Federal Attorney Client Privilege in Corporate Investigations

Key Takeaways

The attorney-client privilege in federal corporate investigations is not absolute; it can be pierced through the crime-fraud exception, waiver by selective disclosure, or the fiduciary exception in shareholder derivative contexts.
Under Federal Rule of Evidence 502, inadvertent disclosure during internal investigations does not automatically waive privilege if the producing party took reasonable steps to prevent disclosure and promptly rectified the error.
The Upjohn warning—delivered at the outset of every witness interview in a corporate investigation—is the single most critical prophylactic measure to preserve privilege and avoid creating discoverable factual admissions.
General counsel and outside counsel must treat dual-purpose communications (those mixing legal advice with business strategy) with extreme care, as courts applying the "primary purpose" test under In re Kellogg Brown & Root will scrutinize the dominant reason for the communication.

When the Privilege Shield Cracks: The Crime-Fraud Exception and Selective Waiver Traps

In my 25 years as a federal prosecutor, I saw more corporate privilege claims collapse not because the underlying facts were adverse, but because the client or counsel made a procedural misstep that opened the door to compelled testimony. The crime-fraud exception, codified in common law and applied uniformly across federal circuits pursuant to Federal Rule of Evidence 501, strips privilege from communications made in furtherance of an ongoing or future crime or fraud. This is not merely a technical loophole; it is a substantive limitation that prosecutors invoke aggressively when they suspect that legal advice was used as cover for obstructive conduct. I have personally witnessed grand jury subpoenas issued against in-house counsel after a company's internal investigation produced notes suggesting that executives sought legal guidance on how to "structure" document retention policies to avoid regulatory scrutiny—a textbook trigger for the exception. The government must make a prima facie showing that the client intended to commit a crime or fraud and that the communication was in furtherance of that scheme, but once that threshold is met, the privilege vanishes entirely, and the communications become admissible evidence against the corporation and its officers. The strategic takeaway for corporate counsel is this: never assume that labeling a communication as "privileged" will protect it if the underlying conduct involves concealment, destruction of evidence, or coordination to mislead regulators.

Selective waiver presents an equally dangerous but less understood vulnerability. Many corporate clients believe they can disclose privileged materials to the Department of Justice or a regulatory agency during a cooperation proffer without waiving the privilege as to third parties, including civil plaintiffs or other government entities. The federal courts have roundly rejected this notion in the vast majority of circuits, holding that voluntary disclosure to any third party—even the government under a confidentiality agreement—constitutes a subject-matter waiver of all communications on the same subject under Federal Rule of Evidence 502(a). I have represented clients who, in good faith, shared internal investigation reports with the SEC only to find those same reports later used against them in a shareholder derivative suit, with no ability to claw back the privilege. The only safe harbor is a formal confidentiality order under Rule 502(d), which some courts will enter in advance of production, but even that protection is limited to the specific proceeding. My advice to every corporate client is simple: before you share a single privileged document with any government agency, obtain a written stipulation from that agency agreeing to limit the waiver to that specific enforcement action, and then move for a protective order in federal court to codify that limitation. Without these steps, you are essentially handing your adversary a roadmap to your legal strategy.

The Upjohn Warning: Why Your Internal Interview Script Is a Privilege Preservation Document

The Supreme Court's decision in Upjohn Co. v. United States, 449 U.S. 383 (1981), established that corporate communications with counsel are privileged when they concern matters within the employee's corporate duties and are made at the direction of superiors for the purpose of securing legal advice. However, the privilege belongs to the corporation, not to the individual employee being interviewed, and this distinction creates a minefield for unwary counsel. In my experience, the single most common error I see in corporate internal investigations is the failure to deliver a proper Upjohn warning at the start of every witness interview. That warning must explicitly state that the attorney represents the corporation, not the employee; that the communication is privileged and confidential as to the corporation; that the corporation may choose to waive that privilege in the future without the employee's consent; and that the employee cannot claim privilege over the conversation for their own personal criminal defense. I have sat across the table from former corporate executives who were never given this warning and who later testified in depositions that they believed the company's lawyer was "their lawyer," leading to devastating motions to compel and findings of implied waiver.

The practical consequence of a botched Upjohn warning is that the employee's statements become discoverable by the government and by civil litigants, and the corporation loses its ability to control the narrative. Federal prosecutors routinely ask during grand jury presentations whether a proper Upjohn warning was given, and if the answer is no, they will argue that the employee had a reasonable expectation of personal confidentiality, thereby defeating the corporate privilege altogether. I have seen entire internal investigation reports—thousands of hours of attorney work product—become admissible evidence because a single junior associate failed to read the scripted warning before a key witness interview. The Department of Justice's Justice Manual, Section 9-28.720, explicitly encourages prosecutors to scrutinize the adequacy of privilege warnings when assessing a corporation's cooperation credit, meaning a sloppy interview process can also damage your client's chances of obtaining a declination or deferred prosecution agreement. Every law firm that conducts corporate investigations should have a standardized, written Upjohn protocol that is reviewed annually and practiced through mock interviews. In my practice, I require that every interview be recorded with a verbatim script of the warning, and I instruct my clients to preserve that recording as part of the privilege log. This is not bureaucracy; it is insurance against the single most common attack on corporate privilege.

Dual-Purpose Communications and the Primary Purpose Test: Navigating the Gray Zone

Federal courts have struggled for decades to determine when a communication that mixes legal advice with business strategy is entitled to privilege protection. The modern standard, articulated by the D.C. Circuit in In re Kellogg Brown & Root, Inc., 756 F.3d 754 (D.C. Cir. 2014), holds that the privilege applies only if the "primary purpose" of the communication is to give or receive legal advice, as opposed to business or operational guidance. This test is notoriously fact-intensive and unpredictable, and I have seen it applied inconsistently even within the same district court. In my years as a prosecutor, I used this ambiguity to my advantage by arguing that emails carbon-copied to general counsel were merely "business decisions dressed in legal language," and I won motions to compel on that basis. Now as a defense attorney, I counsel my corporate clients to treat every communication that touches on legal issues as presumptively discoverable unless it is explicitly segregated into a separate, labeled legal advice channel. The safest practice is to create distinct email threads: one for business strategy and one for legal analysis, with the legal thread clearly marked "Privileged and Confidential—Attorney-Client Communication—Legal Advice Requested."

The danger of dual-purpose communications is magnified in the context of internal investigations, where the same document often serves both as a factual investigation report and as a legal analysis of potential liability. Courts applying the primary purpose test will look at the dominant reason the communication was created, and if the investigation was conducted primarily to comply with regulatory requirements or to make business decisions about personnel or operations, the privilege may not attach at all. I have represented companies where a board-commissioned investigation report was deemed discoverable because the board's resolution authorizing the investigation cited "business risk assessment" rather than "legal advice" as the primary purpose. The fix is straightforward: every internal investigation should be initiated by a formal legal engagement letter from outside counsel that explicitly states the investigation is being conducted to provide legal advice to the corporation, and that factual findings are being gathered solely for that purpose. Federal Rule of Civil Procedure 26(b)(5) requires that privilege claims be asserted with specificity, and a well-drafted engagement letter serves as the foundational document for that assertion. I also advise clients to avoid mixing legal and business personnel on the same investigation team; if an accountant or human resources professional is included in the legal strategy meetings, the privilege over those discussions is likely lost under the "presence of a third party" doctrine.

Data Breaches, Inadvertent Disclosure, and the 502(d) Protective Order: A Modern Compliance Imperative

The digital age has created a new frontier for privilege waivers: inadvertent disclosure through data breaches, misdirected emails, and overly broad e-discovery productions. Federal Rule of Evidence 502(b) provides a limited safe harbor, stating that an inadvertent disclosure does not operate as a waiver if the holder of the privilege took reasonable steps to prevent disclosure and promptly took reasonable steps to rectify the error. However, the "reasonable steps" standard is a moving target, and courts have held that using basic email encryption, implementing automated privilege review software, and training employees on privilege protocols are all factors that weigh in favor of finding no waiver. In my practice, I have seen a federal magistrate judge rule that a corporation waived privilege over 12,000 documents because its e-discovery vendor used keyword searches that were too broad and failed to catch obvious privilege markings—a finding that cost the client millions in settlement leverage. The lesson is that privilege protection is not a one-time designation; it is a process that must be audited continuously throughout the life of any investigation or litigation.

The most effective tool for preventing catastrophic waiver is the Federal Rule of Evidence 502(d) protective order, which allows parties to stipulate that disclosure of privileged material in a proceeding does not constitute a waiver in that proceeding or in any other federal or state proceeding. I now make it a standard practice to request a 502(d) order at the outset of every federal criminal investigation and every civil case involving corporate documents. This order does not protect against intentional waiver, but it eliminates the risk that a single misdirected document or a vendor error will result in a subject-matter waiver that destroys privilege across an entire case. The Department of Justice has recognized the utility of these orders and, in many districts, will agree to them as a matter of course in parallel proceedings. I also recommend that corporate clients implement a "privilege incident response plan" that designates a specific partner-level attorney to handle any inadvertent disclosure within 24 hours, including immediate claw-back demands and forensic analysis to determine the scope of the disclosure. In the federal system, the clock starts ticking the moment you discover the error, and a delayed response is almost always fatal to the privilege claim. The combination of a 502(d) order and a rapid-response protocol is the gold standard for modern privilege management, and I consider it malpractice to operate without both in place.

Frequently Asked Questions on Federal Attorney-Client Privilege in Corporate Investigations

Q: If our company conducts an internal investigation and shares the results with the government under a confidentiality agreement, have we waived privilege as to civil plaintiffs?

A: In nearly every federal circuit, the answer is yes—voluntary disclosure to any third party, including the government under a confidentiality agreement, waives the privilege as to all communications on the same subject matter. The only exception is if you obtain a Federal Rule of Evidence 502(d) protective order from the court before production, or if the government enters into a formal, written stipulation limiting the waiver to that specific enforcement action. I have seen too many well-intentioned cooperation efforts backfire when civil litigants successfully moved to compel the same privileged materials. My standard advice is to treat every government disclosure as a permanent waiver to the world unless you have a court order explicitly stating otherwise. The Department of Justice's own guidance in the Justice Manual discourages prosecutors from requesting privilege waivers as a condition of cooperation, but many companies still voluntarily offer them without understanding the downstream consequences. Always consult with experienced privilege counsel before sharing any privileged document with a government agency.

Q: Can an employee's personal attorney assert privilege over communications made during a corporate internal investigation interview?

A: No, because the privilege over those communications belongs exclusively to the corporation, not to the employee. This is the central holding of Upjohn Co. v. United States, and it is why the Upjohn warning is so critical. If the employee retains personal counsel and brings that attorney to the interview, the presence of separate counsel does not create a personal privilege for the employee over the corporation's communications. However, the employee's personal attorney can assert the employee's Fifth Amendment privilege against self-incrimination to prevent the employee from answering questions, which can create a conflict with the corporation's desire for a full factual accounting. I have seen this dynamic play out in dozens of investigations where the corporation's interests diverge from the employee's, and the only safe resolution is to have separate counsel for each party. If an employee refuses to cooperate based on personal Fifth Amendment concerns, the corporation must decide whether to terminate the employee or seek a proffer agreement from the government that protects both the corporation and the individual. The key point is that the employee cannot hide behind the corporation's attorney-client privilege to avoid answering questions—the privilege is the corporation's to waive or assert, not the employee's.

If you are facing a federal corporate investigation or need to conduct an internal review while preserving the attorney-client privilege, do not rely on generic compliance protocols or boilerplate engagement letters. The stakes are too high, and the rules are too nuanced for a one-size-fits-all approach. I invite you to contact my office for a confidential consultation, where we will conduct a privilege audit of your current investigation protocols, draft tailored Upjohn warning scripts and 502(d) protective orders, and develop a strategic plan to protect your most sensitive communications from compelled disclosure. In my 25 years as a federal prosecutor and now as a defense attorney, I have seen privilege destroyed by a single misplaced email or a poorly worded interview script—do not let that happen to your organization. Call my firm today to schedule a meeting, and we will put our experience to work safeguarding your legal defenses.