Privilege and Assessments

The General Counsel of a client (an insurance company) for which I performed a compliance risk assessment a couple of years ago called me recently.  She said that their regulators were performing a routine exam, and one of their employees mentioned to the regulator that the company had conducted a compliance risk assessment. The regulator asked to see the risk assessment report. The report is by now a couple of years old, and it documents certain “opportunities” in their compliance program. The General Counsel, quite understandably, did not want to hand the report over to the regulators. And I breathed a big sigh of relief that we had conducted the assessment under the attorney-client privilege, so we have a good argument not to produce that report.

An important threshold issue to be considered before beginning a compliance program assessment or compliance risk assessment is the question of whether to conduct the assessment under the attorney-client privilege.  That question will impact the way an assessment is conducted, and it can also – in my experience – impact its effectiveness. (As outside counsel, I have a definite bias in favor of conducting assessments under privilege.)  As illustrated by my experience with the insurance company client, that question will also impact how the report is treated for many years in the future, so it’s an important one.  (This article discusses attorney-client privilege from a US-law perspective.  The treatment of the privilege outside the United States varies and is beyond the scope of this article.)

Benefits to Conducting Assessments Under the Attorney-Client Privilege

There are several benefits to conducting a program or risk assessment under the attorney-client privilege given the risks created by the self-critical information that an assessment often generates. First, employees may otherwise fear that comments made in assessment interviews will be used by their companies’ adversaries, which can cause them to be less candid in providing important information about the compliance program and compliance risks. Employees may be more likely to discuss, e.g., prior misconduct and program gaps where they believe the information will likely be protected from disclosure. Indeed, most of the employees who are interviewed for an assessment are high-level employees who typically have a sophisticated understanding of the legal landscape. Their understanding of the potential risks of disclosure can cause them to be unduly cautious when discussing gaps in compliance controls. 

I have been in many an assessment interview when the CEO or CFO or head of HR confirmed, before answering a particular question, that “this is under privilege, yes?”  Those experiences have validated for me that, when conducting a privileged assessment, I tend to get more open and candid answers than I might otherwise.  That, of course, leads to a more meaningful assessment.

Second, conducting an assessment under privilege allows companies to protect the report from disclosure when sought by regulators, enforcement officials, and adversaries in litigation, as illustrated by my story above. As outside compliance counsel, one of my biggest fears is that I create a document (like an assessment report) that is used against the company in the context of litigation or an enforcement action, which could harm the company and the company’s support for the compliance program.  The privilege helps protect against that.

The Requirements of Privilege

The mere involvement of attorneys in an assessment will not, by itself, establish the privilege.  In order for communications to be protected by the attorney-client privilege (again, in the United States), there must be an attorney-client relationship and a communication that takes place for the purpose of obtaining or providing legal advice, in confidence, where there has been no waiver. In that connection, one should document from the outset that the purpose of the assessment is to review the extent to which the company’s program meets applicable legal expectations and helps reduce legal risks, and that counsel is collecting information in order to render legal advice to the company.  The assessor must also inform employees who are being interviewed that the assessment is being conducted in order to provide legal advice to the company and that employees should keep the contents of the assessment interviews confidential.  In addition, after the assessment is complete, the company must keep the assessment report confidential, sharing it only with those who have a “need to know” the information in the report.  How much internal disclosure is permissible without risking waiver is a function of applicable state law, at least in the U.S. 

Disadvantages of Privilege

There are two possible disadvantages to conducting an assessment under privilege.  The first is that, as noted above, a privileged report cannot be as widely disseminated as a non-privileged report, which decreases the ways in which the report can be utilized. A company may thus be limited in the extent to which it can share a favorable review of its program. (However, it may be possible to share some of the results with employees in a way that does not waive the privilege.)    

The second potential disadvantage is that the legal “warning language” that is required at the beginning of an interview (e.g., “this discussion should be considered confidential and not be shared with anyone outside the interview”) when the assessment is conducted under privilege could intimidate certain employees and cause them not to be as open, which could have a detrimental impact on the collection of information during the interview process.  However, as noted above, my experience is that the privilege disclaimer tends to have the opposite effect – making employees feel more comfortable discussing the company’s compliance history and compliance risks.

Recognition of Privilege and Potential Waiver

An important thing to note about privileged assessments:  It is possible that – despite a company’s and a lawyer’s best efforts – a court may rule that an assessment is not in fact protected by the attorney-client privilege.  An adversary in litigation could argue that an assessment was conducted to provide business – not legal – advice.  In my view, it is clear that compliance counsel provides legal advice to a company.  It is also clear that legal advice is often  sought and rendered to facilitate compliance with the law.  However, relevant case law in this area is limited. 

In addition, companies may affirmatively decide to waive the privilege, for instance, where a company decides to share the report with the government in the context of an investigation in order to demonstrate the effectiveness of its compliance program. 

Compliance professionals should thus document assessments in a way that anticipates disclosure in the event that a court does not recognize the privilege or a company decides to waive it. This suggests that the compliance professional should be highly confident of both factual findings and recommendations, including, at least in most situations, reviewing these in draft with key client personnel to assure the accuracy of the reported facts and the underlying assumptions as well as the wisdom of the recommendations.  In addition, assessment reports should describe the positive aspects of a program, as well as including feasible and appropriate remedial measures in response to any problematic findings.

The call from the General Counsel of the insurance company client left me feeling both anxious (the outside counsel nightmare of having an aged report used against a client) and relieved (that the assessment had in fact been conducted under privilege). Regardless of whether privilege is used, it is advisable to discuss the advantages and disadvantages with relevant company leadership at the outset so that everyone understands the implications of how you proceed.