When a serious incident occurs – whether it be a workplace fatality, an equipment failure, or a chemical release – a company faces competing demands. It must respond operationally and meet its regulatory obligations while counsel assesses legal exposure and prepares for reasonably anticipated litigation.
The internal investigation that follows sits at the intersection of those demands. If the investigation is structured correctly, it can produce a complete factual record while preserving applicable protections. If it is not, some or all of its materials may be discoverable.
Protection turns on purpose, content, process, and implementation. Standing alone, a privilege legend or counsel’s involvement does not establish protection. Attorney–client privilege requires confidential communications made for the purpose of obtaining or providing legal advice. Work-product protection requires proof that the material was prepared because of reasonably anticipated litigation and would not have been prepared in substantially similar form otherwise.
In federal court, federal law governs work-product protection. The law governing attorney-client privilege depends on the claims: federal common law governs federal claims, while state privilege law governs claims for which state law supplies the rule of decision. Counsel should address choice of law at the outset, particularly when anticipated litigation may include both federal and state claims.
Work-product protection and the “because of” test
The work-product doctrine originates in Hickman v. Taylor, 329 U.S. 495, 510–11 (1947) and is codified at Federal Rule of Civil Procedure 26(b)(3), which reaches documents prepared “in anticipation of litigation.” A widely applied formulation comes from United States v. Adlman, 134 F.3d 1194 (2d Cir. 1998). A document created because of anticipated litigation that “would not have been prepared in substantially similar form but for the prospect of that litigation” falls within the Rule, even when it also informs a business decision. Id. at 1195. Adlman adopted the Wright & Miller “because of” test, which the court noted had been cited by the Third, Fourth, Seventh, Eighth, and D.C. Circuits. Id. at 1202.
The “because of” test “withholds protection from documents that are prepared in the ordinary course of business or that would have been created in essentially similar form irrespective of the litigation.” Even if those documents “might also help in preparation for litigation, they do not qualify for protection.” Id. A document prepared because of anticipated litigation is therefore only “eligible for work-product privilege”; it may still be discoverable upon the showing required by Rule 26(b)(3). Id. at 1202–03.
Foreseeability alone does not satisfy the standard. In Binks Manufacturing Co. v. National Presto Industries, Inc., 709 F.2d 1109 (7th Cir. 1983), the Seventh Circuit held that “[t]he mere fact that litigation does eventually ensue does not, by itself, cloak materials prepared by an attorney with the protection of the work product privilege; the privilege is not that broad.” Id. at 1118. The court then quoted with approval the rule that “[a] more or less routine investigation of a possibly resistible claim is not sufficient to immunize an investigative report developed in the ordinary course of business” and that some courts have looked for “objective facts establishing an identifiable resolve to litigate prior to the investigative efforts resulting in the report.” Id. at 1119 (quoting Janicker v. George Washington University, 94 F.R.D. 648, 650 (D.D.C. 1982)). Applying that standard, the court found no work-product protection for in-house counsel’s memoranda analyzing the equipment failure at issue.
Fact and opinion work product
Rule 26(b)(3) provides heightened protection for counsel’s mental impressions, conclusions, opinions, and legal theories. It establishes “two tiers of protection”: ordinary work product is discoverable on a showing of need and hardship, while “core” or “opinion” work product is “generally afforded near absolute protection from discovery” and is discoverable “only upon a showing of rare and exceptional circumstances.” In re Cendant Corp. Securities Litigation, 343 F.3d 658, 663 (3d Cir. 2003). That distinction should guide document design. Maintain source evidence, technical analysis, and counsel’s legal assessment in separately identifiable records or sections so that factual material can be produced, if required, without unnecessarily disclosing opinion work product. Separation does not permit counsel to alter, omit, or suppress unfavorable findings or failed hypotheses, and all notes, drafts, and data must be preserved.
Attorney-client privilege and dual-purpose investigations
The attorney–client privilege applies to confidential communications made for the purpose of obtaining or providing legal advice, including qualifying communications between corporate employees and company counsel during an internal investigation. Upjohn Co. v. United States, 449 U.S. 383, 389–90, 394–96 (1981). Most post-incident investigations serve legal and business purposes at once, and federal courts have not converged on how to treat dual-purpose communications.
The D.C. Circuit applies a comparatively protective standard. “So long as obtaining or providing legal advice was one of the significant purposes of the internal investigation, the attorney–client privilege applies, even if there were also other purposes for the investigation and even if the investigation was mandated by regulation rather than simply an exercise of company discretion.” In re Kellogg Brown & Root, Inc., 756 F.3d 754, 758–59 (D.C. Cir. 2014). Kellogg also confirms that no “magic words” are required, that a lawyer’s status as in-house counsel “does not dilute the privilege,” and that communications through non-attorney agents may be protected when they serve the legal investigation. Id. at 758–60.
The Ninth Circuit applies the primary-purpose test. In In re Grand Jury, 23 F.4th 1088 (9th Cir. 2022), the court held that “the primary-purpose test applies to attorney–client privilege claims for dual-purpose communications” and declined to extend the broader work-product “because of” test to the privilege. Id. at 1092. The panel left open whether to adopt Kellogg’s “primary purpose” formulation, finding the question unnecessary on the facts and noting that Kellogg arose in “the very specific context of corporate internal investigations.” Id. at 1094. The Supreme Court later dismissed the writ of certiorari as improvidently granted. In re Grand Jury, 598 U.S. 15 (2023) (per curiam). Counsel should structure an investigation to satisfy the narrower standard and exercise substantive responsibility for its legal purpose and direction.
The extension of privilege to certain nonlawyer agents is commonly associated with United States v. Kovel, 296 F.2d 918 (2d Cir. 1961). Kovel recognized that a client’s confidential communications through an accountant may fall within the privilege when the accountant is necessary – or at least highly useful – to counsel’s effective provision of legal advice. Id. at 922. The court did not determine that the communications before it were privileged; it vacated the contempt judgment and remanded for factual findings. Applied to post-incident investigations, Kovel may support protection where a technical specialist translates or analyzes information that counsel needs in order to provide legal advice. It does not protect the specialist’s independent operational or technical work merely because counsel made the retention.
EEOC v. George Washington University, 342 F.R.D. 161 (D.D.C. 2022), illustrates how attorney–client privilege and work-product protection may produce different results for the same investigation. There, an employee had filed a discrimination grievance, and the university’s equal employment officer contacted in-house counsel after concluding that the grievance was likely to result in litigation. Counsel advised on investigative strategy, and outside counsel later assumed responsibility for the investigation and prepared a report containing legal analysis. The court held that the withheld investigation materials, including the non-attorney investigator’s interview notes, were protected by the attorney–client privilege because obtaining legal advice was a significant purpose of the counsel-directed investigation. Id. at 178–81.
The work-product analysis was narrower. The court held that the outside counsel report, its drafts, and related communications were prepared because of anticipated litigation. Id. at 181–82. The non-attorney investigator’s interview notes did not qualify as work product because she routinely took similar notes in non-litigation investigations, and the university did not explain how anticipated litigation changed their form. Id. at 182–83. The same document therefore may fail the work-product test yet remain protected by the attorney–client privilege.
Underlying facts remain discoverable
Even a well-structured investigation will not shield the underlying facts. The privilege “only protects disclosure of communications; it does not protect disclosure of the underlying facts by those who communicated with the attorney.” Upjohn, 449 U.S. at 395. Work-product protection likewise does not reach “actual evidence taken from the scene or facts about the scene or incident.” National Union Fire Insurance Co. v. Murray Sheet Metal Co., 967 F.2d 980, 984 n.5 (4th Cir. 1992). Physical evidence, photographs, witness identities, and raw test data may remain discoverable, and an adversary may obtain employees’ factual knowledge through deposition or other discovery.
Two tracks: operations and legal analysis
After any serious incident, some investigation will occur for reasons unrelated to litigation. The Fourth Circuit stated the problem directly in National Union Fire Insurance Co., a case arising from a plant fire and ensuing contamination: “Following any industrial accident, it can be expected that designated personnel will conduct investigations, not only out of a concern for future litigation, but also to prevent reoccurrences, to improve safety and efficiency in the facility, and to respond to regulatory obligations. Determining the driving force behind the preparation of each requested document is therefore required in resolving a work product immunity question.” 967 F.2d at 984. Those principles support a two-track protocol that distinguishes the company’s operational response from a separate legal investigation.
The operational response should proceed under its own purpose, governance, records, and distribution controls, with deliverables the company treats as potentially discoverable. The counsel-directed investigation should be separate in substance and form, including through distinct matter records, repositories, recipient lists, and deliverables where appropriate. A single report circulated to counsel, engineering, safety, sales, insurers, and business decision-makers may invite both an ordinary-course finding and a waiver argument.
Application in post-incident investigations
Klosin v. E.I. du Pont de Nemours & Co., 561 F. Supp. 3d 343 (W.D.N.Y. 2021), illustrates the rule as applied in the company’s favor. Two workers died at a logistics facility. The company’s general counsel initiated the investigation, directed the site safety director, brought in a second in-house lawyer and an OSHA-specialist outside counsel, told management he was coordinating the matter, issued a litigation hold covering the OSHA proceeding and “other litigation relating to this accident,” and submitted declarations that the root-cause report was not ordinarily prepared and would not have been created in substantially similar form but for the prospect of litigation. The report itself recited that it was prepared at counsel’s request. The court held that those contemporaneous facts satisfied Adlman. 134 F.3d at 353–58.
Protection was still partial. Because the investigation began within hours of the incident, witness memories had faded, and the only direct witnesses to the accident had died, the plaintiff showed substantial need for the factual material. The court ordered the factual portions of the report and its drafts produced while requiring redaction of the sections containing corrective-action recommendations, analysis, and counsel’s mental impressions. Id. at 358–62. The court also declined to treat employee-to-employee emails as privileged merely because counsel was copied and some carried privilege legends. Id. at 362 n.9.
Wells Dairy, Inc. v. American Industrial Refrigeration, Inc., 690 N.W.2d 38 (Iowa 2004), illustrates the contrary result. After an ammonia leak caused an explosion and fire, a senior executive retained two university specialists and later attested that he sought help evaluating and responding to legal claims. The Iowa Supreme Court adopted Adlman’s because-of test, replacing its own narrower primary-purpose standard and still affirmed production of the resulting 107-page report. The report was styled as a critical review of refrigeration staffing, its three stated objectives were forward-looking and operational, and it acknowledged that “investigating and evaluating this incident was not directly in the investigator’s scope of work.” The trial court considered the executive’s affidavit but gave it little weight because “the investigative report itself does not support this statement and does not address this goal.” Id. at 43–49. Subjective intent, an expectation of confidentiality, and outside specialists cannot rescue a document whose own text describes a business purpose.
A written policy is evidence of purpose, but it is not dispositive. A policy may support protection when it requires matter-specific escalation to counsel and permits counsel to define a distinct legal investigation. A policy may undercut protection when it automatically requires the same investigation and report after every qualifying event. In Harper v. Auto-Owners Insurance Co., 138 F.R.D. 655 (S.D. Ind. 1991), the insurer argued that its policy of conducting a specialized investigation for every arson loss took those investigations outside the ordinary course. The court disagreed: “A process that has become a company ‘policy’ and is undertaken as a matter of course is that company’s routine.” Id. at 668. Because Harper arose in the insurance-claims context and applied a restrictive concurrent-purpose analysis, its broader lesson is that policy language cannot substitute for document-specific proof of purpose.
Practical takeaways for in-house counsel
- Use objective escalation criteria and require a documented gateway decision. Criteria may include death, serious injury, major fire or property loss, recurring failures of the same product, government involvement, or an express defect allegation. For an escalated incident, counsel should document the likely claimants, potential legal theories, preservation needs, and incident-specific facts supporting a reasonable anticipation of litigation. The memorandum should also explain how the legal investigation differs in purpose, scope, or deliverables from any review the business would conduct regardless of litigation.
- Run separate operational and legal tracks. Distinguish their purposes, governance, records, and distribution. Treat operational materials as potentially discoverable and avoid a single report intended to serve legal, safety, regulatory, warranty, and business functions at once.
- Retain investigators under matter-specific engagement letters. An engagement letter should state the legal purpose truthfully, describe the anticipated dispute, recite that the work would not be undertaken in the same form absent litigation, require the investigator to work at counsel’s direction, preserve source materials and chain of custody, and bar distribution or destructive testing without authorization. Avoid standing retentions that assign the same investigator and the same report to every incident.
- Keep source evidence, technical analysis, and legal analysis separately identifiable. Use distinct records or clearly labeled sections so that factual material can be produced, if required, without unnecessarily disclosing opinion work product. Preserve all unfavorable findings and failed hypotheses.
- Issue the litigation hold when counsel reasonably anticipates litigation. At that point, the party must suspend routine destruction and implement a litigation hold. See Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 216–18 (S.D.N.Y. 2003). Where the company does not own or control failed equipment or the incident scene, send preservation notices and provide an opportunity for inspection. See Silvestri v. General Motors Corp., 271 F.3d 583, 590–91 (4th Cir. 2001).
- Log withheld documents individually. Identify each document’s author, recipients, date, legal purpose, anticipated proceeding, and asserted protection. A blanket assertion over an entire investigation file is vulnerable to challenge and may fail. See Harper v. Auto-Owners Ins. Co., 138 F.R.D. 655, 664–65 (S.D. Ind. 1991).
Conclusion
No protocol guarantees protection. Design the process before an incident occurs; open a legal investigation only after a documented, matter-specific assessment has been done; keep that investigation separate from the operational response; and control distribution of the document(s). Counsel should assume that underlying facts, physical evidence, and records of remedial measures may remain discoverable. A disciplined structure provides the strongest basis for protecting counsel’s legal advice, litigation analysis, and mental impressions, but only where the contemporaneous record supports the asserted protection.
This article is provided for general informational purposes only and does not constitute legal advice. Readers should consult qualified counsel regarding their specific circumstances.
Client Alert 2026-164