The Board Called the Investigation Independent. Now It Has to Prove It.
On November 8, Nvidia's board announced an independent investigation after recent reporting that CEO Jensen Huang had been targeted by a foreign intelligence effort. The board said it had no reason to believe national security or Nvidia secrets were compromised, that a committee of independent directors would oversee the inquiry, and that Huang supported the review and would cooperate. Two days later, the independent directors identified their investigators: former acting U.S. Attorney Joon H. Kim and Wachtell, Lipton, Rosen & Katz. Those are consequential first steps. They are not the conclusion. A board does not make an investigation independent by using the word in a press release or by retaining a prestigious firm. Independence is a structure that must survive the difficult facts, including facts that may involve the person who defines the company in the public mind.
The announcement gets the reporting line right
The two public statements are short, but their sequence is important. The full board first said that a committee of independent directors, assisted by outside independent counsel, would oversee the inquiry. The independent directors then said they had retained Kim and Wachtell to conduct it. That places the client and the investigators on the board side of the management line, where an inquiry that could reach the chief executive belongs.
This is not a finding that Huang or anyone else did anything wrong. Nvidia's statement describes the precipitating concern as recent reporting, says the board has no reason to believe national security or company secrets were compromised, and records Huang's commitment to cooperate. No public statement identifies a legal violation, announces a conclusion, or describes evidence establishing misconduct. The disciplined starting point is therefore procedural: the board has opened an inquiry into available information while expressing confidence in management.
That combination is possible, but it creates a credibility burden. A board can believe in a chief executive and still investigate a risk involving that executive. It cannot allow confidence to narrow the answer before the evidence defines the question. The committee's job is not to validate the board's initial belief. It is to create a process in which an unwelcome answer can reach the directors intact.
The distinction is particularly important at a founder-led company. A founder-chief executive may shape strategy, investor confidence, recruiting, culture, and government relationships at once. That does not make a fair investigation impossible. It makes ordinary deference more dangerous because the subject's institutional gravity can influence witnesses, information flow, and remedial choices without anyone issuing an explicit instruction.
A famous law firm is not a governance system
Outside counsel can supply independence from management, investigative experience, privilege, and a disciplined record. None of those qualities is self-executing. The committee still must decide what counsel may investigate, to whom counsel reports, who can expand the scope, whether management receives interim briefings, and who resolves resistance over documents or interviews.
An older but still useful benchmark comes from the Conference Board's Commission on Public Trust and Private Enterprise. Its 2003 report, hosted by the Securities and Exchange Commission but not itself an SEC rule, recommended that when an investigation is reasonably likely to implicate executives, the board should retain special counsel that reports directly to the board and is not the company's regular outside firm or materially dependent on the company for revenue. The point is not that one historical recommendation governs Nvidia. It is that professional distance has dimensions that a letterhead cannot establish.
The committee should understand every relationship that could matter. Has the firm represented the company, directors, executives, or significant counterparties on related issues? Would the inquiry require counsel to evaluate advice previously supplied by its own lawyers? How material is the client relationship? Do any investigators have personal or professional ties that could reasonably call their judgment into question? Some relationships can be disclosed and managed. Others should change the team or the assignment. Silence is not conflict analysis.
Independence also requires control of the work. Counsel should receive instructions from the independent committee, not a management steering group. Interview order, document requests, forensic work, and the decision to follow a new lead should not depend on approval from people whose conduct may fall within the scope. Management can provide essential facts and logistical help. It should not own the funnel through which the evidence reaches the board.
The mandate must be broad enough to find the real problem
A credible mandate begins with the reported concern but does not freeze there. The investigators need authority to determine what happened, what company information or systems were implicated, who knew what and when, which controls applied, whether escalation obligations were followed, and whether the evidence exposes a different risk from the one described publicly. An investigation that can answer only the board's first question may miss the question the facts actually raise.
That does not mean counsel should conduct an unlimited review of the company. Scope must be connected to risk, evidence, and materiality. It should be written, understood by the committee, and capable of expansion without management consent. The board should also define the relevant period, custodians, systems, communications channels, and foreign or personal devices that may lawfully require preservation or review. If data cannot be obtained, the report should identify that limit rather than convert an access gap into an exonerating absence of evidence.
Preservation is the first practical test. Notices should reach relevant employees and directors promptly. Automatic deletion, ephemeral messaging, device replacement, travel data, access logs, security alerts, and third-party records need separate attention. If the matter crosses jurisdictions, privacy, labor, blocking, and data-transfer rules may affect collection. Those constraints are legal issues to solve and disclose, not reasons to let the record expire.
The Justice Department's corporate-compliance guidance is not a checklist for this particular investigation, and the public record does not establish a criminal matter. It is useful because it asks the operational questions that separate a paper program from a working one: whether a system is well designed, adequately resourced and empowered, applied in good faith, and effective in practice. The same skepticism belongs here. An inquiry should test whether controls worked and whether people could raise concerns, not merely whether policies existed.
Privilege protects the process. It does not prove the result
Boards often retain counsel so legal advice and attorney work product can be protected while facts are collected. That is legitimate. It is also different from public credibility. A company cannot answer every external question by invoking privilege and then ask investors, employees, regulators, and business partners to treat the existence of a privileged investigation as proof that the underlying concern was resolved.
The committee should decide early what it may eventually disclose, who makes that decision, and how disclosure will be supported. Possible outcomes include a public summary, findings on defined questions, changes to controls, personnel action, referral to authorities, or an explanation that the evidence did not substantiate the reported concern. The right choice depends on the facts and legal obligations. But postponing the disclosure strategy until the report arrives invites a fight in which every sentence is evaluated only for litigation risk.
Counsel should preserve the distinction between facts, legal analysis, and recommendations. A board may need to communicate the factual basis for a decision without publishing privileged interviews or legal advice. That becomes easier when the investigation was documented with future accountability in mind. It becomes harder when all information is compressed into a single oral presentation designed to leave no discoverable record.
The board's promise to provide updates as appropriate leaves substantial discretion. That is sensible at the outset. The longer the investigation lasts, the more that discretion should be exercised through a stated principle: update when a development materially changes the company's prior account, when corrective action affects stakeholders, or when silence would make an earlier statement misleading. A timetable is less important than a defensible disclosure rule.
Independence is measured by what the board is willing to do
The hardest part of an internal investigation is rarely collecting the first set of emails. It is deciding what happens when the evidence creates cost. A meaningful process gives the independent committee authority to demand more work, retain specialists, correct earlier statements, strengthen controls, discipline personnel, recommend leadership changes, or refer issues outside the company when warranted. If every available remedy is subject to the approval of the people under review, the investigation is advisory theater.
Boards should also resist two opposite errors. One is treating a lack of substantiation as proof that the reported event was impossible. An investigation can conclude that available evidence does not establish a claim while acknowledging missing data or competing explanations. The other is treating the existence of scrutiny as proof of misconduct. Fairness requires the same precision in both directions.
For lawyers advising an independent committee, the practical questions are concrete. Who is the client? Who can instruct counsel? Can scope expand? Is counsel free of relationships that impair the assignment? Are witnesses protected from retaliation and told whom counsel represents? Are relevant data preserved beyond ordinary retention schedules? Will access limitations be recorded? Can the committee act on the findings? What public statement could the evidence fairly support?
Nvidia has done the visible first part: independent directors retained outside counsel and announced the reporting structure. The next part will happen mostly outside public view. That is normal. It does not make process details unimportant. The word independent is ultimately a claim about who controls the questions, who receives the answers, and whether the institution can respond when the answer is inconvenient. The board has used the word. The investigation now has to earn it.
Sources and further reading
Primary and industry sources used to support this page. External guidance should be reviewed in context and for your jurisdiction.
- Nvidia Board of Directors, November 8 statementThe board's official announcement of the inquiry, its independent-director oversight, its statement that it has no reason to believe secrets or national security were compromised, and Huang's commitment to cooperate.
- Independent members of Nvidia's board, November 10 statementThe official identification of Joon H. Kim and Wachtell, Lipton, Rosen & Katz as the outside investigators.
- Nvidia corporate-governance documentsThe company's published governance policies, committee charters, code documents, bylaws, and related board materials.
- U.S. Department of Justice, Evaluation of Corporate Compliance ProgramsSeptember 2024 guidance on whether compliance structures are designed, resourced, empowered, applied in good faith, and effective in practice. Cited as a general operational benchmark, not as a finding about Nvidia.
- U.S. Department of Justice, Principles of Federal Prosecution of Business OrganizationsCurrent Justice Manual principles concerning corporate self-policing, compliance, remediation, and the difference between a program's existence and its practical effectiveness.
- Conference Board Commission on Public Trust and Private EnterpriseA 2003 commission report, hosted by the SEC but not an SEC rule, recommending board-retained special counsel that reports directly to independent directors when executives may be implicated.