Internal Investigations – When Are They Necessary And How Are They Carried Out?

Internal investigations are a key part of companies’ risk management, compliance activities, and responsible leadership. When suspicions of misconduct, harassment, or non-compliance arise within an organisation, an internal investigation is often essential.

What Is an Internal Investigation?

The matters under investigation in internal investigations often relate to serious and sensitive issues, which naturally sets a high standard for the investigation. Investigations may, for example, concern activities that contravene regulations or guidelines or a breach of contract. It is essential that internal investigations are conducted independently, objectively, thoroughly, and efficiently.

Internal investigations comprise a rather diverse range of different enquiries, and they may differ significantly from one another in terms of their purpose, scope, and complexity, among other things. Occasionally, investigations may be very limited in scope and concern a single incident and individual. On the other hand, investigations may sometimes be a wide-ranging exercise, extending across several geographical areas and affecting different business areas and numerous individuals within a company.

In internal investigations, it is important to bear in mind that, although the investigation process is confidential, the potential interest of the media should not be underestimated. Particularly, in more serious cases or those with wider implications, the matter may quickly become public knowledge, in which case the company will also have to respond to external expectations and questions. The need for internal communication must also always be assessed on a case-by-case basis, taking into account confidentiality and data protection requirements. For this reason, it is advisable to prepare for communication proactively, both internally and externally. Well-planned communication supports the smooth conduct of the investigation and helps manage potential risks, including from a PR perspective.

Properly conducted investigations help organisations identify challenges, minimise reputational damage and material losses, and implement corrective measures. The process can boost internal and external confidence in a company and strengthen its ethical operating culture. Conversely, a poorly executed process can erode the trust an organisation has built up, which may have taken decades to establish.

When Is an Internal Investigation Required by Law?

Many companies define in advance how and by whom various suspicions and reports are to be investigated. The procedures set out in a company’s code of conduct guide the course of the investigation and ensure that matters are dealt with consistently and appropriately. The need for an investigation may arise from a company’s own requirements, but often applicable regulations also require that reports and suspicions of misconduct be investigated. For example, the Finnish Whistleblower Protection Act (1171/2022), the Finnish Occupational Safety and Health Act (738/2002), and the Finnish Non-Discrimination Act (1325/2014) oblige companies to investigate certain types of notifications and suspected misconduct.

In accordance with the Finnish Whistleblower Protection Act, the person responsible for handling a report must take the necessary steps to verify the accuracy of the report. The Finnish Occupational Safety and Health Act obliges employers to identify and eliminate work-related hazards and risks. If an employer becomes aware of inappropriate treatment of an employee, they must take action to remedy the situation. Furthermore, under the Finnish Non-Discrimination Act, an employer’s conduct is deemed to constitute discrimination if it has failed to take the measures at its disposal to put an end to the harassment after becoming aware that an employee has been subjected to harassment at work.

If a company and its responsible persons fail to act appropriately in a situation where an investigation is required, claims for compensation may be brought against them, or they may even face criminal liability.

How Does an Internal Investigation Proceed?

There is no single ‘correct’ model for internal investigations — nor would such a model be practically feasible given the diversity of situations. It is therefore advisable to structure the investigation process around a clear basic framework that can be flexibly adapted and supplemented as required.

1. The company is notified of the matter, or the company itself detects the irregularity.
2. A written action plan is drawn up, setting out the investigation’s timetable, subject, scope, composition of the investigation team, and the methodology used. It is often necessary to update the plan as the investigation progresses.
3. Documentary evidence is gathered, individuals are interviewed, regulations and internal guidelines are analysed, and a risk assessment is carried out where necessary.
4. A written report is drawn up, setting out the conclusions of the investigation and recommendations for action. These may include, for example, measures under employment law, notifying authorities (such as a request for an investigation by the police or a report to the Data Protection Ombudsman), identifying staff training needs, and updating or supplementing internal guidelines and processes.

Attorney as an Internal Investigator — When and Why?

In principle, companies are free to decide how internal investigations concerning them are to be conducted. In practice, however, situations may arise where it is appropriate to outsource the investigation, either in full or in part, or where it is necessary to supplement the investigation team with an external expert.

• Attorney–client privilege: Having an attorney as the investigator brings significant benefits to the company, not least because the attorney–client privilege safeguards the confidential relationship between the attorney and the company. This can prove to be extremely important should a party to the investigation, an opposing party in a dispute, or a public authority wish to use, for example, the final report of the investigation against the company in other proceedings.
• Legal expertise: Internal investigations often involve complex legal issues even during the process itself, but particularly when the subject of the assessment is non-compliance with regulations and the associated recommendations for legal action. Furthermore, the various parties involved in an investigation may bring their own legal advisers into the process, which in turn adds to the overall complexity.
• Resources: Internal investigations are often expected to be conducted swiftly, but the process can be extensive and complex. Consequently, the investigation may require a considerable amount of resources, particularly within a short timeframe, which an external investigator can provide.
• Independence: An attorney may be a justified choice as an investigator to ensure the independence of the investigation. An internal investigation into sensitive matters may create tensions within a company, in which case an external investigator can help to ensure the objectivity of the investigation and the continuity of cooperation after the investigation has concluded.
• Reliability: Using an external party as the investigator can also be seen as a factor that enhances the reliability and credibility of an investigation. An investigation conducted solely using a company’s internal resources is rarely the most appropriate solution in situations where the investigation targets the company’s senior management, the board of directors, or the body normally responsible for conducting internal investigations.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.