Under the Microscope: Structuring Internal Investigations That Withstand DOJ Challenge

For years, the internal investigation occupied a comfortable middle ground in corporate legal strategy: thorough enough to satisfy boards and auditors, yet sufficiently contained to limit institutional exposure. That equilibrium has shifted. The Department of Justice, through a succession of updated guidance memoranda and high-profile enforcement actions, has signaled that it will scrutinize not merely the conclusions of internal investigations but the methodology, scope, and independence behind them. For general counsels, the message is unambiguous: the investigation itself is now an evidentiary artifact.

Understanding what the DOJ actually evaluates—and why certain investigations collapse under that scrutiny—is the first step toward building protocols that hold.

What Triggers Federal Skepticism

DOJ attorneys reviewing corporate cooperation do not begin from a position of trust. They are trained to identify the hallmarks of an investigation designed to protect the institution rather than uncover the truth. Several patterns reliably attract adverse attention.

The first is scope limitation without documented justification. When an investigation is narrowly drawn—confined, for instance, to a single business unit when the underlying conduct suggests systemic exposure—prosecutors interpret that narrowness as strategic rather than logical unless the company can demonstrate a principled rationale. A defensible investigation articulates, in writing, why its boundaries were set where they were.

The second is interviewer proximity to the subject matter. Assigning internal attorneys who have prior relationships with witnesses, or who themselves participated in the transactions under review, creates an appearance of conflict that the DOJ will exploit. The independence of the investigation team is not merely an ethical consideration; it is a structural one that bears directly on whether the government credits the findings.

The third, and perhaps most consequential, is document preservation failure. Under the DOJ's Corporate Enforcement Policy, voluntary self-disclosure and full cooperation are the twin pillars of favorable treatment. Nothing undermines both more swiftly than evidence that potentially relevant documents were destroyed, altered, or simply not collected. Prosecutors view document gaps not as accidents but as choices—and they evaluate them accordingly.

Building an Investigation Framework That Demonstrates Good Faith

The foundation of a defensible internal investigation is independence, and independence must be structural rather than rhetorical. For matters involving potential criminal exposure, this typically means engaging outside counsel with no prior relationship to the relevant business unit, operating under a formal engagement letter that delineates the scope and reporting obligations of the investigation. The board's audit committee or a special committee of independent directors should authorize and receive the investigation's findings directly, creating a governance chain that bypasses management where management may itself be implicated.

Scope decisions deserve particular care. General counsels should document, contemporaneously, the reasoning behind each scoping choice—why certain custodians were included, why particular time periods were selected, and what threshold of materiality governed the collection of financial records. This documentation does not merely protect the company in subsequent proceedings; it disciplines the investigation team to think rigorously about completeness rather than convenience.

Witness interview protocols represent another area where methodology matters enormously. The DOJ's guidance, particularly in the wake of the Monaco Memorandum and its subsequent refinements, emphasizes that companies seeking cooperation credit must ensure that individuals—not just the institution—are held accountable where the facts warrant. This means interview practices must be designed to elicit candid testimony rather than to shape or harmonize narratives. Admonishment language at the outset of each interview, clearly explaining that the attorney represents the company and not the individual, is not merely a professional responsibility requirement; it is a prerequisite to credibility with federal prosecutors.

The Attorney-Client Privilege Calculus

No dimension of internal investigation strategy is more contested—or more consequential—than the management of attorney-client privilege. General counsels face a genuine tension: the communications that make an investigation most valuable internally are often the ones that, if disclosed, would be most useful to the government.

The DOJ's current posture does not formally require companies to waive privilege as a condition of cooperation credit. However, the practical dynamics of federal investigations create substantial pressure to share at least the factual findings of an investigation, even where the underlying work product remains protected. Companies that selectively disclose favorable findings while withholding unfavorable ones risk being perceived as acting in bad faith—a characterization that can eliminate cooperation credit entirely.

The most defensible approach involves a deliberate separation between the factual record and the legal analysis. Investigators should maintain clean factual chronologies—interview memoranda, document timelines, financial reconstructions—that can be shared with the government without requiring disclosure of privileged legal conclusions. This architecture requires planning from the investigation's outset, not as an afterthought when the DOJ comes calling.

General counsels should also be attentive to the crime-fraud exception. Communications made in furtherance of ongoing wrongdoing are not protected by privilege, and courts have shown increasing willingness to conduct in camera reviews where the government makes a preliminary showing of exception applicability. Investigations that uncover continuing misconduct must address that misconduct promptly; allowing it to persist while the investigation proceeds eliminates any privilege protection for communications made during that window.

Documentation as Defense

The institutional record of an investigation—how decisions were made, who made them, and on what basis—has become as important as the investigation's substantive findings. General counsels should treat investigation documentation as a form of regulatory compliance in its own right.

This means maintaining a privilege log from the investigation's inception, even before litigation is anticipated. It means preserving communications among the investigation team that reflect the evolution of scope and methodology decisions. And it means creating a written record of remediation steps taken in response to preliminary findings, demonstrating that the investigation was connected to genuine institutional change rather than serving as a containment exercise.

Post-investigation reporting to the board should be formal, comprehensive, and retained. The DOJ will ask, in any subsequent proceeding, whether the board was fully informed and what it did with that information. A board that received a sanitized summary and asked no follow-up questions presents a very different posture than one that engaged substantively with findings, requested additional inquiry where appropriate, and documented its oversight role.

The Strategic Imperative

The DOJ's intensified scrutiny of internal investigations reflects a broader enforcement philosophy: that corporate accountability is not achieved through fines alone but through institutional transformation that makes future misconduct less likely. Investigations that demonstrate genuine commitment to that transformation—through independent process, comprehensive scope, rigorous documentation, and credible remediation—earn the cooperation credit that can mean the difference between a declination and an indictment.

For general counsels, the practical implication is that investigation protocols can no longer be improvised in response to each new incident. They must be designed in advance, stress-tested against DOJ guidance, and embedded in the company's governance infrastructure before the next crisis arrives. The enforcement gap between companies that have done this work and those that have not is closing—and the consequences of falling on the wrong side of it have never been more severe.