Internal investigations

A suspicion of misconduct requires an orderly procedure. Internal investigations should identify reliable facts, limit further damage and enable appropriate decisions. At the same time, the rights of employees, whistleblowers and other persons affected must be safeguarded. We assist companies in the planning, implementation and legal evaluation of internal investigations.

Occasions for an internal investigation

• references to bribery, manipulated accounts, conflicts of interest or property damage.
• Disturbances in purchasing, distribution or payments to intermediaries.
• Suspicion of unauthorised data transmission or the flow of trade secrets.
• Inconsistency in a notification or in documents relating to an administrative audit.
• Signs of systematic infringements or involvement of management.

First, clarify the mission and jurisdiction

At the beginning, the contracting authority, the subject matter of the investigation and the reporting channels are defined. In the case of allegations against the management, it is necessary to examine which independent body may commission and accompany the investigation. The interests of society and individual employees may fall apart. A simultaneous representation of all stakeholders is therefore not a matter of course.

A written investigation plan describes the starting points, open questions, data sources, permissible measures and responsibilities. It shall be adjusted if the suspicion is substantiated, defused or extends to other operations. An investigation shall not focus on a predetermined result.

Protection of evidence and data protection

Relevant documents and data should be secured in a comprehensible manner. Access rights, retention periods, deletion procedures and the integrity of the data must be observed. A security instruction does not replace a data protection legal basis. Private content, particularly protected data and foreign storage locations require a separate audit.

For employee data, in particular § 26 BDSG in conjunction with the GDPR must be observed. For the detection of offences, § 26 para. 1 sentence 2 requires documented actual evidence, necessity and proportionality. General curiosity or an indeterminate suspicion do not justify a comprehensive search of all mailboxes. Information obligations, rights and permitted restrictions must be assessed in concrete terms. Technical supervision measures may trigger participation rights of the works council.

Fair preparation of employee surveys

A discussion guide separates open issues from evaluations. Prior to the survey, the role of applicants, the purpose of the interview, the documentation and the use of the information must be clarified. Obligations to provide information, possible risks of self-impact and the use of assistance shall be assessed on a case-by-case basis. Secret sound recordings are not a standard permissible instrument.

Results, measures and contact with authorities

An investigation report should distinguish between verified facts, conflicting information, remaining gaps and legal assessments. It may contain recommendations for organisational changes, labour law steps or the examination of compensation claims. Deadlines, for example in the event of a possible extraordinary termination, must be monitored separately.

Whether and when authorities, insurers or contractual partners must or should be informed depends on the facts and the relevant obligations. Voluntary cooperation must be examined strategically and legally; existing reporting obligations remain to be observed. Legal secrecy does not mean that all investigation documents are automatically protected from state access. Protection of confiscation and rights to refuse certificates shall be assessed on the basis of the specific situation of mandates and procedures.

Our support and work results

• First legal classification of references and definition of a proportionate scope of investigation.
• Investigation plan, concept of responsibility and communication.
• Legal monitoring of data backup and coordination with required IT specialists.
• Preparation and monitoring of interviews as well as structured evaluation of the findings.
• Legal final report and prioritized action plan.
• follow-up and communication with competent bodies within the agreed mandate.

Common questions

Does every clue have to trigger a large-scale investigation?

Nope. First of all, plausibility, urgency and possible consequences are assessed. Sometimes targeted queries or a limited audit of documents are sufficient. The decision and its reasons should be documented.

Can all business e-mails be evaluated?

There is no flat-rate clearance. Purpose, suspicion, necessity, private use, data protection and participation must be examined. Such terms, periods and persons entitled to access should be defined as closely as possible.

Can confidentiality be fully guaranteed?

Nope. Legal information and reporting obligations as well as the rights of affected persons can set limits. Commitments must take this framework into account. The confidentiality of a hotline and the protection of legal documents are different questions.

How can an investigation be prepared?

Helpful are a factual chronology, existing original documents and the designation of previous measures. Relevant data must not be destroyed or altered on its own. Sensitive documents are transmitted via a previously agreed route.

Legal basis and further official information

• § 26 BDSG – Employee data
• DSGVO
• § 87 BetrVG – Co-determination
• BVerfG, decision of 27 June 2018 – 2 BvR 1405/17

Legal status: 1 November 2026. The classification of concrete facts requires an examination of the applicable regulations and circumstances.

Related topics and next steps

• Whistleblower protection and internal reporting channels
• Corruption and conflicts of interest
• Data protection and IT security
• Liability of managing directors and executive board members

Request advice on the contact page. Briefly describe your request and, if necessary, specify existing deadlines. Scope and remuneration will be agreed prior to commissioning.