Does Attorney-Client Privilege Cover an Internal Investigation?

Attorney-client privilege can protect an internal investigation, but it is not automatic, and it covers less than most executives assume. It protects confidential communications between the company and its lawyers made for the purpose of legal advice. It does not protect the underlying facts, it does not cover business advice dressed up as legal advice, and the company can lose it by sharing the results too widely. If you are about to look into a complaint, an audit finding, or a suspected violation, the way you set up the review in the first week decides how much of it stays protected later.

Structuring reviews this way is a core part of how our risk management and legal compliance practice handles internal investigations, so a company can investigate thoroughly without handing a roadmap to the next plaintiff.

What privilege protects in an internal investigation

Two separate doctrines are in play.

Attorney-client privilege

For a company, the leading case is Upjohn Co. v. United States, where the Supreme Court held that the privilege can cover communications between company counsel and employees at any level when those employees give counsel information needed to advise the company. That is why interviews conducted by counsel, and counsel’s memos reporting legal conclusions, can be privileged.

The privilege belongs to the company, not to the employees who were interviewed. The company decides whether to keep it or waive it, including by sharing findings with a regulator.

Work product protection

Documents prepared in anticipation of litigation, by or for a party or its representatives, are protected as work product under Federal Rule of Civil Procedure 26(b)(3) and similar state rules. Counsel’s mental impressions and legal theories get the strongest protection. Work product can apply even where privilege does not, for example to materials a consultant prepares at counsel’s direction once litigation is reasonably expected.

What neither doctrine protects is the facts. If an employee tells counsel that invoices were backdated, the company cannot refuse to disclose that the invoices were backdated. It can protect the conversation, not the event.

How to set up the review so protection holds

Courts look at substance, not labels. Marking a document “privileged and confidential” signals intent, but it will not save a document that was really a business record. These steps matter more:

1. Have counsel engage and direct the investigation in writing, stating that the purpose is to provide legal advice to the company. A board or committee resolution helps when the issue is serious.
2. If you need forensic accountants, IT examiners, or other consultants, have counsel retain them so their work supports the legal advice.
3. Give an Upjohn warning at the start of every interview: counsel represents the company, not the employee; the conversation is privileged, but the privilege belongs to the company; and the company may choose to disclose what was said. Skipping this invites a later dispute over whether the employee believed counsel was their lawyer.
4. Keep the circle small. Share findings with the people who need them to act on the advice, and route communications through counsel.
5. Separate legal advice from business action. The decision to discipline someone or change a process may be documented in a business record; the legal analysis behind it should stay in counsel’s memo.

Compliance audits are harder to protect

A routine compliance audit run by internal audit or a business team is usually not privileged, because its primary purpose is business monitoring rather than legal advice. Courts often ask whether obtaining legal advice was a primary purpose of the communication, and the test is applied differently from court to court. If you want protection for a periodic review, structure it from the start as a counsel-directed legal risk assessment, rather than trying to attach privilege after the findings come back.

Regulated companies should also know that some regulators expect access to audit results, and some enforcement programs give credit for cooperation that includes sharing investigation facts. That is a strategic decision to make with counsel, not by default.

How companies waive privilege by accident

Most privilege problems come from ordinary behavior:

• Forwarding counsel’s memo to a lender, customer, or prospective buyer. Sharing with outsiders generally waives privilege, though a common-interest arrangement can sometimes preserve it.
• Using the investigation’s conclusions as a defense. If the company argues it acted in good faith because of what counsel found, it may have to produce what counsel found.
• Letting interview notes read like verbatim transcripts. Notes that reflect counsel’s analysis are stronger work product than a word-for-word record.
• Discussing findings in a wide chat channel or email thread that includes people outside the need-to-know group.
• Sending the report to a regulator without a written agreement about its use. Most federal courts reject the idea that disclosure to the government waives privilege only as to the government, so one disclosure can open the door for private plaintiffs too.

Practical questions to decide early

Before the first interview, decide who counsel reports to (management, the board, or a special committee if leadership may be involved), whether the company will consider self-disclosure, how documents will be preserved, and what you will tell employees. If preservation has not started, our guide on when a business must issue a litigation hold explains the trigger and the steps. If the review has already confirmed a problem, see what to do after you discover a compliance violation. And if the matter looks likely to end in a lawsuit, bring in our commercial litigation and dispute resolution attorneys early, so the investigation record is built with that forum in mind.

If you need to look into a complaint or audit finding and want the review protected from the start, Capitol Law Partners can direct the investigation and advise on disclosure. Schedule a consultation.

This article is for informational purposes only and does not constitute legal advice. No attorney-client relationship is formed by this communication.

Attorney Cagatay Ersoy. Practical strategy for founders, investors, and growing companies.

Need help with this topic? See our internal investigations and compliance counsel page or schedule a consultation.