This page explains federal law and New York law on protecting attorney-client privilege and work product when a company investigates possible misconduct by its own people. KOR Law LLP's regulatory and enforcement practice conducts confidential internal investigations on behalf of companies, boards and special committees facing allegations of misconduct, and represents clients in the government investigations that often follow. Investigations frequently begin because of a subpoena; the first steps for that situation are in what a company should do in the first week after a government subpoena.
What did Upjohn decide?
In Upjohn Co. v. United States, decided January 13, 1981, the company's general counsel investigated questionable foreign payments by sending questionnaires to managers and interviewing employees. The IRS sought the questionnaires and interview notes. The lower court had applied a "control group" test, protecting only communications with senior people who direct the company's response to legal advice. The Supreme Court rejected that test, explaining that the privilege "exists to protect not only the giving of professional advice to those who can act on it but also the giving of information to the lawyer to enable him to give sound and informed advice," and that in a company the employees with the relevant information will often be outside the control group.
The Court held that the communications at issue, "made by petitioner's employees to counsel for petitioner acting as such, at the direction of corporate superiors in order to secure legal advice from counsel," were protected, noting that the employees knew the legal implications and the communications were treated as "highly confidential" when made and kept confidential. It also held that the work-product doctrine applies to IRS summonses.
What does privilege not protect?
Facts. Upjohn put it directly: "The privilege only protects disclosure of communications; it does not protect disclosure of the underlying facts by those who communicated with the attorney." The government can still ask employees what happened; it cannot compel the company to hand over what the employees told its lawyers in privileged interviews. Documents that existed before the investigation, such as emails and invoices, do not become privileged because a lawyer later reviews them, and they must be preserved: destroying records to obstruct a federal investigation is a felony (18 U.S.C. 1519).
New York law protects confidential attorney-client communications made in the course of professional employment unless the client waives the privilege (CPLR 4503(a)(1)), and in New York litigation, privileged matter and attorney work product are not obtainable, while materials prepared in anticipation of litigation get qualified protection (CPLR 3101(b), (c), (d)(2)).
| Item | Usually protected? | Why |
|---|---|---|
| Confidential employee interviews with company counsel for legal advice | Yes | Upjohn (1981); CPLR 4503 |
| Counsel's notes and memos of interviews | Generally, as privilege or work product | Upjohn; CPLR 3101(c) |
| The underlying facts employees know | No | Upjohn: privilege covers communications, not facts |
| Pre-existing business records | No | They were not created to obtain legal advice |
| Findings shared with a regulator or outside party | Protection is at risk | Disclosure can waive confidentiality; CPLR 4503 applies "unless the client waives" |
| White papers and Wells submissions to the SEC | No | The SEC may use them, and they may be discoverable (Enforcement Manual) |
How do you structure the investigation, step by step?
- Decide who is the client. The company, the board or a special committee; that choice determines who controls the privilege.
- Engage counsel in writing to investigate for the purpose of providing legal advice, as in Upjohn, where the general counsel directed the inquiry.
- Preserve. Issue a legal hold before interviews begin (18 U.S.C. 1519).
- Interview carefully. At the start of each interview, it is prudent to explain that counsel represents the company, not the employee, that the conversation is privileged and confidential, and that the company may decide to waive the privilege. Upjohn emphasized that the employees were aware of the legal implications and that confidentiality was kept.
- Limit circulation. Share interview memos and drafts only with those who need them to act on legal advice.
- Separate facts from advice in reporting. Oral briefings and carefully labeled memos reduce waiver risk.
- Plan disclosure decisions. Decide in advance what, if anything, will be shared with regulators and how.
How do regulators treat privileged material?
Agencies expect privilege claims to be documented. The FTC, for example, requires anyone withholding responsive material to assert the claim by the production date with a detailed, attorney-attested log listing dates, authors, recipients, a description and the factual basis for each item (16 CFR 2.11(a)); its rules also address inadvertent production of privileged material (2.11(d)). The full FTC process is in what the deadlines are for an FTC civil investigative demand.
Advocacy documents are different. The SEC's Enforcement Manual says the Commission may use information in a white paper "as an admission, or in any other manner permitted by the Federal Rules of Evidence," and that a Wells submission may be used in any action and may be discoverable by third parties. Presenting investigation findings to the SEC therefore requires care; see what an SEC Wells notice is and how to respond.
What changes the answer?
- Purpose. Communications must be made to secure legal advice (Upjohn).
- Confidentiality. Upjohn stressed that the communications were treated as confidential and kept that way.
- Waiver. New York's privilege applies unless the client waives it (CPLR 4503(a)(1)).
- Work product. Attorney work product is not obtainable in New York litigation, and trial preparation materials get qualified protection (CPLR 3101(c), (d)(2)).
- The forum. Federal matters look to federal decisions such as Upjohn; New York proceedings apply CPLR 4503 and 3101.
- Individual interests. Employees may need their own counsel, particularly in securities and FINRA matters; see what a FINRA Rule 8210 request is.
For example: a whistleblower email about inflated invoices
For example, imagine a New York construction supply company whose CFO receives an anonymous email alleging that a sales manager inflated invoices to a city agency. (This is a made-up illustration, not a real client or result.) The board's audit committee retains outside counsel in writing to investigate and advise it, and counsel issues a legal hold covering the sales team's email and phones (18 U.S.C. 1519).
Counsel interviews six employees, explaining at the start that counsel represents the committee and the company and that the company controls the privilege. Counsel's memos go only to the committee. The underlying invoices and emails are not privileged, and the employees could still be asked about the facts by investigators (Upjohn). When the committee later decides whether to make a voluntary report, it weighs what disclosure of the findings could mean for privilege over the interview memos.
Common mistakes
- Letting business people run the interviews. Privilege attaches to communications with counsel for legal advice (Upjohn).
- Copying everyone. Wide circulation undercuts confidentiality.
- Mixing business and legal purposes. Keep the investigation focused on legal advice.
- Forgetting the facts are discoverable. Privilege never hides facts (Upjohn).
- Sharing findings casually with regulators or auditors. Disclosure can waive protection (CPLR 4503).
- Destroying drafts or records. Obstruction exposure is serious (18 U.S.C. 1519).
What to do this week
- Decide who will oversee the investigation: management, the board or a committee.
- Retain counsel with a written engagement describing the legal advice sought.
- Issue a legal hold to the relevant custodians.
- Prepare an interview plan and a standard opening explanation for interviewees.
- Set rules for who receives investigation materials.
- Identify any regulator or agency that may need a response, and the deadlines.
If a regulator is already involved, the timeline may be set by its process; for the New York Attorney General, see what powers the New York Attorney General has in a business investigation.
Frequently asked questions
Does the privilege belong to the employee?
In an investigation run by company counsel, the communications are the company's privilege, protecting information given to the company's lawyer for the company's legal advice (Upjohn). That is why interviewees are told whom counsel represents.
Can the government interview our employees directly?
Generally yes, about the facts, because privilege does not protect the underlying facts (Upjohn). Employees in SEC formal proceedings may be accompanied by counsel (17 CFR 203.7(b)).
Is an investigation report privileged?
It can be, if prepared by counsel to give legal advice and kept confidential. Sharing it outside the circle of those who need it to act on the advice risks waiver (CPLR 4503(a)(1)).
Does work product protection apply in agency investigations?
Upjohn held that the work-product doctrine applies to IRS summonses. Agencies' own rules, such as the FTC's, also recognize withholding of protected material, with a log (16 CFR 2.11).
What happens to investigation materials in later lawsuits?
In New York litigation, privileged matter is not obtainable once a person entitled to the privilege objects, and attorney work product is not obtainable at all (CPLR 3101(b), (c)). Those protections still have to be asserted properly, usually with a privilege log; in the Commercial Division, the logging rules are covered in what discovery limits apply in the New York Commercial Division. Facts learned in the investigation remain discoverable through ordinary documents and testimony.
What if we find a problem with energy-efficiency certifications?
Product compliance issues can involve specific agency procedures; see what happens when the Department of Energy brings an appliance efficiency enforcement case.