ABA Section of Business Law

Volume 15, Number1 September/October 2005

What if it's an inside job?
Responding to crime by business insiders
    By David F. Taylor

You are the general counsel of Software Inc. You have learned that a company vice president may have embezzled money from the company and accepted kickbacks from vendors. You suspect that the officer has received at least $3 million. What should you do?

Much has been written about business crime that victimizes third parties. But crime by insiders that victimizes the business itself is also a significant problem. The Association of Certified Fraud Examiners has estimated that the typical business loses 6 percent of its revenues to fraud alone.

In addition to causing monetary losses, crime by insiders can destroy trust, undermine confidence in a company's controls and processes, and even raise questions about the integrity or competence of management. Opportunities for crime by insiders are growing because of increasingly complex business structures, the geographic dispersal of operations and the spread of powerful technologies.

Employee crime can take many forms. Financial officers can embezzle money. Project managers can solicit bribes and kickbacks. Technology officers can sell trade secrets. Even low-level employees can cause substantial damage by getting into computer systems and destroying or stealing critical data. There is no template for responding to serious insider crime, that is, crimes involving significant losses or high-level management. However, there are some issues that commonly arise.

How should Software Inc. respond when it first suspects that it has been the victim of serious insider misconduct? In most cases, companies will want to take three steps as quickly as possible. The first step is to investigate as much as possible, as quickly as possible.

Second, the company should take prompt action to contain the problem and prevent further harm. This may include determining why the company's internal controls failed, changing controls to prevent similar losses and suspending or firing the wrongdoer.

Third, the company should consider whether it is required to report the misconduct. As a general rule, companies are not required to report insider crime directed solely at the company. See United States v. Ciambrone, 750 F.2d 1416, 1418 (9th Cir. 1984) (". . . a person who witnesses a crime does not violate 18 U.S.C. § 4 if he simply remains silent").

However, there are some notable exceptions and limitations on this general rule. Businesses in some highly regulated industries may have special disclosure obligations. See, for example, 41 U.S.C. § 57(c) (reporting of kickbacks related to government contracts), 12 C.F.R. pt. 21 (suspected bank crimes). And if the misconduct benefited the company or damaged third parties, such as investors, lenders or customers, then other reporting obligations and considerations may come into play.

For issuers of securities, moreover, serious insider crime may trigger important disclosure obligations under the Sarbanes-Oxley Act of 2002 (SOX) and other federal securities laws. For example, Section 404 of SOX may require an issuer to evaluate and report on material deficiencies in the financial controls that contributed to any losses. SOX and related regulations may also require other actions, such as revised controls and improved procedures. Issuers and their lawyers must carefully consider their obligations under SOX and other securities laws and regulations when responding to insider crime.

Assume that Software Inc. takes those steps. It has done an investigation, which confirms that the vice president embezzled money and received kickbacks totaling approximately $3 million. You are confident that no material misrepresentations appear in the financial statements, that no third parties were victimized and that no reporting is required. The vice president has been terminated, new internal controls have been implemented to ensure that the misconduct cannot be repeated and appropriate disclosures have been made. Are you done? Probably not.

At least in theory, Software Inc. could simply terminate the vice president and move on. But companies will often find this approach to be inadequate, especially in cases involving serious misconduct.

Simply terminating the wrongdoer would do nothing to recover the company's losses, punish the wrongdoer or deter other insiders from engaging in misconduct. It could leave management open to claims that it condoned or even abetted the misconduct. And it may be inconsistent with the obligation of management and the board of directors to protect company assets and to establish a reasonably effective ethics and compliance program.

More often than not, in serious cases of misconduct a company will consider some form of remedial action designed to recover the company's losses and punish the wrongdoer. Companies generally have at least three options: reporting the matter to law enforcement for investigation and prosecution; filing a civil lawsuit against the wrongdoer; and pursuing claims against insurers and other third parties. These options are not exclusive, and choosing the best course requires familiarity with both criminal and civil litigation.

Referrals to law enforcement — Serious insider misconduct will generally violate federal or state criminal laws (and often both). Federal criminal laws apply to many of the most common types of misconduct committed by insiders, including various types of fraud, interstate transportation of stolen property, commercial bribery, intellectual property crimes, racketeering and many computer-related crimes. State criminal laws cover much of the same conduct.

Given the sweep of federal and state criminal laws, a company victimized by insider misconduct usually has the option of referring the matter to law enforcement for investigation and prosecution. As discussed above, a company generally is not required to report such crimes to law enforcement, but there may be advantages to doing so.

There are also drawbacks, and law enforcement will usually not have any magic bullets for a company victimized by insider crime. In most serious cases, a company will want to report the crime, but the decision should not be automatic and should be made only after weighing the benefits and costs.

One benefit of reporting a crime to law enforcement is that law enforcement authorities have investigative powers, resources and expertise not readily available to a private company, such as the ability to execute search warrants, carry out undercover operations and quickly obtain financial records without notice to a suspect. Those resources can be especially useful where a crime involves outsiders or evidence that is not accessible to the company.

Another benefit of a criminal referral is that most jurisdictions provide for restitution to the victim of a crime. Federal courts may order a defendant to pay restitution to any victim of a crime. 18 U.S.C. § 3663. The beneficiary of a restitution order may register the order in the same manner as a civil judgment. 18 U.S.C. § 3664(m). Courts sometimes are reluctant to order restitution to a company in the full amount of the claimed loss, especially if there are disputed issues that may be more fully aired in civil litigation. Nonetheless, restitution can provide a cost-effective alternative to civil litigation in some cases, especially where the losses are relatively small or clear cut.

Other benefits of reporting a crime to law enforcement are less tangible. Perhaps most important is the message that a criminal referral sends to stakeholders, such as employees, investors, creditors, customers and regulators. If a matter is not referred for prosecution, stakeholders may wonder whether management condoned or abetted the crime; they may question management's commitment to ethics or compliance. Referring a matter for criminal prosecution can allow management to answer those questions and show its integrity. It also sends a clear message of deterrence to employees.

The costs of reporting a crime to law enforcement include a loss of control over the investigation and prosecution. After a matter is reported to law enforcement, the prosecutor and investigators will control the important decisions. Investigators may follow paths the company sees as irrelevant, costly or damaging, such as interviewing unreasonably large numbers of employees or customers. Prosecutors may make decisions about charging, strategy or settlement with which the company does not agree.

A company that reports a crime also risks unwanted publicity or the disclosure of sensitive information. Most criminal proceedings are public, at least once a defendant is charged. Indictments, search warrant affidavits and plea agreements can contain detailed information about the company's business and the crime. Criminal discovery rules may require a prosecutor to produce information that the company provides to the government, such as business records, investigators' notes of interviews with company employees and grand jury testimony by employees. Prosecutors may even issue press releases or hold press conferences.

Another consideration is that there are no guarantees with a criminal referral. Criminal investigations and prosecutions often move slowly. Prosecutors face heightened burdens of proof, and the experience and skills of prosecutors can vary widely. It is important to assess the strength of the evidence and the skills of the law enforcement authorities before making a referral.

Assume that Software Inc. balances all these considerations and decides to report the crime to law enforcement. It then faces a number of related decisions, including where to report the crime. The answer to that question will depend on the company's goals and the circumstances. The company will want to understand what crimes could be charged in each jurisdiction, whether important evidence, information or assets are located in other jurisdictions and what penalties are likely in each jurisdiction.

The company will also want to understand how the strengths and weaknesses of different law enforcement agencies fit with its strategy. Federal law enforcement authorities, for instance, may have a greater ability to obtain evidence located in other states or countries.

Civil actions — Regardless of whether a company refers the matter for criminal prosecution, it will generally have a second option — filing a civil lawsuit. Virtually every significant crime against a company will give rise to civil claims such as conversion, fraud and deceit, breach of fiduciary duty and unjust enrichment.

Companies also may have powerful statutory remedies, such as claims under the federal Racketeer Influenced and Corrupt Organizations Act (RICO), some state racketeering statutes and the intellectual property statutes. If a wrongdoer has assets sufficient to satisfy a judgment, then companies should consider filing a claim.

The primary downside of filing a civil action is cost. Statutory remedies like RICO mitigate that risk by allowing crime victims to recover attorneys' fees and other costs of litigation. But a company might nonetheless question why it should incur any of the costs of bringing a civil lawsuit if criminal laws provide for restitution to the victims of crime. There are a number of reasons for companies to incur those costs.

Where the amount at issue is large and the defendant has assets to satisfy a judgment, a civil action often provides a superior mechanism for recovering losses. Civil cases may permit quicker and more complete recoveries than criminal-restitution proceedings. In addition, where an employee's conduct violates RICO or state racketeering statutes, a company may be entitled to treble damages, as well as attorneys' fees and other costs of investigation. These amounts may be substantial and can provide a powerful incentive for a defendant to cooperate and resolve a case promptly.

Before filing a civil action to recover losses, the company will want to confirm that the likely recovery justifies the expense. That means both assessing the amount of the likely damages and determining whether the wrongdoer has assets sufficient to satisfy the expected judgment.

Not only is a civil action often a superior method for recovering losses, the prejudgment remedies available in a civil action usually provide the most effective mechanisms for securing assets to satisfy a judgment. A suspect who learns that the company has discovered his misconduct may secrete assets, leaving little or nothing to satisfy a judgment or forfeiture order. By securing assets, the company protects its ability to recoup its losses, deprives the wrongdoer of the benefits of the scheme and may hasten a resolution of the case.

A company victimized by insider crime will almost always be able to establish the basis for prejudgment remedies to secure assets, such as attachment or garnishment. Writs for prejudgment attachment or garnishment generally should issue if the company shows that the defendant is guilty of a fraud or that the damages arise from the commission of some other crime.

The company may have other options for securing assets, such as an injunction barring the transfer of certain assets. Such injunctions are not available to secure payment of a legal claim, but courts likely retain authority to issue such injunctions in support of certain equitable or statutory claims. See Grupo Mexicano v. S.A. Alliance, 527 U.S. 308, 325-26 (1999).

In addition to providing a superior mechanism for recovering a company's losses, civil litigation provides the company with more control and leverage than a criminal restitution proceeding. In a civil action, the company will control the important decisions, such as when and where to file the lawsuit, what claims to assert, what areas to explore in discovery and when and on what terms to settle.

Another reason to file a civil lawsuit is to obtain information through discovery that a company cannot obtain through other means. The government may be unwilling or unable to share information obtained through a criminal investigation or prosecution. Most federal investigations are carried out through a grand jury, and federal law prohibits a prosecutor or investigator from disclosing to a third party matters that occur before a grand jury. See Fed. R. Crim. P. 6(e).

By filing a civil lawsuit, a company acquires broad rights to issue subpoenas, propound written discovery and depose witnesses. A company can use the resulting information to trace assets, identify the extent of the crime or support an insurance claim.

In at least one respect, a criminal restitution order may be somewhat more advantageous than a civil judgment or claim. A criminal restitution order issued under federal law is not dischargeable in bankruptcy. See 11 U.S.C. §§ 523(a)(13), 1328(a)(3). Most other debts arising from an insider's fraud or embezzlement are dischargeable unless the victim company obtains an order from the Bankruptcy Court exempting the debt from discharge. See 11 U.S.C. § 523(c)(1). Courts will likely grant such an exemption if timely requested and supported by the evidence, but this may introduce some risk and uncertainty that the company would not face with a criminal restitution order.

Parallel civil and criminal actions — Criminal prosecution and civil litigation are not mutually exclusive. A company may file a civil action where the government brings a criminal prosecution, and vice versa. Even a bad result in a criminal prosecution will not bar a civil lawsuit. Moreover, filing a civil action does not waive a company's rights to restitution under the criminal laws, although the amount of any restitution will be reduced by the amount of compensation recovered in the civil proceeding.

Pursuing parallel civil and criminal actions can be an effective strategy for a company. It allows a company to secure the benefits of both types of action at minimal cost. For instance, a company may use the civil action to freeze assets and then allow the criminal action to go forward and establish the elements of the defendant's liability. The interplay between parallel civil and criminal actions poses both opportunities and challenges, which the company should carefully consider before pursuing such a strategy.

One important consideration is whether the defendant will assert his or her right against self-incrimination. The Fifth Amendment provides that "[n]o person shall . . . be compelled in any criminal case to be a witness against himself." Although expressly limited to criminal cases, the courts have extended the right against self-incrimination to civil lawsuits. See Kastigar v. United States, 406 U.S. 441, 444 (1972).

A defendant in a civil lawsuit with a reasonable fear of criminal prosecution may invoke the Fifth Amendment to refuse to answer allegations in a complaint, Nat'l Acceptance Co. v. Bathalter, 705 F.2d 924, 927 (7th Cir. 1983), respond to written discovery, Campbell v. Gerrans, 592 F.2d 1054, 1057 (9th Cir. 1979), or answer questions at a deposition. In re Folding Carton Antitrust Lit., 609 F.2d 867, 870-72 (7th Cir. 1979). Thus, a defendant who asserts Fifth Amendment rights can frustrate a company's attempts to obtain information through litigation.

Although the Fifth Amendment privilege can deprive a company of discovery, a defendant who invokes the privilege in a civil action may pay a heavy price. A court may draw an adverse inference against a defendant who invokes the right against self-incrimination. See Baxter v. Palmigiano, 424 U.S. 308, 318 (1976). Even in the absence of an adverse inference, a defendant who invokes the Fifth Amendment may be unable to rebut the company's evidence, paving the way for summary judgment or some other resolution in favor of the company.

A related consideration is whether the defendant will move to stay some or all of a civil action pending resolution of a criminal investigation. Defendants may move for a stay to protect themselves from the dilemma of having to choose between asserting the privilege and losing the civil lawsuit. Stays are not easy to obtain. But where entered, they can delay some or all of a civil case.

What if the defendant pleads guilty in a criminal proceeding? That will almost certainly be good news for the company in the civil lawsuit. A defendant who pleads guilty to a crime will generally be estopped from denying the elements of the criminal offense in civil litigation. See18 U.S.C. § 3664(l). Once the wrongdoer pleads guilty, proving the civil case becomes even easier.

In the case of Software Inc., these considerations may lead the company to file a civil lawsuit, even if it refers the matter for criminal prosecution. Given the powerful remedies available under RICO and some state racketeering acts, the company would certainly want to assert claims under those statutes if possible.

If appropriate, the company would also want to assert the types of equitable claims that would maximize its ability to freeze or otherwise secure assets, including claims that would give rise to equitable interests in specific property derived from the proceeds of the crime. The company would also want to pursue prejudgment attachment or garnishment of assets to secure any judgment.

Insurance and other third-party claims — Another option sometimes available to a company victimized by insider crime is to assert claims against third parties. These claims can be especially important when the wrongdoer lacks assets sufficient to compensate the company for its losses.

Many companies carry insurance to protect against employee crime. A company should check its insurance policies promptly on learning of a crime. If there are grounds to submit a claim, then the company will need to comply with the terms of the policy. Typical policies require the company to provide the insurer with notice of the claim and a proof of loss within certain time periods, to cooperate with the insurer's investigation and to provide certain types of information on the request of the insurer. Policies may also require that the company report the crime to law enforcement authorities.

If it is clear that the policy provides coverage in amounts sufficient to cover the full amount of the company's losses, then the company may need to do little more than submit a claim in accordance with the policy. Unfortunately, even where there is a crime policy in place, it may not cover all the costs of serious insider misconduct.

The policy may have coverage limits that fail to compensate the company fully for its losses. Or the policy may exclude coverage for high-level employees or certain types of crimes. In those cases, the company may submit an insurance claim and still need to take action on its own to recover its uncompensated losses and protect its rights. In that event, the insurer may have rights that the company will want to consider, especially concerning settlement of any claims. The company should be careful not to release the insurer's rights.

A company victimized by insider crime may also have claims against other third parties. These may include claims for negligence against third parties with a duty to detect or prevent a crime, such as auditors, as well as claims against third parties who participated in the crime, such as vendors who paid kickbacks. All such claims need to be analyzed like any litigation claim.

Companies victimized by serious insider crime have a number of options under both criminal and civil law. A well-advised company will evaluate the benefits and risks of its various options in light of its goals. A company that chooses well can recoup losses, protect its reputation and avoid unnecessary embarrassment.