Of the three pillars of prevention, detection and response (prevention, detection and sanction) found in every compliance model, two pillars relate to how companies or organisations deal with past violations of the law or with suspicions of such violations. How are suspected cases identified? How are suspicious cases investigated?

Today there is agreement that compliance in a company or organisation can only exist if legal violations are also sanctioned. One cannot speak of a compliance culture if legal or regulatory violations are swept under the carpet simply because the effort and consequences of clarification are shied away from. Measures to clarify suspicious cases are noticed in the environment, have a deterrent effect on potential offenders and strengthen the trust of managers and employees in the management of their own organisation.

The law on administrative offences and especially the law on association sanctions link positive legal consequences to professionally conducted internal investigations. Knowing what this means is part of preparing for the worst.

Legal obligation to conduct internal investigations

Internal investigations of suspected cases are not only a question of expediency, but in many cases a legal obligation. There is a legal obligation to investigate whenever a suspected violation of the law results either in risks for the future (danger of continuation) or in claims for compensation against the perpetrator or parties involved. The violation of this legal duty may itself constitute a legal violation.

In particular, the supervisory duties of supervisory bodies (exemplified by the regulations of the German Corporate Governance Code on the obligations of the supervisory board of listed stock corporations) extend to the guarantee of compliance in the company or organisation by the supervised management body (executive board of the listed stock corporation, to be applied accordingly to the facultative supervisory board of a GmbH). If a supervisory board were to allow it to pass that an executive board does not take steps to clarify matters despite knowledge of suspicious cases, the supervisory board itself would be placed in a liability risk.

Criminal charges not an alternative

In most cases there is no alternative to internal investigations to clear up suspicious cases. This applies in particular to the filing of criminal charges, which can, however, be a means of clearly showing how suspicious cases are dealt with. Filing a criminal complaint may also be necessary if internal investigation options have been exhausted. However, since investigating authorities rely on internal information anyway, it is also in line with the desire of companies and organisations to be able to control the process of investigation and not to leave things in the hands of others too early or completely.

Standards of internal investigations

Internal investigations of suspicious cases require careful project planning (which investigative actions should take place in which order), which presupposes criminological and criminal tactical experience. This is not part of the tools of the trade of internal auditing, but it may be assumed that lawyers specialising in criminal law have experience in this field.

Above all, internal investigations require careful legal assessment of the individual investigative actions so that specific legal requirements (of labour law, criminal law, data protection law) are met. Standards have been developed in recent years that must be observed. If they are not observed, internal investigations can represent wasted effort and even a risk themselves.

Failure to meet standards means risk of unusability

If the legal requirements for internal investigations are not observed, such an endeavour is doomed to failure. What use is the result of an investigation (there are stolen goods in the employee's opened locker) if the labour courts find that the investigative measure is disproportionate under data protection law and rule that it cannot be used? What use are allegedly confessed statements by an employee who has not been properly informed of his rights and then claims that his statements cannot be used? What is the use of the best investigation results if the responsible data protection commissioner then raises the accusation in the context of fine proceedings that unauthorised personal data were processed?

Experience and expertise

FS-PP Berlin have the expertise and practical experience from specific mandates to plan, manage and conduct internal company investigations themselves. The partnership has the expert knowledge and also the personnel capacities to be able to act quickly and effectively. After all, speed is of the essence when a suspicious case has arisen.

Keywords in this context are: Project planning, creation of a data protection concept, interviews in compliance with the requirements set by the German Federal Bar Association, standardised interview protocols with comprehensive instructions that ensure both the usability under labour law and criminal law, ongoing documentation of all investigative steps, appropriate reporting according to the client's needs, the highest protection of the client's data and the highest discretion in all steps.

FS-PP Berlin is recommended by practitioners for compliance investigations (Juve 2021/2022).



Dr. Rainer Frank

Dr. David Albrecht