials compiled or generated by non-lawyers, there was little protection from the reach of these tools, in essence giving the government access to materials that either confirmed facts uncovered by its own parallel investigations or hanged companies with nooses of their own tying.

Organizations understandably sought protection behind the shield of attorney-client privilege and the work product doctrine by tasking internal investigations to in-house counsel.¹³ This allowed companies to protect the yields of their internal inquiries,¹⁴ but did not ameliorate the government’s concern that these investigations were biased. As a result, the justification and motivation for declining or deferring prosecutions, and computing reduced punishments, was once again tempered.

Buttered Bread Leads to a Slippery Slope
The corporate world reacted by going “independent” with its internal investigations. Organizations retained outside lawyers and firms to conduct inquiries into sensitive or particularized matters that simultaneously required impartiality and confidentiality. Due to valid concerns of business familiarity and economy, many companies went with their outside transactional or litigation counsel to perform this task, and for a time, this satisfied the dual needs of the organizations and the government.

Over time, however, the government’s confidence in the impartiality of investigations conducted by regular outside counsel waned. Those law firms knew who buttered their bread, and it was assumed that they would not want to lose top clients, corporate friendships or status because of the issuance of accurate, albeit damning, findings.¹⁵ Organizations were back to the now-familiar conundrum in which the results of their internal investigations were adequately protected, but accorded reduced value by the government.

In an INFOPAK^SM published in January 2007, the Association of Corporate Counsel sought to bridge this gap by recommending to its membership as a leading practice the employment of specialized outside counsel to conduct independent corporate internal investigations of critical and sensitive matters.¹⁶ The American College of Trial Lawyers followed suit in February 2008.¹⁷ Both publications agree that not all inquiries must be assigned to such counsel, as whether to conduct an internal investigation with in-house or outside personnel is largely dependent upon the size of the organization and/or the nature and scope of the inquiry. But employing specialized counsel, when appropriate definitively comports with the expectations of the USSG, affords a client the protections of the attorney-client privilege and work product doctrine, and assures the government of the integrity of the internal investigation.

And those are very big carrots on which a CEO can chew.

Notes
1. USSG § 8A1.1, comment (n1).
2. USSG Ch. 2, intro. comment.
3. USSG Ch. 8, intro. comment.
4. USSG § 8B1, comment (n3).
5. USSG § 8C2.5, comment (n10).
6. 18 USC § 1347.
7. USSG § 2B1.1; USSG § 5A; USSG § 8C2.4(d).
8. USSG § 8C2.5.
9. USSG § 8C2.6.
10. USSG § 8C2.5.
11. USSG § 8C2.6.
12. Jack M. Rudnick and John P. Langan, “Managing an Internal Fraud Investigation and Prosecution,” ACC Docket, volume
25, no.3 (April 2008), p. 38, available at www.acc.com/legalresources/resource.cfm?show=14543.
13. Deborah L. Edwards, Mark T. Colloway and Brian D. Edwards, “What to Do When the Whistle Blows,” ACC Docket 22 no. 5
(May 2004), p. 65, available at www.acc.com/legalresources/resource.cfm?show=17030.
14. Upjohn Co. v. United States, 449 U.S. 383 (1981).
15. Internal Investigations,” ACC InfoPAKSM (Feb. 2007), available at www.acc.com/legalresources/resource.cfm?show=19675.
16. Association of Corporate Counsel: “Leading Practices in the Use of External Investigators to Aid in Corporate Investigations,”
(Jan. 2007), available at www.acc.com/legalresources/resource.cfm?show=16794.
17. American College of Trial Lawyers, “Recommended Practices for Companies and Their Counsel in Conducting Internal
Investigations” (2008), available at: www.actl.com/AM/Template.cfm?Section=All_Publications&Template=/CM/ContentDisplay.cfm&ContentID=3390.