1          The Decision to Conduct an Internal Investigation

1.1       What statutory or regulatory obligations should an entity consider when deciding whether to conduct an internal investigation in your jurisdiction?  Are there any consequences for failing to comply with these statutory or regulatory regulations?  Are there any regulatory or legal benefits for conducting an investigation?

The decision to conduct an investigation may be driven by one or more of a number of statutory or regulatory obligations that a body corporate in India is subject to.  While these statutes may not expressly dictate that an “internal investigation” be conducted, compliance with obligations thereunder would often necessitate it.

Examples of such statutes are the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 (“POSH Act”), the provisions relating to internal controls and audits in the Companies Act, 2013 (“Companies Act”) and the Securities and Exchange Board of India (Listing Obligations and Disclosure Requirements) Regulations, 2015 (“LODR”) which applies to companies whose shares are listed on stock exchanges.

An amendment to the Prevention of Corruption Act, 1988 (“PCA”) has introduced an “adequate procedures” defence to an allegation of bribery against a body corporate.  Guidelines with respect to these “adequate procedures” are yet to be notified by the Central Government.  It is probable that such guidelines may include an internal vigil mechanism.

As a general statement, an appropriately conducted internal investigation would help ensure compliance with applicable law, remedial action and improve preparation for potential legal action.  There may be statute-specific benefits to conducting such an investigation.  For example, under the Companies Act, the requirement for a statutory auditor to report incidents of fraud to the Central Government may be mitigated if the fraud is first detected and remedied by the company.

1.2       How should an entity assess the credibility of a whistleblower’s complaint and determine whether an internal investigation is necessary?  Are there any legal implications for dealing with whistleblowers?

There is no uniform bright-line test that dictates the level of response to a whistleblower’s complaint.

Where no guidance has been provided by the applicable regulation, the relevant function (legal, compliance, investigations, etc.) within the body corporate will need to make a qualitative assessment of the nature of the information provided by the whistleblower before launching a full-fledged investigation.

A costs and benefits analysis between responding to each instance of whistleblowing with a full-fledged investigation on the one hand and selectively acting on complaints could involve the following factors:

(i)   the seriousness of the facts alleged in the complaint and the potential consequences of a failure to investigate extensively;

(ii)   whether the complaint fits into a situation where complaints are frequent and risks are known to be typical;

(iii)  if there is a delay in making the complaint and whether the facts alleged are still relevant; and

(iv)  the completeness and accuracy of the disclosures made.  Initial procedures such as limited interviews, random testing, and limited electronic searches could be applied before launching a full-fledged investigation.

Applicable law may in some cases provide some guidance.  For example the POSH Act does not require a company to act on anonymous complaints, verbal complaints, or complaints made after a prescribed period of time.

The LODR requires a listed entity to devise an effective whistleblower mechanism which enables stakeholders including individual employees and their representative bodies to freely communicate any concerns about illegal or unethical practices.

In the case of any complaint relating to financial fraud, the relevant function (legal, compliance, investigations, etc.) may be able to take guidance from standards and practice applicable to internal audits which prescribe the exercise of “reasonable care” and “professional skepticism”.

1.3       How does outside counsel determine who “the client” is for the purposes of conducting an internal investigation and reporting findings (e.g. the Legal Department, the Chief Compliance Officer, the Board of Directors, the Audit Committee, a special committee, etc.)?  What steps must outside counsel take to ensure that the reporting relationship is free of any internal conflicts?  When is it appropriate to exclude an in-house attorney, senior executive, or major shareholder who might have an interest in influencing the direction of the investigation?

Identification of the client is an important aspect of an outside counsel’s role. This is driven by several factors which may include: (i) independence requirements imposed by statutes such as the POSH Act and the Companies Act; (ii) the need to preserve legal privilege and secrecy across multiple jurisdictions; (iii) identification of the department or function responsible for the relevant compliance and the implications that it might have for the relevant “client” constituent; and (iv) disclosure and reporting obligations in all relevant jurisdictions.

It is usually appropriate to exclude an in-house attorney, senior executive, or major shareholder who might have an interest in influencing the direction of the investigation.  Sometimes an internal investigation may be required not for compliance or governance purposes but in order to assist outside counsel on defence strategy in a prosecution against the company and its executives.  The analysis in such an investigation may be different from other situations.

Internal conflicts of interest at both the ends, i.e. the client as well as the outside counsel, need to be checked at the initiation of the engagement and regularly thereafter as facts emerge.

2          Self-Disclosure to Enforcement Authorities

2.1       When considering whether to impose civil or criminal penalties, do law enforcement authorities in your jurisdiction consider an entity’s willingness to voluntarily disclose the results of a properly conducted internal investigation?  What factors do they consider?

There are some statutes that provide for leniency in the case of voluntary disclosures.  Such disclosures should ideally be predicated on an appropriately conducted and robust investigation.

As an example, the Income Tax Act, 1961 and the Goods and Services Tax Act, 2016 provide for the establishment of “settlement commissions” who are empowered to take into account disclosures and cooperation made by a tax assessee and grant immunity from prosecution under those specific statutes.

As another example, the Competition Act, 2002 empowers the Competition Commission of India to impose a lesser penalty in cases where a participant in an anti-competitive cartel has made full and true disclosure regarding a cartel and where such disclosure has been found to be “vital”.

Examples of statutes that provide for leniency in return for disclosure and cooperation are, however, sparse under Indian law.

2.2       When, during an internal investigation, should a disclosure be made to enforcement authorities?  What are the steps that should be followed for making a disclosure?

There is no bright-line test in this regard.  As discussed above in question 2.1, a factor in considering whether or not to disclose (or when to disclose) is that examples of cooperation credit are sparse under Indian law.

There may be situations where the internal investigation discovers the commission of offences that are mandatorily reportable (such as offences provided for in Section 39 of the Code of Criminal Procedure, 1973).

There may be situations where outside counsel may be able to advise on tactical advantages to reporting to law enforcement authorities, such as fraud committed by renegade employees without the knowledge of management of a company.

2.3       How, and in what format, should the findings of an internal investigation be reported?  Must the findings of an internal investigation be reported in writing?  What risks, if any, arise from providing reports in writing?

There cannot be a “one size fits all” approach to the mode and format of reporting.  Factors that will need to be considered are: (i) the purpose of the investigation; and (ii) the findings of the investigation.

It is always preferable to ensure that a sensitive investigation is conducted by outside counsel enrolled to practise in India or by experts engaged on the instructions of outside counsel enrolled to practise in India.  The findings of an investigation should preferably be communicated within the folds of attorney-client privilege.

The risk of a written investigation report being leaked or seized by a law enforcement agency cannot be ruled out.

There have been instances of persons subjected to an internal investigation filing legal proceedings alleging defamation.

If a law enforcement agency is able to access an internal investigation report, it is usually possible to exclude such a report from being adduced in evidence. However, the “fruits of the poisonous tree” doctrine is not strictly applied in India and the law enforcement agency may be able to construct a case on the basis of other evidence to which they  were pointed by the report.

3          Cooperation with Law Enforcement Authorities

3.1       If an entity is aware that it is the subject or target of a government investigation, is it required to liaise with local authorities before starting an internal investigation?  Should it liaise with local authorities even if it is not required to do so?

Indian law does not mandate liaising with local authorities before starting an internal investigation.  As a general rule, a lawful internal investigation with appropriate precautions should not require liaison.  The requirements of a governmental investigation on production of documents, availability of witnesses, etc. will always take precedence over the requirements of the internal investigation.

3.2       If regulatory or law enforcement authorities are investigating an entity’s conduct, does the entity have the ability to help define or limit the scope of a government investigation?  If so, how is it best achieved?

No, the entity does not have any ability to define or limit the scope of a government investigation.

3.3       Do law enforcement authorities in your jurisdiction tend to coordinate with authorities in other jurisdictions?  What strategies can entities adopt if they face investigations in multiple jurisdictions?

Yes.  Enforcement authorities in India frequently coordinate with authorities in other jurisdictions using formal and informal mechanisms.  Formal mechanisms may include Mutual Legal Assistance Treaties, Extradition Treaties, regional cooperation arrangements and Tax Information Exchange Agreements.  Informal mechanisms may include cooperation between intelligence and diplomatic services.

When faced with investigations in multiple jurisdictions, it is advisable to: (i) take the possibility of international cooperation as a given; (ii) ensure that the entity in question has strong legal advice and representation in each such jurisdiction where it is being investigated; (iii) ensure that due process rights and privilege rights are preserved in each jurisdiction; and (iv) simultaneously assess risks in each jurisdiction before deciding on a strategy rather than to adopt a piece-meal approach.

4          The Investigation Process

4.1       What steps should typically be included in an investigation plan?

A robust investigation plan should clearly identify the scope and the objective of the investigation.  It should focus on the specific entities and functions within that entity, it should begin with an identified time period and move out radially if required.

Steps would depend on the object of the investigation.

Typically, steps in an investigation plan should include, in most cases, a thorough review of the entity’s corporate records, financial statements and observations drawn pursuant to a statutory audit.  It must contemplate a review of the entity’s internal policies and practices along with the degree of compliance with such policies.  The entity’s dealings with relevant third parties should also be analysed.

The investigation plan should contemplate a review of all correspondence previously made by relevant personnel and interviews with such relevant personnel.

A robust mechanism to ensure the preservation and storage of data, confidentiality of interviews and awareness of the legal rights of each stakeholder must also be put in place.  While the plan may set out a roadmap for the activities going forward, it should also provide sufficient flexibility to address any unforeseen issues.

4.2       When should companies elicit the assistance of outside counsel or outside resources such as forensic consultants?  If outside counsel is used, what criteria or credentials should one seek in retaining outside counsel?

As a matter of Indian law, it may be important to engage outside counsel at the very outset to preserve privilege over the work product generated during the investigation.  The decision to retain forensic consultants would depend on whether the skills and technology required for the investigation are available to the entity in-house or to the external counsel.

Criteria and credentials for outside counsel would include: (i) expertise and past experience on similar mandates and familiarity with the “turf”; (ii) ability to work seamlessly with forensic consultants, statutory auditors, etc.; (iii) ability to seamlessly progress from the internal investigation to litigation roles; and (iv) ability to advise comprehensively on ancillary legal aspects that may arise as a result of the investigation.  For example, an anti-corruption investigation may result in the entity requiring advice in relation to its previous tax filings.

5          Confidentiality and Attorney-Client Privileges

5.1       Does your jurisdiction recognise the attorney-client, attorney work product, or any other legal privileges in the context of internal investigations?  What best practices should be followed to preserve these privileges?

In India, professional communication between a legal adviser and a client is accorded protection under the Indian Evidence Act, 1872, the Advocates Act, 1961 (“Advocates Act”) and the Bar Council of India Rules (“BCI Rules”).  The issue regarding the position of an in-house counsel on the question of attorney-client privilege in India is not free from doubt – and has been subject matter of judicial interpretation.  Hence, as stated above, as a matter of Indian law, it may be important to engage outside counsel at the very outset to preserve privilege over the work product generated by the investigation.  Attorney-client privilege in India is a rule of evidence and is subject to exceptions (for example, communications made in furtherance of an illegal purpose are not covered by attorney-client privilege) – hence, the exact scope and coverage of attorney-privilege would depend on specific facts and circumstances.  As an example, while there is no direct judicial precedent on this question, notes of interviews: (i) conducted by legal counsel or in the presence of legal counsel; and (ii) required by legal counsel in order to provide advice or to prepare for litigation may be covered by privilege.  Best practice to be followed involves appropriate engagement with the outside counsel at every step of the investigation, right from the time the event which triggers the internal investigation occurs (e.g. receipt of a whistleblower complaint) till operationalising the decisions taken as an outcome of the investigation.

5.2       Do any privileges or rules of confidentiality apply to interactions between the client and third parties engaged by outside counsel during the investigation (e.g. an accounting firm engaged to perform transaction testing or a document collection vendor)?

While there is no direct judicial precedent on this question, as long as the third party (e.g. an accounting firm engaged to perform transaction testing) has been engaged by, and is working on the basis of instructions received from, outside counsel, and submits their work product to the outside counsel (the work product being relevant for the provision of advice or preparation for litigation), their work product may be covered by privilege.

5.3       Do legal privileges apply equally whether in-house counsel or outside counsel direct the internal investigation?

As stated above, the issue regarding the position of an in-house counsel on the question of attorney-client privilege in India is not free from doubt – and has been subject matter of judicial interpretation.  The legal position is described in brief below:

Under the Advocates Act, an “advocate” is one who has been entered in the relevant state bar council (“SBC”) rolls.  The BCI Rules stipulate that an advocate must not be a full-time salaried employee of any person, government, firm, corporation or concern.  Therefore, an in-house lawyer (i.e. one who receives a salary) cannot practice as an advocate while employed full-time.

There does not appear to be any decision by the Supreme Court of India as to whether communications with an in-house counsel are on the same footing as those with an advocate.  The Bombay High Court, in Municipal Corporation of Greater Bombay v. Vijay Metal Works (Bombay High Court), held that privilege should apply to in-house legal advisers.  In Larsen & Toubro Ltd. v. Prime Displays (P) Ltd the Bombay High Court observed that where in-house counsel would, save for their employment with the concerned litigant, be otherwise qualified to give legal advice, then communication between the in-house counsel and the litigant would be privileged.  The above was an observation of the Court, and the Court did not make any finding on this issue, due to lack of pleadings on the issue.  Further, decisions of the Bombay High Court have only persuasive value before the high courts of other states.

5.4       How can entities protect privileged documents during an internal investigation conducted in your jurisdiction?

In addition to appropriate involvement of outside counsel as detailed above, we advise entities to protect privileged documents by expressly marking them as “Legally Privileged and Confidential – Attorney Client Communication” or with other similar legends, such that privilege is sought to be claimed up-front on the communication being exchanged.  Physical and digital security of documents is also important.  Privileged documents should be segregated and kept in safe custody with internal counsel to the extent possible.  Electronic records should be password protected.

5.5       Do enforcement agencies in your jurisdictions keep the results of an internal investigation confidential if such results were voluntarily provided by the entity?

The enforcement agencies do not have a duty under law to keep the results of an internal investigation confidential even if such results were voluntarily provided by the entity.  In fact, it is quite likely that such results may be shared between different agencies as part of the inter-agency cooperation arrangements.

6          Data Collection and Data Privacy Issues

6.1       What data protection laws or regulations apply to internal investigations in your jurisdiction?

As per the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data and Information) Rules, 2011, an entity is required to comply with prescribed security practices and procedures relating to “sensitive personal data or information of a person” (“SDPI”) such as bank account or credit card details, health condition, medical records and history and biometric information.  Any wrongful gain or loss caused due to negligence in maintaining such procedures may result in the entity being liable to pay compensation.

Some of the obligations cast on the entity are:

(i)    to obtain prior consent from persons providing sensitive personal data or information;

(ii)   to make any person providing any information aware of the purpose, intended recipients and the agency collecting and retaining such information;

(iii)  to keep all information received secure; and

(iv)  to not disclose information to third parties without obtaining prior permission of the providers.

Additionally, if the internal investigation is conducted by a group or parent entity (e.g. as a part of a global whistleblowing programme), requiring transfer of the SDPI in question to another entity, this would require some additional safeguards to be maintained.

6.2       Is it a common practice or a legal requirement in your jurisdiction to prepare and issue a document preservation notice to individuals who may have documents related to the issues under investigation?  Who should receive such a notice?  What types of documents or data should be preserved?  How should the investigation be described?  How should compliance with the preservation notice be recorded?

The Indian Penal Code criminalises the secreting and destruction of any document or electronic record that may be required to be produced as evidence in legal proceedings.  As a result, it is a common practice to prepare and issue a preservation notice.  All individuals who may have documents or electronic records related to the issues under investigation should receive such a notice.  The investigation should be described clearly to avoid ambiguity on what is required to be preserved.  At the same time, the description should also avoid sensationalism and prejudgment of issues.

6.3       What factors must an entity consider when documents are located in multiple jurisdictions (e.g. bank secrecy laws, data privacy, procedural requirements, etc.)?

Compliance with local laws and established customs of each jurisdiction is of paramount importance, in addition to contractual requirements across the chain where the information is being shared.

6.4       What types of documents are generally deemed important to collect for an internal investigation by your jurisdiction’s enforcement agencies?

Internal investigations in India are those conducted by (or on behalf of) the entity itself, and are usually not guided by enforcement agencies.  Entities should adopt practical and robust standards on document collection and on each aspect of the investigation.

6.5       What resources are typically used to collect documents during an internal investigation, and which resources are considered the most efficient?

In addition to work emails, the most efficient resource to collect data in an internal investigation is usually a forensic examination of devices where work-related data is stored.  If the entity’s policies permit storage of work data on personal device(s) of an employee, such personal device(s) are also examined (subject to receiving consent of the employee in question).

6.6       When reviewing documents, do judicial or enforcement authorities in your jurisdiction permit the use of predictive coding techniques?  What are best practices for reviewing a voluminous document collection in internal investigations?

The best practice to review voluminous document collection in an internal investigation is to prepare and pre-agree to an appropriate and sufficiently detailed list of key words which are likely to throw up the data in respect of which the investigation is being conducted, and then run the key-word search on the data in question (using appropriate software, if deemed necessary).  The emails, documents and data then identified are physically reviewed, with the reviewers separately tagging (or identifying) the emails/documents/data that seems relevant to the matter being investigated, for further review and action.

7          Witness Interviews

7.1       What local laws or regulations apply to interviews of employees, former employees, or third parties?  What authorities, if any, do entities need to consult before initiating witness interviews?

While there are no specific laws that govern employee interviews, general legal principles to be followed include the following: (i) the person being interviewed is clearly informed of the purpose of the interview, the identity of the interviewers and if there is an outside counsel,  the presence of the outside counsel (and a disclosure that such outside counsel represents the entity, and not the employee); (ii) the interview should be conducted respectfully, with no intimidation, and in such manner and setting that the person being interviewed does not feel (and has no reason to feel) under undue pressure; (iii) if the interview is being recorded, the same should be specifically informed to the person being interviewed; and (iv) to the extent practicable, the interview notes should be drawn up in parallel with the interview and signed by the interviewee (in addition to the interviewee confirming that there was no coercion, the information represents the matters discussed during the interview accurately, etc.).

No authorities are required to be consulted before initiating witness interviews.

7.2       Are employees required to cooperate with their employer’s internal investigation?  When and under what circumstances may they decline to participate in a witness interview?

Employees may be required by contract or internal policy of the employer to cooperate with an internal investigation.  In appropriate cases, non-participation may entitle the employer to take disciplinary steps against the employee.  However as a countervailing factor, participation in interviews is necessarily consensual, the employer has no coercive powers, and all individuals have a right against self-incrimination under Indian law.

7.3       Is an entity required to provide legal representation to witnesses prior to interviews?  If so, under what circumstances must an entity provide legal representation for witnesses?

There is no general rule in this regard.  It may be important to make a judgment call if there is a possibility that the witness may subsequently allege that she was coerced or if in the assessment of the entity, there is a danger of self-incrimination.

7.4       What are best practices for conducting witness interviews in your jurisdiction?

–     The consent of the witness to participate in the process should be recorded up-front.

–     The witness should be made aware of the identities and roles of the participants.

–     The witness should be made aware of her contractual obligations AND her legal rights.

–     Women witnesses should be interviewed within regular working hours and in the presence of another woman.

–     Notes of the interview should be prepared by outside counsel or at the direction of outside counsel and securely held.

–     At the conclusion of the interview the witness should be asked to confirm in writing that the interview did not cause any discomfort to her.

The principles set forth in response to 7.1 above should be read along with these best practices

7.5       What cultural factors should interviewers be aware of when conducting interviews in your jurisdiction?

An interview is a fact-finding exercise and should be conducted in a transparent manner without being an adversarial or accusatory process.  The interviewee should be made aware of his contribution to the investigation process.  It is helpful if such person is also provided adequate guidance on his/her conduct with investigation authorities in case a prosecution is initiated against the entity or its executives.  In case of allegations regarding an interviewee’s conduct, he/she must be provided an opportunity to explain themselves.

The confidentiality of the discussions in the interview must be emphasised.  Interviews with employees should commence with an “Upjohn” warning stating that any attorney-client privilege with an employee belongs solely to the entity and the entity may waive such privilege and disclose the discussions to a governmental agency or third party.

Interviewees (and in particular, employees of the entity) should also be assured of no adverse repercussions pursuant to any disclosure, except in case of disclosure regarding any misconduct by the interviewee which warrants action under the entity’s policies.

7.6       When interviewing a whistleblower, how can an entity protect the interests of the company while upholding the rights of the whistleblower?

While dealing with a whistleblower, it is important to ensure the anonymity of the whistleblower and his/her complaint.  The entity must safeguard the whistleblower’s existing position and ensure no detrimental treatment is accorded.  A preferred step would be to confirm the whistleblower’s current status and the level of protection accorded to him/her.  He/she must also be made aware that the complaint may form part of any submission to an investigating authority and his/her rights (including anonymity and protection) in the event of a prosecution.

Certain companies are required to have a vigil mechanism under the Companies Act, which would need to be complied with. A listed entity will also need to comply with the whistleblower policy adopted by the entity pursuant to the provisions of the LODR.

7.7       Can employees in your jurisdiction request to review or revise statements they have made or are the statements closed?

As good practice, the entity should provide an employee with the opportunity to issue any clarification or supplement his/her statement with any additional information which the employee becomes aware of after the interview.  However, the extent of any variation from statements previously given must be scrutinised and the veracity of any additional disclosure must be established to ensure that the investigation process is not jeopardised.

7.8       Does your jurisdiction require that enforcement authorities or a witness’ legal representative be present during witness interviews for internal investigations?

As stated in question 7.3 above, this is not a general rule.  However, it may be important to make a judgment call if there is a possibility that the witness may subsequently allege that she was coerced or if in the assessment of the entity, there is a danger of self-incrimination.

8          Investigation Report

8.1       How should the investigation report be structured and what topics should it address?

As stated in question 2.3 above, there cannot be a “one size fits all” approach to the structure and the contents of reports.  An investigation report should clearly outline the scope of the investigation and the steps undertaken in the course of the investigation.  Any non-compliance with applicable law should be clearly spelt out along with recommendations for remedial action.

Any existing practices and policies adopted by the entity which address the subject matter of the investigation must be detailed, along with the degree of compliance.  Any relevant findings pursuant to a review of corporate records, financial statements and observations pursuant to a statutory audit must be clearly spelt out.  To the extent necessary, the extracts from witness’ interviews and correspondences may also be stated.

As stated in question 2.3 above, while documenting the findings of an internal investigation the entity must consider the risk associated with a report being leaked or seized by a law enforcement agency or a defamation proceeding by the person accused in the report.

Acknowledgment

The authors would like to acknowledge the invaluable assistance of Mr. Soumit Nikhra, Mr. Shantanu Singh, Ms. Jomol Joy and Mr. Anmol Suhane.]

Authors

1. Aditya Vikram Bhat, Senior Partner
2. Prerak Ved, Partner
3. Soumit Nikhra, Partner