White Paper · Business & Contracts · Investigations

Internal Investigations: Build the Record Without Assuming Privilege

An internal investigation should produce facts management can act on while preserving a disciplined legal record. In Illinois, that requires separating ordinary business fact-finding from legal advice, controlling who communicates with counsel, and documenting decisions without promising that every interview note is privileged.

By Lincoln Square Law · 8-minute read

Define the legal purpose before interviews begin

Start with a written investigation charter that identifies the issue, the decision-maker, the investigator, and why counsel is involved. A complaint about harassment, billing, data access, licensing, safety, vendor misconduct, or financial controls may require the company to gather facts for several purposes at once. Some are operational: stop harm, preserve service, discipline employees, notify a regulator, or correct a process. Others are legal: obtain advice about exposure, litigation, disclosure duties, or remedial options. Those purposes should not be blurred. A file labeled “privileged” does not become protected merely because counsel was copied on an email.

The charter should identify the client as the organization, not the individual employee who reported the problem or the manager conducting interviews. Illinois Rule of Professional Conduct 1.13 states that a lawyer retained by an organization represents the organization acting through its authorized constituents. That matters when a witness assumes the lawyer is “their lawyer.” Investigation communications should accurately explain counsel’s role and avoid creating a misleading expectation of personal representation.

Separate fact collection from legal advice

Build two linked workstreams. The factual record should capture who knew what, when events occurred, which systems or documents support the account, and what immediate controls were taken. The legal workstream should record counsel’s requests, advice, mental impressions, and decision analysis. In Illinois discovery, Supreme Court Rule 201(b)(2) protects privileged matters and limits discovery of certain trial-preparation material, but it does not create a blanket shield for every fact gathered after a lawyer becomes involved.

The practical discipline is to make each document serve a clear purpose. A chronology created so operations can remediate a recurring failure is different from counsel’s memorandum analyzing legal theories. Interview notes that simply memorialize factual statements may receive different treatment from notes that reveal counsel’s strategy or mental impressions. Do not put legal commentary into routine operational tickets merely to make them look protected. That can spread sensitive advice to people who do not need it and complicate later privilege analysis.

Use an Illinois-specific privilege map

Illinois corporate privilege analysis deserves special attention because the state has historically used a narrower control-group approach than the federal Upjohn framework. Consolidation Coal Co. v. Bucyrus-Erie Co., 89 Ill. 2d 103 (1982), addresses both corporate attorney-client privilege and work product. A company should therefore avoid telling employees that every communication with an investigating lawyer is automatically privileged. The safer message is that the lawyer represents the organization, the interview is being conducted to gather information for legal advice, confidentiality is important, and the company controls the organization’s privilege subject to applicable law.

Create a witness map before interviews. Identify senior decision-makers, employees whose advice is ordinarily relied upon for the relevant corporate decision, people with first-hand facts, and people who merely received copied communications. That map helps counsel decide interview order and documentation method. It also helps the company distinguish persons who must know legal advice from persons who only need an operational instruction.

Preserve evidence before the story hardens

Issue preservation instructions early when litigation, a claim, agency inquiry, contractual dispute, or serious internal allegation is reasonably foreseeable. Preserve email, messaging, relevant cloud folders, access logs, camera footage, HR records, quality records, contracts, system audit trails, and device data that could otherwise roll off. Coordinate preservation with IT so routine deletion, log rotation, or account deactivation does not destroy relevant evidence.

Preservation should be targeted rather than theatrical. Define custodians, systems, date ranges, and subject matter, and document additions as the investigation develops. If an employee leaves during the investigation, hold the account before disabling it and capture organization-owned devices according to policy. A preservation record is valuable because it shows what was protected and when, and it prevents the later investigation from depending on memory about what might once have existed.

Interview for facts, not a predetermined conclusion

Prepare an issue outline, not a script designed to confirm management’s first theory. Ask open questions before confronting a witness with documents. Distinguish direct observation from what the witness heard from others. Identify dates, locations, participants, systems, and documents during the interview so statements can be tested. When credibility matters, record the specific conflict or corroboration rather than assigning a vague label such as “not credible.”

At the beginning of a counsel-led interview, give a concise role warning appropriate to the situation. Counsel represents the company, not the witness. The purpose is to obtain information so counsel can advise the company. The company may decide whether and how to disclose information. The witness should keep the interview confidential to protect the process, subject to legal rights that cannot be restricted. Avoid overbroad confidentiality directions that could interfere with protected employee activity or reporting rights.

Keep the chronology, evidence index, and decision log synchronized

Maintain three core records. The chronology states events in time order and identifies the supporting source. The evidence index lists documents, files, interviews, and system records with stable identifiers. The decision log records material steps: preservation, interim controls, interview sequencing, privilege decisions, specialist involvement, report format, disclosures, and remediation. These records reduce the risk that the final memorandum contains conclusions that cannot be traced to evidence.

Version control matters. Do not overwrite interview summaries after later evidence changes the investigator’s view. Correct factual errors transparently and preserve the prior version when appropriate. Keep legal analysis out of business-facing corrective-action trackers unless it is necessary for implementation. The objective is not to create more paper. It is to make the file explain itself months later to management, outside counsel, an auditor, or a court.

Plan the report and disclosure path before the final interview

Decide early who will receive the final product. A privileged legal memorandum for a board committee serves a different purpose from a factual findings report used to impose discipline, an insurer notice, a government disclosure, or a remediation plan sent to operations. Trying to make one document serve every audience can expose legal analysis unnecessarily or produce a business report too abstract to implement.

Counsel should identify mandatory or contractual notice issues as facts develop, not after the report is complete. Privacy incidents, workplace injuries, licensing events, fraud allegations, contractual breaches, or professional-practice issues may have different reporting clocks. If the company chooses voluntary disclosure, document who authorized it, what was disclosed, the legal basis, and what privilege consequences were considered. Privilege should support candid advice. It should not become an excuse to delay an operational response the law requires.

Close with remediation and a defensible file

A completed investigation should answer four questions: what happened, what evidence supports that finding, what rule or control applies, and what the organization will do next. Separate substantiated facts from unresolved conflicts and recommendations. Assign corrective actions to owners with dates and evidence of completion. If policy, access, training, contracting, supervision, or reporting controls failed, fix the system rather than treating discipline as the only remedy.

Then close the file deliberately. Confirm preservation status, access restrictions, document retention, privilege labels where appropriate, and the location of the final evidence index. Record whether the matter should be revisited after a regulator response, lawsuit, audit, or remediation deadline. A defensible investigation record is not one that contains the most documents. It is one that allows a later reviewer to understand the question, the evidence, counsel’s role, the organization’s decision, and the corrective action without inventing facts that were never recorded.

Run a privilege-and-evidence check before closure

Before the investigation closes, have counsel review the evidence index for documents that were promised but never collected, interview notes that contain ambiguous attribution, and business records that were mixed with legal analysis. Confirm that privilege labels are accurate and not overused. A blanket label weakens discipline because it tells later reviewers nothing about the legal basis for protection.

Test the file against a realistic disclosure request. If a regulator, litigant, auditor, insurer, or board member asked for the factual chronology tomorrow, could the organization produce the relevant facts without accidentally disclosing unrelated legal advice? Could counsel identify what is withheld and why? This exercise often exposes the need to separate a legal memorandum from the evidence and remediation records. It also gives management a final chance to complete corrective actions before the matter is treated as closed.