First Contact: How In-House Counsel Should Triage Incoming Legal Demands Before the Clock Runs Out

When a subpoena lands on a general counsel's desk, the instinct is often to treat it as a singular event — a discrete legal obligation to be routed to the appropriate litigation team and managed through established document-production workflows. That instinct, while understandable, can be dangerously inadequate. The manner in which a company responds in the first 48 hours following receipt of a government demand frequently shapes the entire trajectory of any subsequent investigation, enforcement action, or litigation. Understanding how to read what has arrived — and what it likely signals — is among the most consequential skills a modern general counsel can possess.

Not All Subpoenas Are Created Equal

At the most basic level, incoming legal demands fall along a spectrum of institutional risk. On one end sit routine civil subpoenas issued in third-party litigation — demands that require a company to produce records because it happens to possess information relevant to a dispute between other parties. These are procedurally significant but rarely existential. On the other end sit grand jury subpoenas, Civil Investigative Demands (CIDs) issued by the Department of Justice, or formal investigative orders from agencies such as the SEC, CFTC, or CFPB. These instruments do not merely request information — they frequently signal that the issuing authority has already developed a theory of potential wrongdoing and considers the recipient either a subject, a target, or a material witness.

The critical error many organizations make is applying identical workflows to both categories. Routing a grand jury subpoena through the same administrative process used to respond to a routine civil discovery request is not merely inefficient — it is a governance failure that can compromise privilege, misalign internal communications, and deprive leadership of the situational awareness required to make sound strategic decisions.

Red Flags That Demand Immediate Escalation

Certain characteristics of an incoming legal demand should trigger immediate escalation to senior leadership and, in many cases, prompt engagement of outside counsel with specific government-enforcement experience. General counsels should treat the following as high-priority indicators:

Grand jury identification. Any subpoena bearing the caption of a federal grand jury proceeding warrants immediate attention. Grand juries do not issue subpoenas for academic purposes. Their invocation signals that a federal prosecutor has sufficient predicate to open a formal criminal investigation and has received judicial authorization to compel testimony or document production.

Narrow, targeted document requests. Paradoxically, highly specific requests — those seeking records associated with particular individuals, specific transactions, or defined time windows — are often more alarming than broad, sweeping demands. Specificity frequently reflects prior investigative work. If a regulator already knows to ask for communications between two named executives during a three-week period in a particular quarter, they likely know why those communications matter.

Parallel civil and criminal indicators. When a company receives near-simultaneous demands from both a civil regulatory body and a criminal enforcement division — or learns through counsel that both are active — the risk profile escalates substantially. Coordination between the SEC's Enforcement Division and DOJ's Criminal Division, for example, is well-documented and increasingly common in securities fraud investigations.

Requests involving current or former senior personnel. A subpoena seeking communications to or from C-suite executives, board members, or the general counsel's own office introduces privilege complexity and governance sensitivity that standard litigation workflows are not designed to handle.

Unusual service methods or accompanying law enforcement activity. A subpoena hand-delivered by federal agents, or one that arrives in conjunction with a search warrant execution at a company facility, transforms a legal compliance matter into an active crisis requiring immediate, coordinated response across legal, communications, and executive leadership.

The First 48 Hours: A Framework for Structured Response

The hours immediately following receipt of a significant legal demand are not the time for deliberation — they are the time for structured action. General counsels should operate against a clear internal protocol that addresses the following in sequence:

Authenticate and categorize. Confirm the demand is genuine, identify the issuing authority, and determine whether it is civil, criminal, regulatory, or grand jury in nature. Verify the return date and any compliance deadlines. These steps sound rudimentary, but organizations operating without formal intake procedures routinely misroute or misclassify demands at this stage.

Issue a litigation hold immediately. Regardless of how the demand is ultimately classified, a defensible litigation hold notice should be issued as soon as counsel determines that reasonably anticipated litigation or investigation exists. Courts and regulators have shown diminishing patience for spoliation defenses premised on delayed hold implementation. The hold should be tailored, documented, and confirmed in writing by all custodians.

Evaluate the privilege landscape. If the demand touches on matters that may implicate attorney-client communications or work product, outside counsel should be engaged before any internal communications about the substance of the inquiry are created. Internal emails discussing the merits of a government investigation are not automatically privileged, and careless internal messaging in the early hours of a response has repeatedly surfaced as damaging evidence in subsequent proceedings.

Assess subject-versus-witness status. Where possible, counsel should make discreet inquiries — typically through outside counsel with government relationships — to assess whether the company is being treated as a subject or target of an investigation, or merely as a third-party witness. This distinction materially affects response strategy, cooperation calculus, and disclosure obligations to the board.

Brief the board appropriately. For demands that clear the escalation threshold, the audit committee or full board should be informed in a manner that is accurate, appropriately measured, and privilege-protective. Boards have fiduciary obligations that require material legal risk information; general counsels who manage up selectively or delay disclosure in significant matters expose themselves and the company to compounded governance liability.

Building Institutional Readiness Before the Demand Arrives

The most effective triage systems are not assembled reactively. Organizations that navigate government inquiries with minimal disruption typically have invested in advance infrastructure: documented intake protocols, pre-identified outside counsel relationships with enforcement-specific expertise, board-level awareness of escalation thresholds, and litigation hold systems that can be activated within hours rather than days.

General counsels should conduct periodic tabletop exercises that simulate the receipt of a significant government demand, stress-testing the organization's ability to authenticate, categorize, escalate, and preserve within the critical early window. These exercises reveal gaps — in personnel awareness, in document management systems, in executive communication protocols — that are far less costly to address prospectively than during an active enforcement inquiry.

The subpoena that arrives without warning is, in one sense, unavoidable. The institutional unpreparedness that transforms a manageable legal demand into an organizational crisis is not.