An internal investigation rarely begins with a complete story. It begins with fragments: a hotline report, an unusual payment, a complaint from a customer, or a subpoena that tells the company the government may already know more than management does.

The first decisions can shape the entire matter. Who leads the inquiry, what the company preserves, and what employees are told before an interview may later affect privilege, credibility, and the company’s options with the government.

Keith & Lorfing advises West Texas businesses that need to investigate suspected misconduct and represents employees or executives whose interests may not match the company’s. When allegations involve a founder, officer, senior executive, or other member of leadership, an executive misconduct investigation attorney can help structure the inquiry so the people under scrutiny are not controlling the process.

What an internal corporate investigation is supposed to accomplish

An internal investigation is a structured effort to find reliable facts, assess legal exposure, and decide what the organization should do next. It may address suspected fraud, theft, false billing, kickbacks, regulatory violations, conflicts of interest, data misuse, harassment, or retaliation.

Suspected diversion of company funds, unauthorized transfers, payroll manipulation, or misuse of business accounts may require an internal embezzlement investigation focused on financial records, access controls, approvals, and the path the money took.

When the concern centers on suspicious transactions, false billing, manipulated records, or misuse of company funds, an internal fraud investigation can help determine what happened, who was involved, and whether the conduct creates civil, regulatory, or criminal exposure.

The point is not to confirm management’s first theory. A sound investigation tests competing explanations and follows the evidence, including evidence that clears an employee or shows the problem is smaller than first reported.

Depending on the facts, counsel may need to answer several different questions:

• What happened: Identify the conduct, people, dates, transactions, and systems involved.

• Is it still happening: Determine whether immediate action is needed to stop financial loss, protect people, or secure data.

• Who may be responsible: Separate direct conduct from approval, supervision, control failures, and innocent involvement. If the allegations involve self-dealing, conflicts of interest, misuse of corporate assets, or decisions that may have harmed the company, a fiduciary duty investigation can examine whether directors, officers, or other decision-makers breached duties owed to the organization.

• Which laws or duties apply: Assess possible criminal, civil, regulatory, employment, contractual, and licensing exposure.

• Who must be told: Consider reporting duties to a board, insurer, auditor, regulator, contracting agency, or law enforcement.

• What must change: Repair the control failure without punishing whistleblowers or compromising the evidence.

An investigation should be broad enough to find the truth but disciplined enough to remain useful. Before interviews begin, counsel should define the known allegation, the issues that remain open, who receives reports, and who has authority to expand or close the inquiry.

The first response should protect facts, not reputations

When an allegation reaches leadership, the instinct may be to confront the person named in the complaint or ask the usual team to “look into it.” That can alert witnesses, change records, or place the investigation under someone whose decisions are part of the problem.

The safer first move is to control the flow of information while preserving evidence. The company can investigate without treating an untested allegation as a proven fact.

Early decisions commonly include:

• Choose an appropriate decision-maker: A board committee, owner, or uninvolved executive may be better positioned than the employee’s normal chain of command. When senior leadership or management decisions are themselves part of the allegation, a board-directed internal investigation can give the inquiry a more independent reporting structure and clearer authority.

• Address immediate risk: The company may need temporary access limits, transaction controls, paid leave, or another neutral measure while facts are gathered.

• Identify legal obligations: Some matters trigger notice duties under contracts, insurance policies, regulations, or government programs.

• Set a communication plan: Employees should know where to send information and should be warned against retaliation, deletion, and informal coordination.

• Separate business and legal work: The company should document why counsel was engaged and what legal advice the investigation is intended to support.

Not every complaint needs a sweeping forensic review. A credible claim involving senior leadership, government funds, patient billing, financial reporting, or possible obstruction usually calls for greater independence and tighter controls than a routine policy dispute.

In an investigation involving executive misconduct, that may mean shifting oversight to an uninvolved executive, board committee, or outside counsel rather than leaving the matter within the normal reporting chain.

Attorney-client privilege is powerful, but it is not automatic

The Supreme Court’s decision in Upjohn Co. v. United States rejected a rule that would have limited a corporation’s privilege to communications with senior management. Qualifying communications with employees may be privileged when they are made confidentially so counsel can give legal advice to the company.

Privilege generally protects communications, not the underlying facts. A company cannot make an existing record or a known fact undiscoverable simply by sending it to a lawyer.

Work-product protection is related but different. It may protect material prepared because litigation is reasonably anticipated, with stronger protection usually given to an attorney’s mental impressions and legal theories.

The purpose and structure of the investigation matter. A court may examine whether counsel was giving legal advice, whether the work was primarily business-driven, who received the information, and whether confidentiality was maintained.

A confidential internal investigation should be structured from the beginning around limited circulation, clear reporting lines, and careful handling of privileged and sensitive information.

Practical steps that may help preserve legal protections include:

• State counsel’s role clearly: Engagement documents and internal instructions should identify the legal purpose of the work.

• Limit circulation: Reports and interview notes should go only to people who need them for the legal decision.

• Mark documents accurately: A privilege label can help identify a document, but a label cannot create privilege by itself.

• Use separate workstreams when needed: Legal advice, ordinary compliance work, public relations, and employment decisions may overlap, but they are not automatically protected in the same way.

• Plan before issuing a final report: A detailed written report can be valuable, but it may also create disclosure, waiver, and discoverability issues that an oral briefing would not present in the same form.

Privilege belongs to the company, acting through the people authorized to control it. The company may later decide to disclose facts or communications, so an employee should not assume that speaking with company counsel creates a personal attorney-client relationship.

Preserve evidence before collecting it

An investigation can fail before the first interview if relevant information disappears. When litigation is pending or reasonably anticipated, a party generally must take reasonable steps to preserve relevant electronically stored information; separate retention duties may also arise from statutes, regulations, contracts, or a government request.

A preservation plan should fit the allegation rather than freeze every record in the business. Counsel should identify the relevant date range, custodians, devices, accounts, applications, and data sources, then revisit that scope as new facts emerge.

The plan may need to cover:

• Company and personal email used for business

• Text messages and collaboration platforms

• Accounting, billing, payroll, and customer systems

• Shared drives, cloud storage, and backup practices

• Company-issued and bring-your-own devices

• Security logs, access records, and surveillance footage

• Records held by vendors, accountants, or other third parties

• Devices and accounts belonging to departing employees

Routine deletion should be suspended only where needed, and the company should document what was preserved, by whom, and when. Under 18 U.S.C. § 1519, knowingly altering, destroying, concealing, or falsifying records with the required intent in relation to a federal matter can carry separate criminal exposure.

Preservation does not mean employees should conduct their own searches, forward company files to personal accounts, or start interviewing coworkers. Those actions can change metadata, spread confidential information, and complicate the chain of custody.

When the allegation involves unauthorized access, stolen information, credential misuse, or another cybersecurity incident, a data breach internal investigation can help determine what systems were affected, who had access, what information was exposed, and what preservation or reporting obligations may apply.

What employees should know before an interview with company counsel

Company counsel should make clear whom the lawyer represents before asking substantive questions. This explanation is often called an Upjohn warning, although it is not the same as a Miranda warning and it does not give the employee a personal right to company-paid counsel.

A careful warning usually explains that counsel represents the company, the interview is being conducted to give legal advice to the company, and the company controls any privilege. It should also make clear that the company may decide to share the substance of the interview with third parties, including the government.

Employees should listen for those distinctions. “This conversation is privileged” does not mean “you are the client.”

Before answering, an employee may want to ask:

• Who does the interviewing lawyer represent?

• What subjects will the interview cover?

• Is participation required as a condition of employment?

• May the employee have separate counsel present?

• Will the interview be recorded or summarized in writing?

• Who may receive the interview notes or summary?

• Does the company have a policy for advancing individual legal fees?

An employee should not lie, destroy information, coach another witness, or guess at an answer. Saying “I do not remember” when that is true is different from filling a gap with an assumption that may later be treated as a fact.

When an employee or executive needs independent counsel

Separate counsel becomes important when an answer could expose the employee to criminal charges, civil liability, discipline, loss of a professional license, or a demand to repay money. It also matters when the company appears to be assigning blame, when investigators request the employee’s personal device, or when government agents want an interview.

The Fifth Amendment generally restricts government compulsion; it does not automatically give a private employee the right to refuse a private employer’s questions without workplace consequences. Public employees, union-represented workers, whistleblowers, and employees covered by a contract may have additional rights that require individual analysis.

Union-represented employees may have a right, upon request, to union representation at an investigatory interview they reasonably believe could lead to discipline. The National Labor Relations Board explains the scope and limits of these Weingarten rights, including that the employer generally does not have to advise the employee of the right.

Private counsel can help an individual prepare without scripting false or misleading answers. Counsel can also discuss the interview’s scope, request breaks, address Fifth Amendment concerns if the government is involved, and seek clarity about how statements may be used.

Who pays for separate counsel

Payment depends on the company’s governing documents, employment agreements, applicable state law, insurance coverage, and the person’s role. Indemnification and advancement are not the same thing: indemnification concerns who ultimately bears covered legal costs, while advancement concerns payment while the matter is still pending.

An employee or executive should request the relevant bylaws, policy, contract, or directors-and-officers insurance information before assuming fees will be covered. Advancement may require a written undertaking to repay amounts if the person is later found ineligible.

A company and an employee may also consider a common-interest agreement when their legal interests genuinely overlap. The agreement does not make company counsel the employee’s lawyer, erase conflicts, or create a privilege where the legal requirements are not otherwise met.

Interests can change as facts develop. Each lawyer should continually assess whether sharing information remains lawful and useful for that lawyer’s own client.

Deciding whether to self-disclose to the Department of Justice

Self-disclosure should not be treated as a public-relations choice or a last-minute effort to earn credit. Counsel must first identify what is known, what remains uncertain, whether reporting is already required, which agency or DOJ component has authority, and whether waiting could cause the company to lose an available benefit.

If the company has already received a subpoena, target communication, search warrant, or contact from federal agents, the matter may also require a coordinated federal investigation defense strategy alongside the internal inquiry.

DOJ issued a department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy in March 2026. With an exception for federal antitrust crimes, the policy sets a common framework for corporate criminal matters handled by DOJ.

Under that policy, DOJ says it will decline prosecution when a company meets the policy’s requirements for voluntary self-disclosure, fully cooperates, timely and appropriately remediates, and has no disqualifying aggravating circumstances. A declination can still require disgorgement or forfeiture and restitution or victim compensation, and the policy does not create an enforceable right to a result.

Timing matters. A qualifying disclosure generally must be made in good faith to the appropriate DOJ criminal component, concern misconduct not already known to DOJ, occur before an imminent threat of disclosure or government investigation, and be reasonably prompt after discovery.

The policy also contains a specific path when a whistleblower reports internally and submits information to DOJ first. In that setting, the company may still qualify for a declination if it reports to DOJ as soon as reasonably practicable and no later than 120 days after receiving the internal report, while satisfying the policy’s other requirements.

That 120-day provision is not a general deadline for every investigation. A company may need to act sooner, and disclosure to a regulator or civil agency does not necessarily count as disclosure to the appropriate DOJ criminal component.

DOJ evaluates more than speed. The Justice Manual’s corporate prosecution principles also address the seriousness and reach of the conduct, management involvement, compliance history, cooperation, remediation, effects on victims, and individual accountability.

Mistakes that create a second problem

The original allegation is not always what causes the greatest damage. A rushed response can create new evidence of intent, retaliation, obstruction, or dishonesty.

• Deleting or altering records: Preservation should begin before custodians are confronted, and no one should “clean up” an incomplete file.

• Interviewing before reviewing documents: Records often reveal what a witness needs to be asked and make it easier to test an answer fairly.

• Using one lawyer for conflicting clients: The company, executives, and employees may begin aligned and later need separate advice.

• Treating the whistleblower as the problem: Retaliation can create a separate claim and discourage other witnesses from sharing accurate information. A careful corporate whistleblower response should preserve the allegation, protect against retaliation, evaluate its credibility, and determine whether the report triggers internal or external reporting obligations.

• Coordinating accounts: Asking a witness to be truthful is proper; comparing stories or suggesting a shared version of events can create serious risk.

• Speaking casually with federal agents: A voluntary conversation is still an interview, and a materially false statement within federal jurisdiction can itself be a crime.

• Overpromising confidentiality: Counsel should explain who controls the information and avoid guarantees the company may not be able to keep.

• Using an NDA to block lawful reporting: Confidentiality duties have limits. For example, SEC Rule 21F-17 prohibits actions that impede direct reporting of possible securities-law violations to the SEC.