AbleToTrain by Willing & Able

Records Drawn Up During An In-house Corporate Compliance Audit Are Not Privileged

In a notable decision in Barko v. Hallilburton Co., the Federal court ruled that the company’s internal investigations are not confidential and must be made available to the whistleblower.

In the light of Barko’s decision, government contractors and those in regulated sectors should consider taking steps to boost their chances of successfully asserting the right of the attorney-client privilege and carefully review their enforcement systems.

A recent decision by the federal court makes the company’s internal investigation records fair in litigation, especially where federal law, such as the Federal Acquisition Regulation (FAR), requires the company to develop a compliance policy and investigate alleged misconduct.

The situation is directly applicable to federal contractors, but it is theoretically important in other regulated sectors as well. This alert summarizes the decision of the court and highlights a range of areas for businesses where further analysis of its effect is warranted.


Barko’s case

Corporations, like individuals, can assert the right of the attorney-client privilege and the attorney work product doctrine. The decision of the United States of America released on 6 March 2014. District Court of the District of Columbia, United States ex rel. Barko v. Halliburton Co.,2 contributed to the complications faced by businesses and their in-house lawyers.

In Barko’s brief opinion, it is held that documents, provided by non-lawyer in-house investigators during an internal investigation were not covered by the right of the attorney-client or the working product doctrine of the attorney. According to the court, investigations were undertaken pursuant to regulatory law and corporate policy rather than for the purpose of obtaining legal advice.” While the decision has emerged in the context of federal procurement, it raises new challenges for all entities seeking to protect internal investigations from exposure in litigation, in particular those mandated by the federal government.


Assessment of the intent of the investigation

The court noted that interviewed workers had never been informed that the object of the investigation was to allow the company to obtain legal advice and confidentiality agreements. The court also concluded that the workers would not be able to presume that the interviews were for the purpose of seeking legal advice, since they were performed by non-lawyers.

The language used by the court seems to put a certain emphasis on the fact that internal investigation was mandated by law and corporate policy to comply with those legal requirements. This rationale can undoubtedly be used by other litigants who are requesting internal investigation documents. The probable claim is that anywhere government law needs investigative intervention, the right of the attorney-client privilege does not apply. Read more generally, the court’s holding could provide for rules, and not just those specific to government contractors, to annex contact zones that could otherwise be covered by privilege.

Perhaps even more disturbing is the conclusion inevitably suggested by the rationale of the court: namely, that enforcement practices conducted in conjunction with regulatory requirements, including investigations, are simply not legal activities.


Implications to Businesses

Barko underlines some of the fundamental rules that businesses can adopt in order to boost their chances of successively asserting the right of the attorney-client. In finding no right or defense, the court noted the following:

– The outside counsel was not consulted about whether and how to perform an internal investigation.

– That the inquiry was performed by enforcement officers rather than by lawyers.

– Employees have never been told that their interviews have been conducted on the basis of a business request for legal advice.

– That the confidentiality agreements of workers did not contain a language specifying that their interviews were performed on the basis of a business request for legal advice (or were privileged, for that matter).

As far as the court’s findings are concerned, their relevance cannot be understated for entities subject to mandatory enforcement regulations. The court held that the right of the attorney-client and the confidentiality of the work product did not extend to the investigatory records because the investigation was performed in compliance with the laws and company policy, which is likely to be affected by the legal requirements of the company itself. In this case, the rules requiring investigation were those contained in the DFARS, but the rationale of the court would appear to extend to any entity subject to a similar legal regime requiring investigation and reporting. These shall include the following:

– Organizations subject to the rules of the Code of Ethics and Mandatory Disclosure Regulation

– Organizations subject to the mandatory provisions of the Patient Safety and Affordable Care Act Compliance Program

– Organizations subject to the Medicare Modernization Act are expected to introduce enforcement programs to minimize the risk of fraud and abuse

– Organizations subject to the Health Insurance Portability and Transparency Act (HIPAA) mandate that privacy and protection protocols be in place to secure access to sensitive health information

– Organizations subject to the requirement of the 2002 Sarbanes-Oxley Act to develop compliance procedures to help support the integrity of internal accounting and financial reporting controls of the company

– Organizations subject to the Bank Secrecy Act’s requirement to enact policies to avoid the laundering and depositing of proceeds from illicit activities.

Even while not working under a statutory compliance policy, entities investigating non-compliance on the basis of their voluntary application of the compliance program should be aware of Barko’s possible consequences. Across several sectors, the introduction of a corporate compliance program and the timely review of possible non-compliance are known best practices. Several regulatory authorities also urge businesses to adopt effective compliance programs. Effective compliance programs have been proven to help protect a corporation from prosecution.


Defense of the Attorney-Client Right Post-Barko

Barko recommends that cautious organizations should conduct a thorough review of their compliance programmes. In order to increase the chances of protecting rights, a corporation should review its investigative enforcement procedures and consider resolving the reasons found by the court before launching an investigation. At a minimum, the following should be included in the review:

– Updating compliance procedures and related documents to make clear reference to the fact that such investigations are conducted by the organization for the purpose of receiving legal advice.

– For suspected alleged wrongdoing that could result in legal liability for the organization, consult outside counsel from the outset to decide if an investigation is required.

– Having lawyers – whether outside or in-house attorneys – carrying out the actual work of the investigation, or at the very least making it clear that the investigation is being undertaken and conducted by counsel.

– Conduct an investigation with all privilege traps: keep alerts, Upjohn warnings prior to interviews, and adequate protective legends on records, emails and employee confidentiality agreements.

– Preparing and memorizing the rationale for the investigation to demonstrate that the primary aim of the investigation is to provide legal advice rather than to satisfy business needs or regulatory requirements (this rationale can take the form of a carefully planned, contemporary statement that the investigation is being undertaken in order to receive legal advice on whether or not the investigation is being conducted).



Barko represents a major change in law that could disrupt many of the organization’s expectations about the state of its enforcement efforts. Prudent organizations should carry out a thorough review of their enforcement programs, including incident investigations, in the light of this new opinion.