May 15, 2025

Internal Investigations Checklist

Authors:

Internal investigations are on the rise. As governments and regulators step up enforcement measures and whistleblower complaints surge, the number of internal investigations is increasing across a variety of industry sectors. Internal investigations can arise in a wide range of scenarios—including to investigate the veracity of reports by a whistleblower, concerns raised by an employee, third party, regulator, or enforcement agency—and cover a broad spectrum of issues, from allegations of bribery, corruption and fraud, to non-financial misconduct and HR-related disputes. As global regulatory requirements evolve, investigations into both financial and non-financial misconduct are poised to require the engagement of significant company resources. With many employers operating internationally, the number of cross-border investigations have also increased, adding another layer of complexity to an already sensitive process as employers must carefully consider the extent to which local laws may apply, including diverse privilege and confidentiality requirements.

An effective internal investigation protocol is key to an organisation’s ability to identify and respond to potential issues promptly and efficiently, before they turn into larger problems. A company capable of promptly handling emerging issues internally is more likely to avoid regulatory and government agency inquiries in the first place, and will be better positioned to effectively respond to more formal enforcement action and facilitate a favourable (and speedy) resolution.

This Internal Investigations Checklist outlines key steps for employers to consider when faced with an internal investigation. The checklist is not intended to be comprehensive, as each internal investigation must be tailored to the specific circumstances and issues of the particular complaint, but is designed as an aid to performing successful internal investigations. In addition, many aspects of an internal investigation will vary depending on the local laws in the relevant jurisdiction—seeking local advice is always recommended.

Define the Scope of the Investigation

Draft an Investigation Plan/Terms of Reference

Record the relevant scope, purpose, date range, fact finding tasks, and anticipated closure date of the investigation.
Define the client clearly, as well as the chain of command, decision making procedures, and internal reporting requirements (including, but not limited to, reports to the board of directors or relevant risk management committees).
Ensure that the appointed investigation team is independent, impartial, and free from conflicts, and includes personnel who are, or who are capable of becoming, subject matter experts.
Consider appointing a final “decision-maker” that would have independent oversight of the investigation, such as a non-executive director.

Preserve and Collect Relevant Data

Identify potential sources of data and take immediate action to preserve and collate relevant documents.
Identify relevant custodians, including those who have ceased employment with the company, or may do so in the near-term. Note that this list may change as the investigation evolves.
Suspend routine document destruction procedures for relevant custodians for company-controlled data, e.g. email, instant messaging, recorded phone lines, etc.
Consider the sensitivity of the investigation, and whether to send a document preservation notice to custodians prior to interviews to minimise the risk of destruction of data that the company does not control, such as personal mobile data. This may not be an appropriate step for highly sensitive and confidential investigations.
Document the relevant data sources, preservation and collection procedures, including any applicable internal policies, and next steps to process and review the materials.
Privilege and disclosure rules may vary, as can data privacy rights (e.g., in relation to the imaging of mobile phone and electronic devices) and the ability to transfer data outside of the jurisdiction.

Engage External Counsel and/or Vendors

Identify thresholds for when external counsel engagement is appropriate, including an assessment of reputational/monetary/regulatory risk, where independence is required, and/or where attorney-client privilege is likely to be a particularly important consideration. Consider whether additional, local counsel in foreign jurisdictions should be engaged.
Consider whether other external vendors are required given the scope of the investigation, e.g., e-discovery vendors, foreign language experts or translators, forensic accountants, etc.

Protect Legal Privilege

Create a communications protocol to determine when issues should be escalated and reported, and to confirm which issues attract legal privilege.
In cross-border investigations, clarify the relevant jurisdictions and privilege rules in each, including whether privilege would apply to communications with and/or advice from in-house counsel.
Identify a narrowly tailored chain of privilege in the investigation plan, including key stakeholders involved on a need-to-know basis.
Clearly mark and segregate privileged materials from non-privileged materials.
Specify when external vendors are being retained under legal privilege, including in the formal engagement letter.

Conduct Interviews

Identify relevant interviewees and determine whether to conduct preliminary scoping interviews prior to a full review of the relevant documents, or to wait until the document review is substantially complete.
Carefully consider the timing and sequencing of interviews to ensure the credibility of both the witness(es) and the wider investigation.
Determine appropriate level of documentation, including whether such interview notes will be legally privileged.

Consider When and How to Engage Regulatory Authorities/Other Stakeholders

Evaluate early and often whether to engage with relevant regulatory bodies, based on both the initial analysis of the conduct, and ongoing fact-finding.
Self-disclosures are of particular importance in gaining cooperation credit and reduced penalties for certain jurisdictions and agencies.
Determine whether and when other external stakeholders will be notified, e.g., external auditors, shareholders, etc.

Mitigate Further Risk & Consider Lessons Learned

Ensure key stakeholders are kept apprised of decisions taken as result of investigation closure, and consider whether to inform others, e.g., whistleblowers, affected employees, etc. of actions taken.
Update company risk assessments, policies and training programs to mitigate the risk of similar issues arising in the future.
Remediate any risk, controls, and compliance shortcomings.
Maintain investigation records for appropriate retention period.
Consider accountability measures for involved employees, including consequence management items, such as training, remediation, compensation adjustments, and termination.
Prepare a media strategy if the results of the investigation must be disclosed publicly, including updating externally facing company publications, e.g., investor reports, company filings, etc.

Be Flexible

The Mayer Brown Internal Investigations team is highly experienced and skilled at conducting sensitive internal investigations, and is regularly engaged by clients across the most highly regulated industries, including health care, defense, automotive, gaming, energy, technology and the global financial services sector. If you have any questions, or would like to learn more about the topics discussed in this Legal Update, please contact Sam Eastwood and Maura McDevitt.

Authors

Partner
Sam Eastwood
- London +44 20 3130 3087
seastwood@mayerbrown.com
Associate
Maura K. McDevitt
- London +44 20 3130 3853
- New York +1 212 506 2347
mmcdevitt@mayerbrown.com

Related Services & Industries

Services

Stay Up To Date With Our Insights

See how we use a multidisciplinary, integrated approach to meet our clients' needs.