We design and manage your internal compliance investigations protocol: alert analysis, evidence collection, interviews, reporting to the control body and closure in line with the Whistleblower Protection Law. Rigor, confidentiality and legal safeguards.
Free consultation
We reply within 24 h
Six workstreams to manage internal compliance investigations with legal rigor, evidence traceability and safeguards for the company and the people under investigation.
Drafting the internal compliance investigations protocol: opening an investigation, assigning the investigating team, deadlines, confidentiality and safeguards for the people under investigation.
Implementing and managing the whistleblowing channel under Law 2/2023, the Whistleblower Protection Law: receipt, acknowledgment, initial assessment, the decision to investigate and communication with the whistleblower.
Obtaining, preserving and maintaining the chain of custody of documents, communications and digital records. Evidence that is admissible and carries probative value in judicial or regulatory proceedings.
Planning and conducting interviews with witnesses, whistleblowers and the persons under investigation. Forensic interview techniques, documentation and safeguards for the right of defense.
Preparing the final investigation report with established facts, legal assessment, responsibilities and recommendations for corrective or disciplinary measures.
Practical training for the compliance team, human resources and senior management: how to open an investigation, manage interviews and document the process with the right safeguards.
Internal fraud, workplace harassment, conflicts of interest, corruption or information leaks: each type of investigation has its own methodology, deadlines and specific safeguards.
“Internal fraud investigations require forensic analysis of accounting records and transactions, digital preservation of evidence and coordination with the legal department and the external auditors.”
“Harassment investigations call for special protection of the victim, reinforced confidentiality, forensic interview techniques and coordination with the company’s harassment protocol.”
“Investigating corrupt conduct requires analyzing payments, gifts, relationships with third parties and undeclared conflicts of interest, with particular attention to the company’s regulatory exposure.”
“Investigations into leaks of confidential information require digital traceability analysis, a review of access rights and action coordinated with the DPO so as not to breach data protection rules.”
A poorly managed internal investigation can increase the company’s criminal liability, invalidate evidence and create labor and reputational disputes that are hard to resolve.
Corporate criminal liability: without a diligent internal investigation, the company cannot show that it reacted to the breach, a key factor for exemption from or mitigation of criminal liability.
Invalidated evidence: gathering evidence without respecting fundamental rights (confidentiality of communications, data protection) can make it inadmissible at trial and expose the company to lawsuits.
Labor disputes: a poorly conducted investigation can lead to unfair dismissals, violations of the right of defense and claims before the labor courts with high costs.
Law 2/2023 prohibits any retaliation against the whistleblower. Failing to protect them adequately can lead to penalties for the company and the loss of the protection the channel offers.
Processing of personal data in an internal investigation must comply with data protection rules. Breaches in this area can lead to penalties from the Spanish Data Protection Agency (AEPD).
Article 31 bis of the Criminal Code allows a legal entity to be exempted from criminal liability if it demonstrates an effective compliance model and an adequate response to the breach.
We assess the case, design the action protocol and manage the investigation with legal rigor: evidence, interviews, reporting and closure in line with the Whistleblower Protection Law and the Criminal Code.
An internal compliance investigation is the formal, structured process by which a company investigates, confidentially and impartially, alleged breaches of its code of conduct, internal rules or applicable law.
It includes activating the protocol, collecting evidence, conducting interviews, legal analysis and preparing a conclusions report with corrective measures.
Law 2/2023 on the protection of persons who report regulatory breaches requires companies with 50 or more employees to have an internal whistleblowing channel, a procedure for handling reports with specific deadlines and measures to protect the whistleblower from retaliation.
An internal investigation must be led by a person or team that is independent, impartial and has sufficient legal knowledge. In practice, this can be the compliance officer, a specialized outside lawyer or a combination of both.
Independence is key: if the person under investigation is a senior executive, we recommend outsourcing the investigation to ensure impartiality and protect the company against any later challenge.
Confidentiality is a fundamental principle of any internal compliance investigation. Usual measures include:
The admissible evidence in an internal investigation can include corporate emails, system access logs, financial documents, internal communications and statements from interviewees.
However, evidence collection must respect employees’ fundamental rights: confidentiality of communications, data protection, privacy and the right not to incriminate oneself. Evidence obtained in breach of fundamental rights may be declared void and expose the company to liability.
Article 31 bis of the Criminal Code provides that a legal entity is exempt from criminal liability if, among other requirements, it adopted and effectively implemented an organizational model that included supervision, control and response measures for breaches.
Deadlines in an internal compliance investigation depend on its complexity, but Law 2/2023 sets specific milestones for handling reports:
Processing personal data in an internal investigation is subject to the GDPR and the LOPDGDD. The company must be able to show a legal basis for the processing (generally legitimate interest or compliance with a legal obligation), inform the affected persons appropriately (within the limits the investigation imposes) and ensure the security of the data collected.
We recommend coordinating with the Data Protection Officer (DPO) before and during the investigation to avoid security breaches and AEPD penalties.
An effective internal investigation does not start when the problem arises: it requires a prior protocol, a prepared team and an evidence management system that ensures the findings are legally admissible.
Designing the investigation protocol in advance, appointing the investigating team and defining responsibilities and activation criteria. Without a prior protocol, the investigation loses rigor and traceability.
Obtaining documents, digital records and statements while respecting fundamental rights. A rigorous chain of custody and detailed documentation of every investigative step.
Conclusions report with established facts, legal assessment and recommendations. Implementation of corrective and disciplinary measures, or measures to improve the compliance system.
If you need support with an internal investigation, see our corporate compliance services or request a free consultation.
An effective internal compliance investigation is organized into operational blocks with clear owners, defined deadlines and documentary traceability. These are the modules we design and oversee.
1) Channel and alertHandling the alert from the moment it is received: classification, acknowledgment, preliminary assessment and a reasoned decision to investigate or close the file.
2) EvidenceImmediate preservation of documents, emails, access logs and communications. Chain of custody with probative value and GDPR compliance.
3) InterviewsPlanning and conducting interviews with witnesses, whistleblowers and the persons under investigation. Forensic technique, right of defense and documentation of the interview record.
4) ReportFinal report with established facts, legal analysis, responsibilities and recommendations for corrective or disciplinary measures, or for strengthening the compliance system.
By type of incidentFinancial forensic analysis, digital preservation, coordination with the external auditors and possible notification to the authorities.
Reinforced protection of the victim, maximum confidentiality, interviews using specialized technique and immediate precautionary measures.
Digital traceability analysis, review of access rights, coordination with the DPO and assessment of the security breach.
Internal whistleblowing channel, a management procedure with deadlines, whistleblower protection and a ban on retaliation.
Channel policy, report register, acknowledgments of receipt, communications to the whistleblower, documentation of measures taken.
An effective compliance model with supervision, control and a diligent response to breaches. The internal investigation is the evidence of that response.
Investigation protocol, conclusions report, corrective measures implemented, minutes of the control body.
Legal basis for processing data in the investigation, information to the affected persons (with limits), data security and coordination with the DPO.
Record of processing activities, legal basis analysis, DPO report, documented security measures.
The right of defense of the person under investigation, proportionality of disciplinary measures and compliance with the disciplinary dismissal procedure.
Letter of charges, prior hearing, employment law report, dismissal letter and documentation of the disciplinary process.
Companies must have a protocol on workplace and sexual harassment. The internal investigation of these incidents must follow the established procedure.
Approved harassment protocol, register of harassment reports, investigation records, measures adopted and follow-up.
If you recognize any of these situations, you urgently need to review your internal compliance investigations protocol.
If you are managing or designing an internal compliance investigations protocol, these terms appear in the regulations, in the procedures and in the company’s legal defense.
A structured, confidential process by which the company investigates alleged breaches of its internal rules or the law, with safeguards for the people under investigation and for whistleblowers.
A secure, confidential and accessible channel for employees and third parties to report alleged breaches. Mandatory for companies with 50 or more employees.
An individual who reports violations and has legal protection against retaliation: dismissal, sanction, harassment or any measure that harms them for having reported.
A documented record of everyone who has accessed, held or transferred a piece of evidence, to ensure its integrity and admissibility in judicial or regulatory proceedings.
The article of the Criminal Code that sets the conditions for a legal entity to be exempt from liability: an effective compliance model and a diligent response to breaches.
The set of safeguards that must be respected during the internal investigation: presumption of innocence, the right to be heard, access to relevant information and proportionality of the measures adopted.
The person responsible for the company’s compliance system, including oversight of the whistleblowing channel and the direction or supervision of internal investigations.
Any act or omission that harms the whistleblower as a result of their report: dismissal, sanction, change of position, harassment, exclusion, unjustified negative evaluation.
A report setting out the established facts, the legal analysis, the responsibilities identified and the recommendations for corrective or disciplinary measures or improvements to the compliance model.
INTERNAL INVESTIGATIONS · COMPLIANCE CONSOLE
The level of requirement for internal compliance investigations varies with company size, sector and regulatory exposure. This panel summarizes the obligations and risk level by profile.
Identify your profile and prioritize the elements of the internal investigations protocol.
Tell us about your situation and we will explain how to manage an internal investigation with legal rigor, confidentiality and safeguards for your company.
Internal compliance investigations are the mechanism by which a company reacts diligently to alleged breaches of its internal rules or the law. In the context of Spanish and European corporate compliance, the internal investigation has gone from being an option to an essential element of the compliance model.
Law 2/2023 of February 20 transposes European Directive 2019/1937 and requires companies with 50 or more employees to have a secure, confidential and accessible internal whistleblowing channel. The law sets specific response deadlines, prohibits any retaliation against the whistleblower and guarantees the possibility of anonymous reporting. Non-compliance can lead to fines of up to €300,000 for legal entities.
Article 31 bis of the Criminal Code provides that a legal entity is exempt from criminal liability if it adopted and effectively implemented an organizational model with supervision, control and response measures for breaches. The internal compliance investigation is the evidence that the company reacted diligently to the breach detected. Without a documented internal investigation, the company loses one of its main defense arguments before the prosecutor’s office.
Processing personal data in an internal investigation is subject to the GDPR and the LOPDGDD. The company must identify the legal basis for the processing, inform the affected persons appropriately (within the limits the investigation imposes), ensure data security and coordinate its actions with the Data Protection Officer. A breach in this area can lead to AEPD penalties and the nullity of the evidence obtained.
An internal investigation must respect the right of defense of the person under investigation: presumption of innocence, the right to be heard and proportionality of the measures adopted. In the employment context, a disciplinary dismissal that follows an internal investigation must meet the requirements of the Workers’ Statute to avoid being classified as unfair or void.
Key legislation, linked to the official text:
Legislation and links reviewed in .