Legal Proceedings and Confidentiality

1. Why This Topic Matters

Every fraud examination should be planned and conducted under one governing assumption: the case may end up in litigation. Whether the matter becomes a criminal prosecution, a civil lawsuit for recovery, an employment dispute, an insurance claim, or a regulatory enforcement action, the work the examiner does today will be scrutinized tomorrow by opposing counsel, judges, and juries. If the examiner mishandles evidence, discusses the case with people who have no need to know, writes a report full of opinions about guilt, or fails to protect privileged communications, the entire examination can be undermined. The organization may lose its ability to recover funds, the suspect may walk free, and the examiner (and the client) may face counterclaims for defamation, invasion of privacy, or wrongful termination.

Confidentiality is the other half of the equation. Fraud examinations deal with allegations, not proven facts. Premature or careless disclosure damages reputations, tips off subjects who may destroy evidence or flee, exposes the organization to liability, and can waive legal protections such as the attorney-client privilege. On the CFE Exam, this topic sits within the Investigation section under Planning and Conducting a Fraud Examination, and it is tested heavily because it reflects the professional judgment that separates a Certified Fraud Examiner from an ordinary investigator.

2. What the Topic Covers

The ACFE Fraud Examination Manual frames this area around several interlocking ideas:

(a) The litigation assumption. Because examiners cannot know at the outset how a case will be resolved, they must act from day one as if every document, interview note, and email will be produced in court. This drives decisions about documentation, chain of custody, interview conduct, and report writing.

(b) Confidentiality of the examination. Information about the examination should be shared only with those who have a legitimate need to know. This protects the integrity of the investigation, the rights and reputation of the subject, and the legal position of the organization.

(c) Attorney-client privilege. Confidential communications between a client and its attorney for the purpose of obtaining legal advice are protected from compelled disclosure. When a fraud examiner is retained by counsel (rather than directly by the company) to assist the attorney in rendering legal advice, the examiner's communications and work may fall under the umbrella of this privilege. The privilege belongs to the client, not the attorney or the examiner, and only the client can waive it. Disclosure to third parties outside the privileged circle generally waives it.

(d) Work product doctrine. Materials prepared in anticipation of litigation are protected from discovery. Courts distinguish between opinion work product (mental impressions, conclusions, legal theories of counsel, which receive near-absolute protection) and fact work product (underlying facts and documents, which can be discovered if the opposing party shows substantial need and inability to obtain the equivalent without undue hardship).

(e) Preservation of evidence and litigation holds. Once litigation is reasonably anticipated, the organization has a duty to preserve relevant evidence, including electronic data. Destroying or altering evidence after that point is spoliation, which can result in sanctions, adverse inference instructions, or dismissal.

(f) Defamation and related torts. Statements that falsely accuse someone of a crime are defamatory. Examiners protect themselves by sticking to facts, communicating only with those who have a duty or interest in the matter (which may give rise to a qualified privilege), and avoiding conclusions about guilt.

(g) Reporting discipline. Written reports should contain facts, evidence, and findings, not opinions on the guilt or innocence of any party. The examiner reports what the evidence shows; legal conclusions are for the trier of fact.

3. How It Works in Practice

Step 1: Establish the engagement correctly. When litigation is a realistic possibility, the fraud examiner should be engaged by, and report to, legal counsel. The engagement letter should state that the examiner is assisting counsel in providing legal advice to the client and in anticipation of litigation. This structure maximizes the chance that communications and work product will be protected. If the examiner is hired directly by management, much of the work may be fully discoverable.

Step 2: Define the need-to-know circle. Identify precisely who will receive information about the examination: typically counsel, the engagement sponsor (such as the audit committee or a senior executive not implicated in the allegation), and essential team members. Everyone else, including the subject's supervisor and coworkers, should be excluded unless their involvement is required and controlled.

Step 3: Label and protect documents. Work prepared at the direction of counsel should be marked "Privileged and Confidential: Attorney-Client Communication / Attorney Work Product." Labels do not create privilege on their own, but they demonstrate intent and help prevent inadvertent disclosure. Physical files should be secured; electronic files should be access-restricted and encrypted where appropriate.

Step 4: Issue a litigation hold. Counsel should direct relevant custodians to suspend routine document destruction and preserve emails, files, backups, and devices. The examiner should document when the hold was issued and to whom, because the timing of the duty to preserve is often litigated.

Step 5: Maintain chain of custody. Every piece of evidence should be logged, showing who collected it, when, where, how it was stored, and every transfer of possession. Originals should be preserved and copies used for analysis. Unbroken chain of custody is what allows evidence to be authenticated and admitted.

Step 6: Conduct interviews with litigation in mind. Interviews should be conducted privately, by trained personnel, with a witness present when appropriate. Notes should be factual and prepared promptly. Examiners should avoid threats, promises, or coercion that could render a statement inadmissible or expose the organization to claims of false imprisonment or intentional infliction of emotional distress.

Step 7: Communicate carefully. Oral briefings should be given only to those with a need to know. Emails should be minimized and routed through counsel. Casual remarks such as "we know he stole the money" made in the hallway are exactly the kind of statements that generate defamation claims.

Step 8: Write a fact-based report. The report should describe the scope, the procedures performed, the evidence obtained, and the findings. It should not state that someone is guilty of fraud or embezzlement. Phrases such as "the evidence indicates that the subject authorized payments to a vendor he controlled" are appropriate; "the subject is a thief" is not.

Step 9: Control distribution of the report. Decide with counsel whether a written report is needed at all, who will receive it, and whether distribution to third parties (auditors, insurers, regulators, law enforcement) will waive privilege. Voluntary disclosure to a government agency generally waives the privilege as to that material, though some jurisdictions and agencies have selective-waiver arrangements.

Step 10: Consider privacy and cross-border rules. In international engagements, data protection laws (for example, the EU's GDPR), employee privacy rights, banking secrecy, and blocking statutes can restrict what information may be collected, transferred, or disclosed. Local counsel should be consulted before data leaves a jurisdiction.

4. Key Legal Concepts to Memorize

Attorney-client privilege requires (1) a communication, (2) made in confidence, (3) between a client and attorney (or the attorney's agents), (4) for the purpose of obtaining legal advice. It covers communications, not underlying facts. A fraud examiner working under the attorney is treated as the attorney's agent (sometimes called the Kovel arrangement in the United States).

Work product doctrine protects materials prepared in anticipation of litigation by or for a party or its representative. It is a qualified protection for fact work product and a near-absolute protection for opinion work product.

Waiver occurs when privileged material is voluntarily disclosed to someone outside the privileged relationship. The client controls waiver. Inadvertent disclosure may or may not waive depending on the jurisdiction and the precautions taken.

Defamation is a false statement of fact communicated to a third party that harms reputation. Libel is written; slander is spoken. Truth is an absolute defense. A qualified privilege protects good-faith communications made to those with a corresponding duty or interest, such as internal reports to management about suspected misconduct, provided they are not made with malice or excessive publication.

Spoliation is the destruction or material alteration of evidence after the duty to preserve has arisen. Remedies include monetary sanctions, adverse inference instructions, and default judgment.

Fact witness versus expert witness. A fact witness testifies to what they personally observed; an expert witness may offer opinions based on specialized knowledge. A fraud examiner may serve as either, and the role affects what must be disclosed to the other side. In many jurisdictions, communications with a testifying expert are discoverable, while those with a non-testifying consulting expert remain protected.

5. Exam Tips: Answering Questions on Legal Proceedings and Confidentiality

Tip 1: Default to the litigation assumption. If a question asks how an examiner should approach documentation, evidence, or reporting, the correct answer almost always reflects the principle that every examination should be conducted as though it will end in litigation. Answers that suggest relaxing standards because "this is only an internal matter" are wrong.

Tip 2: Need to know is the confidentiality standard. When asked who should be informed of an examination or its results, choose the answer that limits disclosure to those with a legitimate need to know. Eliminate answers that involve informing all management, the subject's peers, or the entire board unless the question specifically establishes their need.

Tip 3: Privilege flows through the attorney and belongs to the client. Expect questions testing whether a fraud examiner's work is privileged. Remember: the examiner must be retained by counsel to assist in providing legal advice. If the examiner is hired directly by management, the privilege is unlikely to attach. Also remember that the client, not the attorney and not the examiner, holds and may waive the privilege.

Tip 4: Know what waives privilege. Sharing privileged reports with outside parties who are not within the privileged circle (external auditors, business partners, the media, and often government agencies) generally waives protection. Labeling a document "privileged" does not make it privileged, and marking a document does not cure a disclosure that has already occurred.

Tip 5: Distinguish fact work product from opinion work product. If a question asks which materials receive the strongest protection, the answer is the attorney's mental impressions, conclusions, and legal theories (opinion work product). Fact work product can be obtained by an adversary who shows substantial need and undue hardship.

Tip 6: Reports state facts, never guilt. Any answer in which the examiner concludes that a subject "committed fraud," "is guilty," or "is a criminal" is wrong. The correct approach is to present the evidence and let the reader (or the court) draw conclusions. Watch for subtle wording: "the evidence indicates" is acceptable; "the subject embezzled" is a legal conclusion.

Tip 7: Timing of the duty to preserve. The obligation to preserve evidence arises when litigation is reasonably anticipated, not when a lawsuit is actually filed. Questions that place the trigger at filing, at service of a subpoena, or at a court order are typically distractors.

Tip 8: Defamation defenses. If a scenario involves an examiner communicating findings to management and the subject later sues, remember that truth is an absolute defense and that good-faith reports to those with a duty or interest are covered by a qualified privilege, which can be lost through malice or publication beyond the need-to-know group.

Tip 9: Read true/false items literally. The CFE Exam uses many true/false questions. A statement such as "A fraud examiner's report is automatically protected by the attorney-client privilege" is false because of the word automatically. Statements containing absolutes (always, never, automatically, all) deserve extra scrutiny.

Tip 10: Chain of custody is about admissibility. When asked why chain of custody matters, the answer centers on proving that evidence is authentic and has not been altered, so that it can be admitted in legal proceedings. It is not primarily about efficiency or convenience.

Tip 11: Think about who is giving instructions. In scenario questions, note whether the examiner is working for counsel, for management, or for an audit committee. The source of the engagement determines privilege, reporting lines, and who decides on disclosure.

Tip 12: Cross-border questions turn on local law. If a question involves transferring data or interviewing employees abroad, the correct approach is to consult local counsel and comply with the data protection and privacy laws of the relevant jurisdiction before acting.

6. Common Traps and How to Avoid Them

Trap: Assuming internal investigations are informal. They are not. Internal findings frequently become evidence in termination disputes, insurance claims, and criminal referrals.

Trap: Confusing confidentiality with privilege. Confidentiality is a professional and practical obligation to limit disclosure; privilege is a legal protection against compelled disclosure. Something can be confidential without being privileged.

Trap: Believing the examiner can decide to waive privilege. Only the client can.

Trap: Overlooking oral disclosures. Privilege and confidentiality are lost through spoken words just as easily as through documents.

Trap: Writing conclusory language in notes. Interview notes and working papers are often discoverable. Keep them factual and professional.

7. Quick Review Summary

Conduct every examination as if it will be litigated. Share information strictly on a need-to-know basis. When litigation is possible, work through counsel so that attorney-client privilege and work product protection may apply, remembering that the privilege belongs to the client and is waived by disclosure to outsiders. Preserve evidence as soon as litigation is reasonably anticipated and maintain an unbroken chain of custody. Report facts and evidence, never opinions on guilt. Protect yourself and the client from defamation by communicating truthfully, in good faith, and only to those with a legitimate interest. Master these principles and the exam questions on Legal Proceedings and Confidentiality become straightforward exercises in applying consistent professional judgment.