Di derivazione dai paesi di common law, le internal investigations hanno acquisito un ruolo sempre più rilevante anche nel nostro ordinamento, specie nell’ambito della responsabilità da reato degli enti ex D. Lgs. n. 231/2001, costituendo non solo il più efficace meccanismo di risposta ad eventuali criticità interne, ma anche la prima linea di difesa della società in ottica processuale.
Le ragioni per cui l’ente proceda ad avviare un’investigazione interna possono essere differenti: una segnalazione pervenuta mediante il sistema di whistleblowing, un giudizio negativo del revisore legale dei conti, la richiesta dell’organo di controllo interno, l’avvio di indagini da parte della Procura o delle Autorità di Vigilanza, persino notizie di stampa.
Di conseguenza, differenti potranno essere le modalità, gli obiettivi e quindi gli effetti delle investigazioni interne:
(a) nel caso in cui si sospetti unicamente l’inosservanza delle procedure interne, sicché la finalità perseguita sarebbe l’accertamento dell’infrazione con eventuale instaurazione di un procedimento disciplinare, è ragionevole che gli organi “interni”, quali l’Internal Audit o l’Organismo di Vigilanza, realizzino gli approfondimenti necessari;
(b) qualora, invece, l’ente tema che mediante la violazione di protocolli interni sia stato commesso un reato, sarebbe preferibile affidare la conduzione delle investigazioni a professionisti esterni, valutando anche l’opportunità di procedere secondo lo “statuto” delle investigazioni difensive delineato dal codice di procedure penale, e comunque assicurando un opportuno coordinamento con l’Organismo di Vigilanza (ove presente). L’intervento di professionisti esterni, peraltro, garantirebbe all’ente anche il legal privilege (attorney-client privilege), allo stato non riconosciuto rispetto all’attività compiuta dagli in-house counsel o dall’Organismo di Vigilanza.
Nel caso delle internal investigations aventi finalità esterne o processuali diverrebbe fondamentale raccogliere elementi di prova utili alla difesa della società in un ipotetico procedimento penale (o anche amministrativo/sanzionatorio). A tal fine, le investigations realizzate con le modalità delle “indagini difensive” assicurerebbero all’ente un peculiare regime probatorio degli elementi raccolti, nonché tutte le garanzie previste dal codice di procedura penale, relative – tra l’altro – al divieto di sequestro della corrispondenza e della documentazione pertinente all’oggetto della difesa, nonché al divieto di intercettazione delle comunicazioni e conversazioni.
In ogni caso, è opportuno che le investigazioni interne siano realizzate da più soggetti organizzati in team, dotati di adeguate competenze multidisciplinari, che seguano un ben preciso action plan: quest’ultimo, redatto all’esito di un case assessment preliminare, dovrà contemplare le varie iniziative da intraprendere, dall’attività di acquisizione ed analisi della documentazione aziendale – compreso lo screening delle caselle aziendali di posta elettronica e, in generale, tutta l’attività di e-discovery – alla esecuzione di interviste con i dipendenti (management compreso).
Attraverso un apposito Focus sul tema, i nostri Giuseppe Fornari, Enrico Di Fiorino, Salvatore Rocco e Caterina Peroni rispondono ai più frequenti quesiti delle società estere che operano in Italia.
***
In Italy, internal investigations are playing an increasingly important role in the context of the criminal liability of legal entities. The main issues that are addressed when conducting an internal investigation usually include the applicable law, the objectives of the investigation, the persons entitled to carry it out, as well as the use that can be made of the findings and the materials collected in the course of the investigation.
Urgent enquiries in a business crisis context or ordinary business matters concerning the actions of employees are the typical scenarios in which internal investigations become the preferred course of action, and the first line of defence for the corporation.
1. What is the relationship between criminal corporate liability and internal investigations?
Criminal vicarious corporate liability is regulated by Legislative Decree no. 231/2001 (hereafter, “Law 231”); among other activities necessary to avoid criminal liability, corporations must ensure that their employees (including managers, directors, auditors, top management) act in accordance with the relevant procedures and protocols.
This monitoring should allow the company to always conduct its business in compliance with the law. Any misconduct – whoever the author – should be immediately reported to the competent corporate functions and to the Surveillance Committee (“Organismo di Vigilanza”), when established.
At such stage, it could indeed be useful to carry out internal investigations, in order to duly assess the seriousness of the warning. As far as internal investigations are concerned, the Italian Code of Criminal Procedure provides specific rules only to the extent they are carried out by a criminal defence counsel while, in any other case, there is no specific legislative regulation.
2. When can a company be requested to conduct an internal investigation?
The need to conduct an internal investigation could arise from several circumstances.
Firstly, it could be triggered by the report of a whistle-blower, made through (and according to) the company’s procedure. Furthermore, an internal investigation could come after the execution of investigative acts, carried out by the Prosecution Service or by an independent administrative authority (such as BANK OF ITALY, CONSOB or IVASS).
Lastly, a corporate investigation could be specifically requested by the internal control body, if anomalies have come to light in the execution of its activity. In the same way, even news spread by the media regarding alleged misconducts perpetrated by an executive or an employee – and the related possibility of the beginning of a criminal or regulatory investigation – could suggest the opportunity of a compliance check, made by internal or external auditors.
3. Which are the objectives of an investigation?
The main purpose of an internal investigation is to shed light over the object being investigated – whether it concerns an alleged breach of the company’s policies, protocols or procedures – and to clearly identify the potential consequences that may arise, whether the unethical or improper practice has criminal relevance, and if corporate disorder, lack of productivity and reputational damages are also a matter of concern.
With respect to the specific scenario of potential criminal liability, several advantages could derive from an internal investigation. First of all, the corporation could gather essential information useful in potential criminal proceedings (as well as in civil trial or disciplinary proceedings), consequently evaluating and setting up the most suitable defence. Secondly, a well-timed investigation could simplify the access to reward mechanisms provided for by Law 231 (e.g. reduction of the financial penalties, according to Article 12, and/or inapplicability of disqualification sanctions pursuant to Article 17).
In any case, the proactive initiative of the corporation would be, on one hand, a clear demonstration that the company itself does not approve, tolerate or encourage the commission of crimes by its executives and/or employees; on the other, it would be tangible proof of the effectiveness and efficiency of its internal control system. Consequently, the risk of precautionary measures (of in rem or disqualification nature) could be significantly mitigated.
4. Is a corporate investigation permitted only in case of an alleged criminal offence?
Certainly, the most common case in which a company starts an internal investigation is when a crime is alleged to have been perpetrated by an executive or an employee.
However, the settled practice shows that corporations spontaneously carry out investigations as soon as any violation of the law (or breach of procedures and protocols) within the organisation arises; likewise, an internal investigation is the very first countermeasure that a company sets up in order to deal with any fact which could trigger its liability, both from a civil or regulatory point of view.
Moreover, any illegal or unethical conduct may be a good opportunity to weed out the bad apples, promoting a good organizational culture and – in that way – protecting the company’s reputation.
5. Who is entitled to conduct an internal investigation?
The choice of the person entitled to lead the investigations depends primarily on the scope and the subject matter of the activity. If the purpose of the internal investigation is to assess whether a company’s protocol was breached, the task could be entrusted to internal auditors or members of the Surveillance Committee.
On the contrary, if there is a reasonable suspect a crime has been committed, then external counsels are strongly advised. As a matter of fact, external counsels could properly evaluate all the arising risks and verify that duties and rights provided for by the law are observed. Moreover, external parties could examine objectively the company and its policies, underlining its possible inadequacies, without being troubled by internal politics. Besides, an appointed external lawyer would grant the company attorney-client privilege.
Nonetheless, external counsels usually work in tandem with company’s in-house functions (as well as internal audit, legal counsels and compliance officers), who could provide useful insights on the organization’s operations for the investigation. In case complex investigations are needed, it is strongly recommendable to designate a multidisciplinary team; in addition, if criminal risk for the company arises, it is advisable that the team is led by a criminal defence counsel, who should receive a specific mandate in order to carry out the internal investigations in the light of the framework of defence investigations (also with a preventive scope), pursuant to Articles 327-bis and 391-nonies of the Code of Criminal Procedure. Such course of action would allow the company to collect in advance important evidence to produce in Court.
6. Who should appoint the person in charge of the internal investigation?
Typically, the appointment to lead the internal investigation derives from the Board of Directors (Chairman or the Chief Executive Officer). Nevertheless, if the company suspects that a crime has been committed, it is strongly recommendable that the Board designates a commissioner empowered to elect the person who would perform the internal investigation.
Indeed, according to Article 39 of Law 231, if a criminal investigation has begun and a member of the Board – even the chairman – was involved, there would be a conflict of interest between him or her and the company. Consequently, the acts performed on the corporation’s behalf would be invalid. Occasionally, the assignment could be given also from the Surveillance Committee.
7. What activities should the internal investigation provide for?
A company is advised to begin each investigation with a carefully drafted action plan, which should identify: (a) the allegations of misconduct or concerns reported (by internal control bodies or whistle-blowers) or resulted (from media speculations or acts of a criminal or regulatory investigation); (b) the functions and external parties who will manage and conduct the investigation; (c) all the conceivable actions to be carried out (documentation to be analysed and individuals to be interviewed); (d) the time frame for the investigation.
After a preliminary case assessment with the internal functions, the action plan should be drafted by the investigation team and must be approved by the governing body or, in case the alleged misconduct is ascribable to the Board of Directors, the Audit Committee.
Generally, before proceeding with the interview of employees it is recommended to start with the acquisition and analysis of key corporate documents.
8. Is the investigation team entitled to access corporate documents?
The team could certainly have access to all documents, data and information recorded in a place (premises, cloud or hard disk) in the availability of the company. If the documents needed are in the hands of an employee, it is worth considering that the employer has the possibility to access just to documents, information, correspondence and letters connected to the corporate activity.
Therefore, upon request from the investigation team, the employee is supposed to place the documents at the investigators’ disposal; if the employee refuses, the employer has the power to conduct an inspection of the documents, also the ones stored on individual computers and devices provided by the company.
Several issues could arise in case of necessity of access to an electronic device used solely by the employee, where it could be challenging to discern whether the files are personal or connected to the working activity.
Anyhow, considering that electronic documents could be modified and altered, even accidentally, the adoption of technical precautions and compliance to procedural rules is recommendable, so that the information gathered could be effectively filed and used in Court, notably within criminal proceedings. To this end, the corporation should consider that a criminal defence counsel is entitled to appoint technical consultants and experts, whom could securely collect data and information expendable as evidences in Court.
Furthermore, in the event that a noteworthy document is detained by a public administration, the criminal counsel has the power – according to Article 391-quater of the Italian Code of Criminal Procedure – to request and obtain a copy, addressing the demand to the administration which has produced the document or permanently holds it.
9. How should the investigation team manage the interviews?
One of the most important activities within an internal investigation is the conduction of interviews with employees and executives.
Although no regulation has been provided in Italy yet, the settled practice has defined several “recommendations”: (a) firstly, any interview should always be recorded, or at least documented and reported; (b) secondly, it is advisable that at least two interviewers take part in the interview; (c) moreover, the in-house counsel should not participate in the interview, since the interviewee could misjudge his or her role; (d) furthermore, no threat, bribe or pressure towards the interviewee should ever be performed; (e) the interviewer should remind the interviewee: (e.1.) that he represents the company and, since he is not his or her lawyer, he would not preserve the interviewee’s personal interests; (e.2.) the object of the interview; (e.3.) that the substance of the interview should not be discussed with anyone; (e.4.) his or her constitutional rights, especially if criminal/disciplinary proceedings or a civil trial could arise.
If the interview is performed within a defence investigation, the criminal defence counsel in charge has to comply with the Code of Criminal Procedure, providing the interviewee with a further series of warnings.
10. Can the employee refuse to be interviewed?
The employee is requested to cooperate with the investigation team with regard to any aspects connected to his or her role and tasks, and more broadly to any information he or she learnt due to the job. The duty to respond – and to respond truthfully and without reticence – descends from the duties of loyalty and cooperation, provided for by the Civil Code (in particular, Articles 2094, 2104, 2105 and 2106).
The same duties suggest that the employee is requested to report any misconduct or wrongdoing carried out by other individuals within the organization. This obligation is even more significant, in case an employee in a senior position is investigated, and he or she is asked to provide information about the conduct of someone who is reporting to him or her.
On the contrary, in the case of a former employee, the interview might be carried out only with the consent of the person being interviewed.
A broad limit to the aforementioned duties of cooperation is represented by the privilege against self-incrimination (or “right to silence”), recognised by the European Convention on Human Rights (ECHR) and the Italian Constitution as an appendix of the right of the defence. In fact, in case the interview is conducted by the criminal defence counsel, according to the Code of Criminal Procedure, the lawyer shall interrupt the gathering of information, if the person interviewed makes self-incrimination statements, revealing indication of guilt against himself or herself.
Moreover, pursuant to the privilege against self-incrimination, where it arises, it prevents individuals from having to take statements which might incriminate himself or herself. If the employee, able to provide relevant information, has exercised his right, the lawyer could request the Public Prosecutor to set the examination within seven days.
11. Is the employee or executive entitled to be assisted by his or her lawyer?
Generally, the employee or executive does not have the possibility to be assisted by a lawyer during the interview. The cooperation requested to the employee, with the related duty to answer, derives from the current working relationship, and the investigation aims specifically to gather information with regard to behaviours taken in violation of internal procedures or protocols, or against the law.
In the event the employee is already under criminal investigation conducted by the Prosecution Service, his or her right to defence allows the privilege against self-incrimination to be raised and, where he or she decides to render a statement, to be assisted by a lawyer.
Similarly, in case a disciplinary proceeding has already been triggered against the employee, the latter is entitled to have a lawyer.
12. How could information gathered be used in the criminal proceedings?
The potential usage of information or documents should be carefully evaluated before starting an internal investigation, paying attention to the source and the procedure followed. Documents, obtained during the investigation, can be filed in Court within the criminal proceedings’ dossier, where they can be read and taken into consideration by the judge for the decision.
Considering the lack of an express ban, it is possible to conclude that even minutes of the interviews can be filed during the criminal proceedings (which would be, however, evaluated by the judge merely as “documents”).
Moreover, if the interview has been carried out according to the rules provided for by the Code of Criminal Procedure for defence investigation, the minutes of the interviews can be inserted in the defending lawyer’s dossier, which is drafted and kept at the office of the Preliminary Investigation Judge. Therefore, the latter could take into account the elements of evidence in case he or she has to take a decision that does not require the intervention of the company’s defence counsel.
Besides, the statements included in the lawyer’s dossier can be used – during the trial – in order to challenge, in whole or in part, the content of a testimony. If, due to unforeseeable circumstances, it has become impossible to summon the employee interviewed, the minutes of his or her interview can be filed within the trial dossier and read by the judge as a notable piece of evidence.
13. Could legal privilege be invoked in relation to an internal investigation?
If the internal investigation is carried out with the prerogatives of preventive defence investigations, according to Article 327-bis and Article 391-nonies of the Code of Criminal Procedure, the legal privilege (attorney-client privilege) is granted to the criminal defence counsel, in addition to the professional secret generally provided for by Article 200 of the Code of Criminal Procedure.
In particular, Article 103 of the Code of Criminal Procedure (“Safeguards of freedom of the lawyer”) guarantees the freedom of the criminal defence counsel to forbid the seizure of papers and documents related to the subject of the defence that are retained at the defence lawyer’s premises, unless they are corpus delicti (“body of crime”).
Moreover, the aforementioned article also forbids the wiretapping of conversations or communications between the defence lawyers and their clients and rules that the seizure and any form of control of the correspondence between the suspect and his defence lawyer is not allowed unless the judicial authority has grounded motive to believe that it involves the corpus delicti.
The legal privilege is granted to the criminal counsel not only in relation to the criminal proceedings in which he or she carried out the investigation, but it is recognized to all criminal lawyers admitted to the Bar, with regard to any legal activity, even if extraneous to the criminal proceedings.
14. Does attorney-client privilege apply to in-house counsel?
While attorney-client privilege applies in relation to external counsel, the professional activity of an in-house counsel is neither recognised nor regulated by any legal provision or statute. In-house counsel cannot be admitted to the Bar (with some limited exceptions) and are thus deprived of all rights and privileges afforded to independent lawyers who are members of the Italian Bar. Still, some judgments exceptionally recognise the possibility of invoking legal privilege when in-house counsel is defending the company in proceedings.
15. What are the prerogatives arising from legal privilege?
Firstly, according to Article 200 of the Code of Criminal Procedure, criminal lawyer cannot be obliged to testify on what they know on account of their function, service or profession.
Secondly, Article 256 of Code of Criminal Procedure, relating to the duty to disclose documents and documentary evidence, requires the lawyer, in writing and with a specific declaration, to confirm to the judicial authority that documents are covered by professional secret. As mentioned above, professional secret does not provide the same advantages deriving from the attorney-client privilege, pursuant to Article 103 of the Code of Criminal Procedure.
16. Is it mandatory to share the information gathered with the public authority?
There is no duty to share the outcome of the internal investigation with the Prosecution Service or with the independent administrative authority.
However – except for (i) the correspondence between lawyer and client; (ii) the documents composed by the lawyer (such as legal opinions) and (iii) those collected during the internal investigation carried out pursuant to the relevant provisions of the Code of Criminal Procedure – the Public Prosecutor has the possibility to order, by reasoned decree, the seizure of the corpus delicti and of material items related to the offence necessary for ascertaining the facts of the case.
17. What effects may arise from cooperation (or – on the contrary – lack of cooperation) with public authorities?
It must be clear that, if the company voluntarily discloses and reports to the public authorities a misconduct of its employee or executive (self-reporting), Law 231 does not contemplate any limitation to the investigation activity and to the possibility for the Prosecutor to file the request for committal to trial.
Nonetheless, any conduct of cooperation, even if it does not allow the Public Prosecutor to drop the case, could lead to several procedural rewards.
Firstly, a reduction of the financial penalties could be granted according to Article 12 of Law 231 if, before the first-instance court hearing begins: (a) the entity has completely refunded the damage and has either eliminated the damaging or dangerous consequences of the crime or taken effective steps in this direction; and (b) the entity has adopted and put into practice a compliance model to prevent crimes of the type in question.
Secondly, a voluntary cooperation could be taken into consideration by the judge, as partial proof of the repairing of the consequences of a crime. In particular, according to Article 17 of Law 231, disqualification sanctions are not applied if the following conditions exist before the first-instance court hearing begins: (a) the company has completely refunded the damage and has either eliminated the damaging or dangerous consequences of the crime or taken effective steps in this direction; (b) the company has eliminated the organizational deficiencies that allowed the crime to be committed by adopting and implementing compliance models suitable for preventing crimes of the type in question; (c) the company has set available for confiscation the profit derived from the offence.
In case of lack of cooperation, no negative consequences are provided for by law. After all, the company under investigation – or at trial – assumes the same position as the defendant, and therefore the privilege against self-incrimination (or right to silence) is granted. Nevertheless, the attitude shown by the company could lead to greater reputational risk and could be taken into consideration by the Prosecutor in a request for precautionary measures against the corporation or employees/executives.
18. Which is the role of the Surveillance Committee within an internal investigation?
The role of the Surveillance Committee ensures an on-going monitoring that the activity of the company is always carried out in compliance with the corporate procedures, rules and protocols, according to Law 231.
The Surveillance Committee should be promptly informed of every misconduct within the company, upon which the Surveillance Committee could: (a) directly investigate on the alleged wrongdoing; (b) appoint an external counsel with the task to carry out an internal investigation; (c) advise the Board of Directors to set up an internal investigation. Accordingly, the Surveillance Committee: (i) carries out the internal investigation, inspects corporate information, data and documents, and also interviews employees and/or executives, at its own discretion (in this scenario, it must be clear that no attorney-client privilege would be granted); (ii) coordinates the internal investigation, defining – along with the investigation leader – the action plan and the composition of the team. The investigation leader must update the Surveillance Committee on a regular basis on the execution of the internal investigation (likewise, the Surveillance Committee must be informed of the investigation’s outcomes); (iii) should coordinate its work with the activity of the investigation team. Since the investigation leader reports directly to the Board of Directors, it is not mandatory to inform the Surveillance Committee of the developments of the internal investigation.
