Duties of in-house lawyer when confronted with internal fraud or criminal conduct that could be imputed to the organization.

Facts

Lawyer is in-house counsel to a private not-for-profit corporation (“Company”). Several years ago, a Company employee informed Lawyer that several matters were occurring that could be construed as fraud against the state and federal governments. Lawyer brought the employee to the Company’s internal audit department. With the assistance of the Company’s legal department, the internal audit department retained outside counsel and investigated the matter. Ultimately, a report was issued, and the matter brought to the corporate board of directors (“Board”). The Board decided (for reasons not completely known to the Lawyer) that there would be no action taken against the alleged wrongdoers and no self-reporting of the wrongdoing to the government. The Lawyer believes that the outside counsel made several recommendations to the Board that the Board did not follow. Subsequently, the Company terminated the employee who had initially reported the matter to the Lawyer. The Lawyer was not part of any of the Board meetings and was not aware of the employment decision until later.

Since that time, the Lawyer has come across similar instances of additional potential wrongdoing or potential fraud against the federal government. The Lawyer reported those matters up the chain of command to the general counsel and the Chief Compliance Officer, who is also an attorney. In at least one of those instances outside counsel was again hired and an investigation ensued. The Lawyer does not know if the matters were reported to the Board.

The Lawyer has again become aware of another instance of wrongdoing and potential fraud against the federal government and possibly against the state government, again under circumstances similar to those the Lawyer had previously reported. Pursuant to Illinois Rule of Professional Conduct (“IRPC”) 1.13, the Lawyer reported the matters up the chain of command to the Company’s general counsel and the Chief Compliance Officer. The Chief Compliance Officer has an indirect reporting relationship to the Board.

Questions

1. What are the Lawyer’s obligations under IRPC 1.13(b)? Specifically, in light of the history of prior matter(s) reported to the Board is it sufficient that the Lawyer has taken the most recent matter to the general counsel and chief compliance officer? If they decide not to bring this most recent matter to the Board, has the Lawyer complied with IRPC 1.13(b)? In other words, has the Lawyer proceeded as “is reasonably necessary in the best interest of the corporation” under the circumstances?
2. Under what circumstances may an in-house lawyer report fraud by the lawyer’s employer to the government under IRPC 1.13(c)?
3. May an in-house lawyer bring a claim under the False Claims Act against the employer? If so, under what circumstances?

Analysis

IRPC 1.13 sets forth rules specific to a lawyer’s representation of organizations, including in-house counsel. The following sections of IRPC 1.13 are particularly relevant here:

1. A lawyer employed or retained by an organization represents the organization acting through its duly authorized constituents.
2. If a lawyer for an organization knows that an officer, employee or other person associated with the organization is engaged in action, intends to act or refuses to act in a matter related to the representation that is a violation of a legal obligation to the organization, or a crime, fraud or other violation of law that reasonably might be imputed to the organization, and that is likely to result in substantial injury to the organization, then the lawyer shall proceed as is reasonably necessary in the best interest of the organization. Unless the lawyer reasonably believes that it is not necessary in the best interest of the organization to do so, the lawyer shall refer the matter to higher authority in the organization, including, if warranted by the circumstances, to the highest authority that can act on behalf of the organization as determined by applicable law.
3. Except as provided in paragraph (d), if
   1. despite the lawyer’s efforts in accordance with paragraph (b) the highest authority that can act on behalf of the organization insists upon or fails to address in a timely and appropriate manner an action or a refusal to act, that is clearly a crime or fraud, and
   2. the lawyer reasonably believes that the crime or fraud is reasonably certain to result in substantial injury to the organization, then the lawyer may reveal information relating to the representation whether or not Rule 1.6 permits such disclosure, but only if and to the extent the lawyer reasonably believes necessary to prevent substantial injury to the organization.
4. Paragraph (c) shall not apply with respect to information relating to a lawyer’s representation of an organization to investigate an alleged crime, fraud or other violation of law, or to defend the organization or an officer, employee or other constituent associated with the organization against a claim arising out of an alleged crime, fraud or other violation of law.

Lawyer represents and owes duties to the organization, including confidentiality.

Representing an entity presents unique challenges. One of the most obvious is the fact that an entity client may act only through and at the direction of its human constituents who are authorized to act on its behalf – typically, its employees, officers, and directors. Thus, a lawyer who represents an organization necessarily communicates with and takes direction from those “duly authorized constituents,” even though the organization is the client and not the individuals.¹ IRPC 1.13(a). Cf. Majumdar v Lurie, 274 Ill.App.3d 267, 270 (1st Dist. 1995)(attorney for corporate client owes duties to the entity, not to the individual shareholders, officers or directors); Reynolds v. Henderson & Lyman, 903 F.3d 693 (7th Cir. 2018) (entity is client not owner/manager).

The distinction between the entity client and its duly authorized constituents becomes particularly important when the lawyer “knows” “an officer, employee or other person associated with the organization” is engaged in or intends to engage in conduct that either violates a legal obligation to the entity or constitutes a crime or violation of law that may be imputed to the entity. Whether a lawyer has a duty to take any action and what action the lawyer is required to take or may take depends on several factors, all of which are laid out in IRPC 1.13(b), (c) and (d).

A lawyer owes the same duties under the IRPC to the client entity as he or she would to any client. For example, communications between the organization’s lawyer and a constituent acting in that constituent’s organizational capacity are protected under IRPC 1.6 as confidential communications. See IRPC 1.13 (comment [2]). However, because the client is the entity, the lawyer may also only disclose information relating to the representation – that is confidential information – to constituents where such disclosures are explicitly or implicitly authorized by the organization to carry out the representation or are permitted under IRPC 1.6. IRPC 1.9 also governs the lawyer’s obligation to maintain confidentiality even after his or employment (or the representation) has ended. See IRPC 1.9 (comment [3]) (“In the case of an organizational client, general knowledge of the client’s policies and practices ordinarily will not preclude a subsequent representation; on the other hand, knowledge of specific facts gained in a prior representation that are relevant to the matter in question ordinarily will preclude such a representation.”)

A lawyer’s confidentiality obligations are particularly relevant to the discussion below concerning the circumstances under which a lawyer for the organization is required to disclose information within the organization or may disclose information concerning the representation to persons outside the organization, such as governmental authorities. (Although beyond the IRPC, communications with individuals authorized to act on behalf of the entity may also be protected from disclosure as attorney-client privileged communications.)

“Knows” and “best interests”

IRPC 1.13(b) governs a lawyer’s obligations to report to a higher authority within the organization – that is, to “report up” the organizational chain. Rule 1.13(b) governs when a lawyer is obligated – shall – report within the organization. Rule 1.13(b) does not limit when a lawyer may choose to make a report within the organization. That is, even if Rule 1.13 does not require that a lawyer report concerns up the chain of command within the organization, the lawyer may nonetheless conclude that she should do so. As noted in Comment [4] to IRPC 1.13, “[e]ven in circumstances where a lawyer is not obligated by Rule 1.13 to proceed, a lawyer may bring to the attention of an organizational client, including its highest authority, matters that the lawyer reasonably believes to be of sufficient importance to warrant doing so in the best interest of the organization.”

The standards requiring a lawyer to report up the chain of command, however, are high. A reporting obligation exists only where a lawyer “knows” that specified conditions exist. Under IRPC 1.0(f), “knows” “denotes actual knowledge of the fact in question,” although a person’s knowledge “may be inferred from circumstances.” [Emphasis added.] Whether the circumstances giving rise to such knowledge exist is very fact-specific.

Under IRPC 1.13(b), the lawyer has no obligation to report unless she knows the following:

1. An individual associated with the entity (employee, officer or other person) is engaged in or intends to engage in conduct in a matter relating to the representation,
2. That conduct either violates a legal obligation to the entity or constitutes a crime or violation of law that “reasonably might be imputed to the entity”; and
3. The action or refusal to act will “likely to result in substantial injury to the organization.”

If all those conditions are met, then the lawyer “shall proceed as is reasonably necessary in the best interest of the organization.”

As even a cursory review makes clear, an analysis under Rule 1.13(b) is necessarily and heavily fact specific.

Whether the Lawyer here “knows” that the conduct constitutes “fraud” or a “crime” or violation of law (or violates a legal obligation to the entity) depends on the particular facts. Importantly, it is not the lawyer’s role to make business decisions and the lawyer generally must accept the constituent’s decision (assuming he or she has authority to make it) “even if their utility or prudence is doubtful. Decisions concerning policy and operations, including ones entailing serious risk, are not as such in the lawyer’s province” unless the decision amounts to a crime, fraud, violation of law or violation of the constituent’s legal obligation to the entity. IRPC 1.13 (Comment [3]).

The conduct must also be in connection with a matter that relates to the lawyer’s representation of the entity. It is certainly possible that the breadth of the in-house lawyer’s responsibilities is so broad that all matters relating to the entity fall within the lawyer’s representation. However, it is also possible that an in-house lawyer may have a limited scope of responsibility (employment issues, for example) that may not relate to the matter brought to the Lawyer’s attention. (The fact that the employee brought the issue to the Lawyer suggests that at least the employee considered the issue within the scope of the Lawyer’s representation, although that it is not determinative. Conversely, the fact that the Lawyer apparently did not receive the outside counsel’s report and was not part of discussions about the outside counsel’s advice or the Board’s actions suggests that the matter may be outside the Lawyer’s representation. That, again, is an issue of fact.)

Moreover, IRPC 1.13(b) imposes a reporting obligation only where conduct also is “likely to result in substantial injury to the organization.”

Even where all the conditions are met, reporting to a higher authority may generally be in the “best interest” of the organization, but not always. Whether a lawyer is required to report the conduct up the chain depends on still further fact-intensive analyses to determine what steps are “reasonably necessary in the best interest of the organization.” IRPC 1.13 (Comment [4]). The answer depends on consideration of a number of factors, including “the seriousness of the misconduct and its consequences, the responsibility in the organization and the apparent motivation of those involved, the policies of the organization concerning such matters, and any other relevant considerations.” IRPC 1.13 (Comment [4]). For example, as noted in Comment [4], a lawyer may reasonably conclude that it is not necessary to report to a higher authority where the constituent was acting under an innocent misunderstanding of the law and accepted/followed the lawyer’s advice to change course. On the other hand, if the constituent rejects the lawyer’s advice, the lawyer may then decide it is in the best interests to report the matter to a higher authority. And where the potential consequences are substantial or time is limited, the lawyer may bypass consultation with the constituent and report to a higher authority. However, as noted in Comment [4], the lawyer should take steps to minimize disclosure of information to persons outside the organization.

Reporting to a higher authority may also include the “highest authority,” depending on the circumstances. The “highest authority” may be the board of directors or even the independent directors under certain circumstances. Comment [5].

Here, the Lawyer twice reported conduct up the chain within the organization. In the first instance, the Lawyer reported to the internal auditors, who, in turn, retained outside counsel to investigate. That outside counsel issued a report that was presented to the Board, the highest authority within the organization. The Board apparently decided not to take any action against the alleged wrongdoers and did not self-report to the government. The Lawyer also believes that the Board did not follow some of the recommendations of outside counsel. However, the Lawyer was not present for the Board meetings and does not know the reasons for its decisions, presumably, including whether outside counsel determined that it was not necessary to take action against the alleged wrongdoers or to self-report.

With respect to this first report, assuming there was conduct that required the Lawyer to report under IRPC 1.13(b), the Lawyer appears to have met her obligations if the internal audit committee was a higher authority within the organization and if the Lawyer fully reported the alleged misconduct to that committee. The Lawyer reported the conduct, which resulted in an investigation and report to the Board, the highest authority for the organization. But that conclusion depends on facts beyond this Opinion. For example, if the Lawyer knows the Board was not informed about the conduct that the Lawyer initially reported to the internal audit committee and if that conduct meets all the requirements of IRPC 1.13(b), the Lawyer may have an obligation to take further steps to report the conduct within the organization. Depending on the nature of the conduct, a reasonable first step may be to ask to review the outside counsel’s report or discuss the report and the Board’s response with the general counsel. (We address separately whether the Lawyer may disclose information to persons outside the organization under IRPC 1.13(c)).

In the subsequent examples, the Lawyer reported the alleged misconduct directly to both the Chief Compliance Officer and the General Counsel. In response to at least one of the reports, outside counsel was retained but the Lawyer does not know whether the conduct was reported directly to the Board. Again, whether the Lawyer has satisfied IRPC 1.13(b) depends on the facts. However, the fact that the Lawyer has concluded that there were additional, subsequent instances of conduct that may also constitute a crime or fraud under similar circumstances – and assuming that the Lawyer correctly concluded that the conduct constitutes a fraud or crime – suggests either that the Lawyer’s prior reports were not sufficient, either in terms of what was reported or to whom, or the reports were disregarded even though the proper information was reported to the highest authority. If the former, the Lawyer may have a duty to supplement the Lawyer’s prior reports and/or seek to provide the information directly to the highest authority (either the Board or the independent directors, if appropriate).

If the latter – that is, the proper information was reported to the Board as the highest authority and the Board chose to take no action, the issue becomes whether and to what extent the Lawyer may report the conduct to persons outside the organization. That issue is governed by IRPC 1.13(c) and IRPC 1.6(b) and (c).

IPRC 1.6

Rule 1.6 generally bars a lawyer from revealing any information concerning the representation of a client unless the client has explicitly or implicitly authorized disclosure or unless the exceptions set forth in Rule 1.6(b) or (c) apply.

Rule 1.6(b) is permissive. It permits, but does not require, that a lawyer disclose otherwise confidential information “to the extent the lawyer believes reasonably necessary,” among other things,

1. to prevent the client from committing a crime in circumstances other than those specified in paragraph (c);
2. to prevent the client from committing fraud that is reasonably certain to result in substantial injury to the financial interests or property of another and in furtherance of which the client has used or is using the lawyer’s services;
3. to prevent, mitigate or rectify substantial injury to the financial interests or property of another that is reasonably certain to result or has resulted from the client’s commission of a crime or fraud in furtherance of which the client has used the lawyer’s services;

Both Rule 1.6(b)(2) and (b)(3) permit disclosure only where the lawyer’s services were used in furtherance of the relevant wrongful conduct. Rule 1.6(b)(1) permits disclosure to prevent a client from committing a crime.

Even if Rule 1.6 does not permit or require the Lawyer to disclose information to persons outside the organization, Rule 1.13(c) may do so. Rule 1.13(c) supplements Rule 1.6 and provides an additional basis that would permit – but not require – in-house counsel to disclose information outside the organization. IRPC 1.13, Comment 6. IRPC 1.13(c) provides as follows:

(c) Except as provided in paragraph (d),² if

(1) despite the lawyer’s efforts in accordance with paragraph (b) the highest authority that can act on behalf of the organization insists upon or fails to address in a timely and appropriate manner an action or a refusal to act, that is clearly a crime or fraud, and

(2) the lawyer reasonably believes that the crime or fraud is reasonably certain to result in substantial injury to the organization,

then the lawyer may reveal information relating to the representation whether or not Rule 1.6 permits such disclosure, but only if and to the extent the lawyer reasonably believes necessary to prevent substantial injury to the organization.

Rule 1.13(c) is intended to address a situation where an organization’s lawyer has reported conducted to the highest authority in the organization pursuant to Rule 1.13(b) but that authority has failed to address the matter “in a timely and appropriate manner” or has refused to act. Under those circumstances, a lawyer may disclose information to persons outside the organization. This is true even though the lawyer’s services were not used in furtherance of the wrongful conduct (unlike Rule 1.6(b)(2) and (b)(3)), provided the conduct relates to the representation. See IRPC 1.13, Comment 6. Note, however, that the conduct that would permit disclosure under Rule 1.13(c) to persons outside the organization is narrower than the conduct that triggers a lawyer’s obligation to report within the organization under Rule 1.13(b). Disclosure under Rule 1.13(c) is permitted only where the conduct is “clearly” a crime or fraud. Moreover, also unlike Rule 1.13(b), Rule 1.13(c) is permissive. It addresses situations where lawyer “may” reveal otherwise confidential information to persons outside the organization. Disclosure should be “only to the minimum extent the lawyer reasonably believes necessary to prevent reasonably certain substantial injury to the organization.”

Another important difference between disclosures permitted (or required) under Rule 1.6 and disclosures permitted under Rule 1.13 is the focus on the injured party. Unlike Rule 1.6, a lawyer may disclose confidential information under Rule 1.13(c) only where a crime or fraud “is reasonably certain to result in substantial injury to the organization.” It is possible that revealing an employee’s fraud or crime to persons outside the organization may harm the organization. If so, the lawyer may not reveal that information unless it falls within one of the exceptions to Rule 1.6(b) or Rule 1.6(c). Whether these circumstances exist here is fact specific and beyond the scope of this Opinion. (Also beyond the scope of this Opinion is whether the Lawyer has any basis to assert civil claims against the employer.)

Footnotes

1. There are exceptions not relevant here, such as where the lawyer represents both the organization and one or more of its constituents. In that case, the lawyer would owe duties to both the organization and the constituent. Under the facts presented here, the Lawyer represents only the Company and not any of the employees, officers or directors.
2. IRPC 1.13(d) provides that a lawyer who has been engaged to investigate an alleged crime, fraud or other violation of law may not make disclosures under IRPC 1.13(c). For purposes of this Opinion, we have assumed that subparagraph (d) does not apply here.

References

• Illinois Rules of Professional Conduct 1.6, 1.9, and 1.13;
• Majumdar v Lurie, 274 Ill.App.3d 267, 270 (1st Dist. 1995);
• Reynolds v. Henderson & Lyman, 903 F.3d 693 (7th Cir. 2018)