It’s not every day your company gets a letter from the government demanding documents, data, and sworn answers under tight deadlines.
But when a Civil Investigative Demand (“CID”) arrives, it should signal that government regulators are interested in your business, and what you do next can help ensure the CID is a manageable inquiry.
CIDs are powerful tools used by government agencies to investigate potential violations of civil law—often before a formal complaint or lawsuit is filed.
While CIDs are serious, they do not necessarily mean your company did something wrong, but how you respond can influence the outcome of the investigation.
Your response, thus, must be swift, strategic, and legally sound. Here’s a practical guide to navigating this process.
- Don’t Panic — but Act Immediately.
CIDs come with tight deadlines — often requiring a response or compliance within 20 to 30 days.
The first step is to immediately notify the appropriate stakeholders, including executive leadership, the legal department, and, where appropriate, your board or audit committee.
You should also immediately consider engaging outside counsel to assist you with responding to the CID.
Even if your internal legal team has litigation experience, responding to a CID often requires outside counsel with specific expertise in government investigations who can help you negotiate directly with the government while protecting your company’s interests.
- Initiate a Legal Hold
Whether you decide to engage outside counsel, you must still quickly implement a legal hold across relevant departments and employees.
To do this, you should identify key custodians of potentially responsive data and instruct them to preserve emails, messages, files, and physical documents related to the investigation.
It’s also critical to include IT and compliance teams to ensure a robust hold is in place. Your litigation hold should include a list of topics that may be responsive to the government’s requests, and specifically instruct your custodians to retain responsive documents.
Remember, preserving documents and emails must begin right away to avoid spoliation issues.
- Understand the Scope and Authority
With these initial steps complete, you should now carefully review the CID to determine what it’s about. Be on the lookout for the issuing agency, the conduct under investigation, the time frame, and what documents or information are being requested.
Understanding the CID’s legal basis will help guide you and your legal team’s response. It may reveal opportunities to narrow the scope or negotiate.
Understanding the scope of the CID will also help you assess what potential exposure your company may face.
- Communicate with the Issuing Agency
Your legal team should contact the issuing agency early — ideally within a few days of receiving the CID.
The goals of this initial call are to build credibility, seek clarity on the agency’s concerns, and negotiate the scope of the CID. During the call, you may discuss logistics, including extensions, productions, and timing.
While you never want to waive any defenses, it’s important to establish a cooperative tone early and often.
This initial call can further help your legal team assess whether an early presentation from counsel may short-circuit some or all of the issues raised in the CID.
- Coordinate the Collection and Review Process
In conjunction with your legal team, you should begin to collect and review relevant documents from your custodians in a way that is defensible, efficient, and complete.
Your legal team should also consider retaining a third-party vendor to assist with the document collection process to ensure you capture all relevant documents from relevant repositories.
If the CID contains interrogatories, begin to identify who from your company is best suited to help respond to each inquiry.
- Monitor, Respond, and Be Patient
While the government inquiry is ongoing (which is often a prolonged process), the bulk of the work will be in your legal team’s hands. This work will include producing documents, preparing witnesses, and communicating with the government.
While legal must lead this response, business continuity is key. You should maintain regular updates to senior management on the investigation’s progress, costs, and potential outcomes.
If there’s a serious risk of liability, you and your legal team should also begin contingency planning.
Conclusion: Be Proactive, Strategic, and Controlled
While a CID is serious, it can be manageable. How you respond can significantly influence the outcome of the investigation.
With the right legal team, internal coordination, and external strategy, you can mitigate risk and maintain your company’s credibility with regulators.
Authors: Jason Mehta & Samantha Gerencir (Foley & Lardner LLP)
