The Corporate Internal Investigation After a Sign of Crime

When an alert is raised in the whistleblowing channel, an auditor spots an accounting discrepancy, or management receives a request from the authorities, the company faces a delicate decision: whether to investigate internally what has happened. The internal investigation is today a central piece of criminal compliance and, well executed, the best evidence that the prevention model works. Poorly executed —violating the employee's rights or gathering evidence without safeguards— it can turn against the company itself and its directors. As a firm that directs corporate internal investigations, we explain its legal framework from a strictly defensive standpoint.

What an Internal Investigation Is and When It Is Triggered

The internal investigation is the procedure, ordered by the company, to clarify potentially criminal acts committed within its area of activity. It is neither a parallel trial nor a substitute for judicial proceedings: its purpose is to find out what happened, assess the organisation's criminal risk, and decide on internal measures and, where appropriate, disclosure to the authorities. It is usually triggered by one of four routes:

• A report through the whistleblowing channel (internal information system).
• An audit or internal-control alert.
• A finding during a due diligence process, typically in an acquisition or restructuring.
• A request from a public authority (the Prosecutor's Office, a court, a supervisory body).

The decision to open the investigation and its precise scope must be documented from the very first moment. Article 31 bis 5 CP itself requires the prevention model to impose the obligation to report and investigate risks and breaches, so failing to act on reasonable indications directly compromises the company's position.

The Legal Framework: Neither Exposure Nor Immunity

There is no single, self-contained statute in Spain governing the internal investigation; its regime is built from several sources worth bearing in mind:

• The Criminal Code (CP) (Art. 31 bis), which links the functioning of the prevention model to the exemption or mitigation of the legal entity's liability.
• Law 2/2023, on the protection of persons who report breaches, which governs the whistleblowing channel and the handling of reports.
• Data protection law (the GDPR and Organic Law 3/2018), which regulates the processing of the investigated person's personal data.
• The Workers' Statute, which delimits the employer's monitoring powers and their limits.
• The fundamental rights of the employee (privacy, secrecy of communications, data protection, the right not to testify against oneself), as interpreted by settled constitutional doctrine and by the case law of the European Court of Human Rights.

The practical consequence is clear: the company may investigate, but not at any cost. Evidence obtained in breach of fundamental rights is null and taints derivative evidence, while also exposing the company to labour and data-protection liabilities.

Rights of the Investigated Employee

An employee subject to an internal investigation does not forfeit their safeguards. An investigation that tramples them is not only unlawful: it is worthless as exculpatory evidence. The essential rights are:

• Privacy and proportionality: any monitoring measure (access to devices, review of records, video surveillance) must pass the triple test of suitability, necessity and proportionality. Indiscriminate searching "just in case" is not permitted.
• Data protection: processing the personal information requires a lawful basis, a specific purpose and the duty to inform, save for the exceptions legally provided for the investigation.
• Information about their status: the employee must be made aware that they are under investigation and of its subject matter, to the extent this does not frustrate its purpose.
• Legal assistance, especially where the internal interview may bear on subsequent criminal proceedings.
• The right against self-incrimination: the employee cannot be compelled, under threat of disciplinary action, to confess a crime. The labour duty to cooperate must be distinguished from the right to remain silent in the face of a criminal charge.

These safeguards do not weaken the investigation: they strengthen it. A finding obtained while respecting the rights of the investigated employee is far more robust before a court than a confession extracted in an interview without safeguards.

Validity of Digital Evidence: Email and Devices

The most contentious point is access to corporate email and the company devices used by the employee. The general rule emerging from the case law can be summarised as follows:

• There must be a prior, clear and known policy on the use of company resources and on the possibility of monitoring. Without a reasonably limited expectation of privacy, monitoring becomes complicated.
• Access must serve a legitimate purpose (investigating a specific indication) and be proportionate: confined to what is necessary in terms of persons, period and keywords.
• Manifestly private communications and the employee's strictly personal accounts enjoy enhanced protection; intervening in them demands particular caution. The case law of the European Court of Human Rights (ECtHR case law on employer monitoring of employee communications) set firm criteria on the monitoring of an employee's communications.
• The forensic chain of custody of digital evidence (acquisition, preservation, integrity via hashing) is decisive: evidence that has been altered or lacks traceability loses its value.

That is why we recommend that the collection be directed by a computer forensics expert under legal supervision, separating what is material evidence —emails, contracts, accounting entries, judicially seizable through independent channels— from the lawyer's work product, which is protected by professional secrecy.

The Whistleblowing Channel and Law 2/2023

Law 2/2023 requires many companies to have an internal information system (whistleblowing channel) and to handle reports with safeguards. Its key features for the internal investigation are:

• Confidentiality of the identity of the reporting person and of those affected, with the possibility of anonymous reporting.
• A prohibition on retaliation against anyone who reports in good faith.
• An independent system manager and a handling procedure with set response deadlines.
• Respect for the presumption of innocence and the defence rights of the person identified, who is also protected by the statute.

An operational, well-run channel is not a formality: it is the orderly gateway to the internal investigation and tangible proof that the prevention model lives beyond paper.

Value for the Exemption Under Art. 31 bis CP

This is where doing things properly truly pays off. Article 31 bis 2 CP allows the legal entity to be exempted from criminal liability if it proves that, before the offence, it had adopted and effectively implemented a suitable organisation and management model, supervised by a body with autonomous powers, and that the individual perpetrator fraudulently circumvented it without any failure of supervision. The internal investigation is the evidence that brings those requirements to life: it shows that the model detects, reacts and cleans house.

Where full exemption does not apply, subsequent cooperation —confessing before learning that proceedings are directed against the company, providing new and decisive evidence, repairing the harm and implementing effective measures— operates as a highly qualified mitigating factor (Art. 31 quater CP), with a possible reduction of one or two degrees in the legal entity's penalty. Disclosing findings to the Prosecutor is therefore not a surrender: well designed, it is a defence tool. Deciding what to disclose, when and in what format is the most delicate strategic call of the entire process.

Mistakes That Ruin an Internal Investigation

• Dumping the employee's entire email without confining the purpose, period or scope: null evidence and a risk of data-protection sanction.
• "Corridor" interviews with no minutes, no information about the employee's status and no opportunity for legal assistance.
• Dismissing before concluding: a premature dismissal or one without safeguards may give rise to labour nullity and undermine the credibility of the whole investigation.
• Confusing audit and legal practice: if whoever directs the investigation does not act as a lawyer, professional secrecy over their work is lost.
• Failing to document the initial mandate, the chain of custody or the decisions taken: what is not recorded does not exist before a court.