By Eric Carlson
Any company with more than a small presence in China will likely need to conduct an internal investigation in China at some point. Companies can take certain steps to minimize headaches when such an investigation is needed.
Properly adopt company policies
Most companies have a global code of conduct and an anti-corruption policy that apply to employees in China. A company may not realize that in order for the policies to be legally enforceable, they must be provided to the trade union (if one exists) or to all local employees for review, discussion, and comment. Failure to do so increases the risk that employees may challenge these policies, particularly in cases of termination of employment based on serious violations of company policy.
Include privacy provisions in contracts and notices
Collecting electronic data from employees’ IT assets is often needed in the initial stages of an investigation. PRC privacy laws have evolved quickly in recent years. Employers are required to keep employee data confidential, and should obtain advance consent prior to sharing such information outside of the company. In view of such a requirement, companies can best protect themselves and mitigate risk by:
- Implementing an IT use policy stating that the company has the right to access, monitor, review, and disclose to third parties information on company-owned IT assets. It is important to ensure the policy is available in Chinese, and pursuant to the PRC Labor Contract Law.
- Having each employee acknowledge receipt and, if possible, acceptance of the policy by signing a hard-copy electronic document. Ideally, the acknowledgment should be in Chinese or the working language used by the employee to avoid any confusion or future dispute with respect to the content of the policy.
- Placing prominent notices (in Chinese and any other working language) around the workplace and/or online (for example, displaying it as a customized legal notice or start-up message when employees log in to company computers or networks) that reminds employees of the policy.
- Including provisions in employment contracts referencing the policy and the company’s rights over company-owned IT assets.
Conduct a front-end state secrets analysis
The PRC Law on Protecting State Secrets — an often misunderstood law — prohibits unauthorized individuals and entities from acquiring, possessing, recording, storing, or transferring, outside of China, information deemed to be a “state secret.” For many multinational companies, the law will not significantly impair investigations in China or require additional steps. However, in some cases, state secrets may post more significant risks that will need to be navigated. In most cases, these risks can be analyzed in advance — before an investigation arises — working with a China-based lawyer who has experience with both China investigations and state secrets issues. The analysis usually turns on factors such as the industry, whether the Chinese affiliate sells to or is in a joint venture with a government or state-owned entity, and what information the Chinese affiliate has access to.
Conducting a front-end analysis can often spare significant headaches in the early days of an investigation when decisions need to be made about how to structure (or restructure) an investigation to account for potential state secrets sensitivities.
Conduct an assessment of China-based IT architecture and access
In our experience, the early days of an investigation are often spent tracking down IT-related questions such as:
- Where email servers are located that service emails for China-based custodians;
- What shared or network drives are accessible to certain China employees;
- Whether China-based employees have company-issued phones, or have company email access from their personal devices;
- Whether remote access to laptops can be obtained from headquarters versus locally in China;
- What kind of images can be made by company IT systems;
- Whether instant messaging software is used in China, and whether messages are preserved and accessible;
- Whether disaster recovery systems (e.g., back-up tapes) are in place; and
- What accounting systems are used, and what transaction data and details are accessible locally and remotely.
Most of these questions can be assessed in advance and updated periodically (e.g., in an IT system map) to save time after an allegation arrives.
Institute or update a dawn raid protocol
Companies in sectors likely to be visited by PRC regulatory authorities should consider implementing a protocol of best practices to prepare for such visits. Companies are increasingly training both reception staff and local or regional legal personnel on how to appropriately handle visits from regulatory authorities, such as assigning a designated liaison, documenting requests and interviews, and monitoring documents or other items copied or taken by authorities.
Understand PRC laws on bribery and corruption
PRC laws on bribery and corruption significantly overlap with other corruption statutes, such as the FCPA and UK Bribery Act. PRC law provides administrative and criminal penalties for commercial bribery. Local enforcement authorities have significant discretion, so it may not be in a company’s best interest to assume that because an improper payment was made to a purely private individual, it need not be investigated, or does not pose significant legal risk.
Realize that US-style legal privileges do not exist in China
The attorney-client privilege and the work product doctrine do not exist under PRC law. China-based attorneys may not be aware of the importance of these privileges and immunities and the need to structure and execute investigations in a way to maximize the protection of these privileges and immunities outside of China, even if they do not apply inside of China. For this reason, we recently drafted an article in English and Chinese (available from the authors upon request) about how to preserve privilege when conducting an internal investigation in China.
Understand PRC laws on whistleblowers
Many allegations in China come from anonymous sources, so steps must be taken to ensure they are legitimate claims and not merely retaliatory.
Understand PRC laws on discipline and termination
PRC laws related to employee discipline and termination are somewhat different than in other countries, particularly the United States. Labor tribunals that hear employment complaints and suits are widely perceived to be pro-employee, and written evidence carries far more weight than oral testimony. Companies should collect sufficient evidence during an investigation to mitigate the risk of an employee terminated for misconduct later filing a wrongful termination suit.
Identify local resources
Many investigations will require local assistance — internal and external. Internal resources may include IT managers to assist with preservation efforts or accounting managers to identify transactions of interest, in addition to local legal, compliance, audit, and management staff. External resources may involve forensic accounting firms, forensic technology firms, law firms, private investigative firms, and translation vendors. Having a short list of recommended or preferred vendors in these areas that have significant experience handling investigations in China can save valuable time in a fast-moving investigation.
About the author: This article first appeared as a two-part series on the FCPA Blog. The original posts can be viewed here. Eric Carlson, a contributing editor of the FCPA Blog, is a Shanghai-based partner at Covington & Burling LLP specializing in anti-corruption investigations and compliance, with a particular focus on China. He speaks fluent Mandarin and Cantonese and can be contacted here.
