Corporate Internal Investigations and Federal Disclosure Obligations

The Disclosure Trap: When Your Internal Investigation Becomes a Federal Exhibit

In my 25 years as a federal prosecutor and now as a defense attorney, I have watched too many well-intentioned corporate internal investigations morph into the prosecution's most powerful weapon against the very companies that commissioned them. The fundamental tension is this: the federal government expects corporations to self-police and self-report, but every document created, every interview conducted, and every conclusion drawn during an internal investigation becomes a potential exhibit in a criminal or civil enforcement action. I have seen chief compliance officers sit in my office, stunned, as I explain that their detailed internal memorandum summarizing employee interviews—prepared with the best intentions—has just handed the Department of Justice a roadmap to indict their client. The federal disclosure obligations that attach to internal investigations are not merely procedural formalities; they are substantive legal minefields that demand strategic navigation from the very first moment a potential violation is identified. The False Claims Act, 31 U.S.C. § 3729, imposes strict liability for knowingly presenting false claims to the government, and the knowledge element can be satisfied by information uncovered during an internal investigation, even if that information is preliminary and unverified. I have seen companies rush to disclose preliminary findings to demonstrate cooperation, only to discover that those disclosures triggered mandatory reporting obligations under the Securities Exchange Act of 1934 and the Sarbanes-Oxley Act of 2002, creating a cascade of liability that a more measured approach could have avoided entirely. The key takeaway that I drill into every client is this: an internal investigation is never purely an internal matter, and every step you take must be evaluated through the lens of how it will appear to a federal prosecutor who is reviewing the investigation's methodology and conclusions with the benefit of hindsight.

The False Claims Act and the Duty to Disclose: Beyond Mere Cooperation

The interplay between corporate internal investigations and the False Claims Act creates what I call the "disclosure paradox," where the act of investigating can itself generate new disclosure obligations that did not previously exist. Under 31 U.S.C. § 3729(a)(1)(G), commonly referred to as the reverse false claims provision, a person violates the False Claims Act by knowingly concealing or knowingly and improperly avoiding an obligation to pay money to the government. In my experience representing healthcare companies and government contractors, I have seen internal investigations uncover billing errors that, had they remained undiscovered, would not have constituted a violation because the company lacked the requisite knowledge. However, once the internal investigation identifies the error and confirms its existence, the company now has actual knowledge of an overpayment, and the failure to disclose and return that overpayment within sixty days creates a new, independent violation of the False Claims Act under the Affordable Care Act's 60-day repayment rule, codified at 42 U.S.C. § 1320a-7k(d). I have defended companies that conducted internal audits in good faith, identified overpayments, and then spent months analyzing the scope of the problem before making disclosure—only to face civil investigative demands and qui tam complaints alleging that the delay itself constituted a knowing concealment of an obligation to repay. The federal sentencing guidelines at USSG §8B2.1 require that organizations have an effective compliance and ethics program, and one of the hallmarks of such a program is the prompt disclosure of any identified violations to appropriate government authorities. However, "prompt" is a term of art that must be balanced against the need to conduct a thorough investigation, and I have seen prosecutors argue that a company that takes more than thirty days to disclose findings has failed to meet this standard, even when the delay was caused by the legitimate complexity of the investigation. The strategic response I recommend to my clients involves creating a structured disclosure timeline that documents every step of the investigation, the reasons for any delays, and the factual basis for any conclusions reached, so that if the government later questions the timing of disclosure, the company can demonstrate good faith and reasonable diligence rather than concealment.

The Yates Memo's Individual Accountability Mandate: Who Do You Sacrifice and When?

The September 2015 Yates Memorandum, which was subsequently incorporated into the Justice Manual at Section 9-28.000 et seq., fundamentally altered the calculus of corporate internal investigations by requiring that companies identify all individuals involved in misconduct and provide all relevant facts about those individuals to qualify for any form of cooperation credit. In my years as a federal prosecutor, I saw the pre-Yates era where companies could conduct internal investigations, fire a few low-level employees, and negotiate deferred prosecution agreements that protected senior executives from scrutiny. That era is dead, and any corporate counsel who approaches an internal investigation with the assumption that they can limit disclosure to a narrow set of facts is making a catastrophic strategic error. The Justice Manual now explicitly states that a corporation's cooperation will be evaluated based on whether it timely discloses all relevant facts about individual misconduct, including the involvement of senior executives, and that failure to provide such information can result in the denial of cooperation credit entirely. I have personally represented companies that conducted internal investigations, identified misconduct by mid-level managers, and disclosed those findings to the government, only to have prosecutors demand access to the entire investigative file, including attorney interview memoranda and privileged legal analysis, under the theory that the company had waived privilege by selectively disclosing certain facts. The Department of Justice's position, as articulated in the Justice Manual and in numerous enforcement actions, is that a company cannot pick and choose which facts to disclose; if you want cooperation credit, you must provide the government with a complete picture of the investigation, including the evidence that might be exculpatory or that might implicate higher-level executives. I advise every client to assume that any internal investigation document, including draft reports, interview notes, and email communications with counsel, will eventually be produced to the government, and to conduct the investigation accordingly. The strategic decision of when and how to disclose individual wrongdoers is perhaps the most consequential decision in any corporate internal investigation, and I have seen companies make the mistake of disclosing individuals too early, before the investigation is complete, only to have those individuals retain separate counsel who then provide exculpatory evidence that contradicts the company's initial disclosures, creating the appearance of a shifting narrative that undermines credibility with prosecutors.

Privilege, Work Product, and the Selective Waiver Gambit

The attorney-client privilege and the work-product doctrine are the twin pillars that protect the confidentiality of internal investigations, but I have seen more companies inadvertently waive these protections than I can count, often through well-meaning efforts to demonstrate transparency to regulators. The federal common law, as articulated in cases like United States v. Ruehle, 583 F.3d 600 (9th Cir. 2009), and the principles codified in Federal Rule of Evidence 502, make clear that disclosure of privileged communications to a third party, including a government regulator, generally waives the privilege as to all communications on the same subject matter. I have represented companies that entered into confidentiality agreements with the Securities and Exchange Commission or the Department of Justice, believing that those agreements would protect their privilege, only to discover that in subsequent civil litigation brought by private plaintiffs, the courts refused to recognize the concept of "selective waiver" and ordered the production of all privileged materials that had been shared with the government. The American Law Institute's Restatement (Third) of the Law Governing Lawyers and the majority of federal circuit courts have rejected the selective waiver doctrine, meaning that once you show your cards to the government, you have shown them to the world, including plaintiffs' attorneys, qui tam relators, and competitors in civil litigation. In my practice, I now insist that every internal investigation be conducted under a carefully structured protocol that separates factual investigation from legal analysis, with privilege logs prepared contemporaneously and all privileged communications clearly marked and segregated from non-privileged materials. I also advise clients to consider whether they need to disclose privileged materials at all, or whether they can provide the government with sufficient factual information through non-privileged channels, such as factual summaries prepared by non-attorney investigators or reports that do not contain legal advice or analysis. The federal sentencing guidelines at USSG §8B2.1(b)(5) require that organizations take reasonable steps to respond to detected offenses and prevent further similar offenses, and this can often be accomplished without waiving privilege by implementing remedial measures and providing the government with a detailed factual narrative that does not reveal the specific content of privileged communications. I have successfully negotiated with federal prosecutors to accept factual proffers rather than privileged documents, and I have found that the government is often more interested in the substance of the facts than in the specific wording of attorney interview memoranda, provided that the company can demonstrate the reliability and completeness of its factual disclosures through other means.

Frequently Asked Questions

What is the single most important step a company should take before launching an internal investigation that may trigger federal disclosure obligations?

In my experience, the single most important step is to conduct a pre-investigation privilege and disclosure mapping exercise, where corporate counsel identifies every federal statute, regulation, and contractual provision that could impose a disclosure obligation based on the potential findings of the investigation. This mapping should include the False Claims Act's reverse false claims provision at 31 U.S.C. § 3729(a)(1)(G), the Sarbanes-Oxley Act's certification requirements at 18 U.S.C. § 1350, the Securities Exchange Act's reporting obligations under Section 13 and Section 16, and any applicable regulatory reporting requirements from agencies like the FDA, EPA, or SEC. I have seen companies launch investigations without this mapping and then discover mid-investigation that they have already triggered a disclosure obligation under the federal securities laws by creating internal documents that suggest material weaknesses in internal controls, even though the investigation was still in its preliminary stages. The pre-investigation mapping also allows counsel to structure the investigation to avoid creating unnecessary disclosure triggers, for example by using non-attorney investigators to gather facts initially and only involving attorneys when legal advice is needed, thereby reducing the risk that preliminary factual findings will be attributed to the company as knowledge for purposes of the False Claims Act's scienter requirement.

Can a company disclose findings to the Department of Justice while maintaining attorney-client privilege for the underlying investigative materials?

The short answer is that it is extremely difficult to maintain privilege once materials are disclosed to the government, and the concept of selective waiver is not recognized in the majority of federal circuits. While some courts have recognized a limited "common interest" or "joint defense" privilege when sharing information with the government, this protection is narrow and does not extend to subsequent civil litigation by private parties. I advise clients that any document or communication shared with the government should be presumed to be discoverable by any party in any future proceeding, and that the decision to share privileged materials must be weighed against the risk of waiving privilege as to the entire subject matter of the investigation. The safer approach is to provide the government with detailed factual summaries and investigative findings that do not reveal privileged legal analysis or attorney mental impressions, while maintaining privilege over the underlying interview memoranda, legal research, and strategy documents. However, I have also seen situations where the government insists on access to the full investigative file as a condition of cooperation credit, and in those cases, the company must make a strategic decision about whether the benefits of cooperation outweigh the risks of privilege waiver, taking into account the likelihood of subsequent civil litigation and the potential value of the privileged materials to adverse parties.

Your Next Move: Protecting Your Company from the Investigation Itself

If your company is facing a potential compliance issue or has already received a subpoena or civil investigative demand, the decisions you make in the next seventy-two hours will determine whether this matter remains a manageable compliance issue or escalates into a federal criminal investigation that threatens the organization's survival. I have spent my career on both sides of these battles, and I know that the difference between a successful resolution and a catastrophic outcome often comes down to the strategic choices made before the internal investigation even begins. Do not assume that your general counsel or in-house compliance team has the experience necessary to navigate the intersection of internal investigations and federal disclosure obligations, because this is a specialized area where even sophisticated lawyers make mistakes that have lasting consequences. I invite you to contact my office for a confidential consultation where we can review your specific situation, assess your disclosure obligations under the False Claims Act, the securities laws, and the federal sentencing guidelines, and develop a strategic plan that protects your privilege, manages your disclosure risks, and positions your company for the best possible outcome. The federal government is not going to wait while you figure out your obligations, and neither should you.