Regulatory Investigations: A survival guide

Emma Bufton: Hello everyone. My name is Emma Bufton and I am a Senior Associate at Gowling WLG and I co-chair ThinkHouse Foundations; a network for in-house lawyers at the start of their careers where we provide tailored training, development and resources for lawyers of up to five years PQE. I am here with Natalie Barton-Howes from our Regulatory Crime team who is experienced in leading clients through regulatory investigations and minimising the impact that they can have for businesses. Natalie spoke recently at our ThinkHouse Foundations event about regulatory investigations and enforcement and gave some great practical advice on this. No-one wants to be on the receiving end of a regulatory investigation, under any circumstances. They inevitably cause business disruption, take up significant management time and can result in extremely serious consequences and reputational damage. So Natalie, who is mainly at risk from being subject to an investigation by their regulator?

Natalie Barton-Howes: Well, there are very many different regulators who can investigate for many different reasons. There are particularly high risk industries and sectors who can expect to be subject to more scrutiny, depending on what they do. For example, those in manufacturing and construction are going to be on the radar of the Health and Safety Executive and the Environment Agency. The healthcare sector is closely monitored by a number of bodies including the Care Quality Commission and The Medicines and Healthcare Products Regulatory Agency. Different regulators have different priorities, resources and approaches to enforcement and you need to be aware of who is most likely to get involved in any incident involving your business.

Emma: Despite their differences, are there any tips you can share from your experience that would be relevant to the majority of regulatory investigations?

Natalie: Well, the first priority will be to respond early and appropriately at the start of the investigation, understand what is being investigated and why and take control of the response to the regulator. The immediate priority is safety or stopping any illegal conduct. An emergency response plan for your business should be prepared just in case with a single point of contact to coordinate the response in the first instance. You are also always going to need to cooperate with the regulator, bearing in mind your ongoing relationship with them and their powers of enforcement. Be as helpful as you can be to cooperate with their investigation but where you are entitled to, ask questions, pushback, ask for more time, seek legal support and manage how the investigation is being carried out, particularly where the investigation is causing significant business interruption. You should also think about any notifications that need to be made; for example to the Environment Agency or to the HSE, for certain injuries, dangerous occurrences, illnesses and fatalities within a specified timeframe. Conversely, some investigations need to be discreet, where there is a danger of tipping off those who may be implicated. You should have clear internal escalation procedures to follow so it is understood who needs to be informed about investigations including legal support, any external advisors or group companies. There is also likely to be a pre-requisite for any insurance cover, be it civil claims or legal defence costs, but insurers are notified of any incident as soon as possible. Other notifications you might need to consider are to family members of anyone involved, your employees, other company sites, key customers and suppliers, particularly if the incident is public, and your PR department or agency.

Emma: So cooperation is obviously going to be extremely important but you also mentioned understanding where you can pushback. What powers are most regulators able to exercise?

Natalie: There are several common powers shared by regulators such as the power to enter a premises. This could be with or without a warrant, with or without notice and it could be using such force as is reasonably necessary. As I have already mentioned, you should seek to cooperate with your regulator and try and accommodate them as best you can. By avoiding being obstructive at the outset and instead offering to help them by explaining, for example, an overview of how your organisation operates, you could buy yourselves valuable time to ensure those that need to know about the regulator's visit are informed and, if necessary, on their way to assist. It also sets the tone for the remainder of any investigation and can pay dividends later on when they may be more likely to keep you informed about where their investigation is heading.

They usually have the power to seize anything that is likely to assist them in their investigation such as documents, laptops, servers. Again, think of business interruption, get receipts for everything taken, take lists and make copies, if you can, so you have your own file of what is relevant to the investigation.

Most regulators also have the power to conduct any testing and take samples and photographs. Again, keep track of everything they have taken. Take your own copies and samples if they are not provided to you and if there is insufficient time to arrange this, you can seek to instruct your own expert to shadow the regulator to observe their findings and report back to you.

Emma: Thanks Nat. So, what about privileged documents? Is there anything you can do to maintain privilege in the context of a regulatory investigation?

Natalie: Yes. There is case law to support that documents can be privileged and withheld from inspection in a regulatory investigation. First, make sure you know where privileged material, both hard and softcopy documents, are stored and do not hand anything over to the investigators that you consider to be privileged. If you are unsure, ask for some time for these documents to be reviewed by your lawyers before releasing them. Second, whilst it is often important to investigate any incident that has occurred as soon as possible, limit generation of any further documents to an internal investigation team who have a set terms of reference and understand the scope and purpose of the internal investigation. Any reports produced should be factual and should not speculate or come to any premature conclusions as to the cause of whatever incident or issue is under investigation.

Emma: Something else to consider will be witnesses. Regulators are going to want to take statements from relevant individuals; often those who are employed by the company. What can businesses do to try and manage this process and also understand what evidence is being gathered?

Natalie: When individuals are being interviewed, you should always ask what type of interview is being carried out. Is it to obtain a statement of fact? If so, are the statements being taken on a voluntary basis or is the interview compulsory using statutory powers? Depending on the circumstances, the regulator may allow you to prepare and provide statements from your employees. This would be preferable because it allows you to know what the evidence is otherwise, although it is not always the case, regulators may instead allow a representative of the company, for example someone from HR, to sit in on the interview to support the witness. It will not always be possible, but try to get a copy of the statements or ask the witness to repeat what they said afterwards and take a note of what information has been relayed. If an interview is under caution then the witness will need their own lawyer as it means they maybe suspected of having committed an offence. The company itself may also be asked to provide a statement under caution. Think carefully how best to respond. Can any one person sufficiently address, on behalf of the company, all of the practises and procedures that relate to often fairly complex sets of facts surrounding any incident. We would usually advise that a company should respond in writing to those interview requests, submitting a statement which can be treated as if given under caution and which gives the business the best opportunity to fully address all areas that may be of concern to the regulator.

Emma: And what is the worst that could happen to those businesses that are eventually found to be in breach of the regulations?

Natalie: There is a huge range of potential enforcement options for regulators to pursue but regulatory investigations can result in substantial prison sentences for individuals, fines for your business that are calculated as a percentage of global turnover, irrecoverable reputational damage and loss of lucrative contacts, particularly public sector contracts where you have to mention a criminal record when tendering. Recent cases have significantly increased sanctions in the future perhaps to impose fines in excess of £100,000,000 to ensure that the message is being sent to shareholders.

Emma: Wow! Thank you Natalie for those insights which I hope everyone listening has found useful. If you do need any further guidance on anything raised in this podcast then you can contact Natalie at natalie.barton-howes@gowlingwlg.com.