Status

This is draft guidance. 

This guidance is to help you understand your obligations and how to comply with them. In the future, we may have regard to it when exercising our regulatory functions.

Who is this guidance for?

All SRA-regulated firms, their principals, role holders and employees.

All solicitors and registered European or foreign lawyers.

Purpose of this guidance

This guidance is to help all firms we regulate and all solicitors (wherever they work) understand and manage regulatory risks and issues associated with conducting an internal investigation.

This guidance will be relevant for solicitors working in-house for an organisation that is conducting its own investigation and for firms conducting investigations on their own behalf or on behalf of another.

Internal investigations are an essential aspect of risk management and help to ensure firms and organisations meet their legal, regulatory and employment obligations. Failing to identify an issue or concern that requires internal investigation – or to carry out an investigation properly – can expose firms and organisations to significant regulatory, legal, employment, and reputational risks.

We have issued this guidance as we are concerned that:

• A poorly managed investigation could fail to properly identify and manage underlying risks, leading to serious regulatory breaches and/or the possibility of repeated incidents.
• Internal investigations that are not carried out properly can in themselves give rise to a breach. This could be, for example, if witness evidence is tailored, outcomes inappropriately influenced, witnesses victimised or disclosure improperly handled.

This guidance does not set out any new regulatory standards or requirements beyond those in our current Standards and Regulations. It aims to help you to understand how these apply to your role when conducting internal investigations and help you comply with our regulatory requirements.

This guidance does not advise on how to make sure investigations comply with employment law. Or how to meet the requirements of other regulatory authorities or law enforcement bodies, such as the police, as that is outside our remit.

The regulatory framework

Our Principles set out the core ethical values we require of all those we regulate which apply at all times and in all contexts.

Those most relevant to internal investigations are those requiring solicitors and firms to:

• act in a way that upholds public trust and confidence in the solicitors' profession and in the legal services provided by authorised persons (Principle 2)
• act with independence (Principle 3)
• act with integrity (Principle 5)
• and act in a way that encourages equality, diversity and inclusion (Principle 6).

The paragraphs most relevant in the Code of Conduct for Individuals are:

The standards that are most relevant in our Codes of Conduct are:

• Treat colleagues fairly and with respect and not to bully nor harass them. Specified managers of firms are required to challenge behaviour that does not meet this standard. (Paragraph 1.5 of the Code of Conduct for Solicitors and 1.6 of the Code of Conduct for Firms)
• Not to act if you have an own interest conflict, or a significant risk of such a conflict. (Paragraph 6.1 of the Code of Conduct for Solicitors and Paragraph 6.1 of the Code of Conduct for Firms)
• Paragraph 7 of the Code of Conduct for Individuals and Paragraph 3 of the Code of Conduct for Firms which sets out a number of requirements to ensure cooperation with the SRA and other relevant bodies and ensures you take accountability if things go wrong.
• This includes the requirement to report to us promptly (or to another approved legal services regulator if appropriate) any facts or matters which you reasonably believe are capable of amounting to a serious breach of regulatory obligations or that we need to investigate or otherwise exercise our regulatory powers. (Paragraphs 7.7 and 7.8 of the Code of Conduct for Solicitors and paragraphs 3.9 and 3.10 of the Code of Conduct for Firms)
• Paragraph 2.1 of the Code of Conduct for Firms which requires firms to have effective governance structures, arrangements, systems and controls in place that ensure you comply with the SRA's regulatory arrangements as well as other regulatory or legislative arrangements that apply.

What is an internal investigation?

We use 'internal investigation' to describe a process done by an organisation or individuals within it to establish the facts relating to an allegation, a concern or misconduct about or related to that organisation or those within it.

This process is key to identifying if there has been any wrongdoing, what led to that wrongdoing and what steps can be taken by way of remediation or to prevent it happening again.

A robust and well-led internal investigation will help to identify lessons learned and promote a culture of transparency and compliance with legal and regulatory obligations. It should give staff, clients, customers and others confidence that concerns will be investigated and acted upon.

You should check whether your firm or organisation has any policies or procedures for conducting internal investigations. If you are leading an internal investigation, you may also want to seek advice and support on employment related matters from your organisation's or firm's Human Resources (HR) Department. If you don't have access to a HR department, for example, if you are a small organisation or firm, you may wish to refer to information from Acas.

The importance of having clear terms of reference

The process of carrying out an internal investigation can be designed for a wide range of purposes and cover a wide variety of activities.

To manage the risks associated with a poorly managed investigation, terms of reference help to set clear expectations from the outset and should be shared with all those involved. The terms should also cover any interdependencies with other processes that may be ongoing at the same time, such as internal grievance and disciplinary procedures.

It is important to be clear about:

• The scope of the investigation, especially what specifically is being investigated and why. While you may wish to keep this broad enough to encompass matters that may. come to light during the investigation, this should not be so broad as to lack focus.
• How the facts will be investigated. This may include gathering and reviewing relevant documents or classes of documents and conducting interviews with relevant individuals or classes of individuals.
• Who will be conducting the investigation, including the roles of those involved as well as those of any relevant third parties.
• What information and findings will be shared with the relevant parties and when.
• How all those involved in the investigation will be supported.
• How personal data and privacy concerns will be handled in accordance with the relevant legislation.
• Confidentiality and the level of information sharing with third parties and witnesses and the extent to which individuals' anonymity will be protected.
• The interface with legal professional privilege and how this has a bearing on the investigation.
• How any relevant employment matters will be addressed.
• What the output will be. You should confirm whether this will be a written report, how it will be reported and who it will be shared with, both internally and externally. In your terms of reference, you should be clear about any external reporting obligations, including to the SRA, and how these will be handled.
• Whether and at what stage there will be any opportunity for individuals against who findings or recommendations are made, or the person who raised the concern, to comment on the draft report or factual findings.
• Clarification about who the decision-makers are in the internal investigation process. For solicitors who are working in-house, the decision-makers may be the organisation's governing board. For solicitors in private practice, decision-makers may be the senior partners in the firm.

Acting with independence

The person nominated to lead the investigation will need to be independent of the issue under investigation and maintain their independence throughout the course of it.

If an investigation is not sufficiently independent, this risks a breach of your regulatory obligations to act with independence and to avoid acting with an own interest conflict. This will also risk undermining the outcome on grounds of actual or perceived unfairness or bias and damaging public trust and confidence.

It is important that the following factors are taken into consideration:

• Who commissions and directs the investigation and how far removed they are from the alleged wrongdoing. This includes giving consideration as to who is funding the investigation, and how to make sure freedom from undue influence and avoid perceptions of bias.
• The investigator/s themselves should have no prior knowledge of, or involvement in, the concern or alleged event.

If you are a solicitor nominated to lead an internal investigation, it will be particularly important that you act with independence and integrity, as set out in Principles 3 and 5. This is to make sure a robust internal investigation delivers an objective, unbiased outcome.

If you are responsible for appointing others to assist in the investigation, then you should make sure that you don't, for example, choose individuals or organisations connected with the events. Or those with pre-conceived views on the likely outcome.

If you are an in-house solicitor and have been appointed as an internal investigator, you should also consider the following:

• Be sure you are in a confident position to give independent, objective advice to your client. The 'client' for these purposes may not necessarily be the individual or team who has commissioned your advice or with who you have day-to-day interactions. Similarly, when reporting your findings, these are likely to be addressed to senior decision-makers and not necessarily the individuals who commissioned your report.

In-house solicitors can experience pressures from senior leaders to take steps or reach conclusions that inappropriately pre-empt or influence the outcome of an investigation. We have also heard about outcomes of internal investigations being blocked from being reported, or outcomes being manipulated, before being presented to the governing Board.

Please see our separate guidance on identifying your client. In addition, our guidance on reporting client wrongdoing also provides further advice on establishing direct reporting lines to a governing board.

• You will need to be clear that you can act free from bias. You should therefore not be involved in an internal investigation if the subject matter concerns issues which have already had or may, in the future, have an impact on you as an employee. Or in matters in which you are likely to be a witness of fact.

Equally, you must consider whether there is a possibility that later down the line you may be asked to provide legal advice to your employer on any matters related to the internal investigation, in which case there is a potential for a conflict of interest to arise. For example, where your employer subsequently has a claim brought against it in relation to the handling of the investigation.

Appointing an external investigator

Appointing an external investigator may help to guard against conflicts of interest or perceptions of bias. This may be particularly relevant where the allegations being investigated are against individuals at executive or board level.

In all cases, whether it is feasible for an in-house solicitor or General Counsel to lead an investigation will depend on their ability to act with independence as set out above. This will determine whether additional external subject matter expertise is required and the availability of resources.

Managing the investigation process

Supporting people involved in the investigation process

Being involved in an investigation can be difficult for all concerned. It is important that everyone receives an appropriate level of support, including the person who has reported the issue, and any witnesses. The subject of the investigation will also need support. This will include making sure the process is fair and that their rights to be represented or accompanied and to receive and respond to evidence or findings are fulfilled.

The terms of reference should make it clear what support is available for people involved in the investigation, who will provide it and how. This may include giving certainty about the timeframes for interviews and what is required of the individual, as well as providing multiple options as to how to participate, such as participate in writing instead.

Treat all people and issues fairly. Do not condone the victimisation of anyone who raises a concern. This includes complaints or concerns raised by one member of staff about another, for example. allegations of sexual misconduct, bullying, fraud. Our guidance on the workplace environment, highlights the importance of creating a culture in which people can speak up, and the regulatory risks of failing to do so.

Where an investigation is commenced following a disclosure by a whistleblower, additional support may be required to ensure the individual's anonymity and to protect them from the risk of victimisation.

Interviewing those involved in the process

It is important that where you are conducting an interview as part of the investigation process reasonable adjustments and accommodations are made, where appropriate.

You should also document the interviews as part of the evidence gathering process. The notes that you keep ought to be clear and concise. It is important to make records at the time that events happen or as soon as possible afterwards and include details of any actions that you have taken. You will want to consider how you will share interview notes and transcripts with the interviewee and the process for seeking agreement.

It is also important that evidence is appropriately obtained. Issues can arise if the investigator isn't adequately trained, asks leading questions, or the interview is arranged or conducted in any way which means that the person being interviewed cannot answer questions freely. It is not acceptable for anyone to influence witnesses or inappropriately influence the course of an internal investigation in any way.

It may not be possible to speak to all of those involved if, for example, an employee has left the firm. If someone relevant cannot be interviewed or leaves the firm/organisation, you should record that you did not have had the opportunity to put the allegation or speak to the individual. You must be transparent as to the evidence that ultimately has been relied upon in any findings.

Managing and recording evidence

At the outset of the internal investigation, it is important to think about preserving the available evidence as memories fade fast and people leave the organisation. And to make sure underlying documents and data are not lost or destroyed. You should consider whether technical support is needed to save and recover electronic files and communications.

The types of evidence gathered during the course of an investigation typically include text messages, emails, documents, policies etc. It is also helpful to think about gathering other forms of evidence such as online calendar-recordings, which are often relevant and sometimes missed. CCTV is often written over after a number of days, so is especially time critical. Metadata can be important to preserve when there is a question about when documents were created or deleted.

Concluding an internal investigation – decision-making

We would expect the investigation to be concluded promptly, but fairly.

Reporting

The output of the investigation will typically take the form of a report. This will include factual findings about what happened and possibly why. The report may also include recommendations, for example sanctions or remedial actions.

If the investigator also has a role in decision making, this should be clear in the terms of reference. And consideration should be given to whether this raises any question as to their independence as a decision-maker and, if so, how independence will be maintained.

Once the outcome of an internal investigation has been reported internally to the appropriate decision-maker, it will be important to reconsider whether the outcome of the investigation needs to be disclosed externally. And how any remedial measures identified should be enacted and monitored, as anticipated in the terms of reference.

When should you notify the SRA?

Where you consider that an individual or firm we regulate may have been implicated in the wrongdoing identified by your investigation, you should consider your reporting obligations as set out above.

You may need to report a matter to us before an investigation is concluded. Whether or not something should be reported, and if so, when, is a matter of judgment, which will depend on the individual facts and circumstances. If you are unsure about whether to make a report, you should err on the side of caution and do so.

For more information, please see our reporting and notifications guidance and Enforcement Strategy.

It is important to note that a settlement agreement would not prohibit us subsequently carrying out a full investigation. We may still need to speak to all of the individuals concerned – including former employees and witnesses in the investigation. Confidentiality agreements cannot prevent workers from making protected disclosures. We have issued a warning notice which sets out more information about our expectations on the use of NDAs.

When making a report to us it is useful to provide:

• date of incident or timespan of issues arising
• date you or your organisation became aware
• how you became aware
• parties involved
• what action the organisation has taken to date
• what the impact has been/could be (eg number of clients, amounts involved)
• whether insurers have been notified and their initial response
• actions taken to prevent recurrence
• whether the internal investigation has concluded or is still ongoing (if the latter then what further work needs to be performed and likely date of conclusion)
• any next steps or further actions.

In the event that we have to carry out our own regulatory investigation, we are likely to place a higher degree of reliance on evidence collected as part of a properly conducted, robust internal investigation. And this helps to make sure we can conclude our investigation more swiftly and avoid unnecessary duplication.

We will always have to properly assess the integrity of the evidence, including how it was obtained, stored and secured, and disclosed to people as part of the internal investigation. For example, in a case involving misuse of funds, it is important to be clear about who has access to the relevant systems, and to avoid questions about the authenticity of documents, to obtain documents with electronic date stamps.

We may nonetheless wish to investigate the matter, or an aspect of a matter, ourselves – for example because our focus is different, or because we need to gather additional evidence.

If you need any help in reaching a decision whether to make a report, you can:

• contact our Professional Ethics helpline
• make a confidential report through our Red Alert line.

We have also have guidance to help you to understand how we assess reports and complaints about those we regulate.

Should your require reasonable adjustments, to support this, please see our policy for further details.

Further help

Information on help and support for solicitors.

Protect, the UK's whistleblowing charity has detailed information on whistleblowing as a solicitor. They also run a free and confidential adviceline.

---

This content is: