How an Attorney General investigation works before anything is filed

An Attorney General investigation spends most of its life invisible to the business it concerns. Before anything is filed, the office is doing four things. It is gathering documents, usually by written demand. It is talking to people who are not you, including former employees and complaining customers. It is testing whether the conduct fits a statute the office can actually enforce. And it is working through an internal approval process that has very little to do with how angry anyone is.

I spent part of my career as an Assistant Attorney General. The part that surprises people is how ordinary the work is. A state law office has a docket, a budget, a chain of command and a fixed number of lawyers, and those constraints shape which matters get filed at least as much as the facts do. Understanding that machinery is most of what separates a company that handles an inquiry well from one that makes it considerably worse.

Where does an Attorney General investigation actually come from?

Most start with complaints. Every Attorney General investigation of a consumer-facing business begins in the same building as the complaint intake operation, and the volume there is large. A single complaint almost never produces anything. What produces something is a cluster. The same company or the same product appearing repeatedly in the same quarter, often with the same phrases turning up in complaints from people who have never met.

The second source is other government. Licensing boards, insurance departments, securities regulators, banking divisions, revenue departments and local prosecutors all refer matters they cannot handle or would rather not own. Federal agencies refer too. These arrive with a file already built, which is why they tend to move faster than complaint-driven matters.

The third source is other states. Attorneys General talk to each other constantly through standing committees and working groups, and a company that is a problem in one state becomes a name on a list in several. Multistate matters are their own animal. They are slower, broader, and much harder to resolve quietly. The fourth source is everything else. Press coverage. A legislator forwarding a constituent’s letter. A former employee who kept documents. A competitor’s complaint dressed up as a customer’s.

Who inside the office decides whether to open a file?

Usually a line assistant attorney general writes a short memo and a division chief decides. Some offices run a screening committee. The criteria are not mysterious, but they are not what outsiders expect either. The first question is statutory fit. Does this conduct violate a law this office enforces, in language a judge will recognize on sight? Offices are more conservative about novel theories than people assume, because a loss creates a precedent that costs them the next ten cases.

The second question is proof, and specifically whether the case can be proven with documents instead of testimony. Document cases are cheap and they survive witness problems. Cases that turn on what a salesperson said to a customer three years ago are expensive and fragile. The third question is scale. How many people were affected, how much money moved, and is the harm still happening. The fourth is institutional. Does another agency already own this, is there any relief worth obtaining, and what will it cost in lawyer-hours the office does not have.

What does not drive the decision is tone. A furious complainant does not open a file. A well-documented one does. Companies often spend their energy on the wrong audience at this stage, working hard to satisfy the customer who complained, when the office stopped caring about that particular customer weeks ago and is now interested in the forty behind them.

What is the office doing with the documents it demands?

The demand has different names in different states. Civil investigative demand. Investigative subpoena. A subpoena issued by the office itself rather than by a court. The effect is the same. It is enforceable, it has a return date, and it asks for more than anyone expected. Scope is negotiable in most states, and negotiating it is normal professional practice rather than resistance.

What happens next is less dramatic than companies fear and more thorough than they hope. Paralegals and analysts build a chronology. They are not reading for atmosphere. They are hunting for a small number of specific documents. The internal complaint log. The email where somebody flagged the problem and named it correctly. The training script or the call script. The written policy that was not followed. The approval chain for a disclosure that got shortened to improve conversion. One document showing that somebody inside the company already knew is worth more than a thousand pages of marketing material.

This is also why the manner of production matters. Produce too little and you have handed the office a second case about the investigation itself, which is far easier to prove than the first one. Dump everything unsorted and you have paid to have your own problems indexed by the person whose job is to find them. The useful middle is a careful, documented, internally consistent production with the privilege decisions made deliberately and written down.

Why does an Attorney General investigation care so much about a pattern?

Because the statutes are written that way. Most state consumer protection and unfair practices laws reach a practice rather than an incident, and many of them do not require the office to prove that anyone intended to deceive anybody. That is a structural advantage and the office builds toward it from the first week.

So the real question an investigator is answering is whether the conduct was systemic. One employee going off script is a personnel matter. A script that says the same thing to every caller is a practice. A compensation plan that pays more when a disclosure gets skipped is a practice. A complaint log with forty entries containing the same sentence, and no record of anyone changing anything in response, is a practice with knowledge attached to it.

This is why internal complaint handling is often more damaging than the underlying conduct. A company that documented the problem and fixed it has a real defense, and sometimes a very good one. A company that documented the problem and did nothing has written the state’s opening statement on the state’s behalf.

What does the decision to file look like from the inside?

Filing is a choice, and most offices would rather not. A lawsuit costs years of attorney time and can be lost. A negotiated resolution produces money, binding conduct terms and an announcement on the office’s own schedule. That is why a great many matters that get this far never become public cases. The names vary again. Assurance of voluntary compliance, consent judgment, settlement agreement. The structure is usually restitution, civil penalties, specific changes to the conduct going forward, and some period of compliance reporting.

Before that there is normally a window where the company’s lawyers can meet the office and submit a written response. Taking that meeting seriously is the highest-value thing most companies do in the entire process. Remember who the audience is. It is a lawyer deciding whether this case is worth their next eighteen months. Give them the legal problem with their theory, the factual correction with documents behind it, and the remedial steps already taken. Give them indignation instead and you have confirmed that you will be difficult in litigation too.

What pushes an office to file anyway is fairly consistent. Harm that is still happening and needs an injunction now. A sense that the company was not straight during the investigation. A refusal to pay restitution the office considers obvious. A statutory deadline approaching with no tolling agreement in place. Or a company large enough that a public filing is part of the point. I wrote separately about what actually triggers consumer protection scrutiny in the first place, which is the stage where most of this is still avoidable.

Frequently asked questions

Can we ignore a civil investigative demand?

No. It is enforceable in court, and refusing to respond usually produces an enforcement proceeding that is far simpler for the office to win than the underlying case. Objecting to particular requests and negotiating scope is a completely different thing, and it is routine. The date on the face of the document is often movable. The obligation is not.

Will the office tell us we are under investigation?

Not necessarily, and usually not at the start. Offices frequently interview former employees and complaining customers before contacting the company at all. Many states also exempt open investigative files from public records requests, so a matter can be well advanced before anyone inside the business hears about it.

Is it better to resolve things before anything is filed?

Often yes, because a pre-filing resolution avoids a public complaint and the years that follow one. It is not free. Consent terms bind future conduct, commonly include ongoing reporting, and may be enforceable by contempt. Whether that trade makes sense depends on how strong the office’s proof actually is, which is why the assessment has to come before the negotiation.

Talk with Michael

I handle regulatory and administrative defense, which means companies and licensed professionals on the receiving end of exactly this process. I also spent part of my career as an Assistant Attorney General, so I have written the memos and sat in the meetings this article describes. If a demand letter or an investigative subpoena has landed on your desk, the first few weeks matter a good deal more than they appear to. Reach me through our contact page.

By Michael Cherba, Senior Attorney, Complex Litigation, AEGIS Law