That's Privileged nformation. What internal auditors should know about attorneyclient privilege in corporate legal investigations.

That's Privileged nformation What internal auditors should know about attorneyclient privilege in corporate legal investigations. KENNETH GLASCOCK, jd, CIA. CFSA, CISA, CISSP, CBCP PHOTOGRAPH BY JONNIE MILES IHTERNAl AUDITOR AUGUST 2005

FIRST HINT OF MALFEASANCE OR FRAUD, an internal auditor's instinct is often to be involved immediately and directly in the investigation from start to finish. Typically, Internal auditors take such matters personally, as though no impropriety should ever occur on their watch. Although this instinct is common, it's important for audit professionals to remember that the ontrol environment is management's esponsibility, and the manner in which AU&US! 2005 INTERNAL AUDITOR

wrongdoings are investigated and reported can have wide-ranging legal, financial, and rcputational consequences for the organization. One factor that can influence these consequences is the legal concept of privilege, or the protection of certain information, records, or advice from being disclosed in litigation. U.S. internal auditors, or those whose companies do business with U.S. firms, should have a basic understanding of how information can be kept privileged under U.S. law and how organizations can conduct an investigation to minimize future litigation exposure. DIFFERING RESPONSIBILITIES In addition to internal auditing and management, the parties involved in an investigation of malfeasance may include the audit committee, in-house counsel, external counsel, regulators, and external auditors. Each of these groups may have differing agendas and be subject to different legal or ethical obligations. Among the parties involved, the interests of the audit committee and the internal auditor arc probably the most closely aligned. However, if the audit committee must comply with the requirements of the U.S. Sarbanes-Oxley Act of 2002 and the U.S. Securities and Exchange Commission (SEC) Rule 10A-3, which addresses implementing Section 301 of the act, the audit committee's responsibilities are more clearly defined than those of the internal auditor. Rule 10A-3 requires audit committees to establish formal procedures to receive, retain, and deal with complaints received hy the company regarding accounting, internal accounting controls, or audit issues; and to facilitate confidential and anonymous suhmissions by the company's employees regarding questionable accounting or audit matters. The rule vests authority in audit committees to engage independent counsel and other advisers as deemed necessary to address legal, accounting, or fmancial reporting issues as they arise. Consistent with congressional intent and SEC expectations, audit committees have an affirmative duty to be skeptical and inquisitive, and to receive adequate information to make an informed judgment. INVESTIGATION CONSIDERATIONS Should an audit committee become aware of a potential issue, it has a duty Attorney-client privilege protects advice rendered by legal counsel and encourages frank and open communication about legal matters between client and attorney. to investigate to protect the interests of the company's investors. However, it's important to remember that the material (e.g, information, documents, or evidence) gathered during this investigation could be discoverable (i.e., ordered by the court to be disclosed), in subsequent private litigation. In other words, an adverse party could request a document such as an audit report in litigation, and if the report is deemed discoverable, the court would enforce the adversary's right to obtain it. Other disadvantages of an investigation include: direct costs, and the inevitable distraction (and loss of productivity) as management and employees expend time and energy cooperating with or fearing the possible or imagined consequences of the investigation. Further, the results of the investigation may require disclosure in the Management Discussion and Analysis section of the financial statements, or in the Legal Proceedings section, both in accordance with SEC Rule S-K, or a discussion of possible loss contingencies as directed by the external auditor. Although the results of an investigation eventually may he discoverable, there are also advantages to company-sponsored investigations, such as helping the defense of a shareholder derivative suit, a governmental inquiry, or a criminal investigation. An investigation performed at a company's direction is likely to be less disruptive than an externally controlled investigation, could help dissuade a regulator from conducting its own investigation, and will assist the board in exercising prudent business judgment. If the purpose ot the investigation is clearly nonlegal, then internal auditors, external auditors, or other subject matter experts can be involved without regard to privilege. However, if litigation is possible or likely, the audit committee may choose to minimize the possibility of discovery by engaging legal counsel to conduct the investigation. Thus, a threshold issue for the committee to consider is whether the investigation has a legal or nonlegal purpose. If the purpose is legal, the committee might also consider whether an oral report will suffice, because a written deliverable creates a potentially discoverable document. ATTORNEY-CLIENT PRIVILEGE Whether the resulting materials of the investigation become discoverable depends on the common law attorney-client privilege (ACP). The purpose of the ACP is to protect advice rendered by legal counsel and to encourage frank and open communication about legal matters between client and attorney. Thus, if privilege applies, a third party can't learn about the communications a client has with its legal counsel. The privilege can also apply to notes and reports resulting from an investigation as well as employee interviews. The privilege exists to protect not only the rendering of professional legal advice to those who can act on it, hut also the information provided to the lawyer, which enables him or her to provide such advice. The protection of the privilege extends only to communications and not to facts. Thus, an adverse party might be able to learn a fact, but could not learn exactly what one told an attorney or what advice the attorney gave. Moreover, a fact cannot be concealed merely by revealing it to a lawyer. For example, if a witness were asked on the stand if she made manual journal entries not consistent with INTERNAL AUDITOR AUGUST 2005

THAT'S PRIVILEGED I N F O R M A T I O N Generally Accepted Accounting Principles at quarter-end to help make revenue targets, she could not respond, "Sorry, that is soniething my attorney and I discussed. It is therefore privileged information." It's important to note that the privilege belongs to the client {i.e., company) and not the employee. For example, if a company obtains advice, documents, or reports in connection with a lawsuit or prospective lawsuit, the company, not an employee, has a right to decide whether the material will be kept confidential (i.e., privileged). A corporation can hold a privilege through a representative typically a senior manager acting on its behalf. For example, if an adversary seeks an internal or external audit report in connection with litigation, the chief audit executive or other senior manager could assert "privilege" and decline to produce the report. A judge would likely make a case-by-case determination of whether ACP applies. However, an internal audit report likely would not be covered by a privilege. Tbe U.S. Supreme Court addressed the ACP in the case of Upjohn v. United States. The case centered on the disclosure of potentially inappropriate payments made to foreign government officials by a foreign subsidiary of Upjohn. Tbe Internal Revenue Service demanded documents related to a legal investigation conducted by inbouse counsel. Upjobn refused to produce the documents, arguing that tbey were protected by tbe ACP. The Supreme Court held the communications were confidential and protected from disclosure by tbe ACP. The court also found the ACP applicable to certain communications between employees of a corporation and a corporation's counsel, but declined to define a clear test for the development of a privilege, preferring instead a case-by-case analysis that considers all the facts and circumstances of tbe particular situation. In addition, not all federal or state court cases must follow tbe bolding in Upjohn. Tbe ACP can also protect communications with experts (including accountants) and legal counsel provided that legal counsel engaged the experts. If a special counsel is engaged to conduct accounting-related investigations, and he or sbe in turn engages an accounting firm, tbe communications from tbe accounting firm would be protected by the ACP and not discoverable by a potential litigant. internal auditors to provide a report, that report may be privileged because it was prepared in connection with a legal matter. If a legal issue relates only to accounting advice, a WPD privilege is unlikely If the purpose of an investigation is clearly nonlegal, then internal auditors, external auditors, or other subject matter experts can be involved without regard to privilege. WORK PRODUCT DOCTRINE As a general rule, accountant workpapers are not likely to be protected by tbe ACP because tbey are not considered client communications. Nonetheless, tbey may be covered by a related privilege known as the Work Product Doctrine (WPD). This privilege Is distinct from, and broader tban, the ACP and extends beyond confidential communications between the attorney and client to any document prepared in anticipation of litigation by or for tbe attorney. For the material to be kept confidential, or privileged by tbe court, it must have been created for tbe purpose of obtaining legal advice and kept confidential. For example, if tbe audit committee engages legal counsel, and legal counsel engages external or Document Retention Guidelines to be recognized. The WPD can protect materials created by lawyers and tbeir engaged experts in anticipation of litigation. However, tbis privilege is more easily overcome by an adverse party, who can demonstrate need or an "undue bardsbip" if tbe materials are not provided. Nonetbeless, if the material sougbt is based on opinions or conclusions, as opposed to being inberently factual, it will be more difficult for the opponent to overcome tbe privilege. Altbougb tbis may seem like a fine point, it could have a bearing on whether legal counsel or internal auditors use a written questionnaire or another potentially less discoverable technique during tbe course of tbe investigation. Courts have beld that the WPD is not as easilv waived as tbe ACP. Tbe kev Strict adherence to an organization's document retention policy is critical to minimizing potential civil or criminal liability. Failure to preserve the appropriate records could result in severe consequences to both individuals and organizations. The following guidelines can help ensure documents are correctly preserved for future legal use. As soon as the decision to conduct an investigation is made, the company should take whatever steps are necessary to create a document retention program. If litigation has commenced, is threatened, or is likely, the organization should act immediately to preserve all relevant records, including e-mails. Title VIM of Sarbanes-Oxley, the Corporate and Criminal Fraud Accountability Act of 2002, provides for a 20 year prison sentence for committing the crime of knowingly destroying, altering, or falsifying records in connection with a federal investigation or bankruptcy and a 10-year sentence for the crime of destroying audit records. The Act provides enhanced fines or imprisonment of up to 20 years for corruptly altering, destroying, mutilating, or concealing records, documents, or other objects with the objective of preventing their use in an official proceeding or for obstructing, influencing, or impeding any official proceeding or attempting to do so. AUGUST 7005 INTERNAL AUDITOR 49

50 is to prevent disclosure to adversaries. Accordingly, disclosure of confidential records to a government audit agency could be construed as a disclosure to a potential adversary and could compromise the privilege. Any time an organization provides a confidential document to an unrelated entity, in cases wbere communications have been disclosed to third parties sucb as external auditors, underwriters, or even regulators, who can be construed as legal adversaries (i.e., entities witb potentially different interests who may sue, fine, or otherwise sanction the company or its employees). Even par- External auditors usually are outside the circle of third persons with whom the organization's confidential information may be shared without compromise. it becomes more difficult to assert privilege against another party in litigation. In other words, the more widely available a company makes a document, tbe less credible that firm becomes ifit later asserts in litigation that the information is confidential, or privileged. LOSS OF PRIVILEGE Assuming a written deliverable results from the investigation, preserving its confidentiality is key to possible future protection in court under the ACP and WPD. Courts have waived tbe privilege Initiating the Legal Investigation ticipation in an SEC voluntary disclosure program could cause a privilege to be waived. Thus, tbe entity could find itself witb an irreconcilable dilemma. It may be necessary or desirable to disclose tbe communication to the external auditor or a regulator, yet doing so may waive tbe privilege and subject the entity to civil actions from shareholders. A privilege can also be waived through unintentional disclosure. Specific actions that can be taken to protect the privilege include limiting copies of the information, marking the copies "confidential," and granting access Early in the investigative process, employees should be notified by counsel of the investigation. Typically, notice will be written, but could be oral if the matter is especially sensitive. A written notification should: Indicate the nature of the investigation. Indicate the identity of the investigators (i.e., legal counsel). Include a statement that the attorney represents the organization, not the employee. Include a statement that the entity seeks legal advice. Indicate that cooperation is expected and appreciated. Request to maintain confidentiality. Include a notice that information collected may be shared with third parties. Counsel may opt for a written questionnaire. If so, the questionnaire should be marked "privileged," "confidential," or "attorney-cuent communication." If interviews are conducted, counsel may elect to have at least two interviewers in attendance. The interview notes may be consolidated into a memorandum containing the attorneys' impressions. If an employee declines to cooperate, the board should likely take some punitive action against the employee. Some employees may insist on having their own counsel present during the interview. Outside counsel will determine whether to conduct the interview under this or other conditions. INTERNAL AUDITOR AUGUST 7005 on a need-to-know basis. If a communication must be disclosed to a third party, a confidentiality agreement may belp, but by no means will this provide absolute protection. For internal reporting, it also maybe prudent to designate an individual to review tbe document and report directly to a group of disinterested directors. Further, legal counsel should be consulted before summarizing the results of the investigation for public disclosure, as this too may jeopardize the privilege. In short, if the materials become discoverable, the organization may have built the foundation for additional legal actions against itself. EXTERNAL AUDITORS Unless counsel has engaged external auditors, an organization likely will not be able to claim tbeir work as privileged, because federal law does not recognize a privilege for auditor-client communications. However, there is one exception under tbe Internal Revenue Service (irs) Restructuring and Reform Act of 1998 for tax advice provided to a client by a professional qualified under federal law to practice before tbe IRS. The privilege extends only to advice on legal issues in federal court in which the United States is a party. At the state level, only a handful of jurisdictions recognize a privilege for accountant-client communications. Sucb states may offer protection against the compulsory production of workpapers witbout client consent. Where it is recognized by state statute or common law, the privilege belongs to the client, but it can be lost by either the client or the accountant making a disclosure. According to the Supreme Court, in the case of United States v. Arthur Young &L Co., external auditors serve as "pubhc watchdogs," a role that demands independence from the client. A prior Supreme Court case held that external auditors have a public responsibility transcending any employment relationship witb tbe client and owe allegiance to the corporation's creditors and stockholders, as well as to the investing public. Therefore, external auditors usually are outside the circle of third persons with whom confidential information may be shared without compromise.

THAT'S P R I V I L E G E D I N F O R M A T I O N Accordingly, there is no guarantee of a work product privilege for auditors or a confidential accountant-client privilege. However, if a special audit team as opposed to a regular year-end audit team - is assembled for the purpose of aiding counsel in providing legal advice, confidences might be shared without compromising a privilege. Potentially, the entity may even use its own certified public accounting firm for the investigation if the firm is engaged separately by counsel for the audit committee or board to assist with a legal matter. However, because the annual audit is not a legal matter, the annual audit work or work performed by the audit team would not be privileged. Thus, it would be safer to engage a different firm for an investigation than the firm engaged for tbe annual audit in order to minimize conflict and confusion. IN-HOUSE COUNSEL Using in-house counsel for an investigation raises many independence issues, as the attorney may fmd him or herseu in the awkward position of investigating superiors. In addition, the in-house attorney must navigate a minefield of professional and ethical obligations, wbicb can be exacerbated by a case of significant malfeasance such as senior management perpetrating an Enron- or WorldCom-sized fraud. Additionally, in-house counsel customarily may provide business advice, which could negatively affect the entity's ability to maintain and preserve the counsel's privileged legal advice. If counsel provided legal advice regarding any of the subject matter, the attorney should not be used. If in-bouse counsel routinely offers business advice or serves on the board, the internal auditor should recommend that outside counsel direct an investigation. This is also advisable if the interests ofthe corporation diverge significantly from those of senior management or members of the board. In-house attorneys must take more precautions to preserve tbe ACP than outside legal advisors because tbey face heightened judicial scrutiny. For example, the in-house counsel should keep an independent filing system for confidential communications and only label truly confidential documents "confidential." Against this backdrop, tbe internal auditor may encounter in-house counsel who decline to share communications witb the internal auditor by citing a need to preserve a privilege. Although this issue does not appear to bave been settled in the courts, a good Internal auditors should be aware that their audit reports could be used against the organization in a court of law, should litigation result. argument can be made tbat internal auditors, by virtue of tbeir board-reporting relationsbip, are part of a small circle of "others" with whom privileged communications can be shared without jeopardizing the privilege. If an internal auditor requests to view a report prepared by outside counsel that is relevant to an ongoing audit, arguably tbe in-house counsel sbould provide the report to the internal auditor. It may be belpful for the internal auditor to cite bis or her board-granted authority typically found in the internal audit charter to access any and all information and materials relevant to an internal audit. Any conflict between inbouse counsel and tbe internal auditor may need to be resolved by the audit committee or tbe full board. The internal auditor, however, should balance tbe need for the report against the possibility that gaining access to the report could inadvertently lead to a loss ofthe privilege. INTERNAL AUDIT INVOLVEMENT Not long ago, the Enron and World- Com cases demonstrated tbe potential legal land mines of significant and widespread fraud. In light of tbose infamous examples, the internal auditor should recognize that it might be best to defer investigations of fraudulent behavior or other wrongdoings to independent legal counsel and tbe experts engaged by legal counsel. Accordingly, tbe internal auditor sbould defer to legal counsel wben tbe counsel is engaged by tbe audit committee. If counsel works for management or was engaged by management, the internal auditor should maintain professional skepticism and address any concerns with the audit committee. Generally, internal audit reports will not be protected by either the ACP or the WPD and could be subject to discovery in litigation. Therefore, auditors should be aware that their audit reports could be used against tbe organization in court should litigation result, and they should, therefore, avoid reaching legal conclusions about whether particular conduct violated rules or regulations. If an internal auditor has reason to believe that a lawsuit or the filing of criminal charges against an organization or an employee of tbe organization is likely, he or she should encourage the audit committee to vote on a resolution that authorizes outside counsel to conduct the investigation. The resolution sbould be clear regarding tbe legal basis for the investigation and mention tbe possibility of litigation as a motivating factor. Tbe attorney's engagement letter will serve as the charter for the investigation, describe tbe scope of the work to be performed, and make reference to the attorney being retained to provide legal advice. This turn of events may be contrary to tbe internal auditor's instinct, but allowing and encouraging this course of action may ultimately be in the organization's best interest. This article is not intended to provide specific legal advice. To comment on this article, e-mail the author at kgtascock@theiia.org. AUGUST 200S INTERNAL AUDITOR