Contracting Out Regulatory Investigations – A Costly Exercise, Contributed by Joan E. McKown, Jones Day

Last month the financial community was shocked to learn of the allegedly fraudulent and unauthorized trading by UBS trader Kweku Adoboli. In a somewhat unusual turn, as part of the regulatory response, the United Kingdom’s Financial Services Authority (FSA) and Switzerland’s Financial Market Supervisory Authority (FINMA) have required UBS to pay for KPMG to conduct an investigation on behalf of the regulators. This is on top of UBS’s own separate internal investigation. The purpose of the KPMG review is to determine not only what went wrong, but to focus on UBS’s role in the wrongdoing. Is contracting out investigative work a good thing for a regulator? In this time of tightened government resources in the United States should U.S. regulators consider such an approach? My answer is a definite no―it is too costly for the regulator in terms of loss of control and learning.

First, of course, this arrangement presumably will occur only in significant investigations that are in the public eye and require the entity, and possibly the regulator, to respond on a grand scale for reputational reasons. Also presumably, such external reviews will not replace independent internal investigations by the affected entity, as seen by UBS’s dual investigation. Independent internal investigations are necessary for the audit committee as well as the entity to have a full and in-depth understanding of what happened and what lessons can be learned. This goes beyond what regulators, and in this case, what those hired to do their work are trying to determine—what laws were violated and who caused the violations.

But for the regulator, hiring out its investigation should raise several questions, including: (1) What sort of control will the entity that is paying the bill have on the scope of the investigation? and (2) Will the public nature of the investigation add pressure to complete it more quickly than necessary? Regulators also should be concerned about the future relationship between the third party investigator and its target. While I have not seen KPMG’s contract with FSA and FINMA, hopefully there is an independence clause specifying that the auditor cannot do work for UBS for a certain number of years so that the investigation is perceived as independent and not done with an eye towards getting additional work in the future from the bank. Typically, such independence clauses avoid any appearance that the investigator is cutting the entity some slack or not looking as deeply as it should at the situation. But the question remains whether a third party can ever be as truly independent as a regulator who has no reason from a business standpoint to curry favor with the entity being investigated.

The regulator also will need to review carefully the hired investigator’s underlying work and not merely rely on the glossy report they submit at the end. Moreover, in any investigation there are decisions made about what leads to follow and what issues to run down. While the party doing the investigation presumably would run the larger decisions past the regulator, it is not possible for the regulator to be aware of all the decisions that are made. Lastly, the hired investigator’s final report only captures the highlights of the investigation and has the writer’s perspective of what happened whereas the underlying transcripts and documents may not always be exactly the same as they are portrayed in the report.

The timing of external investigations is important as well. Many years ago the Securities and Exchange Commission (SEC) tried something similar in an auditor independence case. The external investigation showed that the auditor independence problem was more extensive than originally assumed. Unfortunately, the external investigation occurred after the SEC entered into a settlement. Although the external investigation raised public questions as to whether the sanction in the settlement was sufficient in light of the larger extent of the problem, it was problematic, if not impossible, to reopen the settlement at that stage.

The most significant reason that regulators in the United States and other countries should not contract out their investigations is that if they do, they will continue to fall further behind in understanding markets and the issues affecting them. The SEC, for example, has invested significant resources into gaining more industry expertise through hiring experts, developing specialized units, and acquiring enhanced technology. This is extremely important as financial markets become increasingly complex. But even short of hiring new staff with expertise, there is institutional learning that occurs with each investigation a regulator conducts. The staff learns by getting into the weeds and understanding how things worked in a way that cannot be gained by having someone else do the investigative work and report back to them. Hiring out investigations represents a loss in terms of learning and understanding for the regulator. In conducting an investigation a regulator not only learns what went wrong at that entity, but also what issues may need to be explored at other entities and what potential problems may exist generally in the financial markets.

Having a third party do their investigative work allows a regulator to say they have done something, but in the end it is costly for a regulator in terms of loss of independence, control, and institutional expertise. And, if a regulator has such limited resources that it cannot conduct an investigation involving one of its most important regulated entities, will the regulator be seen as a credible guardian of its financial markets? I think not.

Joan McKown is a partner in Jones Day’s Washington DC office. She specializes in securities litigation and SEC enforcement defense. Prior to joining Jones Day in October 2010 she was the long time chief counsel in the SEC’s Division of Enforcement where she played a key role in establishing enforcement policies and in reviewing all enforcement actions before they were recommended to the Commission.

The views set forth herein are the personal views of the author and do not necessarily reflect those of the law firm with which she is associated.