Conducting Effective Compliance Investigations Roberto M. Braceras February 12, 2016 Damian Wilmot Vice President, Litigation Vertex Pharmaceuticals Incorporated
OVERVIEW There are real-life scenarios that occur daily in companies of all sizes all over the world that trigger internal investigations. These investigations often consume significant time and substantial resources. Regardless of the nature of investigation, it is critical to develop a plan that (i) sets objectives, (ii) defines scope, and (iii) considers and respects privilege and confidentiality. 2
What Could Trigger An Investigation Events that may trigger the need to investigate include: Overt employee misconduct toward other employees and/or supervisors. Audit findings of non-compliance. Whistleblower complaints, anonymous hotline reports, or other internal complaints. Receipt of subpoena or other request for information. Government interviews of current or former employees. Alleged financial improprieties. Shareholder demand or civil lawsuit. Suspected data breach or any breach of confidentiality. Allegations of violations of the FCA, FCPA, and/or other local anticorruption laws. 3
FIRST STEP Consult with team, including internal counsel where appropriate, to determine: Whether an investigation should be conducted. Benefits v. costs of investigation. Who will conduct the investigation. How factual information will be developed. Privilege. The goals and scope of the investigation. How the investigation will ultimately be reported. 4
WHETHER TO INVESTIGATE Source and credibility of the information. Severity of the alleged misconduct. Benefits of investigating. Integral aspect of any effective compliance regime, QA, and HR. Internal audits and/or investigations can improve efficiency. Need legitimate investigation or audit process for credibility with regulators. Costs of investigating. Distraction to business. Can create hard feelings and animosity. Rumors/gossip: small internal review can be exaggerated into large, material event. Fees. Potential consequences of not investigating. 5
WHO SHOULD INVESTIGATE? Possible investigators : compliance, H.R., internal audit, internal counsel, outside counsel. Who is being investigated? Type of wrongdoing at issue. Resources needed to manage the investigation. Optics and perceived integrity of the investigation. Privilege. 6
GOALS OF THE INVESTIGATION Develop the facts and evidence. Determine whether there are any violations of the employee handbook or code of conduct. Determine the extent of potential civil and criminal liability. Formulate a strategy for future compliance. Remedy past misconduct and improve operations. 7
SCOPE/TIMING OF THE INVESTIGATION Need to balance efficiency with quality and thoroughness. Potential external factors impacting timing (anticipated employment actions, upcoming Q or K, disclosures, etc.). Is the scope broad enough to: Determine whether misconduct did, in fact, occur; Uncover evidence that might assist the Company in responding effectively to a government investigation; and/or Enable the Company to take appropriate remedial action. 8
CONDUCTING THE INVESTIGATION Review and analysis of relevant documents, including email. Employee interviews. Forensic analysis of emails, financials, confidential data, etc. Do you need to retain external experts? Consider temporary measures to correct processes and prevent further problems or confrontations (e.g., temporary reassignment or leave with pay). Work with outside consultants, investigators, or experts who may be assisting with the investigation. Minimize distraction to the business. Respect and preserve privilege and confidentiality. 9
CONCLUDING THE INVESTIGATION At the outset of the investigation, consideration should be given as to how the results will ultimately be disclosed and to whom. Oral versus written report. Should the Company self-report and/or disclose the issue to (i) the Board of Directors or Audit Committee, (ii) local or federal government authorities, and/or (iii) non-u.s. regulators? Remediation of any inaccurate reports or data. Improvements to compliance? Enhanced training? Employment actions? 10
QUESTIONS? Roberto M. Braceras Damian Wilmot 617-570-1895 617-961-0738 rbraceras@goodwinprocter.com Damian Wilmot@vrtx.com 11