Corporate scandals and new regulations have moved companies to strengthen their response to allegations of wrongdoing. The Sarbanes-Oxley Act, revised organizational sentencing guidelines and new stock exchange rules have placed management and boards of directors under increasingly stringent requirements to respond effectively to allegations of fraud or other misconduct.

Yet there is little guidance as to what constitutes an appropriate response.

Before senior management, boards of directors or audit committees encounter an event that may trigger an investigation, they should ensure that the following are in place:

* A written investigative protocol that standardizes processes and practices.

* Clear delineation of high-level responsibility for performing initial evaluation of allegations.

* A process for review of issues deemed immaterial from an operational or financial standpoint.

The determination of whether to perform an investigation will largely be informed by these standards, with additional consideration given to the allegation’s nature and scope, the individuals involved and the extent to which the government or other external parties have been a factor.

Once the choice to investigate has been made, the first question should be who should conduct the investigation. Key qualifications include capabilities in interviewing, computer forensics, electronic discovery and data analysis. Qualifications for subject matter experience, such as forensic accounting, might also be important.

Another vital question is whether the investigation needs to be independent. In order to help ensure that the results of an investigation will be accepted by third parties, situations that could give rise to criminal prosecution or regulatory enforcement should be reviewed by a law firm with no significant prior contacts with the organization, and with no established relationships with people they may be asked to investigate.

The scope should be set out through a board resolution or a formal engagement letter with an external investigator. As the investigation progresses, the scope may change as a result of what is learned. It is critical that the investigative team brief the oversight body or group on a regular basis, paying specific attention to findings that could alter the course of the process.

Once the investigation is completed, a report should be prepared. Ordinarily, it will include a description of the original complaint, a summary of the investigative procedures, an analysis of the information obtained and recommendations for action. The report may be delivered orally or in written form; most attorneys prefer the former (leaving no paper trail for future civil litigation), and regulators and external auditors prefer the latter.

If the matter involves a serious or highly sensitive allegation, the full board of directors and senior management (if not involved) should be briefed. In some cases, informing all employees of an investigation and its results can be a positive step toward demonstrating organizational commitment to compliance. A more limited disclosure, to those affected or to the complaining party (if known), may also be appropriate.

Considerations on external or public disclosure also need to be made. These may highlight the organization’s diligence and willingness to cooperate with law enforcement and other authorities while reducing long-term damage to its reputation. Companies should be wary that attorney-client privilege might restrict external disclosures. However, it is becoming more frequent that the government, regulators and external auditors are requiring the waiver of this privilege.

Though the primary purpose of an investigation is to learn the facts and circumstances of the alleged wrongdoing, the process is not complete until corrective action is taken. Typically, this is associated with disciplinary action. However, as organizations focus on the effectiveness of their internal controls, true remediation of specific processes or procedures that may have failed must be implemented.

The goal of an effective investigation is to put a troublesome matter for a company behind it. The consequences of an ineffective investigation will only compound the original problem.

Patricia Tilton is an audit partner in KPMG LLP’s forensic services practice and is based in Des Moines.