Jeffrey M. Kaplan (jkaplan@kaplanwalker.com) is a Partner with Kaplan & Walker LLP in Princeton, New Jersey, USA.
Companies may wish to conduct compliance and ethics risk assessments under their respective attorney–client privileges. Being able to conduct risk assessment interviews and analyses and develop recommendations with the confidentiality afforded by the privilege has many benefits, the chief of which is that it promotes those involved being totally candid in dealing with sensitive manners. But securing privileged status for a risk assessment requires more than wishful thinking:
-
When using an outside law firm for the assessment, the firm should be formally retained to provide legal advice to the company, and spell out (though not in great detail) how the risk assessment serves to provide such advice.
-
When documents or other materials related to the assessment are exchanged, they should be marked “Privileged & Confidential/Attorney–Client Communication.”
-
A high-ranking executive or company counsel should communicate to employees who are scheduled to be interviewed the purpose, importance, and confidential nature of the assessment, including that interviews are necessary for counsel to render legal advice to the company.
-
Interviews should begin by reminding employees of the need to maintain the confidentiality of the discussion. This should be repeated at the end of the interview. As well, interviewees should be asked not to take notes.
-
The final report of the assessment should indicate that it contains legal advice and should be labeled as privileged and confidential. The dissemination of the report should be appropriately limited.
Note that a company’s privilege assertion might not be sustained, even if it takes all the appropriate steps. As indicated above, a court might not immediately recognize risk assessment work as legal in nature, because a court might consider the nature of a risk assessment to be more administrative than legal. Though I do not believe that such a ruling would be correct, it is possible.
Also, regardless of how such matter is resolved, those documenting the risk assessment should do so in a noninflammatory way. This is a good point to stress generally—not just in risk assessments. Finally, and perhaps most important, when significant risks are found, they should be remedied in a prompt and thorough way.