I. Introduction

The Foreign Corrupt Practices Act of 1977 (FCPA) prohibits U.S. persons and companies, as well as foreign issuers listed on U.S. exchanges, from bribing foreign government officials to obtain or retain business. The statute is jointly enforced by the Department of Justice (DOJ) and the Securities and Exchange Commission (SEC), and it carries severe consequences: criminal fines running into the hundreds of millions of dollars, disgorgement of profits, deferred prosecution agreements (DPAs) or non-prosecution agreements (NPAs), monitorships, reputational damage, and individual imprisonment for responsible executives. With global operations the norm rather than the exception for American and multinational companies, even a well-managed compliance program may not prevent a rogue employee, a third-party distributor, or a joint-venture partner from engaging in conduct that triggers FCPA exposure.

When potential misconduct surfaces, whether through a whistleblower complaint, a routine internal audit, an anonymous tip line report, a government inquiry, or due diligence in a merger or acquisition, companies face a pivotal decision: how to investigate, how thoroughly, and with what strategic objectives in mind. An FCPA internal investigation is far more than a fact-finding exercise. Conducted properly, it serves multiple intertwined purposes and requires a carefully calibrated strategy that balances legal risk, regulatory relationships, business continuity, and corporate governance obligations. This article examines those purposes and the principal strategic choices counsel and management must navigate.

II. The Core Purposes of an FCPA Internal Investigation

A. Establishing the Facts

The foundational purpose of any internal investigation is to determine what actually happened. The company needs to know whether FCPA violations occurred, their scope and duration, who was involved at what levels of the organization, what amounts were paid or promised, which government officials were targeted, and whether the conduct was isolated or systemic. Without a reliable factual record, the company cannot make rational decisions about disclosure, remediation, or litigation strategy. A thorough investigation also allows counsel to identify defenses and mitigating circumstances early, before the government develops its own narrative.

Establishing the facts requires far more than a review of company books and records. FCPA cases frequently involve off-book payments routed through third-party agents, inflated commissions, sham consulting agreements, or gift-and-hospitality schemes. Sophisticated fact-finding typically combines email and document collection, forensic accounting, financial data analysis, and candid witness interviews conducted under the attorney-client privilege.

B. Positioning the Company for Voluntary Self-Disclosure and Cooperation Credit

One of the most consequential and strategically sensitive purposes of an FCPA internal investigation is deciding whether, and how, to engage with the DOJ and SEC. Both agencies have adopted formal policies that reward cooperation and voluntary self-disclosure with significant sentencing and penalty reductions. The DOJ’s FCPA Corporate Enforcement Policy, first issued in 2017 and periodically updated, creates a presumption of a declination of prosecution for companies that voluntarily disclose, fully cooperate, timely remediate, and disgorge profits. Where prosecution is nonetheless warranted, a voluntary disclosing and cooperating company may receive up to a 50 percent reduction off the bottom of the U.S. Sentencing Guidelines fine range. Companies that cooperate but do not voluntarily disclose may still receive up to a 25 percent reduction.

These incentives are substantial, but realizing them demands that the investigation produce a full, accurate, and non-selective account of the misconduct, including evidence that is unfavorable to the company or to individuals the company might prefer to protect. The DOJ has made clear that cooperation means providing proactive, timely disclosure of all facts relevant to the wrongdoing, including information about individuals, not merely responding reactively to government requests. An investigation that attempts to minimize findings or shield senior executives is unlikely to earn cooperation credit and may instead deepen the company’s exposure.

This dynamic creates an inherent tension. Senior management and the board want a complete picture for governance and liability-management purposes. Individual employees, including potential witnesses and subjects, have personal interests that may diverge from those of the company. Employees who fear termination or prosecution may be uncooperative or less than candid. Counsel must design an investigation that is rigorous enough to satisfy government expectations while navigating these competing pressures, including through careful handling of Upjohn warnings to employee witnesses.

C. Satisfying Disclosure Obligations to the Board and Audit Committee

Publicly traded companies have independent legal obligations to their boards of directors and audit committees that run parallel to, and sometimes exceed, the demands of enforcement agencies. Under the Sarbanes-Oxley Act and the listing standards of U.S. stock exchanges, audit committees bear responsibility for overseeing financial reporting integrity and for receiving and acting on complaints regarding accounting controls and auditing matters. Where potential FCPA violations implicate the accuracy of the company’s books and records or its disclosure controls, the audit committee has both the authority and the obligation to oversee, and in many cases to direct, the investigation.

Beyond governance obligations, senior management has fiduciary duties to the board to surface and address material legal risks. An FCPA matter may give rise to securities law obligations as well. If the potential misconduct is material to investors, the company may need to evaluate whether the facts must be disclosed in SEC periodic reports, earnings announcements, or other public communications. The investigation must therefore be structured to produce findings that are clear, well-documented, and reliable enough to support these governance and securities law judgments.

D. Enabling Remediation

A critical purpose of an FCPA internal investigation is to identify and remediate the conditions that allowed the misconduct to occur. Both the DOJ and the SEC place substantial weight on remediation when evaluating whether to prosecute and what penalty to impose. The DOJ’s Corporate Enforcement Policy requires companies seeking declination credit to demonstrate that they have engaged in timely and appropriate remediation, including discipline of responsible employees at all levels of seniority, enhancement of compliance programs, and the implementation of effective controls to prevent recurrence.

Remediation requires more than firing the employees most directly involved. Investigators must assess whether inadequate supervision, deficient third-party due diligence, poor tone at the top, perverse incentive structures, or gaps in the compliance program created an environment in which corruption could take root. The findings of the investigation become the blueprint for corrective action, which may include redesigning the third-party management program, enhancing anti-bribery training, revising financial controls and approval workflows, improving gift and hospitality policies, and strengthening the whistleblower reporting culture. Ineffective or incomplete remediation is one of the most common reasons companies that expected lenient treatment instead face deferred prosecution agreements or monitorship requirements.

E. Managing Civil Litigation and Other Legal Risks

FCPA investigations rarely exist in a vacuum. Conduct that violates the FCPA may also expose the company to civil claims by shareholders (including derivative suits and securities class actions), contract counterparties, and competitors. Bribery investigations can trigger parallel inquiries under the laws of foreign jurisdictions, which increasingly have their own anti-corruption statutes and enforcement agencies. They may also implicate employment law, as the company must navigate how to treat employees who participated in or were aware of misconduct.

The investigation serves the additional purpose of generating a privileged factual and legal analysis that the company can use to assess and manage these collateral risks. The attorney-client privilege and work product doctrine, properly preserved, allow counsel to conduct a candid assessment of exposure that is shielded from civil discovery. This is one of several reasons why the design and execution of the investigation must be managed by qualified legal counsel from the outset.

III. Principal Strategic Decisions and Considerations

A. Who Should Lead the Investigation

One of the first and most important strategic decisions is who will lead the investigation. In most cases, outside counsel with demonstrated FCPA experience should be retained to conduct the investigation or, at minimum, to direct it on behalf of the audit committee. There are several reasons for this approach. Retaining outside counsel ensures that the investigation is conducted under the attorney-client privilege and provides the company with an independent, credible factual record that is more likely to be viewed as reliable by enforcement agencies, courts, and the board. Inside counsel alone, or management-directed investigations without legal oversight, carry a significant risk that the privilege will be challenged and that the resulting work product will be viewed by the government as internally compromised.

Where the company is publicly traded or where the conduct implicates senior management, the audit committee should formally retain outside counsel to conduct the investigation on its behalf. This structure preserves the committee’s independence and helps insulate the board from accusations that management controlled the investigation or shaped its findings. Forensic accountants, e-discovery consultants, and other specialists typically work as agents of outside counsel to ensure their work falls within the privilege umbrella.

B. Preserving the Privilege and Protecting Work Product

Attorney-client privilege and work product protection are the twin pillars on which a well-structured FCPA investigation rests. At the outset, counsel must ensure that all investigative work is organized to maximize these protections. Communications between counsel and the company regarding the investigation should be clearly designated as privileged. Document collection and review should be directed by counsel. Interview memoranda prepared by counsel summarizing witness statements are work product and should be prepared with that purpose in mind.

Practitioners must also be vigilant about the risks of waiving the privilege. Voluntary disclosure to the DOJ or SEC of factual summaries from witness interviews, or of investigative reports, may waive the privilege as to those documents and potentially as to related materials. Courts have split on the scope of such waivers, and the DOJ has historically argued for broad subject-matter waiver in some contexts. Counsel must therefore make deliberate, informed decisions about precisely what is shared with the government and in what form, and should document those decisions carefully. The use of a “facts only” oral proffer or a carefully scoped written summary, rather than a wholesale disclosure of interview memoranda, is one approach that attempts to satisfy government cooperation expectations while limiting waiver risk.

C. Document Preservation and the Litigation Hold

As soon as FCPA exposure is reasonably anticipated, the company has a legal obligation to preserve potentially relevant documents and electronic data. Failure to do so can result in sanctions, adverse inference instructions, and serious credibility damage with enforcement agencies. Counsel must issue a litigation hold notice promptly to all likely custodians, covering email, internal messaging platforms, financial systems, travel and expense records, and any third-party agent files that are within the company’s possession, custody, or control.

In cross-border investigations, document preservation is complicated by foreign data protection laws. The General Data Protection Regulation (GDPR) and its national implementations, as well as data localization laws in countries such as China, Russia, and India, restrict the transfer and processing of personal data in ways that can conflict with U.S. discovery and cooperation obligations. Experienced FCPA counsel must anticipate these conflicts early and develop a preservation and collection strategy that is legally defensible under both U.S. and foreign law.

D. The Voluntary Disclosure Decision

Perhaps no strategic decision in an FCPA investigation is more consequential than whether to voluntarily self-disclose to the DOJ and SEC. Disclosure triggers a cooperative relationship with enforcement agencies that, if managed well, can lead to significantly reduced penalties or even a declination. However, disclosure also removes the company’s ability to control whether an investigation is pursued and surrenders the initiative to government prosecutors and regulators. A company that discloses will be expected to cooperate fully, produce documents in foreign jurisdictions, and make employees available for interviews. If cooperation is incomplete or if the company later appears to have disclosed strategically rather than fully, the consequences can be worse than if the company had not disclosed at all.

The analysis of whether to disclose voluntarily depends on several factors: the seriousness and breadth of the misconduct; whether the company is a U.S. issuer with independent SEC disclosure obligations; whether the conduct has already come to the attention of the government through a whistleblower, a foreign government, or another source; whether the company is under a prior DPA or NPA that requires disclosure; the likelihood that the government will eventually discover the conduct independently; and an honest assessment of the strength of available defenses. Counsel should also consider whether disclosure in one jurisdiction will trigger inquiries in others. A decision to self-disclose is irreversible; it deserves careful, deliberate analysis supported by a substantially complete factual record.

E. Managing Individual Employee Rights and Interests

An FCPA investigation inevitably involves interviews of current and former employees, many of whom may be witnesses, subjects, or targets. The company has an obligation to inform each employee at the outset of an interview that counsel represents the company, not the individual, that the interview is protected by the attorney-client privilege belonging to the company, and that the company may decide to waive that privilege and share interview information with the government. These are the so-called Upjohn warnings, derived from the Supreme Court’s decision in Upjohn Co. v. United States, and delivering them correctly is a matter of ethical obligation as well as legal strategy.

Employees have a right to retain their own counsel, and the company must decide, as a matter of policy and ethics, whether to advance legal fees to employees under investigation. Many companies do so under corporate indemnification bylaws or applicable state law, particularly where the employee acted within the scope of their duties. However, advancing fees to an employee who is later found to have engaged in intentional misconduct can create its own complications, particularly in the context of government cooperation. Counsel should develop a coherent and consistently applied indemnification policy at the outset of the investigation.

F. Coordinating with Foreign Counsel and Regulators

FCPA investigations are inherently cross-border matters, and in virtually every case the underlying conduct will have occurred in one or more foreign jurisdictions. Engaging local counsel in each affected country is not optional, it is essential. Foreign counsel can advise on local labor laws governing employee interviews and terminations, data protection requirements governing document collection and transfer, local anti-corruption laws that may apply independently of the FCPA, and the practices of local enforcement agencies that may coordinate with DOJ or SEC.

The UK Bribery Act, the Brazilian Clean Company Act, France’s Sapin II law, and many other national anti-corruption statutes may apply concurrently with the FCPA, creating multiple regulatory relationships that must be managed in parallel. A voluntary disclosure to the DOJ may not prevent prosecution by a foreign regulator, and the terms of a settlement with one authority may not satisfy another. Experienced FCPA counsel coordinates across jurisdictions to develop a globally coherent strategy, while working to avoid creating privileged documents in one jurisdiction that may be discoverable in another.

IV. Structuring the Investigation for Maximum Effectiveness

A well-structured FCPA investigation proceeds in defined phases, though in practice these phases often overlap. The initial phase focuses on scoping: reviewing the triggering information, identifying the universe of potentially relevant countries, business units, and time periods, designing the document collection plan, and briefing the audit committee. Counsel should resist the temptation to narrow the scope prematurely based on initial impressions; FCPA misconduct frequently proves broader than the first indications suggest, and an investigation that later has to be expanded is more disruptive and more costly in government credibility than one properly scoped from the start.

The document collection and review phase involves gathering financial records, email and electronic communications, third-party contracts and due diligence files, travel and expense reports, and approvals for government-related expenditures. Forensic accountants typically assist in tracing fund flows, analyzing expense reimbursements, and identifying accounting irregularities. Modern FCPA investigations involve large volumes of electronically stored information, and counsel should work with e-discovery vendors to deploy technology-assisted review efficiently while maintaining the integrity and defensibility of the review process.

Witness interviews are typically conducted after an initial document review provides a factual foundation. Prioritizing the order of interviews is a strategic judgment: beginning with lower-level employees or cooperative witnesses before interviewing subjects or senior management can help develop the factual record and avoid being misled by incomplete or self-serving accounts. Interview memoranda should be prepared promptly and accurately, and should be treated as privileged work product throughout.

At the conclusion of the investigation, counsel typically prepares a final report or, where the audit committee is the client, makes a presentation of findings. The nature and format of that presentation should be carefully considered in light of disclosure risks. A detailed written report may be more useful for internal governance and remediation planning, but it also represents a document that, if disclosed to the government, may waive the privilege or create risks in civil litigation. Many practitioners prefer to present findings orally to the board or audit committee, supplemented by limited written materials, preserving flexibility regarding what is ultimately shared with enforcement agencies.

V. Conclusion

An FCPA internal investigation is one of the most complex and consequential undertakings a company can face. Done well, it serves multiple critical purposes simultaneously: establishing the facts with the rigor and independence the government expects; enabling the company to assess and manage its legal exposure; satisfying governance and disclosure obligations to the board, audit committee, and in some cases the public markets; and generating the factual foundation for effective remediation. Done poorly, it can deepen the company’s legal jeopardy, damage its credibility with enforcement agencies, expose privileged communications, and leave governance deficiencies unaddressed.

The strategic decisions that must be made at the outset, including who leads the investigation, how the privilege is structured and protected, whether and when to self-disclose, how individual employees are treated, and how foreign jurisdictions are managed, are not merely tactical choices. They define the trajectory of the entire matter. Companies that confront potential FCPA exposure benefit enormously from engaging experienced counsel early, before facts are lost, documents are inadvertently destroyed, or strategic options are foreclosed by inaction. The investment in a thorough, properly structured investigation is almost always less costly than the alternative.

This article is intended as general information for business clients and does not constitute legal advice. Companies facing potential FCPA issues should consult with qualified legal counsel regarding their specific circumstances.