# SOLSTICE TRANSIT GROUP — PRIVILEGED INVESTIGATION & DISCLOSURE PLAN **Prepared for the Board's independent directors | Day 1: Monday, August 2** --- ## 0. Threshold rulings that shape everything else (decide in the first 60 minutes) **Reject the CFO's three proposals, in writing, with reasons documented:** | CFO proposal | Ruling | Why | |---|---|---| | Assign internal audit | No — internal audit *supports*, does not *direct* | Internal audit reports to the CFO; the CFO's own function approved four reimbursements of the suspect invoice. That is not a "structure capable of independent legal judgment" (Rule 1) and generates no privilege (Rule 2). | | "Let Cole explain" now | No — Cole is not interviewed until after his devices are imaged | Interviewing the principal subject before collection invites deletion of 7-day-cycle chats and personal-phone content. Sequencing is a spoliation control, not a courtesy. | | Wait to preserve personal devices until "we know the complaint is real" | No — preservation is triggered by credibility of the *allegation*, not proof of the *offense* | Rules 1 and 4 require preservation on a credible allegation. The records are perishable **this week** (7-day chat purge, 21-day log rollover, weekend server purge). Waiting is the one decision that cannot be corrected later. | **Document this exchange.** The CFO's proposal is itself an investigative fact (why did finance want delay?) and a potential control failure. It goes to the special committee, not into a privileged advice memo where it becomes hard to disclose cleanly. --- ## 1. Immediate preservation and suspension of deletion (Hours 0–24; complete before Friday, August 6, 5:00 p.m.) **Hour 0–1 — Verbal freeze order.** GC (or, until the committee is seated, GC on the independent chair's authority) instructs the CIO by phone, confirmed by email within the hour: 1. **Suspend the quarterly server purge scheduled for this weekend** — enterprise-wide, not custodian-limited. Require the IT owner to reply confirming suspension by name, timestamp, and job/script ID. Verify Friday and again Monday that it did not run. 2. **Disable messaging auto-deletion** for all Tier 1 custodians and, if the platform cannot do it selectively, tenant-wide. **In parallel, export today** everything still in the 7-day window: chats before ~July 26 are already gone, so today's export is the last chance for the last week's traffic. 3. **Image finance-system audit logs immediately.** Logs before ~July 12 have already rolled. Capture what remains today, plus any archived/backup copies, plus database transaction logs. 4. **Quarantine backup tapes/snapshots** covering the last 24 months; take them out of rotation and out of the overwrite schedule. 5. **Enable mailbox journaling/litigation hold** for Tier 1 custodians; disable their delete/purge permissions in the ERP and document repositories; disable admin ability to bulk-delete. 6. **Preserve hotline vendor records** (submission metadata, attachments in native form, access logs) — and *do not* run any query aimed at identifying the reporter. **Hour 1–4 — Written legal hold.** Issued by outside counsel over the special committee's name. Scope must reach (Rule 4): company systems and email; **personal phones and personal accounts used for work** (Cole's and the CCO's are already known); all messaging applications including consumer apps; finance and ERP records; expense/T&E; **East Reach files within Solstice's control** (shared drives, portals, the relationship manager's files); and every identified custodian. The notice must: - Name a single counsel contact and require **written acknowledgment within 24 hours**; - Instruct: do not delete, do not "clean up," do not change auto-delete settings, do not migrate devices, do not discuss the notice's substance with other recipients; - State the nonretaliation rule and the whistleblower-protection commitment (§6); - Be deliberately silent as to the allegation's details. **Hour 4–24 — Personal-device capture.** Offer forensic collection appointments Monday–Wednesday: consent form, narrowly scoped to work communications and the relevant date range, using targeted-container collection where the BYOD policy permits, local privacy counsel cleared **before** collection in any non-U.S. jurisdiction. If Cole or any custodian refuses consent, escalate immediately: written preservation directive, employment-policy consequences, and a documented record of the refusal (a refusal is itself evidence and it changes the credibility calculus in §7). **Third-party preservation.** By Day 2, outside counsel sends East Reach a **contractual audit-rights and document-preservation demand** (subledgers, bank records, consultant contracts, sub-vendor files, communications with Solstice personnel). Tip-off is not a reason to delay: East Reach's owner is already a party to the chat and already knows. The perishable-records risk dominates. --- ## 2. Payments and relationships: pause surgically, not blindly **Stop immediately (Rule 1's "stop reasonably suspected ongoing payments"):** - All payments under or referencing the East Reach invoice — including any **fifth installment or unpaid balance**; verify in AP today whether anything is queued, and place a hard block plus a duplicate-payment/renamed-vendor check. - All "facilitation," "consulting," "expediting," or unspecified-services line items to East Reach or any related entity, company-wide. - Cole's payment-approval, vendor-onboarding, and expense-approval authority — revoked today. - Any cash advances or reimbursements to Cole or his team pending review. **Do not terminate East Reach outright yet.** Termination would (a) destroy the leverage of the contractual audit right and access to the subledger, (b) risk destruction of the very records we need, and (c) strand in-transit rail-control shipments. Instead: - Continue only the **documented, legitimate brokerage** (~$160k/yr) under a transaction-by-transaction regime: pre-approval by the CCO's designee, tariff codes and duty receipts verified against government-issued documentation, no cash, no unspecified line items, written confirmation from East Reach that no payment to any official will be made on Solstice's behalf. - If East Reach refuses the audit demand, refuses the certification, or the brokerage cannot be separated from the suspect stream, **suspend the relationship** and re-route through an alternative broker. **Cole:** paid administrative leave (or reassignment stripped of customs, payment, vendor, and personnel authority), effective after device imaging is arranged — same day if possible. Frame in writing as **non-disciplinary and precautionary**, no findings implied. Preserve his systems access rights for investigators; remove his own access. Consider the same for any subordinate who signed clearance documents, once identified. --- ## 3. Board and counsel structure **Special Committee (constituted today).** Rule 9 is triggered: a regional VP is a subject and the CFO's finance function processed the payments, so senior management may be involved. - **Composition:** three independent directors. **The two directors who are Cole's business allies are excluded** — no membership, no observer status, no briefings, no access to the workspace or hold notices. Record the recusal in the minutes with the reason. - **Chartered authority:** retain and instruct counsel; set scope; control privilege and any waiver; direct preservation and remediation; approve personnel actions affecting subjects; **hold the sole authority to decide whether and when to disclose**; report to the full board only through the chair, with subject-adjacent directors screened out. - **No management veto.** The CFO and CEO receive information on a need-to-know basis and take no decisions on scope, custodians, or disclosure. **Counsel and experts.** - **Outside counsel** (no prior representation of Cole or East Reach; conflicts cleared today) is retained *by the committee* to conduct a privileged investigation and render legal advice. Engagement letter states this purpose expressly. - **Forensic accountants and forensic-imaging vendors retained by counsel** (Kovel-style) under counsel's direction, to assist counsel's legal advice. - **Local counsel** in the clearance jurisdiction: data privacy, employment, and local-law exposure before any device collection or interview there. - **Internal audit and the CCO are seconded to counsel** as fact-gathering resources, taking direction from counsel, not from the CFO. Note: the CCO is also a **custodian** (personal-phone work messages) and the hotline recipient — she is imaged and interviewed like anyone else, and she does not assess her own credibility judgment. --- ## 4. Privilege limits and interview warnings **What privilege will and will not do (Rule 2).** Plan now for the disclosure you may make later; do not build a record you cannot safely hand over. - **Not privileged, and do not label as such:** the invoice, chat, spreadsheet, bank records, ERP entries, customs filings, contracts, due-diligence files, audit logs — all ordinary business records. Also **remediation work** (control fixes, vendor certifications, payment blocks, training) and the underlying **facts**. - **Privileged:** counsel's communications with the committee and employees conducted for legal advice; counsel's memoranda, analysis, and mental impressions; witness-interview memoranda containing counsel's assessments. - **Two-track documentation discipline from Day 1:** - **Track A (disclosable):** a **factual chronology** and a **document binder** — sourced, dated, transaction-level, with no legal conclusions, no counsel opinions, no probability assessments. Built from the start as the eventual disclosure product. - **Track B (privileged):** legal advice, risk analysis, culpability assessments, penalty modeling, disclosure strategy — physically and technologically separate, distinct file naming, distinct distribution list. - Never mix advice into a factual document; never quote counsel's conclusions in an operational email. Selective quotation is how waiver happens. - **No over-designation.** Marking ordinary records "privileged" does not protect them and, in a disclosure posture, reads as concealment. Rule 8 forecloses using privilege to hide who, what, when, or how much. **Upjohn/corporate warning — mandatory script, delivered and documented at every interview (Rule 3):** 1. Counsel represents **Solstice**, not the interviewee. 2. The interview is conducted so counsel can give **legal advice to the company**. 3. The conversation is **privileged, and the privilege belongs to the company**, which may waive it and disclose what is said, including to a regulator, **without the interviewee's consent**. 4. The interviewee **may wish to obtain separate counsel**; how to request it and that the company will consider fees consistent with policy and law (no conditioning on giving favorable testimony). 5. **Retaliation is prohibited**; here is the reporting channel if the interviewee experiences it. 6. Keep the discussion confidential to protect the integrity of the investigation — while making clear the company **cannot and does not promise the interviewee personal confidentiality**, and the interviewee retains the right to report to authorities. 7. Preservation obligation restated; no deletion. Record delivery and acknowledgment at the top of each memorandum. **No investigator may say "this is just between us," "you won't be named," or "nothing you say leaves this room."** Two attorneys or an attorney plus a counsel-directed note-taker at every interview; no recording without local-law clearance. --- ## 5. First custodians, devices, and records **Tier 1 custodians (imaged/collected Days 1–3):** Cole Marr; East Reach relationship manager and Cole's assistant; the regional logistics/customs manager and any employee who signed clearance documents; the AP specialist and the controller who processed the four installments; the regional finance director; the CFO (as approver in the payment chain); the CCO (hotline recipient, personal-phone user); Cole's direct reports with vendor contact. **Devices and accounts:** company laptops and desktops; Exchange/mail archives; **messaging application exports (today)**; personal phones used for work — including Cole's and the CCO's; personal email/cloud accounts if used for work; OneDrive/SharePoint/shared drives; expense-system accounts; VPN/badge/travel logs to place people at clearance events. **Records (perishability order):** 1. **Bank wire records for all four installments** — full MT103/SWIFT detail: beneficiary name, account number, beneficiary bank, correspondent chain, intermediary jurisdictions, remittance references. *This is the single highest-value document in the case.* 2. **Finance-system audit logs** (21-day rollover — today) and ERP approval-workflow history for the invoice and each installment. 3. **Messaging exports** (7-day cycle — today). 4. East Reach vendor master file, onboarding and due-diligence file, contracts and amendments, prior audits, the $240,000 invoice in native form with metadata, and all supporting documentation. 5. GL coding and journal entries for the $240,000 — **how was it booked and described?** 6. Customs entry documents, broker declarations, duty receipts, inspection and clearance records, amendment history, and shipment timelines — matched against payment dates. 7. Cole's T&E, gifts/hospitality, cash advances, and 24-month payment-approval history across **all** vendors. 8. Hotline history for prior reports touching Cole, the region, or East Reach; Cole's HR file and performance/bonus records tied to clearance metrics. 9. Metadata authentication of the three attachments against source systems and Cole's device. --- ## 6. Nonretaliation and witness-contact controls - **Written nonretaliation directive** from the committee chair to all custodians and their managers: retaliation in any form is prohibited and is independently a terminable offense; this covers assignments, ratings, compensation, transfers, and social exclusion. - **No reporter-identification.** No forensic query, hotline metadata review, or informal speculation aimed at identifying the whistleblower. Anyone who attempts it is investigated. Restrict knowledge of the attachments' existence to the minimum list. - **Witness-contact controls:** Cole and any subject may not contact custodians or witnesses about the investigation, directly or through intermediaries (including the two allied directors and East Reach's owner). Any attempted contact is reported to counsel and logged; witness tampering is treated as a separate, escalated matter. - **HR adverse-action screen:** for 24 months, no termination, demotion, PIP, reassignment, or compensation reduction affecting any custodian without prior committee-counsel review. Sole HR point of contact designated. - **Separate counsel:** available on request at company expense consistent with policy, with no conditions on content of testimony; funding decisions made by the committee, not by anyone in the reporting chain of a subject. - **Interview integrity:** no joint interviews; no prior circulation of others' accounts; no "alignment" meetings. --- ## 7. Do the attachments already start the 30-day clock? **Operating answer: assume yes, and run the clock from Monday, August 2, with the outer disclosure limit calendared as Tuesday, September 1.** **Why the "bare anonymous accusation" safe harbor does not apply.** Rule 6 excuses a *bare* accusation; this is not one. Three independent, mutually corroborating documentary items arrived with it: - an invoice whose stated purpose — *"border facilitation"* — describes the alleged conduct; - a contemporaneous instruction from a named senior executive to **use an intermediary to make "the border problem disappear"** and to **"not put government names in our file"** — i.e., evidence of both the mechanism and the concealment; and - an internal spreadsheet **tracing Solstice's own reimbursement** of the exact amount in four installments. Rule 6 expressly contemplates that documentary support, corroboration, or payment tracing "may create credible evidence **before every detail is known**." Under Rule 5, the threshold is a **reasonable belief that a covered payment occurred**, not proof of the recipient. The unknowns here — consultant name, beneficiary bank, official, country account — are exactly the details Rule 6 says need not be known. **The single legitimate caveat: authenticity.** A fabricated or altered chat would defeat reasonable belief. So authentication is not a delay tactic but a **72-hour sprint** (§9, Days 1–3): metadata verification, source-system match, device recovery of the chat, ERP confirmation of the four installments. **How we handle the ambiguity honestly:** 1. **Dated credible-evidence memorandum today**, signed by the CCO and GC, recording: the 8:10 a.m. August 2 receipt; the three attachments; the reasoning; and the conclusion that the threshold is **treated as met on August 2**, subject to authenticity confirmation. A regulator will later reconstruct *when* we knew; a contemporaneous, self-adverse-leaning memo is the best possible record. A post-hoc "we didn't think it was credible until August 20" is the worst. 2. **Never argue for a later trigger date as a reason to slow down.** If authentication confirms the documents (Day 3), the trigger date is August 2 and nothing changes. If authentication *disproves* them, we document that and the clock never ran. 3. **Treat Rule 5's second condition as the real risk.** The credit is lost on **regulator contact**, whatever the day count. The whistleblower who assembled bank-traceable documentation may already have filed externally; the path could close in week one. That, plus Rule 10, means the operative deadline is our own early decision date, not September 1. --- ## 8. Missing facts required for the disclosure decision **Dispositive (must have, or must be able to say we tried and could not get):** 1. **Beneficiary of the four installments** — name, account, bank, jurisdiction, beneficial owner. Is it East Reach, a consultant, a shell, or an official-linked entity? 2. **Identity and ownership of the "consultant"** — including whether any owner, relative, or nominee is a customs official or official-connected. 3. **East Reach's subledger** — what left East Reach after the $240,000 arrived, to whom, when, in what form (cash?). 4. **Whether anything of value reached a government official**, directly or through the consultant. 5. **Authenticity** of the invoice, chat, and spreadsheet. 6. **What the customs record shows** — duty reductions, waived inspections, retroactive amendments, unusual clearance speed — and whether clearance events **temporally correlate** with the four installments. **Scope and culpability (needed for a truthful, complete disclosure):** 7. **How the $240,000 was booked** in the GL and whether descriptions were false (books-and-records exposure independent of the payment). 8. **Who approved, who knew, who was copied** — specifically whether the CFO, finance leadership, or any director knew or should have; whether the two allied directors were involved. 9. **Any other similar payments** — other invoices, vendors, countries, periods; is $240,000 an instance or a pattern? 10. Whether any **installment or successor payment remains outstanding** (ongoing-conduct exposure). 11. Whether the legitimate $160k brokerage stream was used as a **conduit or cover**. 12. Statute-of-limitations period, currency/jurisdiction, and local-law parallel exposure. **We will not have all twelve by the decision date. That is expected, and Rule 7 accommodates it through disclosed material uncertainty — not through delay.** --- ## 9. Seven-day investigative plan and the decision date **Day 1 — Monday, August 2** Special committee constituted; allied directors recused; outside counsel and forensic accountants engaged. Verbal IT freeze; **weekend server purge suspended (written confirmation obtained)**; messaging exports run; audit logs imaged; backups quarantined. Legal hold issued. Payment blocks on East Reach facilitation/consulting; check for a pending fifth installment. Cole's approval authority revoked; leave/reassignment decision made. Credible-evidence memorandum signed and dated. **Bank-records request filed with treasury and the banks for full MT103 detail on all four installments** — longest lead time, start today. CFO proposals rejected in writing. **Day 2 — Tuesday, August 3** Personal-device imaging begins (Cole first, with local-privacy clearance). East Reach preservation and audit-rights demand served. ERP extraction: invoice, four vouchers, approval workflow, GL coding. Custodian list finalized; hold acknowledgments tracked. Nonretaliation directive issued. Customs/clearance record request initiated in-country. **Day 3 — Wednesday, August 4** **Authentication checkpoint:** metadata and source-system verification of all three attachments; chat recovered from device. Peripheral interviews begin — AP specialist, controller, relationship manager (Upjohn warnings, full script). First banking responses triaged. Verify the server purge is still suspended. **Day 4 — Thursday, August 5** Payment tracing: match installments to bank debits and beneficiary detail. Customs-entry review against payment dates. Interview logistics/customs personnel. Open-source and registry work on the consultant and East Reach ownership. First East Reach response assessed. **Day 5 — Friday, August 6** **Cole interview** (devices imaged; two attorneys; full warnings; no confidentiality promise). Interview the CFO on the approval chain and on his delay proposal. Vendor-population sweep for other "facilitation"-type line items. **Re-verify at 5:00 p.m. and again Monday that the quarterly purge did not execute.** **Days 6–7 — Weekend, August 7–8** Forensic review of collected devices and messaging; second-level tracing; draft the **Track A factual chronology** with confidence tiers (Confirmed / Documentarily supported / Unresolved). Counsel drafts the Track B privileged assessment separately. **Day 8 — Monday, August 9 — Committee session #1.** Findings report; scope-expansion decisions; remediation approvals; escalation of any preservation failure or refusal. **DECISION DATE — Thursday, August 12 (Day 11):** the special committee decides **disclose or not disclose**, on the record, with reasons. Not September 1. **Accelerators that override August 12:** - **Confirmation trigger:** if bank beneficiary data, the East Reach subledger, or a witness confirms that value reached or was routed toward an official, **disclose within 72 hours of confirmation** — do not wait for the calendar. - **Path-closure trigger:** any sign of regulator interest, external whistleblower filing, media inquiry, or counterpart-government activity → **immediate protective disclosure** with uncertainty flagged (§10), rather than a complete disclosure that arrives after contact and is worth nothing. - **Obstruction trigger:** deletion, device-refusal, witness contact, or East Reach stonewalling → accelerate; obstruction both raises the credibility of the allegation and shortens the runway. **If August 12 arrives with the beneficiary still unknown:** the committee still decides. Given a euphemistic invoice, an executive instruction to conceal government names, and traced reimbursement, the presumption is **disclose with disclosed uncertainty and a commitment to supplement**, rather than run toward September 1 hoping for certainty. Any decision to defer must be re-taken with a written justification at fixed intervals (August 12, 19, 26), each time confirming that the deferral is short, that perishable work is proceeding in parallel, and that the full 30-day path from August 2 remains intact. --- ## 10. Disclosing material uncertainty without waiving privileged advice **Structure the submission in tiers, and let the tiering carry the uncertainty (Rule 7):** - **Tier 1 — Confirmed facts.** Named participants and transactions: Cole Marr, regional VP; East Reach and its owner; invoice number, date, and amount ($240,000, "border facilitation and technical consulting"); the four reimbursement installments with dates, amounts, approvers, and GL coding; the verbatim August chat with authentication basis; the customs entries and clearance events matched to payment dates. **Who, what, when, how much** — stated fully, because Rule 8 forbids using privilege to obscure exactly these. - **Tier 2 — Documentarily supported but not conclusive.** Stated with its evidentiary basis and its limits: e.g., "the invoice description and the instruction not to record government names are consistent with payments intended for officials; we have not yet identified the recipient." - **Tier 3 — Expressly unresolved.** Enumerated: consultant identity; ultimate beneficiary; whether value reached an official; scope beyond this transaction; whether any additional employee or director knew. Each item paired with the step being taken and an expected date. - **Explicit uncertainty statement:** "Solstice cannot presently confirm whether the $240,000 reached a government official, a legitimate broker, or another private recipient. We disclose this uncertainty rather than resolve it by inference." - **Cooperation commitment:** rolling supplements on a stated cadence; document productions; witness availability; translations; assistance with third-party and foreign-bank process; notice of any material change in our understanding, **including facts that cut against our earlier statements**. **Waiver discipline:** - Produce **facts and documents**, not counsel's analysis. The chronology, the binder, and factual interview content (delivered as **oral factual proffers or attributed factual summaries**, not as interview memoranda) carry the disclosure. Rule 8 gives us this right — use it. - **Withhold** legal advice, culpability assessments, penalty modeling, and mental impressions. Say so expressly and consistently; a general, uniform withholding is defensible, while ad hoc withholding after selective disclosure invites a waiver finding. - **Never quote or characterize counsel's advice** to bolster the disclosure — no "counsel has concluded there was no violation," no "counsel advises the payment was likely legitimate." That is both the classic waiver trap and, on this record, speculation dressed as fact. - Seek a **written non-waiver and confidentiality understanding** before any oral factual proffer, while planning as though it may not hold. - Reconcile the disclosure to the Track A chronology line by line before filing, and log every produced document. **No statement to the regulator may rest on facts we have not verified** — Rule 7's forfeiture provision punishes speculation presented as fact far more severely than it punishes admitted ignorance. - Present **remediation as remediation, not as legal advice**: payment blocks, Cole's removal, vendor certification, third-party controls redesign, messaging-retention change (the 7-day auto-delete is itself a control defect worth fixing and reporting). Remediation is not privileged (Rule 2) and is a credit-enhancing narrative — do not bury it in privileged files. **Finally, the correction obligation.** If later facts show that the $240,000 went to a legitimate broker, we supplement and say so; if they show a wider pattern, we supplement and say that. Substantial truthfulness (Rule 7) is a continuing duty, and the credibility earned by early self-correction is worth more than the 50 percent reduction it protects.