Internal audits are an essential tool for identifying and reducing legal risk. But without careful planning, those same audits can create discoverable records that may later be used against the company in litigation or regulatory proceedings. The attorney-client privilege protects sensitive audit-related communications from disclosure, but this often requires structuring and managing the audit with privilege in mind from the outset.
Why Privilege Can Be Difficult to Preserve
Attorney-client privilege generally protects confidential communications between counsel and the client made for the purpose of seeking or providing legal advice. It does not automatically protect all statements or materials prepared by in-house counsel. As a result, an internal audit is not privileged simply because it involves a sensitive topic, is important to the business, or includes counsel on some communications.
Common missteps include assuming that all audit data is protected, copying counsel on emails that otherwise involve business advice, circulating audit-related communications too broadly, or allowing non-legal teams to drive the project without a clear record of legal direction. These issues are especially acute for large-scale or recurring audits involving compensation, pay equity, compliance, finance, safety, or other cross-functional business areas.
The Cross-Functional Audit Challenge
Many audits require substantial involvement from non-legal stakeholders. For example, a pay equity audit may depend heavily on compensation, human resources, finance, and data analytics teams that understand the company’s pay systems, job architecture, policies, and workforce data. From a practical standpoint, those teams may be best positioned to collect information, run analyses, and identify operational issues.
The privilege risk arises when the record shows that the audit was primarily business-driven rather than counsel-directed. If counsel is largely absent from project planning, status updates, document review, and decision points, it may be harder to establish that key communications were made for the purpose of obtaining legal advice. Similarly, if non-legal teams broadly cascade audit updates through email, chat, or collaboration platforms, the company may increase the risk of waiver or create unnecessary discoverable material.
Practical Steps to Help Preserve Privilege
There is no one-size-fits-all approach, and the right structure will depend on the company, the audit subject matter, and the applicable legal risks. However, companies should consider the following steps when planning privileged or potentially privileged audits:
- Define counsel’s role at the outset. Document that the audit is being conducted at the direction of counsel for the purpose of obtaining legal advice, where appropriate.
- Clarify ownership and governance. Establish a core working group or steering committee that includes legal and the key business leaders needed to execute the audit.
- Limit distribution. Share privileged communications and legal advice only with individuals who need the information to support the legal purpose of the audit.
- Use clear communication protocols. Provide project participants with practical guidance on email, chat, document storage, labeling, and escalation procedures.
- Separate legal advice from routine business work. Consider whether compliance documentation, business analyses, and privileged legal assessments should be maintained separately.
- Manage collaboration platforms carefully. Slack, Teams, and other messaging tools can create informal, widely distributed records; audit teams should understand when and how those tools may be used.
Implementation Considerations
One approach is to form a central committee made up of the leaders from legal and business functions most relevant to the audit. Counsel can direct the legal aspects of the project, while non-legal committee members coordinate data collection, operational follow-up, and issue escalation. This structure can help maintain legal oversight without requiring the legal department to perform every audit task itself.
Companies should also consider adopting written communication and document-handling protocols for audit participants. These protocols may address when to involve counsel, how to label privileged communications, where to store audit materials, who may access them, and how to avoid unnecessary discussion of sensitive issues in informal channels.
Key Takeaway
Internal audits can reduce legal risk only if they are structured to avoid creating new exposure. Companies planning sensitive audits should involve counsel early, define the legal purpose of the work, establish clear governance, and train project participants on privilege-preserving communications. These steps will not guarantee protection in every circumstance, but they can significantly improve the company’s ability to defend privilege if the audit is later challenged.
This blog post was drafted by Pablo Orozco, an attorney on the Spencer Fane labor and employment team. For more information, visit spencerfane.com.
Click here to subscribe to Spencer Fane communications to ensure you receive timely updates like this directly in your inbox.
