Internal InvestigationsClarify, Know Limits, Address Causes

A report to the whistleblower hotline, a suspicious transaction, a broken cabinet in the warehouse: At some point, almost every company faces the suspicion that someone has violated laws or internal rules. Internal investigations clarify such suspicions before authorities, courts, or the public do. When properly conducted, they achieve more than just identifying a perpetrator: they reveal why a violation was possible and provide the basis for effective prevention. This article explains what companies are allowed to do, where the limits lie, and which opportunities often remain untapped.

Briefly Explained

Internal investigations in five points

• Internal investigations are the clarification of a suspicion of misconduct by the company itself, with its own experts or with external support.
• They secure evidence, limit damage, and adhere to employment law deadlines that can easily pass without structured clarification.
• Companies do not have state powers. Data protection, co-determination by the works council, and fair interviews set clear boundaries.
• An outcome is only admissible in court if traces are cleanly secured and documented from the outset.
• The greatest benefit lies beyond the individual case: in questioning what causes made the misconduct possible and in a prevention concept that eliminates these causes.

Definition and Occasions

What internal investigations are and when they begin

Internal investigations, known in English as Internal Investigations, involve the systematic clarification of a specific suspicion of rule violations within an organisation. The client is the company, usually the management, the compliance function, or the audit department. They are conducted by in-house experts, specialised investigators, forensic experts, and lawyers, or by a mixed team.

They fundamentally differ from state criminal investigations: police and public prosecutors investigate to prosecute crimes and have sovereign powers to do so. The company investigates to understand a situation, avert damage, and decide on consequences. Both can run in parallel, and the results of an internal investigation often end up with the authorities.

Typical triggers include:

• Reports via the whistleblower system. The Whistleblower Protection Act explicitly mentions internal investigations as a follow-up measure of the internal reporting office (§ 18 No. 1 HinSchG).
• Irregularities from audits, controlling, financial audits, or data analyses
• Corruption, embezzlement, fraud, theft, and time theft
• Break-ins, property damage, and sabotage, including insider involvement
• Requests or searches by authorities and reports from the press
• Discrimination, harassment, and other breaches of codes of conduct

Benefits for Companies

Why it pays to investigate internally

Companies that do not investigate a suspicion themselves leave the interpretation of the situation to others. Figures from the Association of Certified Fraud Examiners (ACFE) show what is at stake: In the report Occupational Fraud 2026, 2,402 cases from 143 countries were evaluated. The median loss per case was 104,000 US dollars, it typically took twelve months to discover, and 43 percent of cases were uncovered through tips, more than half of which came from employees.

This results in the main advantages of a professional internal investigation:

• Limit damage. The sooner a violation is understood, the quicker payments can be stopped, access blocked, and claims secured.
• Meet deadlines. For summary dismissal, only two weeks remain from sufficient knowledge (§ 626 para. 2 BGB). A suspicion-based dismissal also requires that the affected person was heard promptly, generally within about a week according to the Federal Labour Court.
• Secure evidence. Traces are erased, items removed, memories fade. Those who secure early retain the ability to stand in court later.
• Fulfil management duties. Failing to take supervisory measures risks a fine under § 130 OWiG; the company itself can face up to ten million euros under § 30 OWiG. A government draft from 2026 envisages higher limits and intends to explicitly consider compliance and post-offence behaviour, such as internal investigations and rectifying weaknesses, in the assessment. This has not yet been enacted.
• Demonstrate credibility. Employees, customers, and authorities see that tips are taken seriously. This strengthens trust in the reporting office and thus the most important source for detecting violations.
• Identify causes. Only those who understand how a violation could occur can prevent it from happening again.

Limits

What companies can and cannot do

A company is not an investigative authority. It may not search private premises, confiscate items, tap phones, or force anyone to testify. What is permissible is determined by employment law, data protection law, and works constitution law, and the limits are narrower than many assume.

This overview does not replace legal advice. Legal support is essential from the outset in any investigation with employment or criminal law implications.

Evidence Preservation

Physical and Testimonial Evidence that Holds Up in Court

Whether a result will later hold up in an employment or criminal court is often determined in the first few hours. The most common mistake is well-intentioned: a manager examines the broken cabinet themselves, tidies up the storage area, or questions colleagues in the corridor. After that, it is hardly possible to prove what traces were originally present and what the parties involved actually perceived.

Criminalistics distinguishes between two types of evidence: physical evidence, i.e., traces and objects, and testimonial evidence, i.e., statements from witnesses and participants. Both require their own diligence. For physical evidence, the following applies:

• Secure the location before anyone alters it. Seal off, regulate access, do not touch or tidy up. Any unavoidable changes are noted.
• Document before securing. Photos in overview and detail with scale, a sketch, and a record with time and involved persons.
• Know the types of traces. Break-in and tool marks on doors, windows, and containers, fingerprints (dactyloscopic traces), DNA traces, shoe and fibre traces, as well as situational and object traces that reveal the sequence of events.
• Avoid contamination. Wear gloves, package each trace separately, label and seal. Anyone who touches or breathes on a DNA trace leaves their own.
• Document the chain of custody. Who secured, handed over, and examined what and when? Gaps in this chain are an entry point for doubt.
• Realistically assess the evidential value. A fingerprint shows that someone touched an object, but not when and why. Each trace has its own evidential value and limitations.
• Obtain independent expert opinions. A court-admissible expert report describes the task, method, findings, and limitations of the statement so that third parties can understand and verify it.

For testimonial evidence, the following applies:

• Interview early and separately. Memories fade and align with each other in conversations.
• Let them report first, then ask questions. Ask open questions, avoid leading questions, and make confrontations only at the end.
• Record promptly and accurately. What was said is recorded separately from what the interviewer concludes from it.
• Match statements with traces. Where statement and physical evidence align, a reliable picture emerges. Contradictions are noted, not smoothed over.

Taking fingerprints, DNA, or tool marks should be left to trained professionals, such as the police or experts. Companies play a crucial role beforehand: protecting the site, documenting it, and not altering anything. The workshop Analogue Evidence Preservation teaches how to identify, protect, and assess evidence; the Interview Training focuses on questioning witnesses and participants.

From Individual Case to Prevention

The Opportunity Many Companies Miss

Many internal investigations conclude once the perpetrator is identified: dismissal, criminal complaint, case closed. This is appropriate for the individual case. However, the underlying issue often remains unaddressed. Misconduct rarely occurs in a vacuum; it arises where opportunity, pressure, and justification converge. This fraud triangle is based on the research of criminologist Donald R. Cressey. Criminologists Gresham Sykes and David Matza described how individuals justify their deviant behavior to themselves: „It doesn’t harm anyone,“ „The company owes me this,“ „Everyone here does it.“

Such patterns are not characteristics of individuals but are often part of the organization: incentive systems that only reward results, controls that anyone can bypass, leaders who look the other way, and a culture where whistleblowing is seen as disloyalty. The ACFE Report 2026 shows how visible the warning signs usually are: 84 percent of perpetrators exhibited at least one behavioral trait before being discovered. In more than half of the cases, internal controls were absent or overridden.

Here lie the opportunities that companies often do not exploit:

• Root cause analysis after each case. Not just asking who did it, but how it was possible, why it went unnoticed for so long, and who could have noticed it.
• Recognizing patterns across cases. Evaluate hints, audit findings, and incidents together. Individual cases from the same department, process, or with the same justification pattern indicate a structural problem.
• Sharpening controls strategically. According to ACFE, management reviews, proactive data analysis, and unannounced audits are associated with lower losses and faster detection.
• Training and raising awareness. Where employees and managers were trained, the median loss was 84,000 USD, compared to 150,000 USD without training.
• Addressing leadership and culture. A prevention concept only works if management leads by example and whistleblowers are protected.
• Integrating into risk management. The insights belong in the risk analysis and process evaluation, not just in the personnel file.
• Checking effectiveness. After a few months, review whether the measures are effective and document the results.

This transforms a single investigation into a contribution to the organization’s resilience: the company learns from the incident instead of merely closing it.

Procedure

An Internal Investigation in Six Steps

1. Initial assessment. Is the tip-off plausible and specific enough? Which legal areas, individuals, and deadlines are affected? The suspicion and its indications are documented.
2. Mandate and team. Management defines scope, objectives, and responsibilities. The team is independent of those involved; legal advice, data protection, and, if necessary, the works council are involved early.
3. Preservation. The scene is secured; traces, documents, and items are documented and preserved before anyone alters them.
4. Evaluation and interviews. First traces and documents, then witnesses, lastly the affected person, with caution and record.
5. Report and decision. The report separates established facts from evaluations. Consequences are decided not by the investigation team but by the responsible authority.
6. Consequences and prevention. Employment law actions, criminal complaint, compensation, and above all: address causes, adjust controls, check effectiveness. Crisis management structures assist with internal and external communication.

In Conversation

Dr. Torsten Huschbeck on Investigations, Evidence, and Expert Reports

Dr. Torsten Huschbeck is a member of the NOVELEDGE network, specialising in internal investigations, evidence preservation, and court-admissible expert reports. As a lecturer and consultant, he combines risk and security management with research and teaching; he is the editor of the NOVELEDGE journals Risks & Policing and Kriminalistik & Kriminaltechnik.

Dr. Huschbeck, when should a company involve external investigators in case of suspicion?

Whenever the outcome needs to hold up later: before the labour court, to authorities, or to an insurance company. This is the case as soon as criminal consequences are possible, evidence needs to be preserved at the scene, or if management might be involved. Internal teams know the company well, but they often lack the distance, forensic tools, and experience in handling evidence.

My rule of thumb: it’s better to get a brief initial assessment in the first few days than to have to explain weeks later why the evidence is no longer salvageable.

What mistakes in the early days of a suspicion case most often make later evidence gathering impossible?

The most common mistake is well-intentioned actionism. A manager inspects the broken cabinet themselves, tidies up, or handles items. In doing so, fingerprints are smudged, DNA traces are overlaid, and tool marks are damaged, making it impossible to prove what was originally there.

Equally problematic is confronting someone too early. Those who are warned remove traces or collude with others. Added to this are too many people in the know and ongoing routines: the cleaner cleans the room, the caretaker replaces the damaged lock, and the most important piece of evidence is lost. And almost always, there is a lack of documentation of who knew what and when, and what actions were taken.

What distinguishes court-admissible evidence preservation from what many companies do internally?

The difference is not just in the tools, but in the method, integrity, and documentation. We photograph the scene before anything is altered, secure each piece of evidence individually, package and label it, and record who took custody of it and when. The chain of custody remains intact, and collection and analysis are clearly separated.

Internally, I often see mobile phone photos without scale, handled items in a plastic bag, or interviews that no one has documented. This may suffice for an initial overview, but in court, the opposing side will focus precisely on these points: Is this really the original condition, and who had access in the meantime?

How should an expert report be structured to withstand scrutiny in court?

A robust expert report begins with a clear question. It then describes the subject of the investigation and its origin, the methods and tools used, and the findings. Evaluations are kept separate from the facts, and the limitations of the statement are openly acknowledged, including possible alternative explanations.

The standard is traceability: Another expert must be able to reach the same conclusion with the same evidence and documents. An expert answers the questions impartially. They do not deliver the result the client desires, and the legal assessment remains the court’s responsibility.

In your view, where are the limits of what companies are allowed to investigate themselves?

Companies do not have investigative powers like the police. They are not allowed to search private premises, eavesdrop on conversations, or exert pressure on individuals. Data protection, proportionality, the rights of the works council, and the personal rights of employees set clear boundaries. Covert surveillance without specific suspicion is not only legally risky, it also destroys trust.

Whether and when law enforcement authorities are involved should be a conscious decision made by management with legal advice. Good internal investigations and state investigations are not mutually exclusive. Properly secured evidence is helpful in both proceedings.

Many investigations end with the dismissal of the perpetrator. What is lost in the process?

Primarily the knowledge of how the act was possible. With the dismissal, the individual case is closed, but the opportunities, control gaps, and sometimes even accomplices remain. Deviant behaviour is rarely just a trait of individual persons. It arises where pressure, opportunity, and a suitable justification come together, and often where minor rule violations have been tolerated for a long time.

Simply replacing the perpetrator also sends the wrong signal: The problem is solved, nothing needs to change. This is precisely when we see similar cases reappear after some time.

What warning signs of deviant behaviour are most often overlooked in organisations?

The warning signs are usually present, they just appear in different places. A lifestyle that does not match income, refusal to take holidays or delegate tasks, conspicuously close relationships with certain suppliers, resistance to controls, processes that only one person truly understands, and repeated exceptions that are „necessary this time.“

Each of these signals can be harmlessly explained when viewed individually. Only together do they form a pattern. The problem in many organisations is that HR, procurement, IT, and audit do not consolidate their observations.

What does an effective prevention concept look like?

An effective concept does not start with a catalogue of patterns, but with the organisation’s own risks and the causes of previous cases. This leads to measures that reduce opportunities: the four-eyes principle at the right points, representation and rotation, clear authorisations, and regular data analyses.

Equally important are a whistleblower system that employees truly trust, training with realistic scenarios instead of slide presentations, and leaders who adhere to the rules themselves. This includes a defined procedure for cases of suspicion, so no one has to improvise in an emergency. Finally, effectiveness is regularly reviewed, not just implemented once.

What advice would you give to management receiving a specific tip-off today?

Stay calm and keep the circle of those involved small. Do not evaluate anything yourself and do not confront the person involved prematurely. Record in writing when and how the tip-off was received. This is crucial for employment law deadlines.

Then promptly seek legal and forensic support and secure the location before anyone alters anything. Protect the whistleblower. And prepare communication, both internally and externally. The first few days determine whether a robust result is achieved in the end.

Frequently Asked Questions

Brief answers for practical application

Further Reading

In-depth Information and Support

• Network Profile Dr. Torsten Huschbeck
• Workshop on Analogue Evidence Preservation
• Interview Training
• Firearms and Gunshot Residue (for authorities only)

Sources

• § 18 Hinweisgeberschutzgesetz (HinSchG), Follow-up Measures of the Internal Reporting Office: gesetze-im-internet.de
• § 26 Bundesdatenschutzgesetz (BDSG), Data Processing for Employment Purposes: gesetze-im-internet.de
• § 87 Betriebsverfassungsgesetz (BetrVG), Co-determination Rights: gesetze-im-internet.de
• § 626 Bürgerliches Gesetzbuch (BGB), Immediate Dismissal for Good Cause: gesetze-im-internet.de
• §§ 30 and 130 Gesetz über Ordnungswidrigkeiten (OWiG), Fines Against Legal Entities and Breach of Supervisory Duty: gesetze-im-internet.de
• Court of Justice of the European Union, Judgment of 30.03.2023, C-34/21 (Main Staff Council of Teachers): curia.europa.eu
• Federal Labour Court, Judgment of 29.06.2023, 2 AZR 296/22, Open Video Surveillance and Prohibition of Use: bundesarbeitsgericht.de
• Federal Labour Court, Judgment of 04.12.2025, 2 AZR 55/25, Start of the Period According to § 626 Para. 2 BGB and Hearing in Case of Suspicion Dismissal: bundesarbeitsgericht.de
• Federal Constitutional Court, Decision of 27.06.2018, 2 BvR 1405/17 et al., Securing Documents of an Internal Investigation
• German Bundestag, Government Draft to Amend the Law on Administrative Offences, BT-Drucksache 21/6133 of 26.05.2026
• Association of Certified Fraud Examiners (ACFE): Occupational Fraud 2026. A Report to the Nations. 2026: acfe.com
• Cressey, Donald R.: Other People’s Money. A Study in the Social Psychology of Embezzlement. Glencoe 1953.
• Sykes, Gresham M.; Matza, David: Techniques of Neutralization. A Theory of Delinquency. American Sociological Review 22 (1957), Issue 6, pp. 664–670.