A Dangerous Departure: Why the Court’s Privilege Ruling Undermines Corporate Self-Policing

The Ruling’s Core Flaw: Privilege as a Penalty for Diligence

In my 25 years as a federal prosecutor, I never witnessed a court so thoroughly invert the relationship between corporate privilege and compliance. The ruling at issue holds that when a corporation conducts an internal investigation and shares non-privileged factual summaries with its independent auditor—as required by SEC rules and the Foreign Corrupt Practices Act—it implicitly waives attorney-client privilege over the underlying legal advice that shaped those summaries. This is not a modest expansion of the "at-issue" waiver doctrine; it is a judicial bulldozer driven through the carefully constructed framework of Federal Rule of Evidence 502 and the common law privilege. The court reasoned that because the corporation "placed the adequacy of its compliance program at issue" by disclosing investigation results to the auditor, fairness demanded that the government receive the privileged legal advice behind those results. With respect, that reasoning conflates a corporation’s regulatory obligation to share factual findings with a voluntary litigation strategy, and it punishes the very transparency that the Department of Justice has spent two decades encouraging.

The practical consequences for general counsel and compliance officers are immediate and chilling. Under this ruling, every email from outside counsel analyzing a whistleblower complaint, every red-line memo recommending remedial measures, and every privilege log entry for internal investigation work product becomes a potential government exhibit. The corporation that follows the DOJ’s own guidance—conduct a thorough investigation, self-report promptly, and cooperate fully—now discovers that its cooperation has been weaponized against it. I have advised dozens of Fortune 500 companies on internal investigations, and the first question from every general counsel after this ruling is: "Why should we document our legal advice if the government can just demand it because we did the right thing?" That question should terrify prosecutors and regulators because it signals the death of the candid, self-critical analysis that makes corporate self-policing effective. The ruling does not merely narrow privilege; it creates a perverse incentive to keep internal investigations shallow, oral, and undocumented—precisely the opposite of what the law demands.

How This Ruling Conflicts with Federal Law and DOJ Policy

Federal Rule of Evidence 502 was enacted specifically to prevent the kind of "subject matter waiver" that this ruling effectively imposes. The advisory committee notes to Rule 502(a) explicitly state that disclosure of privileged material to an auditor or regulator does not waive privilege for all communications on the same subject matter—yet that is exactly what the court has done here. Furthermore, the ruling contradicts the clear language of the SEC’s own rules under the Sarbanes-Oxley Act, which require public companies to maintain "internal accounting controls sufficient to provide reasonable assurances" that transactions are recorded properly. Those controls necessarily involve privileged legal advice about what constitutes a "reasonable assurance." By holding that sharing investigation results with auditors waives privilege over the legal advice that produced those results, the court has created an impossible tension between the SEC’s disclosure mandates and the attorney-client privilege that protects the lawyering process behind those disclosures.

The Department of Justice’s own policy framework—specifically Justice Manual § 9-28.720 and the 2015 Yates Memorandum—explicitly rewards corporations for "voluntary disclosure, cooperation, and remediation." The Yates Memorandum promised that companies would receive "meaningful credit" for self-reporting, including the protection of privilege over internal investigation materials. This ruling eviscerates that promise. In my experience negotiating cooperation credit with federal prosecutors, the single most valuable asset a company brings to the table is the credibility of its internal investigation. If that investigation now becomes a waiver trap, companies will rationally choose to limit their investigations to the bare minimum necessary to satisfy auditors, leaving deeper misconduct undiscovered and unaddressed. The ruling thus undermines not just privilege law but the entire architecture of deferred prosecution agreements and corporate monitorships that has defined white-collar enforcement for the past decade.

The Practical Fallout: Compliance Programs in the Crosshairs

Let me be direct about what this ruling means for the compliance professionals I work with every day. A chief compliance officer who discovers potential FCPA violations through an anonymous hotline report must now weigh three options, each legally perilous. First, she can conduct a full investigation with outside counsel, document the legal analysis, and share findings with the audit committee—but under this ruling, she has effectively waived privilege over the entire investigation. Second, she can limit the investigation to non-privileged factual gathering, but that risks missing the legal nuances that distinguish a compliance failure from a criminal violation. Third, she can simply not investigate at all and hope the government never discovers the issue—a decision that violates the company’s own compliance policies and the DOJ’s expectation of proactive self-policing. None of these options serve the public interest, and none align with the regulatory framework that Congress and the DOJ have built over decades.

The ruling also creates a cascading problem for the attorney-client privilege in the corporate context that will take years to unwind. Under the traditional Upjohn standard, corporations can communicate candidly with counsel knowing those communications remain confidential. This ruling introduces a new variable: if those communications are later disclosed to auditors as part of a regulatory filing or audit response, the privilege is lost not just for the disclosed materials but for all communications on the "same subject." The breadth of the waiver is the most dangerous element. In my practice, I have seen the "same subject" standard expand to encompass entire compliance programs, multiple years of legal advice, and communications with separate legal teams. Corporate counsel will now be forced to segment their advice into "disclosable" and "non-disclosable" categories, a distinction that is artificial and unworkable in the real-world context of an ongoing investigation where facts and legal analysis are inseparable. The end result will be less candor, less documentation, and ultimately less effective compliance.

What Corporate Counsel Must Do Now: Practical Mitigation Strategies

While I strongly believe this ruling is wrong and will likely be narrowed on appeal or through legislative action, I cannot advise my clients to wait for the law to catch up. The immediate steps are painful but necessary. First, every internal investigation should now be structured with a "dual-track" approach: a factual investigation conducted by non-legal personnel under the direction of the compliance department, and a separate privileged investigation conducted by outside counsel. The factual track can be shared with auditors and regulators without triggering waiver over the legal track. This is expensive and inefficient, but it is currently the only way to preserve privilege while satisfying disclosure obligations. Second, I am advising clients to include explicit "common interest" and "limited waiver" agreements in every engagement letter with outside auditors, specifically citing Federal Rule of Evidence 502(d) and requesting court orders that limit the scope of any potential waiver. These protective measures are not foolproof, but they create a record that the corporation intended limited disclosure, not subject-matter waiver.

Third, corporate boards and audit committees must be educated that this ruling changes the calculus of self-reporting. In the past, I could advise a board that early self-disclosure of misconduct was almost always the right course because it earned cooperation credit and avoided the appearance of concealment. Now, that advice comes with a significant caveat: self-reporting may waive privilege over the legal analysis that the board needs to make informed decisions about remedial measures. The board must now consider whether to conduct its investigation under a "no waiver" framework that limits disclosure to the government, or to accept the risk of waiver in exchange for the benefits of full cooperation. This is a terrible position for any board to be in, and it is entirely the product of a single judicial decision that failed to consider the systemic consequences. I am actively working with bar associations and the American Law Institute to develop model protective orders and amicus briefs that can be used to challenge this ruling in other jurisdictions, but in the meantime, corporate counsel must navigate this minefield with extreme caution and a clear understanding of the risks.

If your corporation is facing an internal investigation, a government subpoena, or questions about how this privilege ruling affects your compliance program, do not wait until the government makes the first move. Contact my office today for a confidential consultation. With over 25 years of experience as a federal prosecutor and now as a defense attorney, I have the knowledge and judgment to help you navigate this rapidly changing landscape. Call 202-555-0199 or email [email protected] to schedule a privileged discussion about protecting your company’s rights while fulfilling your regulatory obligations. The decisions you make in the next 30 days will determine whether this ruling becomes a footnote or the defining case of your corporate legacy.