Suspicious circumstances within a company – whether based on an internal tip-off, irregularities in the accounts or media reports – can quickly develop into criminal law issues. This raises a key question for management, compliance officers and supervisory bodies: Do I have to initiate an internal investigation? This immediately raises further considerations, such as: How far can internal investigations go – and at what point is there a risk of engaging in criminal behaviour yourself? This article provides a practical overview of internal investigations from the perspective of Austrian criminal law and shows how a solicitor can help companies minimise risks while maximising the effectiveness of lawful investigative measures.
What is an internal investigation – and what is its purpose?
An internal investigation is a structured review of possible legal, regulatory or compliance violations within a company. It is carried out by private individuals (companies, external consultants) – without sovereign powers and without coercive measures such as house searches or seizures (e.g. of mobile phones).
Typical triggers for internal investigations include:
- Reports from whistleblowing systems,
- Discrepancies in financial accounting or controlling,
- Information from employees, customers, suppliers or business partners, or
- Negative press reports or enquiries from authorities.
In corporate criminal law, internal investigations particularly often concern suspicions in the area of corruption (Sec 302 – 309 of the Austrian Criminal Code, StGB), embezzlement (Sec 153 StGB), fraud (Sec 146 StGB), document or data falsification (Sec 223 – 225a StGB) or other breaches of duty relevant under criminal law.
The purpose of an internal investigation is to objectively clarify the allegations made, which also serves to assess the personal criminal liability of the persons concerned and the corporate liability of the company under the Corporate Liability Act (VbVG). Furthermore, in the course of the investigation, consequences under labour, company and civil law are often prepared and the compliance management system is improved.
Is there an obligation to conduct an internal investigation?
There is no explicit legal obligation to conduct internal investigations in the area of criminal law. At the same time, failure to initiate an internal investigation can have both civil and criminal consequences for the company and its executives as well as the compliance officer.
In certain areas – particularly in regulated industries – investigation obligations arise from special laws (e.g. in financial market and capital market law). In addition, the Whistleblower Protection Act (HSchG) stipulates that incoming reports within the scope of this law must be subjected to a validity check and, if necessary, follow-up measures must be taken.
In this context, company law regulations must also be observed: in accordance with the general duties of care of the management (Sec 25 of the Austrian Act on Limited Liability Companies, GmbHG), Sec 84 of the Austrian Stock Corporation Act (AktG), the company management must also observe the business judgement rule. Accordingly, the company management is obliged to make decisions on the basis of sufficient information and to follow up on concrete suspicions with appropriate measures.
Advantages for the company as a result of an internal investigation
Under the Corporate Liability Act (VbVG), companies can be held liable if decision-makers or employees commit criminal offences for the benefit of the association (Sec 3 para 1 nr 1 VbVG) or thereby violate association obligations (Sec 3 para 1 nr 2 VbVG).
Carefully conducted internal investigations can:
- form the basis for active repentance (Sec 167 StGB) or a voluntary disclosure (Sec 29 of the Austrian Fiscal Penal Code, FinStrG) and
- be the starting point for asserting claims against the direct perpetrators, for example by means of a voluntary statement of facts combined with a private party claim.
- be viewed positively by the public prosecutor’s office (prosecution discretion pursuant to Sec 18 VbVG, diversion pursuant to Sec 19 VbVG).
Typical course of an internal investigation in practice
The scope and depth vary depending on the industry, company size and circumstances of the case. In practice, a multi-stage approach has become established:
Step 1: Plausibility check and initial assessment
The following questions arise at the outset: Is the suspicion credible? How concrete is the information? Are there objective indications (e.g. documents, data, emails)? How serious would the consequences be if the allegations were true? Are there any deadlines (limitation periods, labour law deadlines, insurance notifications)?
Only when concrete suspicion arises should a structured internal investigation be initiated. The question of when this is necessary is often unclear to managing directors and corporate lawyers. If necessary, it is advisable to consult specialised experts.
Step 2: Immediate measures and preservation of evidence
When an internal investigation is launched, the investigation team takes certain immediate measures to prevent further damage and secure evidence.
This may include securing email accounts and electronic documents, temporarily blocking payment and account authorisations, and securing laptops, mobile devices and physical files.
The principle of proportionality always guides the entire internal investigation: restrictions on the rights of the employees concerned are only permissible to the extent that they are justified by a legitimate interest of the employer in monitoring. The least intrusive of the available means that still achieves the desired purpose must always be chosen. In terms of data protection law, it is particularly important to note that in all stages of the investigation, the employer’s legitimate interest in clarifying the allegations must outweigh the individual interests of the employee.
Step 3: Data backup and document analysis – with criminal law restrictions
When securing and evaluating data, criminal law prohibitions must be observed in addition to data protection aspects. The following criminal offences can be affected, among others:
- Breach of privacy of letters and suppression of documents (Sec 118 StGB),
- Unlawful useof to a computer system (Sec 118a StGB),
- Breach of telecommunication confidentiality (Sec 119 StGB),
- Improper interception of data (Sec 119a StGB) and
- Improper use of audio recording and listening devices (Sec 120 StGB).
In the course of the internal investigation, individual members of the investigation team may be at risk of criminal liability in connection with the criminal offences listed above.
Examples:
- By opening a sealed letter addressed to an employee and marked “personal” on the envelope, a member of the investigation team may be liable to prosecution under Sec 118 StGB.
- By secretly installing monitoring software on an employee’s computer, messages sent by that employee are to be recorded and thus further incriminating material secured. However, the recorded messages are not intended for any member of the investigation team and less intrusive means would be available. The offence under Sec 119 StGB is fulfilled.
- If the email review goes far beyond what is necessary, for example by reviewing private communications even though this is not necessary for the internal investigation, Sec 120 para 2a StGB may also be fulfilled.
Step 4: Employee interviews
Interviews with employees are a key tool in any internal investigation. Ideally, they provide background information and context on the allegation, insights into internal processes and decision-making, and clues to further evidence or allegations.
In principle, employees have a duty to cooperate in such interviews due to their duty of loyalty to their employer under labour law. However, particular caution is required here: unlawful pressure and threats (e.g. with dismissal or termination) in the context of an employee survey by members of the investigation team can lead to criminal liability for coercion (Sec 105 StGB) or dangerous threats (Sec 107 StGB). On the other hand, it is permissible to point out the possibility of active repentance (Sec 167 StGB) or to suggest compensation for damages.
Step 5: Investigation report and legal opinion
At the end of an internal investigation, a clearly structured result should be available. On the one hand, an investigation report must be prepared in which the facts are presented objectively, the investigation steps taken are documented in a comprehensible manner, and the evidence and key findings are summarised. On the other hand, a legal opinion should be issued that assesses the criminal law aspects, examines possible grounds for exemption from punishment (such as active repentance or a voluntary disclosure under criminal tax law) and analyses the consequences under labour, civil and corporate law.
In addition, an internal investigation offers the opportunity to make specific recommendations for the further development of the compliance management system. This makes the investigation not only a review of past events, but also a preventive tool that sustainably strengthens the company’s Compliance.
Reporting to law enforcement authorities: When must companies take action?
Private companies and individuals are generally not obliged to inform the authorities about crimes that have already been committed. In many cases, companies are therefore free to decide whether to report a crime.
The legal situation is different if someone becomes aware of an imminent or already commenced criminal offence punishable by more than one year’s imprisonment. In such cases, there can be a legal obligation to help prevent the offence or to notify the authorities (Sec 286 StGB).
For management and compliance officers, the guarantor position under Sec 2 StGB is also particularly important. Persons who, due to their position, are obliged to prevent criminal acts or their success may make themselves liable to prosecution for inaction – for example, for breach of trust by omission (Sec 2, 153 StGB) – if a known suspicion is not prevented and the corresponding acts continue to be carried out by other employees.
How can a criminal lawyer assist with internal investigations?
In many cases of internal investigations, it is advisable to involve a lawyer specialising in criminal law at an early stage. They will classify the suspected case under criminal law and provide essential support to the decision-making bodies in selecting the optimal strategy. In addition, they protect the company management, employees and the company itself by checking individual investigation steps in advance for their legal admissibility, professionally conducting employee interviews and ensuring that members of the investigation team do not commit any criminal offences themselves.
If criminal proceedings have already been initiated, the lawyer also acts as the central point of contact with the investigating authorities, coordinates any contact and ensures consistent and professional communication with the public prosecutor’s office and the criminal investigation department.
Finally, a lawyer can also assist in implementing improvements to the compliance management system based on the findings of the internal investigation. Such measures not only have a positive effect in possible corporate criminal proceedings, but also make a significant contribution to the effective prevention of future legal violations within the company.
