Compliance and internal investigations

At the beginning, the matter to be investigated is defined, as are the affected companies and who may give the mandate. If a report contains allegations against management, it must also be clarified who commissions the investigation and who receives its results.

An investigation plan records which questions are to be answered and which information is needed for them. It must be capable of adjustment to new findings. A matter that is initially narrowly limited can raise further questions; conversely, a suspicion may be refuted by the available documents.

In the evaluation, a distinction must be made between a documented matter, a statement and an assumption that has not yet been reviewed. For example, a payment may be documented while its purpose or the basis for its approval remains open. Only further clarification allows a legal classification.

Before employee data is secured and evaluated, the legal requirements must be clarified. Data protection and participation rights of employee representative bodies belong in the investigation planning. A suspicion does not allow unlimited access to all documents and communication data.

The findings should show what was established, what the findings are based on and which questions remain open. This gives the responsible bodies a basis for deciding on further measures. If the findings concern the responsibility of directors or board members, a separate liability review follows.

In cross-border matters, data, witnesses and decision-makers may be distributed among several companies. The local legal requirements and the responsibilities of the advisers involved must then also be clarified. This concerns, for example, access to documents and their transfer between countries.

Dr. Andreas Lohner assists with cross-border internal investigations. His areas of focus also include D&O liability and compliance management systems.

A policy may require an approval without it being clear in operations who grants it. A business partner may have been checked at the start of the contract although its owners or activities later changed. Such situations show why the actual processes have to be considered when a compliance system is reviewed.

PBL analyzes compliance risks and supports codes of conduct, anti-corruption programs and procedures for business partner reviews. This also includes training for executives, management and supervisory bodies. For an existing system, the work can be limited to a specific process or business area.

An investigation can lead to specific changes: different approval responsibilities, additional checks or adjusted reporting channels. Which measures are appropriate must be derived from the findings and the company's risks.