Introduction
When a business retains outside counsel—or employs lawyers in-house—it enters a professional relationship governed by an intricate body of ethics rules. Among the most consequential of those rules, and among the least understood by non-lawyers, is Model Rule of Professional Conduct 1.13, which addresses the situation where a lawyer’s client is not an individual person but an organization: a corporation, a limited liability company, a partnership, a nonprofit entity, a governmental body, or any other form of legally constituted enterprise. Understanding Rule 1.13 is not merely an academic exercise for law students. For business owners, executives, directors, and in-house counsel, it has direct and practical consequences for how legal advice is delivered, how internal wrongdoing is handled, and who ultimately holds the loyalties of the lawyers serving the company.
This article examines Rule 1.13 in depth, drawing on the text of the ABA Model Rules of Professional Conduct, the accompanying Comments, and the realities of corporate legal practice. We address the foundational question of who the client is when a lawyer represents an organization, how lawyers must navigate conflicts between the interests of the organization and the individuals who act on its behalf, what duties arise when a lawyer discovers that someone inside the organization is acting illegally or unethically, and the limited but significant circumstances in which a lawyer may disclose confidential information to outside authorities. We also consider the rule’s implications for attorney-client privilege and offer practical guidance for businesses seeking to make the most of their legal relationships.
The Foundational Principle: The Organization Is the Client
Rule 1.13(a) sets out the governing principle in straightforward terms:
A lawyer employed or retained by an organization represents the organization acting through its duly authorized constituents.
This deceptively simple sentence carries enormous weight. In the ordinary two-party model of legal representation, the lawyer represents a person, and the duties of loyalty, confidentiality, and communication run to that person. In the organizational context, however, the “client” is a legal fiction—an entity that has no mind, no voice, and no capacity for independent action. The organization can only act through human beings: its officers, directors, employees, shareholders, and agents. Those individuals are referred to in Rule 1.13 and its Comments as “constituents” of the organization.
The critical point is that the lawyer’s primary duty of loyalty runs to the organization as a whole, not to any individual constituent, no matter how senior. The CEO who instructs outside counsel to file a lawsuit, the CFO who asks the company’s lawyer for advice on a transaction, and the general counsel who directs the work of the legal department are all acting as agents of the organization. They are not, by virtue of that interaction, clients in their own right. This distinction is not a technicality. It defines the contours of the lawyer’s obligations in almost every scenario that arises in organizational representation, and it is a source of genuine confusion—and sometimes genuine conflict—in practice.
The Comments to Rule 1.13 acknowledge the practical difficulty of this arrangement. Lawyers working with organizations necessarily form relationships with the people who populate them. Over time, those relationships can feel like personal representations. An executive who has worked closely with outside counsel for years may naturally assume that “their” lawyer has their back in all circumstances. Rule 1.13 makes clear that this assumption is not always warranted. The lawyer’s ultimate loyalty belongs to the entity, and when the interests of an individual constituent diverge from the interests of the organization, the rule governs how that conflict must be managed.
Navigating Conflicts Between the Organization and Its Constituents
The most commonly encountered challenge in organizational representation arises when an officer, employee, or other constituent of the organization is acting, or is about to act, in a manner that is contrary to the organization’s interests. Rule 1.13(b) addresses this situation directly:
If a lawyer for an organization knows that an officer, employee or other person associated with the organization is engaged in action, intends to act or refuses to act in a matter related to the representation that is a violation of a legal obligation to the organization, or a violation of law that reasonably might be imputed to the organization, and that is likely to result in substantial injury to the organization, then the lawyer shall proceed as is reasonably necessary in the best interest of the organization.
This provision captures a scenario that arises with surprising frequency in practice: an individual acting within or on behalf of a company is doing something that exposes the company to significant legal, financial, or reputational harm. The individual may not even realize it. Or the individual may know exactly what they are doing and have personal motives—profit, concealment of earlier wrongdoing, competitive pressure—that conflict with the organization’s lawful interests.
The rule imposes a duty on the lawyer who has actual knowledge of such conduct. The standard is not what the lawyer should have known, or what a reasonably diligent lawyer would have discovered. It is what the lawyer “knows.” The Comments clarify that knowledge means actual knowledge, though it may be inferred from circumstances. A lawyer who studiously avoids learning uncomfortable facts does not escape the rule, but the trigger requires genuine awareness, not mere suspicion.
When the threshold is met, the lawyer is required to proceed in the best interests of the organization, which in the first instance means reporting the matter internally. Rule 1.13(b) directs the lawyer to refer the matter “to higher authority in the organization,” including, if warranted by the seriousness of the matter, to the highest authority—typically the board of directors or an equivalent body. This is the obligation commonly described as “reporting up.”
In determining how far and how urgently to report upward, the lawyer must exercise professional judgment based on a constellation of factors identified in the Comments: the seriousness of the violation, the nature of the threatened harm to the organization, whether the conduct is ongoing or has already occurred, the apparent motivation of the person involved, whether the individual has been put on notice that the conduct is problematic, and the likely effectiveness of various possible responses. These are not mechanical calculations. They call for the kind of seasoned judgment that experienced counsel bring to complex situations.
Importantly, this duty to report up is distinct from any duty the organization’s lawyer might have toward the individual engaged in the problematic conduct. The lawyer does not represent that individual. The lawyer may need to make this clear, particularly if the individual expects or assumes that conversations with the company’s lawyer are confidential as between the two of them. Depending on jurisdiction and circumstances, the lawyer may be required to give what practitioners call an “Upjohn warning” or “organizational counsel warning,” informing the individual that the lawyer represents the company, not the individual, and that information disclosed to the lawyer may be shared with company decision-makers and used by the company.
Reporting Up: A Closer Look at the Internal Escalation Process
The concept of reporting up the organizational chain is central to Rule 1.13 and deserves careful attention. The rule does not require a lawyer to immediately escalate every problem to the board of directors. Rather, it envisions a graduated response calibrated to the severity of the situation.
In ordinary circumstances, the first step is to consult with the officer or employee responsible for the matter—assuming that person is not the one engaged in the problematic conduct. If the problematic conduct is being carried out by someone at a relatively low level of the organization, a conversation with that person’s supervisor may be sufficient. If the conduct is more serious, or if lower-level intervention proves ineffective, the lawyer must escalate further. The sequence moves upward through the organizational hierarchy: from a manager to a vice president, from a vice president to a general counsel or chief executive, and ultimately, if necessary, to the board.
The board of directors—or, in a nonprofit, the board of trustees; or, in a partnership, the managing partners—represents the apex of internal authority. If the lawyer concludes that those at the top of the organizational hierarchy are themselves complicit in the problematic conduct, or are refusing to address it despite the lawyer’s repeated efforts, the rule contemplates that the lawyer may have exhausted internal remedies. At that point, the question becomes whether the situation warrants action beyond the organization’s internal structure.
It is worth emphasizing what reporting up is not. It is not a license for the lawyer to override the decisions of organizational leadership. Organizations, like individuals, have the right to make decisions the lawyer disagrees with, provided those decisions are lawful. The lawyer who counsels against a business decision may be overruled, and being overruled is not a trigger for Rule 1.13 obligations. The rule is focused specifically on conduct that constitutes a violation of a legal obligation to the organization or a violation of law that could be imputed to the organization, and that is likely to cause substantial harm. Legitimate business disagreements, differences of strategic judgment, and even decisions that the lawyer considers unwise do not meet that threshold.
Reporting Out: Disclosure Beyond the Organization
Perhaps the most consequential—and most debated—aspect of Rule 1.13 is subsection (c), which was added as part of the ethics rule reforms that followed the corporate scandals of the early 2000s, most notably the Enron and WorldCom collapses. Rule 1.13(c) permits a lawyer, in carefully defined circumstances, to disclose confidential information to persons outside the organization:
Except as provided in paragraph (d), if despite the lawyer’s efforts in accordance with paragraph (b) the highest authority that can act on behalf of the organization insists upon or fails to address in a timely and appropriate manner an action, or a refusal to act, that is clearly a violation of law, and the lawyer reasonably believes that the violation is reasonably certain to result in substantial injury to the organization, the lawyer may reveal information relating to the representation whether or not Rule 1.6 permits such disclosure, but only if and to the extent the lawyer reasonably believes necessary to prevent the substantial injury.
Several features of this provision deserve emphasis. First, the permission to disclose is permissive, not mandatory. Rule 1.13(c) says the lawyer “may” reveal information; it does not say the lawyer “must.” This stands in contrast to the position taken in some states and under some regulatory regimes, which impose affirmative obligations on lawyers in certain circumstances to report outside the organization. Under the Model Rules as written, the decision whether to disclose is left to the lawyer’s professional judgment.
Second, the preconditions for disclosure under Rule 1.13(c) are demanding. The lawyer must have already made efforts to report up, those efforts must have been unsuccessful, and the highest organizational authority must have either insisted on the unlawful course or failed to address it adequately and in a timely manner. The violation must be “clearly” a violation of law—not arguably, not potentially, but clearly. And the lawyer must reasonably believe that the violation is reasonably certain to result in substantial injury to the organization. These are cumulative requirements, not alternative ones.
Third, the disclosure, if made, must be limited to what is reasonably necessary to prevent the injury. Rule 1.13(c) is not a license to dump confidential information publicly or to engage in a campaign of disclosure. It is a narrow exception to the fundamental duty of confidentiality, calibrated to allow the lawyer to act as a genuinely responsible professional in extremis, while preserving the broader trust that the attorney-client relationship depends upon.
Rule 1.13(d) carves out an important exception: the disclosure permission does not apply when the lawyer’s engagement was specifically to investigate an alleged violation or to defend the organization or its constituents in litigation or a proceeding. This ensures that lawyers brought in specifically to conduct internal investigations or to manage litigation do not find themselves in a position where their investigative role gives them access to information that they then feel empowered to disclose externally. The sensitive nature of those engagements warrants particular protection.
State variations on this framework are significant. A number of states have adopted versions of Rule 1.13 that differ from the Model Rule in important respects. Some states make disclosure mandatory in certain circumstances. Others impose more stringent preconditions. Lawyers and the businesses they serve must be attentive to the rules of the jurisdiction in which the representation is taking place, particularly in multi-state transactions or matters.
The Sarbanes-Oxley Dimension: Federal Obligations for Securities Lawyers
Any comprehensive discussion of Rule 1.13 would be incomplete without reference to the Securities and Exchange Commission’s regulations implementing Section 307 of the Sarbanes-Oxley Act of 2002. Those regulations, codified at 17 C.F.R. Part 205, impose specific obligations on lawyers who appear and practice before the SEC in the representation of public companies.
Under Part 205, a lawyer who becomes aware of evidence of a material violation of securities law or a material breach of fiduciary duty by the company or its officers, directors, or agents must report that evidence “up the ladder” to the company’s chief legal officer or chief executive officer. If that officer does not respond appropriately, the lawyer must further report to the company’s audit committee or board of directors. Unlike the Model Rule framework, the Part 205 obligations are mandatory rather than permissive, and they apply specifically to lawyers representing public companies in SEC matters, regardless of the state ethics rules that might otherwise govern.
The SEC’s regulations also provide for the possibility of a “qualified legal compliance committee,” a specialized subcommittee of the board charged with receiving and acting upon attorney reports of potential violations. Companies that establish such a committee create a defined internal channel for lawyers to fulfill their reporting obligations, which can be an important element of sound corporate governance.
The interplay between Rule 1.13 as adopted by individual states and the federal requirements of Part 205 is a complex area that requires careful navigation by lawyers representing public companies or companies that may become involved in SEC matters. For private companies, the Part 205 framework does not directly apply, but the principles it embodies—mandatory upward reporting, clear escalation paths, board-level accountability—represent best practices that many well-governed private companies have chosen to adopt voluntarily.
Withdrawal as a Remedy of Last Resort
When a lawyer has exhausted internal reporting channels and is not in a position to make external disclosure—whether because the conditions of Rule 1.13(c) are not met or because the lawyer’s own judgment counsels against it—the rule contemplates that withdrawal from the representation may be the only remaining option. Rule 1.13(e) provides that, when the lawyer reasonably believes it is necessary to do so, the lawyer may resign from the representation.
Withdrawal in the organizational context is not a simple matter. Depending on the stage of a matter and the nature of the representation, withdrawal can cause significant disruption to the organization. Courts must approve withdrawal in pending litigation. Clients may need time to retain substitute counsel. Deals in progress may be jeopardized. For these reasons, Rule 1.13 does not treat withdrawal as a routine remedy, and lawyers considering it must weigh their professional obligations against these practical realities.
The Comments to the Rule note that when a lawyer withdraws, or is discharged, the lawyer may disaffirm any opinion, document, affirmation, or the like that the lawyer has issued that the lawyer reasonably believes was based on materially inaccurate information or that would assist the organization’s officers in perpetrating a fraud. This so-called “noisy withdrawal”—resigning in a manner that signals to third parties that something is amiss without disclosing specifics—is a fraught and controversial practice, and one that requires careful judgment and, ordinarily, consultation with ethics counsel.
Attorney-Client Privilege in the Organizational Setting
Rule 1.13 has important implications for attorney-client privilege, which protects confidential communications between a lawyer and client from compelled disclosure in litigation or government investigations. In the organizational context, identifying who holds the privilege—and who controls it—is a question of considerable practical importance.
The attorney-client privilege in the organizational setting belongs to the organization, not to individual constituents. This principle was affirmed and elaborated by the Supreme Court of the United States in Upjohn Co. v. United States, 449 U.S. 383 (1981), one of the foundational decisions in corporate attorney-client privilege law. In Upjohn, the Court held that the privilege extends to communications between outside counsel and employees of the corporation, provided those communications were made for the purpose of enabling the corporation’s lawyers to render legal advice to the corporation. The Court rejected the more restrictive “control group” test, which had limited the privilege to communications with senior executives who had authority to act on legal advice, in favor of a broader approach that recognizes the reality of how legal advice is given in complex organizations.
The practical consequence of the privilege belonging to the organization is that the organization—through its authorized leadership—controls the privilege. Individual employees cannot assert or waive the privilege on their own behalf with respect to communications made in their capacity as company representatives. If an employee learns, for example, that the company intends to waive the privilege and cooperate with a government investigation by producing attorney-client communications, that employee cannot independently prevent the waiver or assert the privilege to protect those communications.
This dynamic can create significant personal jeopardy for individual employees, particularly in the context of government investigations where prosecutors and regulators frequently pressure companies to waive the privilege as a condition of receiving cooperation credit. Employees who communicated with company counsel in the good-faith belief that those communications were protected may find that protection stripped away by a corporate decision to cooperate. This is one of the principal reasons why individuals who are the subject of corporate investigations—or who believe they may become so—should retain independent personal counsel rather than relying exclusively on company lawyers.
The organizational privilege also raises questions about the confidentiality of internal investigations conducted by outside counsel. When a company hires outside counsel to investigate alleged misconduct, the resulting investigation is a privileged communication between the company and its lawyers. The employees interviewed in the course of the investigation do not hold the privilege with respect to their own statements. Again, Upjohn warnings are essential in this context to ensure that employees understand the nature of their relationship with investigative counsel.
The Dual Representation Problem
Rule 1.13(g) expressly permits a lawyer who represents an organization to also represent its directors, officers, employees, members, shareholders, or other constituents—subject to the conflict of interest rules set out in Rules 1.7 and 1.9. This type of dual or joint representation is common in smaller businesses, family-held companies, and early-stage ventures, where the same lawyer or firm may represent the entity and its principal owners in the same transaction or matter.
The permission to represent both the organization and its constituents does not eliminate the conflicts that can arise. When a transaction or dispute puts the interests of the entity and an individual constituent in tension, the lawyer who represents both faces an irreconcilable conflict that may require withdrawal from one or both representations. The Comments caution that if the lawyer is representing both, a conflict of interest may arise that requires the lawyer to decline or terminate the representation of the less essential client—which will ordinarily be the individual, not the organization.
In practice, businesses should be attentive to this issue whenever the same lawyer or firm represents both the company and individual principals. Engagement letters should clearly identify who the client or clients are. When a matter arises in which the interests of the company and an individual diverge, the parties involved should seek separate legal advice before the conflict becomes acute.
Practical Implications for Businesses
Rule 1.13 is not merely a technical rule of legal ethics. It shapes the everyday reality of how legal advice is given and received in the business setting. Understanding its implications enables companies to build more effective legal relationships and to avoid the misunderstandings that can arise when individuals within an organization mistake their interactions with company counsel for a personal attorney-client relationship.
Businesses should ensure that their executives, directors, and employees understand the basic principle: when the company’s lawyers are present, their loyalty runs to the company. This understanding is particularly important in crisis situations, government investigations, and internal compliance matters, where the interests of individuals and the organization may diverge sharply. Companies that have robust compliance programs typically address this issue directly, training employees on the role of legal counsel and establishing clear internal reporting channels so that potential violations are escalated through appropriate channels before they reach the crisis stage.
Businesses should also pay careful attention to engagement letters and retainer agreements. A well-drafted engagement letter will identify the client with precision, describe the scope of the representation, and address the handling of conflicts among related parties. In multi-entity business families—where a holding company, operating subsidiaries, and affiliated entities may all interact with the same legal team—clarity about which entity is the client in any given matter is essential.
For in-house legal departments, Rule 1.13 creates a particular set of professional responsibilities. In-house lawyers are employees of the organization, subject to the direction of management, and at the same time they are lawyers whose professional duties run to the organization as an entity. When management instructs in-house counsel to take a course of action that the lawyer believes violates the law or will cause substantial harm to the company, the lawyer is not free simply to comply. The duty to report up—ultimately to the board if necessary—applies to in-house lawyers just as it does to outside counsel.
The rule also has implications for document retention and privilege management. Companies engaged in litigation, government investigations, or significant transactions should work closely with counsel to understand which communications are privileged, how to maintain privilege over sensitive matters, and what the consequences are of waiving or losing the privilege. Employees should be trained not to include company lawyers gratuitously in communications for the purpose of creating a false privilege shield. Conversely, employees should understand that genuine legal advice, sought through proper channels, is entitled to protection that the company can and should preserve.
Government and Nonprofit Organizations
Rule 1.13 applies not only to for-profit business entities but to any form of organization, including government bodies and nonprofit entities. The Comments acknowledge that the application of the rule to government lawyers presents special challenges. Government lawyers may owe duties to the public interest that do not arise in private sector representations, and the definition of “highest authority” in the governmental context may be ambiguous in ways it is not in a private corporation with a functioning board.
For nonprofit organizations, particularly charitable foundations and advocacy organizations, the board of directors typically exercises the function that the board of a for-profit corporation performs. Rule 1.13 obligations run to that board, and the lawyers serving nonprofits should ensure that internal governance structures are adequate to receive and act upon the kinds of reports the rule contemplates. Smaller nonprofits, which may have part-time or volunteer governance structures, may be particularly vulnerable to the kinds of organizational malfunctions that Rule 1.13 is designed to address.
Conclusion
Rule 1.13 reflects a fundamental truth about the practice of law in the business world: the organizational client is not merely a legal fiction. It is a structured entity with interests, obligations, and a legitimate claim on lawyer loyalty that is distinct from—and sometimes in tension with—the interests of the individuals who happen to speak for it at any given moment. Understanding this principle is essential for businesses that want to use legal counsel effectively and for the individuals within those businesses who interact with lawyers on a daily basis.
The rule’s framework for handling internal wrongdoing—the graduated duty to report up, the limited permission to report out, and the backstop of withdrawal—represents a carefully considered balance between the lawyer’s professional duties to the client, the client’s interest in maintaining the confidentiality of its legal communications, and the broader public interest in preventing the legal system from being used as a tool of corporate misconduct. That balance is not always easy to strike, and the judgments it requires are among the most difficult that lawyers face in practice.
Businesses that understand the framework—and that work with lawyers who take their Rule 1.13 obligations seriously—will be better positioned to benefit from the kind of candid, rigorous legal advice that good corporate governance requires. Businesses that ignore it, or that expect their lawyers to function as uncritical instruments of whatever management decides, may find themselves exposed in ways that could have been avoided.
If you have questions about how Rule 1.13 applies to your organization, your legal department, or your relationships with outside counsel, we invite you to contact our firm. Our attorneys have extensive experience advising businesses on professional responsibility, corporate governance, and the full range of issues that arise at the intersection of law and organizational life.
DISCLAIMER: This article is intended for general educational and informational purposes only and does not constitute legal advice. It does not create an attorney-client relationship between the reader and the firm. The law of professional responsibility varies by jurisdiction, and businesses should consult qualified legal counsel in their applicable jurisdiction for advice on specific situations.