Five Strategies for Managing Regulatory Investigations and Risks

Regulators are applying broader and greater scrutiny to how organizations identify, assess, and remediate potential misconduct, increasing the stakes for getting investigations right from the outset.

These key trends in today’s regulatory, corporate and geopolitical environment, accompanied by shifts in regulator expectations, are shaping internal investigations.

Regulators now offer more voluntary disclosure programs than at any time in history and have strongly encouraged whistleblowers to file claims or report wrongdoing, sometimes using financial incentives. In addition, federal and state law enforcement have many new units, prosecutors and investigators who expect counsel and forensic investigators to demonstrate industry experience and knowledge. There are more data sources than ever, and regulators expect companies to consider more data in an investigation.

Conducting a corporate or regulatory investigation thoroughly and efficiently has never been more critical. Investigations don’t just uncover issues—they can provide a roadmap for navigating the complex regulatory environment. Here are five important strategies for managing investigations and related risks.

Set the stage early. Establishing your data needs at the onset of an investigation is vital. Identifying stakeholders and knowing your universe of data sources require a fundamental understanding of the business and how information and data are shared, stored, communicated, and pulled throughout the organization. With data-heavy regulatory cases, interviews, and live working sessions should be conducted as early as possible.

Obtaining the original, native sources of books and records are required for data integrity and validity. You should also be prepared to handle both structured data (e.g., databases, payments) and unstructured data (e.g., emails, social media, texts). Finally, get your data experts and consultants involved early and often, even if you’re extracting data yourself. This generally saves time from having to repull data later.

Establish synergy. Getting full stakeholder buy-in is the first step in establishing synergy. At the beginning of your investigation, it’s best to cast a wide net in terms of initial data sources and interviews. Identifying key stakeholders early on—including consulting vendors as well as audit committee and special committee chairpersons—maximizes the value they can provide throughout the investigation and establishes consistent communication. Building positive relationships and keeping auditors and committees regularly informed fosters a spirit of cooperation and transparency that ultimately benefits the investigation.

When conducting an accounting investigation, it’s important to have a primary contact in the accounting and finance function who can serve as a gatekeeper for the forensic accountant’s documentation and information requests. Having daily touchpoints with the accounting gatekeeper, supported by the company’s general counsel, can facilitate efficiency with information requests.

It’s also important for counsel and supporting forensic accountants to align the timing and cadence of investigation progress updates to the audit committee and external auditor. This ensures that these two critical parties are receiving the same consistent messaging and coordinates any feedback or thoughts.

Engage with regulators. Early engagement with regulators is one of the most critical aspects of a successful investigation. Being prompt, responsive, and having one’s own theory of the case or defense demonstrates credibility and control. Counsel, and the experts assisting in the case, should understand each agency’s expectations and timeline. For example, some regulators are known for being slow to close matters, while some act more quickly. Handling expectations, setting up a realistic timeline and building a rapport can help in establishing transparency and goodwill. Every communication with a regulator presents a great opportunity to build trust—and a risk if handled poorly.

Use AI effectively. Artificial intelligence isn’t just becoming more popular in modern investigations. It’s now often an accelerator, especially in connection with document review, helping to slice through the sheer volume of data and files at the onset of an investigation. However, counsel and investigators should embrace AI with healthy skepticism.

While new AI tools continue to develop, businesses are still trying to figure out how to: use AI tools appropriately so they’re not a liability; and incorporate AI in response to regulatory inquiries while safeguarding the investigation itself and protecting client information and legal privilege.

To do this, companies and counsel should have transparent documentation to explain their use of AI tools. This documentation should be transparent and must disclose any of the AI’s validation, error rates and sources used. Any AI system used in the business needs to be treated as its own data source, as the information generated from these systems creates data outputs.

AI tools should be used to aid human investigators, not replace them. When combined with other advanced analytics tools and investigation approaches (e.g., social network/link analysis, outlier detection, data mining, predictive analytics), AI can enhance your ability to uncover more complex patterns, relationships and insights.

Strengthen your environment. Remediation isn’t just solving the current issue—it’s an opportunity to formalize the findings of the investigation and to strengthen your control environment, policies and procedures. Almost every regulatory investigation presents an opportunity to remediate, improve, and demonstrate to the regulator why any past problems and gaps will not happen again. Audit committees should see their investigations as opportunities to leverage the knowledge and experience of their investigators to enhance and strengthen business processes and internal controls to reduce regulatory risks.

Developing a manageable but appropriate remediation plan—one that is achievable in the short term but has long-term goals and works to close gaps—demonstrates to regulators that not only did your client perform a thorough and fulsome investigation but that they are working toward closing gaps and are committed to mitigating the risks going forward.

The team of counsel and forensic accountants that just completed an investigation can leverage that recent experience to unlock additional value by leaning into the remediation process and help reduce the need for future investigations.

In today’s ever-changing landscape of regulatory investigations (and even regulators), a return to these five strategies may result in a better managed and more efficient investigative process.

This article does not necessarily reflect the opinion of Bloomberg Industry Group, Inc., the publisher of Bloomberg Law, Bloomberg Tax, and Bloomberg Government, or its owners.

Author Information

Arthur P. Fritzinger is a Philadelphia-based member in Cozen O’Connor’s White Collar Defense & Investigations practice.

Calli Jo Padilla is a Philadelphia-based member in Cozen O’Connor’s White Collar Defense & Investigations practice, as well as co-chair of the firm’s Women’s Initiative.

George A. Saitta, Jr. is a leader in the SEC & Accounting Advisory practice for FTI Consulting in Washington, DC.

Shayne Begin contributed to this article.

Write for Us: Author Guidelines