Internal Investigations in Switzerland: Six common mistakes

Internal investigations are currently very popular: Whenever misconduct in a company is under discussion, the call for comprehensive investigation is not far away, as is the promise that one will be carried out. Whether it is about losses at a major bank, the federal government allegedly overpaying for protective masks or allegations of harassment and bullying at a media company: the “internal investigation” is the measure of choice. 

However, this approach does not always lead to relief. Many companies and authorities have no experience with such situations, but bring many unanswered questions. Decisions have to be made quickly and under pressure, and so mistakes can occur. We have compiled six of the most common:

Mistake 1: Lack of Independence

In the past, it was common to entrust an internal investigation to the company’s usual law firm. However, especially in cases with a high media impact, they will hardly ever be perceived as independent. If the “favourite law firm” (as a journalist recently put it) is entrusted with the investigation of a scandal, no matter how seriously, thoroughly and independently it investigates the case, the external impression of bias remains and “damages the result, the company and the law firm”, as Zoé Baches from the business section of the NZZ put it. Nota bene: External specialists do not always have to be commissioned for an internal investigation. Minor cases, in which it is clear that they only concern few specific individuals and not the company management, can in many cases be adequately investigated completely internally. In practice, the responsibility usually lies with the compliance or HR department.

Mistake 2: Blunders in preserving and collecting data

There are several opportunities for this, as electronic data plays a central role in most internal investigations today. But if, for example, the electronic communication of the employees involved has to be viewed retrospectively, this presupposes that they can be preserved and collected if the worst comes to the worst. In the case of e-mails, this is often not difficult, but today communication and documentation also takes place via many other channels and applications. A new cloud solution is quickly acquired, even if very few companies actually check whether the data processed there is also archived in case of a future investigation and can still be used years later if necessary.

If there is an internal investigation, one of the first things to tackle should be to preserve and eventually collect any data that may be needed. This applies all the more if there is a risk that the employees involved might destroy the data, if necessary for their own protection. This, in turn, presupposes that those in charge of the investigation consider at an early stage which data sources may well be relevant to them. This is often not done either – in some cases, there is simply a lack of the necessary knowledge about their own systems and a lack of imagination.

Mistake 3: Aren’t there data protection issues?

Yes, data protection issues can stand in the way of an internal investigation, but as a rule they will not prevent it. The same applies to labour law, which must also be observed – a keyword to consider is the “duty of care” towards the employee. Three issues should be avoided so that data protection considerations do not cause problems:

• Lack of Information. This can arise long before the internal investigation as employees must be made aware of what they can expect in the event of an internal investigation, such as the review of their own e-mails. If an investigation does take place, the employees concerned should be also informed specifically about the particular investigation, although this may be delayed for tactical reasons.
• Insufficient grounds for suspicion. Access to emails and other employee data or even surveillance measures are only permissible if there is a suspicion that justifies the measure. This can be a tip-off by a whistleblower or an “alarm” set off in a technical system (e.g. unusually high data transfers by an employee).
• Disproportionate monitoring and other evaluations. Monitoring and the like should be limited to what is really necessary. In an e-mail analysis, for example, the number of documents to be manually sifted should be reduced in advance by machine-based search aids, which also saves costs. External parties who have nothing to do with the employees concerned should be called in to do the sifting. In this way, the employer avoids becoming aware of private content that is not its business. The principle of proportionality also requires that the circle of people involved remains as small as possible – also to protect the identity of any whistleblowers or accused persons.

Mistake 4: Tunnel vision in the analysis of the data

The analysis of electronic data in an internal investigation is central, but often the focus is on emails alone. However, it is also a fact that employees are increasingly exchanging information via channels other than their business email account. Private email accounts are used, messenger services, chats, phone calls and video conferences. If private accounts are used, the employer reaches their limits and, if necessary, has to involve the law enforcement authorities.

Misconduct in a company can also be reflected in many other sources of data in the company, which also too often go unnoticed. In the case of financial crimes, for example, an analysis of data from an ERP system can be worthwhile, while server logs as well as metadata on personal notebooks can provide clues to the behaviour of individual employees. These analyses, admittedly, require a certain amount of expertise. However, it can be worthwhile to start thinking about all of these sources at the beginning of an investigation.

Mistake 5: Not considering criminal and supervisory authorities

If a violation of legal provisions is under discussion, the criminal and supervisory authorities may also be interested in the internal investigation. In Switzerland, too, they have long since realised how practical internal investigations are for them: Companies work up the cases at their own expense, and they can then access the findings for their own purposes without much effort. Many companies still believe they can prevent such access by hiring a Swiss law firm, but the Federal Supreme Court has weakened the protection of attorney-client privilege.

It is therefore important to consider from the outset whether law enforcement and supervisory authorities should one day be given access to the documents – and if not, what precautions should be taken. In certain cases, it may even be interesting for a company to provide the law enforcement authorities with evidence, for example, if it is necessary to conduct a house search in order to clarify the matter. Even in the context of questioning employees, one should already think one step further: Should the findings be usable under criminal law or not? This has an influence on the manner of the questioning and the information provided to the employees.

Another common mistake: A company should never guarantee anonymity to whistleblowers and witnesses because it will not be possible to honour such a promise in all situations. Of course, this does not mean that the identity of whistleblowers and the (bona fide) whistleblowers themselves should not be protected.

Mistake 6: Missed deadline for summary dismissal

If misconduct is detected, the question for the affected company or even an authority is how to react. There will be little controversy about medium- and long-term measures to prevent similar occurrences or impede them but what personnel consequences should there be? This often does not have a simple answer. The law and courts exert pressure here, at least if an employee is to be dismissed without notice. A decision has to be made within a few days once the key facts are known.

It is true that larger organisations with long decision-making processes are given a little more leeway. The facts of the case may also be clarified first. However, if it is already clear before the investigation is completed that an employee has destroyed the relationship of trust, the clock starts ticking. If the employee is not terminated without notice, the misconduct established up to that point lapses as grounds for termination without notice. In practice, however, this is not necessarily a problem: In such cases, the employee can still be released from work immediately – and under certain circumstances, the salary can even be withheld. This comes close to summary dismissal and has the side effect that the employee must continue to be available for questioning – until he/she resigns without notice.

By David Rosenthal, Vischer, Switzerland, a Transatlantic Law International Affiliated Firm.

For further information or for any assistance please contact switzerland@transatlanticlaw.com

Disclaimer: Transatlantic Law International Limited is a UK registered limited liability company providing international business and legal solutions through its own resources and the expertise of over 105 affiliated independent law firms in over 95 countries worldwide. This article is for background information only and provided in the context of the applicable law when published and does not constitute legal advice and cannot be relied on as such for any matter. Legal advice may be provided subject to the retention of Transatlantic Law International Limited’s services and its governing terms and conditions of service. Transatlantic Law International Limited, based at 42 Brook Street, London W1K 5DB, United Kingdom, is registered with Companies House, Reg Nr. 361484, with its registered address at 83 Cambridge Street, London SW1V 4PS, United Kingdom.