Waiver of Privilege

1. Why Waiver of Privilege Matters to a Fraud Examiner

Few topics in the Law section of the CFE Exam carry more real-world consequence than waiver of privilege. A Certified Fraud Examiner spends much of his or her career producing documents, interview memoranda, timelines, spreadsheets, and reports that could be devastating in the hands of an adversary. Whether those materials remain shielded from discovery often depends on one question: was the privilege preserved, or was it waived?

Consider the stakes. A company retains counsel to investigate suspected embezzlement. Counsel retains a fraud examiner. The examiner interviews employees, drafts findings, and delivers a report. If that report is later handed to the external auditor, to a regulator, to an insurance carrier, or forwarded to a vendor by a careless executive, a court may rule that the attorney-client privilege and work product protection have been waived – and not just for that report, but potentially for every related communication on the same subject. The defendant in the embezzlement case may then obtain the entire investigative file, including candid assessments of the company's own control weaknesses and legal exposure.

The ACFE tests this area because fraud examiners are routinely the people who either protect or destroy privilege through their conduct. Understanding waiver tells you how to structure an engagement, who may sit in on interviews, how to label and distribute documents, and what to say when a client asks whether a report can be shared. It also helps you anticipate what an opposing party may argue when trying to pry open your file.

2. Foundations: What Privilege Is Being Waived?

Before you can understand waiver, you must be clear on what privileges exist. The CFE Exam focuses primarily on two protections that frequently surround fraud examinations.

Attorney-Client Privilege. This is an evidentiary privilege that protects confidential communications between a client and an attorney made for the purpose of obtaining or providing legal advice. Its elements are generally stated as: (1) a communication, (2) made in confidence, (3) between a client (or the client's agent) and an attorney (or the attorney's agent), (4) for the purpose of securing legal advice. The privilege belongs to the client, not the attorney. This single fact drives much of the law on waiver: only the holder of a privilege can waive it, and because the client holds it, the client's conduct controls.

In the corporate setting, the privilege belongs to the corporation. Under the reasoning of Upjohn Co. v. United States, communications between corporate counsel and employees at any level may be privileged when they are made at the direction of management for the purpose of obtaining legal advice for the company. The authority to assert or waive the privilege rests with current management (the board or officers), not with the individual employee who was interviewed. This is why a fraud examiner conducting interviews on behalf of corporate counsel should deliver an Upjohn warning (sometimes called a corporate Miranda warning), explaining that the examiner represents the company, that the conversation is privileged, but that the privilege belongs to the company, which may choose to waive it and disclose the conversation to third parties, including the government.

Work Product Doctrine. Distinct from attorney-client privilege, the work product doctrine protects materials prepared in anticipation of litigation by or for a party or its representative. It covers documents such as witness interview notes, investigative memoranda, and analyses. Courts distinguish between ordinary (fact) work product, which may be discovered upon a showing of substantial need and inability to obtain the equivalent without undue hardship, and opinion work product (the attorney's mental impressions, conclusions, opinions, and legal theories), which receives nearly absolute protection. Work product is held by both the attorney and the client, and – critically for waiver analysis – it is waived under a different and more forgiving standard than attorney-client privilege.

Other privileges that may appear in CFE Exam questions include the spousal privileges, the physician-patient privilege, the psychotherapist-patient privilege, the clergy-penitent privilege, the accountant-client privilege (recognized by statute in some U.S. states but not under federal common law), and the privilege against self-incrimination. The core principle of waiver – that the holder of the privilege can surrender it through voluntary disclosure or inconsistent conduct – applies broadly across these.

3. What Waiver of Privilege Is

Waiver of privilege is the loss of a privilege's protection, whether intentional or unintentional, so that the previously protected communication or material becomes discoverable and admissible. A privilege is a shield the law gives the holder; waiver is what happens when the holder lowers the shield, hands it to someone else, or uses it as a sword.

The underlying policy is fairness. Privileges exist to encourage candid communication (with lawyers, doctors, spouses, clergy). But privileges also suppress relevant evidence, so courts construe them narrowly. Once the holder has chosen to reveal the protected information to outsiders, or has tried to use the protected information selectively to gain an advantage, the justification for secrecy disappears and the courts will not permit the privilege to be used both offensively and defensively.

4. How Waiver Works: The Principal Forms

A. Express (Intentional) Waiver
The holder knowingly and deliberately gives up the privilege. Examples include a client who testifies about the substance of legal advice received, a company that voluntarily turns over a privileged internal investigation report to a regulator, or a client who instructs counsel to disclose communications. Express waiver is straightforward: the holder decided to disclose, and the protection is gone for the disclosed material.

B. Implied Waiver by Voluntary Disclosure to Third Parties
This is the most common form tested on the CFE Exam. Because confidentiality is an essential element of the attorney-client privilege, voluntarily disclosing a privileged communication to a third party who is outside the privileged relationship destroys that confidentiality and waives the privilege. Classic examples:

• A client forwards an email containing legal advice to a friend, business partner, or vendor.
• A company shares a privileged investigative report with its external auditors, insurance carrier, lender, or a potential acquirer.
• A witness discusses the content of a privileged attorney meeting on social media or with the press.
• A client allows an unnecessary third party to be present during the attorney consultation.

Note the distinction between privilege never attaching and privilege being waived. If an unnecessary third party is present when the communication is originally made, the communication was never confidential and the privilege never attached at all. If the communication was confidential when made but is later disclosed, the privilege attached and was then waived. The exam may test either framing, but the practical result is identical: no protection.

C. Who Is Not a Third Party: Agents of the Attorney (the Kovel Doctrine)
Disclosure to certain persons does not waive the privilege because they are considered within the circle of confidentiality. Under United States v. Kovel, an accountant, fraud examiner, investigator, or other expert retained by the attorney to assist the attorney in rendering legal advice is treated as the attorney's agent. Communications with that agent, made for the purpose of helping the attorney provide legal advice, remain privileged.

This has enormous practical significance for fraud examiners:

• If the attorney retains the fraud examiner to assist in providing legal advice, the examiner's communications and work are more likely to fall under the privilege and work product doctrine.
• If the client retains the fraud examiner directly, without counsel's involvement, the examiner's work is generally not privileged. The company cannot later cloak it in privilege by copying a lawyer on emails.
• Even under a Kovel arrangement, the privilege covers the examiner's role in assisting legal advice, not routine accounting or business services. Courts look at the true purpose of the work.

Similarly, communications among the client's own employees who need to know the legal advice in order to act on it generally do not waive the privilege, provided they are kept within the appropriate circle. Broad distribution within a company to employees with no need to know can, however, risk waiver.

D. Subject-Matter Waiver
Waiver is often not limited to the specific document disclosed. Under the traditional rule, when a party voluntarily discloses part of a privileged communication, courts may find that the party has waived privilege as to all communications on the same subject matter. The rationale is fairness: a party should not be permitted to reveal favorable portions of privileged advice while concealing unfavorable portions.

Under Federal Rule of Evidence 502(a), when a waiver is made in a federal proceeding or to a federal agency, the waiver extends to undisclosed communications only if: (1) the waiver was intentional, (2) the disclosed and undisclosed communications concern the same subject matter, and (3) they ought in fairness to be considered together. This limits the harshness of subject-matter waiver for inadvertent disclosures but preserves it for deliberate, selective disclosures.

E. Inadvertent Waiver
Inadvertent disclosure occurs when privileged material is produced by mistake, typically in large document productions during discovery or electronic discovery. Historically, jurisdictions split among three approaches: (1) a strict rule that any disclosure waives, (2) a lenient rule that only intentional disclosure waives, and (3) a middle-ground balancing test.

Federal Rule of Evidence 502(b) adopted the middle approach. An inadvertent disclosure does not operate as a waiver if: (1) the disclosure was inadvertent, (2) the holder took reasonable steps to prevent disclosure, and (3) the holder promptly took reasonable steps to rectify the error, such as notifying the receiving party and requesting return under the procedures of Federal Rule of Civil Procedure 26(b)(5)(B). Parties may also enter into clawback agreements, which may be incorporated into court orders under Rule 502(d), providing that production of privileged material does not constitute waiver regardless of the care taken. Fraud examiners handling large productions should know that labeling documents, screening for privilege, and responding immediately to mistakes are the factors courts weigh.

F. Selective Waiver (Disclosure to the Government)
Companies under investigation often wish to cooperate with the SEC, DOJ, or other regulators by sharing privileged internal investigation reports, while still asserting privilege against private plaintiffs. This is called selective or limited waiver. The overwhelming majority of U.S. courts have rejected selective waiver: disclosure to the government is treated as disclosure to a third party and waives the privilege as to everyone, including shareholder plaintiffs and criminal defendants. A confidentiality agreement with the agency generally does not preserve privilege against third parties, although a few courts have given weight to such agreements. For exam purposes, remember the majority rule: disclosure to a government agency waives privilege as against all other parties.

G. At-Issue (Sword and Shield) Waiver
A party waives privilege by affirmatively placing privileged communications at issue in litigation. The most common example is the advice-of-counsel defense: a defendant who argues that he acted in good faith because his lawyer told him the conduct was lawful has put the lawyer's advice at issue and cannot then refuse to disclose that advice. Similarly, a company that asserts the adequacy of its internal investigation as a defense (for example, to show it responded appropriately to a whistleblower complaint) may be held to have waived privilege over the investigation. A party may not use the privilege as both a sword and a shield.

H. Waiver by Failure to Assert
Privileges must be asserted timely. A witness who answers a question about privileged communications during a deposition without objecting, or a party that fails to log a document as privileged on a privilege log in discovery, may be found to have waived the privilege. Counsel should object and instruct the witness not to answer when a question calls for privileged information.

I. Waiver by Testimony
If a client testifies about the content of a privileged communication, or calls the attorney as a witness to testify about it, the privilege is waived as to that communication and likely the subject matter. Testifying about the fact that one consulted an attorney, or about the identity of the attorney, generally does not waive privilege over the content of the advice.

5. Waiver of Work Product: A Different Standard

Because the work product doctrine is designed to protect the adversary system rather than confidential communications, waiver of work product is harder to trigger. Disclosure to a third party waives work product protection only if the disclosure is to an adversary or substantially increases the likelihood that an adversary will obtain the material. Thus, sharing an investigative memorandum with an ally, a co-defendant under a joint defense agreement, or even a consultant may not waive work product protection even though it would waive attorney-client privilege. Disclosure to a government agency investigating the company, however, is typically treated as disclosure to an adversary and waives work product protection as well. Opinion work product remains protected in almost all circumstances short of deliberate disclosure to an adversary.

6. Related Concepts That Are Not Waiver (Common Exam Distractors)

Crime-Fraud Exception. The attorney-client privilege does not protect communications made in furtherance of an ongoing or future crime or fraud. This is an exception, not a waiver. The client did not give up the privilege; the privilege never applied because the law will not protect the use of a lawyer to commit wrongdoing. Advice about past completed conduct remains privileged. The CFE Exam frequently tests the distinction.

Joint Defense / Common Interest Doctrine. When parties with a common legal interest (co-defendants, a company and its officers, or affiliated companies) share privileged information to coordinate their legal strategy, the sharing does not waive privilege as to outsiders. This is an exception to the third-party disclosure rule, best documented in a written joint defense agreement. Note that one participant generally cannot unilaterally waive the privilege over shared communications, and if the parties later become adversaries, the communications may be usable between them.

Underlying Facts Are Never Privileged. The privilege protects communications, not facts. A client cannot refuse to disclose what happened simply because he told his lawyer about it. Likewise, pre-existing business records do not become privileged by being sent to counsel. A question stating that a company hid a ledger by delivering it to its attorney is testing this point, not waiver.

Who Can Waive. The holder waives. An attorney cannot waive the client's privilege without authority, and an unauthorized disclosure by the attorney may not constitute waiver. A corporate employee cannot waive the corporation's privilege; only the corporation through its authorized management can. When a company goes bankrupt or changes control, the power to waive passes to the trustee or new management, as recognized in CFTC v. Weintraub.

7. Practical Steps for Fraud Examiners to Avoid Inadvertent Waiver

• Have counsel retain the fraud examiner under a Kovel-style engagement letter stating that the work is to assist counsel in providing legal advice and in anticipation of litigation.
• Direct all reports and work product to counsel, not directly to management.
• Mark documents as Privileged and Confidential – Attorney-Client Communication / Attorney Work Product, understanding that labels help but are not conclusive.
• Limit distribution to persons with a need to know; avoid copying auditors, insurers, lenders, or non-essential employees.
• Deliver Upjohn warnings before employee interviews and document that they were given.
• Exclude unnecessary third parties from interviews and attorney meetings.
• Segregate privileged investigative work from routine business or accounting work.
• In discovery, screen for privilege, maintain a privilege log, seek a Rule 502(d) order or clawback agreement, and act immediately if privileged material is produced by mistake.
• Advise clients that disclosure to the government will almost certainly waive privilege as to private litigants.

8. Exam Tips: Answering Questions on Waiver of Privilege

Tip 1 – Identify the holder first. Before deciding whether a privilege was waived, ask who holds it. For attorney-client privilege the holder is the client; for a corporation it is the entity acting through current management. If the question describes an attorney or an employee disclosing information without authority, consider whether a true waiver occurred. If the question describes the client (or authorized management) disclosing, waiver is likely.

Tip 2 – Look for the third party. The exam loves scenarios involving disclosure to outsiders: auditors, consultants, insurers, friends, the press, or regulators. Ask whether the third party is within the circle of confidentiality. An agent retained by the attorney (Kovel) is inside the circle. An external auditor, an insurer, a lender, or a government agency is outside. Disclosure to those outside the circle waives attorney-client privilege.

Tip 3 – Distinguish attorney-client privilege from work product. If the question involves a document prepared in anticipation of litigation and shared with a non-adversary, the better answer may be that work product protection survives even though attorney-client privilege would not. If the document was given to an adversary or to the government, both protections are generally lost.

Tip 4 – Know the retention rule cold. A fraud examiner retained by counsel to assist in rendering legal advice is more likely to be covered by privilege. A fraud examiner retained directly by the client for business or accounting purposes generally is not. Questions about structuring an engagement to maximize privilege almost always have this as the correct answer.

Tip 5 – Do not confuse exceptions with waiver. The crime-fraud exception is not a waiver; the privilege simply never applied. The joint defense doctrine is not a waiver; it is a recognized exception to the third-party rule. Underlying facts are not privileged in the first place. If an answer choice says privilege was waived when the real issue is that it never attached, be cautious.

Tip 6 – Remember subject-matter waiver and the fairness principle. If a party voluntarily discloses favorable portions of privileged advice, expect the exam to say the privilege is waived as to the entire subject matter. If the disclosure was inadvertent and reasonable precautions were taken, expect the answer to say privilege is not waived (FRE 502(b)).

Tip 7 – Majority rule on selective waiver. When a company shares a privileged internal investigation with the SEC or DOJ, the correct exam answer is that privilege is waived as to third parties, even with a confidentiality agreement. Do not choose an answer suggesting the company can disclose to the government and still assert privilege against shareholders.

Tip 8 – Watch for sword-and-shield language. If a party relies on the advice of counsel as a defense, or asserts the thoroughness of its investigation as a defense, the privilege over that advice or investigation is waived.

Tip 9 – Upjohn warnings signal the corporate holder. A question describing an employee who was interviewed by corporate counsel and later wants to prevent the company from disclosing the interview is testing the rule that the privilege belongs to the company, not the employee. The company may waive it.

Tip 10 – Read for True/False traps. Common false statements include: that only intentional disclosure can waive privilege (false – voluntary disclosure to a third party waives even if the holder did not intend to waive); that an attorney can waive the client's privilege at will (false); that labeling a document privileged guarantees protection (false); that giving documents to an attorney makes pre-existing records privileged (false); and that the crime-fraud exception is a type of waiver (false).

Tip 11 – Eliminate absolutes carefully. Answer choices stating that a privilege can never be waived, or that any disclosure to anyone waives it, are usually wrong. The correct choice typically reflects the nuanced rule: voluntary disclosure to a third party outside the privileged relationship waives the privilege, subject to recognized exceptions.

Tip 12 – Think like the ACFE. The Fraud Examiners Manual emphasizes practical protection of the examiner's work. When in doubt, choose the answer that reflects (a) engagement through counsel, (b) limited distribution, (c) exclusion of unnecessary third parties, and (d) recognition that the client controls the privilege.

9. Quick Review Summary

• Waiver is the loss of privilege protection through the holder's voluntary disclosure or inconsistent conduct.
• The client (or the corporation through management) holds and controls the attorney-client privilege.
• Voluntary disclosure to a third party outside the privileged circle waives the attorney-client privilege; agents of the attorney (Kovel) and common-interest parties are inside the circle.
• Partial intentional disclosure can cause subject-matter waiver; inadvertent disclosure with reasonable precautions and prompt correction generally does not waive (FRE 502(b)).
• Selective waiver to the government is rejected by most courts.
• Placing advice at issue, testifying about the communication, or failing to assert the privilege can all waive it.
• Work product is waived only by disclosure to an adversary or conduct that substantially increases the likelihood an adversary will obtain it.
• The crime-fraud exception, the joint defense doctrine, and the rule that facts are not privileged are distinct concepts, not waivers.

Master these rules, learn to spot the holder and the third party in every fact pattern, and you will handle waiver-of-privilege questions on the CFE Exam with confidence.