Internal investigations are becoming increasingly common, but individuals who face consequences as a result may attempt to undermine the findings or challenge the procedures followed in the investigation — including through seeking the protection of the courts.
How do employers find out about improprieties within their company?
Dominika Stępińska-Duch: This still happens thanks to whistleblowers reporting to the person acting as the compliance officer at the company—or through internal communications channels established especially for this purpose, which should allow employees to remain anonymous at least initially. There could also be signals from competitors, customers or suppliers.
In such instances, management—essentially the employer—not wishing the company’s problems to be aired publicly, may decide to conduct an internal investigation. The purpose is first to determine the facts, without an emphasis on drawing consequences. Such an investigation will help catch any irregularities and prevent such events from being repeated in the future.
As demonstrated by examples reported in the media, measures aimed at clarifying matters are often perceived positively by employees, business partners, and public opinion. From the point of view of the company’s image, confirmed or suspected problems cannot be left without a response.
Janusz Tomczak: The model just described is an ideal model but also frequently encountered in practice. The management board is vested with the right and obligation to pursue the interests of the enterprise they are responsible for. The need to determine the nature and causes of irregularities and prevent them from happening again falls within the scope of the management board’s duties.
Problems arise when suspicions fall on members of the management board or other authorities of the company. Getting to the bottom of the matter requires discretion, while actions must be taken within the bounds of the law. These are complex matters requiring a flexible approach to the situation.
How is an investigation conducted?
Dominika Stępińska-Duch: Typically the management board or other authorised body takes a confidential decision appointing a team which will report directly to that authority. Obviously, the actions taken by the investigating team must also be strictly confidential. The standard today is for the team to be made up of lawyers, IT forensics specialists, and possibly also forensic accountants. Without the ability to rapidly analyse computer data, under current business conditions the team’s efforts would be doomed to failure. It is also vital that the forensics team operate under the instructions of a firm of advocates. This is the only solution that guarantees that the entire procedure will be covered by the attorney-client privilege.
All data available to the enterprise or employer are analysed, particularly data found in devices entrusted to staff, such as mobile phones, laptops and pen drives.
Janusz Tomczak: So the standard is to conduct an internal investigation with the participation of external advisers. This is designed to ensure impartiality, and, given that sensitive information is involved which could impact various key aspects of the operations of the organisation, it also ensures confidentiality, including through use of attorney-client privilege attached to the lawyers involved in the investigation.
Sometimes the investigation will conclude with a report containing recommendations with respect to further measures, together with their potential benefits and problems, and so on. But sometimes no official final report is created.
How does such an investigation relate to the protection of employees’ personal data and integrity?
Dominika Stępińska-Duch: That is a delicate issue. We have to be careful not to cross that thin line. The people conducting the investigation must be aware of the boundaries within which they can move. That is why is it important to have someone on the team who knows about employment regulations, data protection, and criminal law. In this aspect as well, the overall confidentiality of the investigation is vital. The chance of documents circulating around the company must absolutely be eliminated. Every person who is questioned in the investigation must be instructed that they have a duty to keep confidential the matters they were questioned about as well as the fact that such an investigation is being conducted at all. Obviously, this is hard. One must be aware that when an outside team comes to the company, even if people are instructed on the duty to maintain confidentiality it is human nature that somehow the news will spread. This can poison the working atmosphere. An investigation that is not handled skilfully can do more harm than good.
Do employees ever complain that their personal interests are being violated?
Dominika Stępińska-Duch: Yes, they do. That’s why the way employees are approached in the investigation is so important. The staff should be brought closer together. If there is no reason to suspect that someone committed a violation, they must not feel that they are under attack. Employees should also, for example, be given the chance to delete private information from secured electronic devices. The people working with the secured material must not analyse private data.
Janusz Tomczak: This is a key issue, because unfortunately we must be aware that individuals who suffer consequences as a result of an internal investigation may attempt to dispute the findings. Both the handling of the investigation and the information and evidence gathered during the investigation can be examined in other proceedings conducted by legal authorities, such as investigations by prosecutors or disputes before the labour courts. Access to the findings of an internal investigation is one of the most debated issues. A person whose employment or managerial contract was terminated may for example claim that the internal investigation was aimed at finding a scapegoat, while the real perpetrators remain untouched. And it cannot be ruled out that such cases do sometimes happen. Looked at from this angle, it is apparent what great responsibility we may bear.
Are many internal investigations conducted in Poland?
Dominika Stępińska-Duch: In some industries internal investigations are already the standard way to deal with a crisis in the company, a necessary element of the restructuring process.
Janusz Tomczak: But this is still the domain of big companies who can afford to hire specialists from different fields, including data analysts, whose fees can be high.
Can’t a company use its own resources to identify the source of irregularities?
Dominika Stępińska-Duch: Outsourcing this activity helps maintain the objectivity of the process. The team entering the company must first familiarise itself with the company’s business culture. We review all internal documents: statutes, bylaws of the board, and procedures. We need to be fully aware of the standards in force at the company and what the employees have really been required to comply with. Often there is a disconnect between what is provided for on paper and the actual views of the managers.
During the investigation we conduct a thorough analysis of the procedures. We interview people we trust, who can help us compare the reality with what is presented in the documents. The more sources of information, and more objective and accurate a picture we obtain.
What if the company has neglected to prepare precise procedures?
Dominika Stępińska-Duch: Then the guidelines for tightening the procedures and amending the current documentation are a positive outcome of the investigation. Such guidelines are indeed a regular feature of the closing report from the investigation. They help the company avoid losses in the future, even if other consequences can’t be drawn in the specific situation.
Janusz Tomczak: It’s essential to be aware that under the Act on Responsibility of Collective Entities for Punishable Offences, a company can be held responsible for failing to have appropriate oversight mechanisms in place. The guilty party may argue that it was the lack of proper controls that was the source of irregularities or even crimes, which might for example be committed by third parties, such as long-term customers and suppliers of the company. This act is rarely applied, but the possibility does exist.
If the investigation is effective, what can the consequences be for the violators?
Dominika Stępińska-Duch: The consequences of an internal investigation can operate across many different levels. In the relationship between the specific employee and the employer, the employment may be terminated, whether by agreement of the parties or through a disciplinary firing. Claims for damages may be a further consequence. The employer could also file a notice of an offence with the prosecutor’s office concerning the prohibited actions of the former employee.
In the relationship between the employer and the remaining employees, the preventive aspect looms large. They get a signal that behaviour conflicting with the interests of the company will not be tolerated. Another step in this area is often a change in procedures and intensive training for staff.
From the point of view of best practice in management, internal investigations allow companies to identify problem areas and change approaches that were not working, and take steps to eliminate the consequences of violations.
Janusz Tomczak: We must anticipate however that the procedure and consequences of internal investigations will be checked in subsequent proceedings—suits filed by fired employees or actions commenced during the internal investigation or as a result of the findings made in the investigation. This forces the team to act with special caution and concern for respecting the rights of the persons affected by the investigation.
Interview conducted by Justyna Zandberg-Malec
