Preventing and Investigating Fraud During the Coronavirus Outbreak

History teaches us that national emergencies provide a plethora of opportunities to commit fraud within companies. Likewise, fraud is more likely to become exposed during economic downturns. One need only look to Bernie Madoff’s Ponzi scheme, which began unraveling during the Great Recession. Now more than ever, companies must be proactive in preventing, identifying, and investigating fraud.

Implement Strong Compliance and Data Privacy Policies

Businesses and individuals are experiencing unprecedented levels of financial strain, debt, and uncertainty. These conditions have created a heightened risk of fraud within an organization. For companies that are recently adjusting to remote-work environments, detecting fraud may be more challenging. It is crucial for companies to proactively revisit policies to make certain that appropriate controls and strong compliance policies are in place.

Regulatory agencies have begun issuing guidance addressing various topics in the context of COVID-19, including financial reporting, environmental compliance, privacy, and cybersecurity. Regulated entities should pay close attention to regulatory guidance and modify policies accordingly.

It would also be prudent for businesses to revisit their data privacy policies. In adjusting to remote-work environments, employees are increasingly using subscription-based communication services and personal devices to conduct business. Staying digitally connected with employees may provide oversight and deter fraud. However, companies should be mindful that these communication tools also present data privacy concerns that will impact a company’s ability to preserve and access relevant evidence in an internal investigation. For example, unless employees are using a company-owned Zoom account, the company’s ability to access the data is limited, even if the data is business-related.[1] Accordingly, companies should consider modifying their data privacy policies to address the company’s right to access data stored on personal devices and accounts, company-issued devices, and company accounts.

Decide Whether to Conduct an Internal Investigation

With companies facing dwindling resources, it may be tempting to delay an internal investigation of alleged wrongdoing until the physical operations of the business reopen. However, a delay may compromise the company’s ability to gather evidence and manage potential legal and financial exposure. In deciding whether to delay an investigation, companies should pause to consider various factors, including:

• • The seriousness of the allegations and whether delaying the investigation will result in criminal, civil, or financial exposure for the company or any of its employees.

• • Whether the company’s internal controls and policies may have enabled the alleged fraud, and if so, whether a delay will create legal or financial exposure for the company.

• • The likelihood that key witnesses will leave the company or become furloughed during the current crisis, which would create potentially significant hurdles in a future investigation.

• • The likelihood that delaying will impede the company’s ability to preserve evidence. For example, companies should consider whether a delay will encourage the alleged wrongdoers to destroy evidence or tamper with witnesses.

• • The alleged wrongdoer’s role in the company and the likelihood that the wrongdoing will continue if an investigation is delayed.

• • Regulated entities should consider the impact that a delay may have on compliance and industry-related requirements.

Preserve, Collect, and Review Documents

Even if an investigation is delayed, it is crucial to expeditiously identify possible custodians and data repositories and take concrete steps to preserve potentially relevant documents. In addition to sending litigation hold letters to appropriate custodians, companies should work with their IT professionals to ensure that data stored on relevant devices and accounts are preserved.

With employees working remotely, companies must identify which subscription-based services employees are using to conduct business in their new remote-work environments. Even without allegations of fraud, companies should proactively review data preservation policies of these services and customize retention and deletion permission settings accordingly. Gaining a thorough understanding of the data privacy policies will substantially increase a company’s readiness to properly preserve data in the future.

Interviewing Witnesses Remotely

Delaying interviews of key witnesses may not be advisable for the reasons described above. While “social distancing” orders make in-person interviews impossible for the foreseeable future, interviews are made possible by phone or videoconference. However, remote interviews present unique challenges that must be considered before proceeding. While not an exhaustive list, in-house counsel should consider the following issues:

• • Conducting interviews using a subscription-based application increases security risks and breaches of confidentiality. Counsel should ensure that the videoconferencing service of choice has implemented appropriate security and privacy measures.

• • In most cases, witness interviews should not be recorded because such audio-recordings are potentially discoverable in criminal, civil, and regulatory matters. Additionally, companies should keep in mind that recording audio and videoconferences without consent is a crime in Pennsylvania and other states. [2]

• • Make certain that the witness is not recording the interview. At the outset, counsel should notify the witness that recording the interview is prohibited. To the extent possible, recording options in the videoconference service should be disabled.

• • In addition to giving Upjohn[3] warnings, it is crucial for counsel to take additional steps to maintain attorney-client privilege. With employees working from home, the presence of family members in the household could jeopardize privilege and confidentiality. Prior to conducting the interview, counsel should, at a minimum, confirm that the witness is alone and will remain in a private location for the duration of the interview.
  • Remote interviews present the risk that the witness will communicate with third parties during the interview. For example, a witness may be tempted to text message a co-worker, seeking advice about the questions being asked. This reality may impact counsel’s ability to obtain truthful answers from the witness. Accordingly, counsel should warn the witness not to communicate with anyone during the interview and remind the witness that discussing the substance of the interview with others is prohibited.

The Coronavirus Task Force at Klehr Harrison stands ready to assist you in your business and legal needs. We will continue to provide additional information and guidance as the COVID-19 situation develops.

Author Stephanie Wolbransky is an associate in the Litigation Department at Klehr Harrison.

[1] See Privacy Policy, Zoom, available at https://zoom.us/privacy (updated 3/29/20).

[2] See 18 Pa.C.S. § 5703.

[3] See Upjohn Company v. United States, 449 U.S. 383 (1981) (attorney-client privilege is preserved between the company and its attorney when its attorney communicates with the company’s employees, despite the rule that communications with third parties constitute a waiver of the attorney-client privilege).