Have you ever wondered what it’s like to get a phone call from a major international corporation’s General Counsel during their darkest hour, as the company faces potential criminal charges? The GC tells you they need you to hop on the next flight to interview 25 witnesses and deliver a report for the Board summarizing the best options for the Company. How do you prepare? What does a global internal investigation entail? How do you keep track of the events central to the investigation?
In this interview with Guillermo Christensen, Office Managing Partner for the Washington DC office of Ice Miller, and a former CIA officer, shares:
- The very first thing that in-house counsel should do to prepare for an internal investigation
- Tips for getting the most out of your witness interviews
- Why you should avoid video or audio recordings of witness interviews when you want the conversation to remain privileged
Welcome Guillermo! Please tell us about your law practice, and how you developed expertise in internal investigations.
I'm a partner at Ice Miller, and since 2020, have been the office managing partner for our Washington DC office. The office has almost tripled in size this past year, as we’ve added new partners, associates and professionals - our team is effectively a “gateway” for our national clients into the federal government and Washington DC market. My particular practice spans three core areas.
The first is national security law. These issues arise whenever a company is being acquired or will acquire another company, or when they are involved in sensitive work with the US government. There will be national security concerns that touch on telecommunications, export controls, and compliance issues with the Office of Foreign Assets Control (OFAC). Secondly, I do a lot of cybersecurity work, ranging from handling complex ransomware events to designing and implementing cybersecurity programs for companies across many sectors.
And lastly, I conduct complex internal investigations for companies of all sizes, with a particular focus on international matters. I don't typically get involved in the litigation side of things, but I do get involved in investigations that may lead to negotiating outcomes with the Department of Justice, or the SEC, or a foreign government around a deferred prosecution or non-prosecution agreement.
I've been practicing law for about 17 years. Before private practice, I was in government, not as a lawyer, but as an intelligence officer at the CIA for about 15 years, and then as a diplomat with the State Department. One of my diplomatic posts was at an international organization in Paris, the OECD, which is involved in matters related to anti-corruption, cybersecurity, and the like.
I took the experience I had before becoming a lawyer – I went to law school at night mid-career – and I built a legal practice that leverages many of the experiences that I gained when I worked in intelligence and diplomacy. For example, the internal investigations that I do are mainly international in scope. Often, my client is facing an allegation of some wrongdoing whether by an employee, a senior member of the leadership team, or sometimes by a business partner. The allegations, if true, could put the company in a difficult place. The investigations tend to be pretty high intensity, stressful for everyone in the leadership teaml, and they tend to involve high stakes for the company and key employees.
Should an investigation show wrongdoing had occurred, that can result in years of negotiations with the government, as we try to find a resolution that protects the company’s long term interests.
Protecting privilege is usually a key part of the work process of an internal investigation. Many of the matters are sensitive; even revealing the fact that an investigation is happening could make it a lot more difficult to run the investigation. For that reason, it can be important to protect the fact that an allegation has been made. It’s important to have a team and a work process that allows you to protect the fact that the investigation is happening.
When do you typically get involved with an internal investigation that is international in scope?
A large percentage of these internal investigations involve situations in which the companies receive an internal allegation, whether it be through a compliance hotline, or the accounting or finance department has noticed something amiss with certain payments, or sometimes a complaint is filed by a customer. Often exit interviews are a big source, where it’s “Hey, I’m leaving and I’m very upset with you. And by the way, did you know that you've been bribing the prime minister to get that work?”
Other times something comes to light as part of a regular compliance program – having one is essential to mitigate many of these risks – and I get asked to come in to carry out a risk assessment. For example, a company may be thinking about entering a new, high risk market that they haven't operated in before, and they don't know the local country conditions. We may go in and assess that risk, bring in experts, but also spend time with their new team that's going to be in that country to equip them with the know how for dealing with a new set of challenges.
When you get the call that you’re needed to come do an internal investigation, what's your approach?
I think there are two key things for most investigations. First, having an excellent timeline or chronology. This timeline is the spine that holds the whole body together.
Second, it’s really important from the outset to have a process to capture all material details and put them into a timeline. Someone on the team needs to be tracking these and updating them over time. I’ve had timelines that have stretched into the hundreds of pages.
The timeline or chronology becomes the ultimate reference document for the investigation. After two or three years, you may not remember a particular fact and you also will be bringing in people who were not working on the matter from the outset. These newly initiated team members need a way to be able to “read into” the file. The chronology is a great vehicle for that.
When you get the call that you’re needed to come do an internal investigation, what's your approach?
And is it in Microsoft Word where you write that document?
Oftentimes, yes, I keep the chronology in Microsoft Word for regular matters. When I have a more complicated timeline, my workflow involves both Word and Excel if my team is comfortable moving between the two. But it should not be too complicated because it should be a simple document that is flexible and won’t become unmanageable over time.
What I like about using a Word document, especially the more meta rich type of Office 365 documents, is that you can embed objects into documents and then are able to view the source document on the iPad or other platform. We are no longer in the old days when we had to work on a laptop to see the embedded documents. I tend to operate almost exclusively on an iPad for many investigations and I am a huge fan of the options that provide for secure document handling and for working with PDFs and images, as well as text.
[Ed. Note: Watch this demo video to see how Clearbrief can help you create an interactive timeline for internal investigations where every team member can view the relevant source documents.]
It’s also important to have good versions of the timeline because you want to know what changed over time. For example, if something comes up and it’s a new item on the timeline, we may have to look back to understand why that was not known before, or why someone did not discuss that in a prior interview?
In those situations, being able to pivot to an earlier entry, pull up that timeline, and see if the event has an impact on our assessment of a key fact or role of an individual. It’s important that every entry includes the source or interview for that fact. But sometimes when there is a weak document control process, information gets put into the timeline without clear attribution and that’s when it becomes a problem. Perhaps not surprisingly, the reliance on timelines is also very common in intelligence analysis as is the use of link analysis, which I also find helpful in complex fraud matters.
Can you describe more about the overall investigation process?
Another important aspect to any investigation is having a project management mindset. The key is to have an idea of how you're going to sequence what you're doing. This is key to managing an effective and efficient investigation.
Sometimes there are multiple outside counsel involved. When this is the case, it’s critical to bring a project management mindset because otherwise everyone ends up tripping over each other (and costs the client more).
That means having a good way to track actions over time.
Most of the rest of the tools we use for an investigation are pretty straightforward, as in the work product type tools, and creating the interview memoranda are pretty straightforward. One recent exception is some of the technology we have been trying out to allow us to share confidential documents securely in virtual settings.
Another pain point can be putting exhibits together. I have used electronic exhibits, mainly PDFs, exclusively for many years. I like my teams to rely on digital formats and get away from paper, because our work requires us to travel to other countries – and shipping boxes of documents that are often very sensitive is an unnecessary risk. Instead we can bring exhibits and documents on aniPad or some other device that is protected by encryption. That helps us to control the risk around all of these sensitive documents going all over the place.
How has using electronic exhibits shifted the way that you conduct interviews as part of the investigation?
Going paperless has also helped in how I interview folks as part of the investigation. The traditional approach to working with documents with a witness is to provide them with a copy or a binder of documents, and you ask them to read it. One of the side benefits of pivoting to a digital case file was that we weren’t bringing all that paper – so instead I will often use a projector or a screen that we can all look at together.
When I give someone a piece of paper to read, I find it tends to break the flow of conversation. in a sense, this switch to reading takes them out of the room.
Whereas, if I project a document in front of all of us, I can highlight a section and say, read this part, and then I can scroll through the document. The person being interviewed has to keep their eyes up and they have to keep their attention on the same page that we are all reading.
It’s fascinating, really. When you find that key phrase that you really wanted to ask them about. You can see when they see it because it’s reflected on their face when they realize the cat is out of the bag.
And I should underscore it’s not about truth telling or lie detection (a myth that often arises when people think of my prior profession). Rather, what you can see is whether something resonated with them and then begin to unpack that through follow up questions. That’s something that I really learned and appreciated the value of because of my work as an intelligence officer and dealing with all manner of challenging discussions.
So anything you can do to keep the conversation in context is incredibly valuable.
So you're saying, there's a difference between when you just hand a witness something that only they can see versus creating a shared experience for the whole room.
I think it’s often a powerful way to control an interview in a subtle way, but it's not as easy as it sounds. In many ways you need to stage manage how you present information, similar to trial work, but in some ways in a much less formal setting. The key is to think about your strategy and practice beforehand because it can be challenging to manage. And I pay a lot of attention to what my team members think of a particular approach - important to have that situational perspective.
Do you have an idea why this strategy works?
I think that any approach that keeps the attention of the group “inside the room” is helpful. When the person being interviewed focuses on a paper document, it’s not clear to the rest of the group what they are looking at. Whereas if the document is displayed for the room and you scroll together, you can highlight where their attention should be.
I think that many lawyers who do internal investigations are litigators who have been trained to present exhibits in court. Also, for prosecutors or former prosecutors coming to this work, in some ways you need to retrain them for internal investigations. It’s often a different context, and the goal is often different – and they may default to using exhibits in ways that break up the flow of a conversation. My goal in showing the person being interviewed a document may be more to find out what the witness was thinking at the time. This is key because there’s no defense lawyer to present the other side, you are doing both sides of the “truth finding” that is based on an adversarial model in trial. And so, while the document might look like X to you, to the other person it may mean something completely different and its important to build an environment for that interview where you can surface context and nuance.
The dialogue is important not just to get to the truth or the facts, but also to get to what that individual was thinking about in connection with that information or that email or whatever it was. I’ve found that the training and skills I developed in intelligence work and as a diplomat help more in that area than what I learned from law school.
When I went to law school, we had trial practice but nothing much to learn the skills for an internal investigation. At the time when I was going to law school at night, I spent a year on loan to the FBI and I saw there how the typical investigation was primarily done by FBI agents, who then provided the information to the prosecutors in the Department of Justice, the people who conduct the interviews are the FBI agents, who then bring the information to the prosecutors. I’ve found that having that hands on experience for conducting interviews and assessing information is a real advantage - and the interviews are often the most interesting part of this work.
What are the first steps right after you’ve been retained and are trying to gather the universe of facts to make the timeline?
Well, there are a couple of things that you need to get into place very quickly. There may be a concern about information not being available, whether by someone deleting it or just routine data loss due to the way the systems operate. The first action is to lock down all systems that may have information that you will need to access, and then document that. I spend a lot of time getting to know the IT department or the records department to make sure they help us to safeguard data.
In this area, having a good technical background can be helpful. My background is in technology and cybersecurity and I’ve found that understanding the technical aspects of our investigations work is becoming more challenging even as most lawyers seem to be falling further behind on the tech curve. In the past, it was a matter of trying to preserve information on a Blackberry server, such as text messages, and dealing with corporate systems were not built to reach and pull that information. That made it challenging.
But in the past, it was also easier to access a lot of corporate data, which are contained in email these days. Many platforms like Microsoft 365 allow you to immediately stop any document destruction for that reason. Now almost all critical communications for an investigation are likely to be on a mobile device, often on non-corporate platforms like WhatsApp, Signal, or Telegram.
I have been involved with the Sedona Conference in putting together a study on the challenge of these end-to-end encrypted platforms that also often have ephemeral messaging. A disappearing message, can be an a good idea for security purposes, but can be challenging for an investigation.
At Clearbrief we're all about legal writing. So I'm very interested in how you handle your interview notes and manage the different facts that come in as a team?
My preferred mode for taking notes depends on the interview format. In a virtual environment, I think it’s fine to type on a keyboard because the sound of typing can be muted so as to not distract the person you’re talking to. But when we are in person, I really prefer that the notetaking be unobtrusive to avoid the distraction to the person being interviewed.
In the U.S. context we also do not record interviews – audio or video, for the same reason that we don’t take verbatim notes or transcripts of the discussion. The interview output, as indeed the whole investigation, should preserve privilege around work product, which hinges on being focused on the mental impression of a lawyer.
A video, for example, is a verbatim record and so it's the same as a transcript. If the interviewer types up every word the witness says, that is not their mental impression but a word-for-word account of what that person said.
Interview notes also should not just reflect some significant substantive point, but also the tenor of the discussion. For example, if you ask a question and the person answers, “yes,” but they clearly evince a strong reaction, simply writing down the answer is leaving significant context unless you write something on the side that says, “Wow we hit on something here,” and that's the impression that transforms notes into attorney work product.
Over the years I’ve found I spend a fair amount of time training new lawyers on notetaking practices for investigations. Many of them approach note taking in interviews like what I saw people do in law school, and that’s to simply type everything the professor says on their laptop. That’s the worst thing you can do as a notetaker because you lose the value to be gained from listening to the professor or the witness. Handwritten notes (or in my case, scribbling on my iPad screen) forces you to distill real time and that is key to creating more value out of the interview.
You need to distill the issues down to understand what they are saying, and to write down those impressions without much delay. Write down the significance of what you heard, not what they said. There are times when you need to have a quote, but limit quotes for statements that are particularly important.
What format do you use for handwritten interview notes?
Another practice tip I’ve found is that its challenging to put in comments on the side if you are typing notes in most document formats. I like to take notes on a page with a line down the middle of the notepad. On one side, I will take notes and then I will come back and add things along the way or flag certain areas with different symbols. That’s difficult to do in a Word document or in typed notes. That large margin is great to put down references to come back to, to note a particular reaction or some other reminder (such as a follow up document request).
I learned the most about how to conduct a good interview from a lawyer who worked as a journalist prior to becoming a lawyer. He just had that journalistic mind to ask great questions. He asked basic, open-ended questions and had the confidence to let the person being interviewed run with the thread, because he had a great mental map of where he was going.
Lawyers often seem to be taught that they need to appear to control the interview, which I find to be a problematic state of mind for internal investigation interviews. People are not dumb. They understand when someone is trying to corral them, or push them, and they begin to sense that maybe your purpose might not be to find out what happened but to try and prove something. That changes the tenor of the interview and begins to reduce your credibility with the person. Trust and rapport are important in those interviews.
And keep in mind that you often don’t come into the room with much trust. You’re there to ask hard questions, and the person being interviewed may be feeling that nothing good can come of this interview. And so, you need to build credibility. Be patient and let them tell you what happened.
Sometimes I will also hear from other lawyers, often the in-house counsel, that certain interviews should have taken less time. Perhaps that’s true, but often a major element of the success of the interview is creating the right environment for the person being interviewed and that usually takes time. In other situations, where there are questions about the willingness to cooperate, you may need to approach a problem from different directions to assess whether the person is being consistent – and over time its difficult for someone to maintain a fiction when you approach the nub of the issue from many different directions. The story will fall apart over time.
What’s the writing process like for writing the summary memos from interview notes? And I'm curious, how often are you asked to write a summary versus telling what happened orally?
Every interview should be memorialized. The note taker is usually the person who will write the first draft of the memo. As an aside, I’m still surprised when I read about suspects being interviewed by law enforcement or meetings with prosecutors where no one on the government side took notes.
The other thing that I'm very insistent about is that the note taker must write the memo as quickly as possible after the interview is done, because every 24 hours that goes by, something will be lost to fading memory.
Or maybe something wasn’t written down but as they write up the memo they remember it and can include that in the memo. If the person writing the memo comes to me within a couple of hours to ask if I remembered something from the interview, I can do that. But if they come back three days later – we may have interviewed twenty people in a matter of days – there’s no way to remember things that clearly.
So bottom line - it’s incredibly important to have the notes turned into the work product very quickly. And after that, the final version of the memo is what we go by.
Only the final memo exists – do you mean that you get rid of the notepad?
Absolutely. Because the memo is the work product. The rough notes are not our impressions; it’s the resulting memo that includes our mental impressions that form the work product.
These sources of information – interview memos, the timeline, and other documents – are what you rely on when you brief the client, whether it's an update or the final report.
At the end of the process, the final report of the investigation can take many forms. Sometimes there’s a written report. Other times we make an oral presentation to the board. If it’s a sensitive discussion, we may recommend that no copies of the reports are distributed outside a small group to protect privilege and confidentiality.
These days I tend to use PowerPoint for presentations more often than Word simply because, in the business world, people work with Excel and PowerPoint. Lengthy reports or memos are typically not helpful for leadership teams. PowerPoint is a great way to summarize information.
Are there any pain points right now with the process that you just described, for example, where you feel like there is an inefficiency at some step or that you’re annoyed when this?
Ideally we would have both a paper and electronic form for note taking available. I’ve tried different apps on my iPad with stationery that has a line down the middle. I also like to draw diagrams, which you can only really do with freehand note taking. Until recently, the ability to draw diagrams, arrows, and symbols remained a handwritten product. The technology is getting better so that you can export notes on the iPad into a Word document.
The other pain point is the ability to share documents securely. With COVID, the ability to do in person investigation interviews challenging. We interview people outside of the U.S., and may be working with documents that, for a variety of reasons, I don’t want the person to have a copy.
I've experimented with how to get as close to the in-person experience as possible: show the person exhibits and documents, be able to talk with them about those documents, and do it in a way where we don't lose control of that information. The ability to show information during an interview and keep control of that information can be very important. And that's a technological challenge right now.
