There is no question that the COVID-19 pandemic has posed unique challenges for internal investigation teams, including in-house investigators, external counsel and forensic consultants. Stay-at-home orders, travel restrictions and social distancing have affected the typical processes for preserving evidence, gathering data and documents, interviewing witnesses, and presenting findings. Despite these restrictions and limitations, investigation teams have been able to mitigate these challenges through proactive planning and the use of technologies. As we move toward life post-pandemic and with companies embracing a hybrid work model,1 many of the approaches that investigations teams have learned during the pandemic will continue to carry forward. In addition, without the need for travel or working spaces to host and accommodate investigators, remote fraud investigations can reduce the strain on a company’s physical and financial resources.
The following proactive strategies should be given consideration when developing a successful process for managing internal fraud investigations in a remote environment.
1. Assess the impact of reduction in workforce issues
The COVID-19 pandemic has had a significant negative impact on the economy, resulting in massive reductions in workforce across a variety of industries. The unemployment rate peaked at an unprecedented 14.7% in April 2020, and though the rate decreased to 5.9% in June 2021,2 the employment situation remains precarious, as many companies are still working to recover while adjusting to new staffing models and labor practices. As an initial matter, the investigation team must take stock of identified custodians and key witnesses, as access to these individuals may be obstructed due to the reduction in workforce, reduced hours or furloughs.
- Conduct custodial interviews as soon as possible: If the organization is considering personnel cuts, conduct those interviews promptly to avoid losing access to individuals with key knowledge regarding relevant documents and data. Custodial interviews should be prioritized in order to identify the location of potentially relevant information (e.g., electronic devices as well as physical and electronic documents and data) and conduct interviews prior to employee departures.
- Assess availability of key witnesses: Consider factors such as the availability of key witnesses, including whether the employee will be furloughed or laid off, or made otherwise unavailable.
- Maximize the value of employee exit interviews: Prepare human resources for employee exit interviews, including information that may be relevant to the investigation.
- Evaluate adequacy of legal hold: For example, evaluate whether the data retention policy with respect to terminated employees is appropriate. Electronic devices obtained from terminated employees may warrant a longer “hold period” by legal and IT before the devices are reprocessed and placed back into service. In the event devices must be retired, reimaged or sold for financial reasons, a forensic image of the device should be created and retained for a predetermine period of time.
2. Assess the impact of a remote workforce
The COVID-19 pandemic accelerated the existing trends in working remotely. Starting in March 2020, working remotely became the new normal for many employees, with some organizations managing to get more than 90% of their staff working remotely.3 Companies have successfully adopted new ways of working remotely in response to stay-at-home orders and travel restrictions, without sacrificing productivity. Even with the availability of vaccinations and states rolling back COVID restrictions, the trend of working remotely will likely continue.4 According to a McKinsey survey, 72% of executives say they have already started adopting permanent remote working models for some employees.5
With employees dispersed across multiple locations and devices due to the remote work environment, investigators are faced with unique document retention and preservation challenges different than when employees are in the office. The increase in electronically stored information as a result of messaging apps, collaboration tools and cloud-based platforms have also complicated the identification, preservation and collection of such data. As such, document collection planning and scoping is critical. Leading practices for document collection in a remote environment typically include the following:
- Coordination between the IT and legal departments regarding technologies and platform usage policies and protocols for document preservation, retention policies and legal hold notices. Evaluate the adequacy of the legal hold to determine whether it addresses the different ways employees may be communicating or storing work product. With teams working remotely and office closings, certain legal hold distributions may have to be defined by job function, instead of office location.
- Development of a comprehensive custodian and data map outlining the location and accessibility of physical and electronic documents and data. Securing data on devices spread out geographically, such as data residing on remote employees’ personal laptops and electronic devices, must also be considered. Leverage virtual desktop environments and cloud-based file storage and email systems to minimize the need for physical device collection.
- Establishment of secure protocols for the handling and transmittal of information and evidence as well as privileged material. Consider applicable data privacy laws governing the transfer of data between jurisdictions. Ensure that the technologies used by the investigation teams to communicate and store documents are secure and adequately protected from accidental or malicious loss or disclosure.
- Creation and maintenance of a tracking log that documents the information gathered, including custodian, collection date, location and method.
Witness interviews are a critical component of the investigative process. While in-person interviews are certainly preferable, with the advancement of videoconferencing technology, remote witness interviews can be an adequate alternative, particularly with nonhostile witnesses. The investigation team must weigh the advantages and disadvantaged of conducting investigative interviews remotely. Videoconference offers many benefits, including the ability to observe the witness’s demeanor and establish a rapport with the witness as well as sharing documents via screen-sharing tools.
The challenges of remote witness interviews include the unavailability of witnesses due to furloughed or reduced work schedules, difficulty evaluating witness demeanor and credibility, and the interviewer’s inability to control the remote interview environment (e.g., the witness may disconnect to avoid responding to questions or may claim to have issues with their video feed).
If the investigation team elects to conduct remote witness interviews, they should keep the following in mind:
- Be prepared to quickly plan and schedule witness interviews. Witnesses sometimes offer to speak immediately after an event, but often change their minds if enough time has elapsed. Interview scheduling and prioritization is largely dependent on who is being interviewed (e.g., whistleblower, target witness or fact witness). If a witness is expected to be contentious, it may be preferable to defer the interview to such a time in which it can be conducted in person and in a controlled environment.
- Provide clear instructions and expectations to interviewees in advance of interviews. Establish the formality of the interview. Inform the witness in advance that the interview will be conducted by videoconference and confirm that the witness has all necessary hardware (e.g., computer camera) and internet access. Request that the witness find a quiet, private setting for the interview to avoid interruption or prying ears. The investigation team may need to consider simultaneous interviews for certain interviewees to mitigate the possibility of communication with others during the interview or a break.
- Establish the ground rules at the onset of the interview, such as agreeing which individuals will be present during the interview. Ask the witness to confirm they are not recording the interview or copying documents (e.g., via screenshots) shared during the interview. Other considerations include pre-arrangement of breaks (but not while a question is pending). Lastly, establish an alternative means of communication in case of any technological glitches.
- If the internal investigation is being conducted at the direction of counsel, non-attorneys, such as forensic accountants, must act under the direction and instruction of in-house or outside legal counsel to preserve the attorney-client privilege. When in doubt, have an attorney present on the videoconference so that the appropriate qualifiers and disclaimers (e.g., Upjohn warnings) are properly communicated.
- Coordinate with the investigation team to limit the number of participants so that the witness does not feel intimidated. If possible, the interviewer should have a team member take notes and confirm witness statements.
- Prepare an outline or list of questions in advance, but be prepared to pivot. Prepare exhibits beforehand and have a plan for sharing documents. In certain instances, it may be necessary and/or more efficient to share documents, potentially password protected, in advance of the interview via email. As always, be mindful of employment law and data privacy risks before questioning the witness about documents.
- Interviews should be memorialized. Interview summaries create a strong record for the investigation and allow the entire team to access the information obtained during the interview.
Despite the realities of the current and future remote environment, the issues leading to the need for fraud investigations still exist. Remote investigations can offer a great deal of flexibility, which can lead to efficiency and cost savings. By developing practical strategies to address the challenges of in a remote environment, investigation teams can effectively complete remote fraud investigations and ensure the credibility, transparency and reliability of the investigation process.