When reviewing a corporation’s financial statements and internal controls, independent auditors frequently request copies of materials that were prepared for ongoing or anticipated litigation. Auditors may wish to examine reports from internal investigations, legal opinions addressing potential liabilities, or presentations about prospective litigation prepared for the board of directors, among other materials. Indeed, it is becoming more and more common for auditors to conduct their own “shadow investigation” of a company’s internal investigation and, as part of that shadow investigation, to request access to the internal investigation’s underlying work product: the collection of documents that the company’s lawyers have deemed “key,” the analysis of transactions tested by forensic accountants working at counsel’s direction, and notes from interviews conducted by counsel in the course of the investigation. Auditors may make similar requests when investigating the possibility of “illegal acts” at a company, as required under Section 10A of the Securities Exchange Act of 1934.
But these types of privileged materials can be extremely attractive to third parties, including a corporation’s litigation adversaries or regulators. For instance, if an error in a corporation’s financial statements results in both an internal investigation by counsel and securities litigation by a shareholder, the shareholder will likely demand that the corporation produce copies of counsel’s reports from the internal investigation, expecting that the reports may contain damning information about corporate practices. Similarly, if counsel makes a presentation to the board on a prospective lawsuit that subsequently comes to fruition, the corporation’s adversaries may seek discovery of that presentation, hoping to uncover evidence of malfeasance. Ordinarily, many of these types of communications may be protected from discovery by the attorney-client privilege, but if they were disclosed to an independent auditor, that privilege would be waived in most jurisdictions.[1] This puts corporations in a predicament: either they resist disclosure, thereby hampering the auditor’s ability to provide an opinion, or they fully disclose, risking waiver and the possibility that unhelpful information could become discoverable.
The solution to this dilemma may be the work product protection, which in most jurisdictions prevents discovery of materials prepared by a party, its counsel, or other representatives in anticipation of litigation.[2] Unlike the attorney-client privilege, “the work product privilege is not automatically waived by any disclosure to a third party.”[3] Rather, for a waiver to occur, the work product must be disclosed to an adversary, or at least create a risk that the documents will be disclosed to an adversary.[4] However, there is some disagreement among courts about whether disclosures to auditors meet this criteria.
A minority of courts have held that independent auditors are inherently adversarial to the companies they audit, so the work product protection is waived by disclosing to them. For instance, in Medinol, Ltd. v. Boston Scientific Corp., 214 F.R.D. 113 (S.D.N.Y. 2002), where the defendant corporation’s counsel had presented the results of an internal investigation at a board meeting and the minutes from that meeting were subsequently disclosed to the defendant’s independent auditor, the U.S. District Court for the Southern District of New York found that the work product protection over the minutes had been waived, reasoning that auditors by definition “must not share common interests” with their clients. Most recently, in October 2016, the U.S. District Court for the Western District of Tennessee found that work product protection was waived for materials that a defendant company sent to its outside auditor, citing Medinol.[5]
Yet most courts have concluded that disclosure of work product to an independent auditor does not waive work product protection, since the absence of a common legal interest between a company and its auditor does not, in and of itself, make the auditor an “adversary” or a potential conduit to an adversary. For example, two years after Medinol, another judge in the U.S. District Court for the Southern District of New York rejected Medinol’s reasoning, holding that “any tension between an auditor and a corporation that arises from an auditor’s need to scrutinize and investigate a corporation’s records and book-keeping practices simply is not the equivalent of an adversarial relationship contemplated by the work product doctrine.”[6] In 2010, the Court of Appeals for the District of Columbia—the first federal appellate court to weigh in on the issue—agreed, concluding that the mere “power to issue an adverse opinion” is not the same as being a litigation adversary, and auditors’ duty of confidentiality precluded any significant risk of disclosure to an actual adversary.[7] Thus, while some courts have followed Medinol’s reasoning, “[t]he majority of courts to consider the issue have held that disclosure of work product protected materials to outside auditors does not constitute waiver of the privilege,” and Medinol itself “has been roundly criticized for its holding and analysis.”[8]
This majority view rests in part on public policy considerations. If disclosure to an auditor waives work product protection, a corporation may refuse to disclose that work product—leaving the auditor with less information and potentially harming the investing public. Of course, to the extent the auditor knows the work product exists, it could compel disclosure by refusing to provide an opinion until disclosure is made; however, that may discourage corporations from seeking legal advice in the first place, which is precisely the situation that the work product protection was created to avoid.[9] In contrast, if there is no waiver, corporations have a greater incentive to cooperate fully with their external auditors, despite the auditors’ independence. As one court has put it, “[a] business and its auditor can and should be aligned insofar as they both seek to prevent, detect, and root out corporate fraud,” and “this is precisely the type of limited alliance that courts should encourage.”[10]
While corporations should take comfort in the majority rule that disclosure to outside auditors does not waive the work product protection, the disagreement among courts will likely persist until more appellate courts weigh in on this issue. Accordingly, corporate counsel should consider taking certain steps when disclosing work product to external auditors:
- First, confirm that the work product is actually privileged in the jurisdiction(s) where the corporation could face litigation. For example, some attorneys have a tendency to classify all legal documents prepared by or for a corporation as protected work product, forgetting that the documents must be prepared in anticipation of litigation to be protected in most jurisdictions.[11] Different courts use different tests to determine whether work product was prepared in “anticipation of litigation,”[12] but most courts agree that the general business risk of litigation is insufficient, and documents prepared in the ordinary course are not protected.[13] Similarly, attorneys may fail to realize that anything reflecting an attorney’s mental process—e.g., an attorney’s compilation of particular documents, the identities of individuals an attorney chose to interview, or an attorney’s narrative of the facts—may be privileged,[14] while the facts discovered by an attorney may not, in and of themselves, constitute protected work product.[15] By understanding from the outset which materials do and do not qualify for work product protection, corporate counsel can avoid unnecessary headaches about whether disclosure will waive the privilege.
- Next, as the corporation prepares to provide materials to the auditor, it should discuss the auditor’s confidentiality obligations. The standard agreement between an auditor and issuer may contain general provisions regarding confidentiality. Still, the corporation and auditor should agree that any information sent to the auditor is confidential and that the auditor will not further disclose that information. Where appropriate, it should specify that the information is subject to the work product protection and consider documenting the legal basis for that protection when the work product is transferred to the auditor. By taking these steps, a corporation can better demonstrate that it made every effort to avoid disclosure to its litigation adversaries, and the auditor will be on notice if it ever becomes the target of discovery in litigation.
- When providing materials to the auditor, the corporation should tailor disclosures to minimize the scope of any waiver. While the corporation should give its auditor any and all material it needs to render an accurate opinion, it shouldn’t “dump” work product on the auditor before determining whether sensitive portions are actually responsive to the auditor’s requests. Likewise, if the auditor’s request requires generating new work product—e.g., audit response letters, which some courts treat as protected work product[16]—then the corporation or its counsel should prepare that material conservatively, knowing it may eventually become discoverable.[17] On the other hand, if an auditor has asked for existing documents related to a particular litigation risk, the corporation should consider making a broad disclosure rather than compiling and providing a narrower subset of documents that the corporation considers most relevant or “key.” As noted above, the corporation’s compilation of documents may itself be work product, and a broader disclosure would avoid directing its litigation adversaries to the most sensitive documents if the materials are ultimately produced.
- Corporate counsel should also consider asking the auditor to receive work product orally wherever possible. A back-and-forth conversation responding to the auditor’s specific questions—rather than a one-way production from the corporation to the auditor—can limit the amount of work product disclosed, which will in turn narrow the potential waiver. Moreover, the extra precaution taken to minimize written material that an auditor could disclose to an adversary will assist in the argument that there has been no waiver as a matter of law. That said, counsel should exercise caution even when presenting work product orally, as an auditor’s notes from an oral presentation may be discoverable.
- Finally, if litigation arises and the auditor is subpoenaed, the corporation’s counsel should review any auditor work papers that may contain privileged material before they are produced. While competent auditors will not knowingly disclose the corporation’s work product in response to a subpoena, they may not appreciate which documents reflect work product, they may not agree about the scope of the work product protection, and they generally will not review corporate documents as carefully and thoroughly as the corporation’s own counsel would. Further, the corporation’s insistence on the right to review such material will strengthen any argument that it has taken the appropriate steps to ensure that protected material does not end up in the hands of an adversary. So long as the corporation is willing to defend its privilege calls, most auditors will (and should) defer to corporate counsel’s judgment and refer the subpoenaing party to them if a dispute about the privilege arises. After all, it is the corporation’s privilege to waive.
In sum, corporations should exercise caution when disclosing work product to their auditors. Until courts have more uniformly agreed that disclosure of work product to auditors does not waive the work product privilege, corporations must balance their auditors’ needs with the risk of waiver, and they should carefully tailor their disclosures to minimize that risk.
[1] See, e.g., Weil v. Inv./Indicators, Research & Mgmt., Inc., 647 F.2d 18 (9th Cir. 1981) (“[I]t has been widely held that voluntary disclosure of the content of a privilege attorney communication constitutes waiver of the privilege as to all other such communications on the same subject.” (collecting cases)).
[2] This rule is codified in Federal Rule of Civil Procedure 26(b)(3), which protects “documents and tangible things that are prepared in anticipation of litigation or for trial by or for another party or its representative (including the other party’s attorney, consultant, surety, indemnitor, insurer, or agent).” The analysis below focuses on federal law regarding the work product privilege—which governs in all federal court cases, and is frequently cited even by state courts—though the scope of the privilege in some states deviates from FRCP 26(b)(3). For example, California state law limits the privilege to work product prepared by attorneys, but does not require that the work product be prepared in anticipation of litigation. Cal. Civ. Proc. Code § 2018.030. New York state recognizes both a privilege similar to the federal work product protection, see N.Y. C.P.L.R. § 3101(d)(2), and a privilege for “materials prepared by an attorney . . . which contain his or her legal analysis, conclusions, theory, or strategy,” even if not prepared in anticipation of litigation, see Geffner v. Mercy Medical Center, 4 N.Y.S.3d 283 (N.Y. App. Div. 2015).
[3] In re Sealed Case, 676 F.2d 793, 809 (D.C. Cir. 1982).
[4] See, e.g., In re Steinhardt Partners L.P., 9 F. 3d 230, 235 (2d Cir. 1993); Brown v. NCL (Bahamas), Ltd., 155 F. Supp. 3d 1335, 1339 (S.D. Fl. 2015); Curto v. Med. World Comm’ns, Inc., 783 F. Supp. 2d 373, 380 (E.D.N.Y. 2011).
[5] See First Horizon Nat’l Corp. v. Houston Casualty Co., No. 2:15-cv-2235, 2016 WL 5867268 (W.D. Tenn. Oct. 5, 2016); see also United States v. Hatfield, No. 06-CR-0550, 2010 WL 183522, *3-4 (E.D.N.Y. Jan. 8, 2010).
[6] Merrill Lynch Co. v. Allegheny Energy, Inc., 229 F.R.D. 441, 448 (S.D.N.Y. 2004); see also Am. Steamship Owners Mut. Prot. & Indem. Ass’n v. Alcoa Steamship Co., No. 04 Civ. 4309, 2006 WL 278131 (S.D.N.Y. Feb. 2, 2006) (“declin[ing] to follow Medinol”). To date, the Court of Appeals for the Second Circuit has not addressed this issue, despite the apparent disagreement among lower courts in that circuit.
[7] See U.S. v.. Deloitte, LLP, 610 F.3d 129, 139-43 (D.C. Cir. 2010).
[8] Westernbank Puerto Rico v. Kachkar, Civ. No. 07-1606, 2009 WL 530131, *7-8 (D. Puerto Rico Feb. 9, 2009); see also SEC v. Berry, No. C07–04431 RMW, 2011 WL 825742 (N.D. Cal. Mar. 7, 2011); Lawrence E. Jaffe Pension Plan v. Household Int’l, Inc., 237 F.R.D. 176 (N.D. Ill. 2006).
[9] See Deloitte, 610 F.3d at 143 (discussing independent auditors’ “significant leverage over the companies whose finances they audit,” which weighs against waiver of work product protection); Hickman v. Taylor, 329 U.S. 495, 511 (1947) (without the work product doctrine, “much of what is now put down in writing would remain unwritten . . . [a]nd the interests of the clients and the cause of justice would be poorly served”).
[10] Merrill Lynch, 229 F.R.D. at 448.
[11] As previously noted (see note 2), some states, including New York and California, recognize a privilege for attorney work product regardless of whether it was prepared in anticipation of litigation.
[12] See, e.g., Deloitte, 610 F.3d at 136-37 (“Under the test adopted by most circuits, the question is whether the document was created ‘because of’ the anticipated litigation. The Fifth Circuit, however, requires that anticipation be the ‘primary motivating purpose’ behind the document’s creation.” (citations omitted)).
[13] See, e.g., United States v. Textron, Inc. & Subsidiaries, 577 F.3d 21, 30 (1st Cir. 2009) (“Even if prepared by lawyers and reflecting legal thinking, ‘[m]aterials assembled in the ordinary course of business, or pursuant to public requirements unrelated to litigation, or for other nonlitigation purposes’” do not fall under the federal work product protection (citation omitted)).
[14] See, e.g., In re Allen, 106 F.3d 582, 609 (4th Cir. 1997) (attorney’s “selection and compilation” of particular employment records was protected from disclosure because it “reveals her thought processes and theories regarding this litigation”); US Bank Nat’l Ass’n v. PHL Variable Ins. Co., Nos. 12 Civ. 6811, 13 Civ. 1580, 2013 WL 5495542, at *9-10 (S.D.N.Y. Oct. 3, 2013) (noting disagreement among courts, but “find[ing] that the identifies of the individuals [plaintiff] interviewed in its investigation are protected as work product”); United States ex rel. Bagley v. TRW, Inc., 212 F.R.D. 554, 564 (C.D. Cal. 2003) (plaintiff’s “factual narratives” of evidence he deemed material to his case were protected work product).
[15] See, e.g., Resolution Trust Corp. v. Dabney, 73 F.3d 262, 266 (10th Cir. 1995) (work product doctrine “does not protect facts concerning the creation of work product or facts contained within work product”).
[16] See, e.g., Lawrence E. Jaffe Pension Plan, 237 F.R.D. at 181-83 (N.D. Ill. 2006); Laguna Beach Cnty. Water Dist. v. Superior Court, 22 Cal. Rptr. 3d 387, 392-93 (Cal. Ct. App. 2004); Tronitech, Inc. v. NCR Corp., 108 F.R.D. 655, 656-57 (S.D. Ind. 1985); see also United States v. Adlman, 134 F.3d 1194, 1200 (2d Cir. 1998) (stating in dicta that a memo requested by an auditor “estimating the likelihood of success in litigation and an accompanying analysis of the company’s legal strategies and options to assist it in estimating what should be reserved for litigation losses” is protected work product that would not be waived).
[17] The American Bar Association Statement of Policy Regarding Lawyers’ Responses to Auditors’ Requests for Information, adopted in December 1975, suggests numerous limitations to attorneys’ responses to audit request letters, including limiting the scope of matters addressed by an attorney to material claims that have actually been asserted, and not assessing the likely outcome of claims unless an adverse result is either “probable” or “remote.”