Internal and Workplace Investigations: When a Company Has to Investigate Itself

When the subject is inside the building

Most of the investigative work a company buys looks outward: vetting a counterparty, tracing an adversary's assets, verifying a target before a deal. An internal investigation points the same discipline inward, and that reversal changes everything about how the work has to be done. The subject has a badge, a laptop, colleagues, and often authority over the very records that would prove or disprove the allegation.

The triggers are familiar to any general counsel: an anomaly surfaced by the auditors that accounting cannot explain; a hotline report alleging expense fraud or kickbacks; a harassment complaint against a senior manager; inventory or funds that keep not reconciling; a board member approached quietly by an employee who no longer trusts the chain of command. The Association of Certified Fraud Examiners' Report to the Nations — the most widely cited study of occupational fraud — has consistently found that organizations lose about five percent of revenue to fraud, that the median scheme runs about twelve months before detection, and that tips, most of them from employees, catch more fraud than any other mechanism. The typical internal investigation therefore starts late, on a scheme that has had a year to mature, prompted by someone inside who decided to speak.

What the company does in the days that follow determines whether it ends with a defensible decision — discipline, termination, restitution, referral, or exoneration — or with a second problem larger than the first: a tainted process, a retaliation claim, spoiled evidence, or a regulator who concludes the inquiry was designed not to find anything.

Why a company cannot always investigate itself

The instinct to handle it internally is reasonable — HR investigates complaints, internal audit follows anomalies, security reviews access logs — and for routine matters that is exactly the right machinery. The machinery fails when the allegation reaches upward or sideways into the functions that would run it. HR cannot credibly investigate an executive it reports to. Internal audit cannot objectively examine a failure of the controls it designed. A finance team cannot investigate its own CFO.

The working rule is an escalation ladder. An allegation naming a line employee can usually be handled by HR with standard process. An allegation naming a manager, or touching a control function, needs internal audit or compliance — with attention to reporting lines, so nobody investigates their own supervisor. An allegation naming an officer or director, implicating the financial statements, or likely to end in litigation or before a regulator, needs independence: an outside investigator, retained by and reporting to counsel or the board, with no career stake in the answer. The Department of Justice makes the same point from the enforcement side — its Evaluation of Corporate Compliance Programs asks whether investigations are 'independent, objective, appropriately conducted, and properly documented,' and treats the answer as evidence of whether the compliance program is real.

Independence is also what protects the people who are cleared. A finding of no misconduct from an investigator with no stake in that outcome ends the matter. The same finding from the subject's own colleagues invites the allegation to be made again, louder, outside the company.

Privilege is the architecture, not a formality

Serious internal investigations are structured around attorney-client privilege from the first day, because the file the investigation creates is discoverable if privilege is never established and is protected only to the extent the structure is respected. The controlling authority is Upjohn v. United States, where the Supreme Court held that a company's privilege can extend to counsel's communications with employees at any level — not just the control group at the top — when the purpose is obtaining legal advice for the company.

In practice that means the investigation is directed by counsel — in-house or, where independence matters, outside counsel — and investigators, forensic accountants, and other specialists are retained through counsel so their work is done in support of legal advice. It means every employee interview opens with an Upjohn warning: the lawyer represents the company, not the employee; the conversation is privileged, and the privilege belongs to the company alone, which may choose to waive it. Investigators working under this structure document interviews as counsel directs, separate factual summaries from advice, and never promise a witness confidentiality the company cannot keep.

Privilege discipline is not about hiding the findings. Companies routinely choose to share investigation results — with auditors, with a regulator, occasionally with a prosecutor seeking cooperation credit. The point of the architecture is that disclosure remains a decision, made deliberately at the end, rather than an accident committed in the first week by an investigation nobody structured.

Evidence handling decides what the findings are worth

An internal investigation's conclusions are only as good as the evidence chain underneath them, and the errors that destroy that chain are almost all committed early. The duty to preserve attaches when litigation is reasonably anticipated — which is usually the moment a serious allegation surfaces, not the moment a complaint is filed. That means a litigation hold suspending routine document destruction and auto-deletion for everyone plausibly involved, issued in writing, before the first interview. Under Rule 37(e) of the Federal Rules of Civil Procedure, electronically stored information lost because a hold was not issued can cost a company sanctions up to an adverse-inference instruction — a court telling the jury to assume the destroyed evidence was unfavorable.

The same discipline governs devices and data. A departing suspect's laptop is forensically imaged before anyone 'has a look,' because opening files alters metadata and a defensible image preserves deleted material an informal review never sees. Access is logged, custody is documented, and the financial workstream — the ledger entries, approvals, vendor records, and payment flows an embezzlement case turns on — is reconstructed by people who do forensic tracing for a living, not sampled by the team whose controls are in question.

Interviews are sequenced deliberately: documents first, peripheral witnesses next, the subject last, once the questions can be precise. Companies that invert the order — confronting the subject on day one, on instinct — hand over the one advantage an internal investigation has, which is that the company controls the timeline and the record.

What a whistleblower changes

A meaningful share of internal investigations now begin with a whistleblower, and that origin changes the legal posture of everything that follows. For listed companies, Section 301 of the Sarbanes-Oxley Act requires the audit committee — not management — to maintain procedures for confidential, anonymous employee complaints about accounting and internal-control matters, which is why allegations touching the numbers belong with the audit committee from the start.

The whistleblower also has somewhere else to go. The SEC's Dodd-Frank whistleblower program pays awards of ten to thirty percent of sanctions above one million dollars and has awarded more than two billion dollars since its creation; its rules are built so an employee who reports internally first loses nothing by going to the Commission within 120 days. The practical consequence is a clock: a company that sits on an internal report, or is seen to slow-walk it, should assume the same facts may arrive at a regulator with a timeline of the company's inaction attached.

Retaliation is the separate, and often larger, exposure. Anti-retaliation provisions in Sarbanes-Oxley and Dodd-Frank protect the reporter regardless of whether the underlying allegation is ultimately substantiated. The investigation therefore has two duties of care running in parallel: to the accuracy of the findings, and to the treatment of the person who triggered them — including limiting who knows the reporter's identity, and documenting that employment decisions about them stand on grounds independent of the report.

What an outside investigator produces that an internal process cannot

The deliverable is not a longer version of an HR memo. A professionally run engagement produces a scoped work plan agreed with counsel; a preserved and documented evidence set; interview records prepared to counsel's direction; a financial reconstruction where money moved; and a findings report that separates verified fact from allegation and from inference, sources every material finding to a record, states what was not examined, and reaches a conclusion the board can act on. Where the matter may end in court, the work is done so that it can survive an adversary's scrutiny — because if the company terminates, sues, or refers the matter for prosecution, the file becomes the case.

Independence shows up in the product as much as the process. An outside report can say things an internal one structurally cannot: that a control failed because a senior officer overrode it, that a complaint was mishandled the first time it was raised, that the conduct extends further than the original allegation. The DOJ's compliance guidance asks pointedly about root cause — not just what happened, but why the environment allowed it — and root-cause candor about leadership is precisely what internal reporting lines suppress.

There is also a quieter value: proportion. Experienced investigators close weak allegations quickly and document why, which protects the accused and the company alike. An organization that investigates credibly — and is seen by its employees to do so — gets more tips, earlier, which the ACFE data links directly to smaller losses. The investigation function, run well, is a control in its own right.

Employee theft and embezzlement: following the money

The workplace investigations with the highest financial stakes are the ones where money has already left: fictitious vendors, inflated invoices, payroll ghosts, diverted receivables, expense schemes that metastasized. Here the investigation runs on two tracks at once. The conduct track establishes who did what, with what authority, and who else knew. The asset track establishes where the money went and what can be recovered — bank flows, property, transfers to relatives or shell entities — because a finding without recovery is an expensive form of closure.

Recovery has more routes than most companies assume: restitution negotiated against the evidence, civil claims against the employee and knowing recipients, claims under fidelity or crime insurance policies — which have their own proof-of-loss requirements an investigation must anticipate — and, where chosen deliberately rather than in anger, criminal referral. The decision between quiet restitution and public prosecution is a business and reputational judgment for the board and counsel; the investigator's job is to build a file strong enough that every option stays open. The tracing methods are the same ones used against external fraudsters, applied to a subject who had a login.

Speed matters more here than anywhere else in the discipline. Assets that sit still during a slow investigation do not sit still after a termination letter. Where recovery is realistic, the sequencing mirrors pre-litigation practice: understand the asset picture quietly, before the subject knows the company is looking.

How Fortaris runs internal engagements

Fortaris Capital Advisors conducts internal and workplace investigations for companies, boards, and their counsel, led at the Managing Director level by professionals with federal investigative and forensic-accounting backgrounds — the two disciplines an internal matter actually requires: establishing facts about people, and reconstructing what happened in the books. Engagements are typically structured through counsel to protect privilege, scoped in writing, and staffed deliberately small.

The posture throughout is discretion. An internal investigation done well is quiet: the workforce sees a process that is fair and contained, the board sees findings it can rely on, and the company's name stays out of the story. For corporations weighing whether a matter has outgrown their internal machinery, the escalation question — who does this allegation name, and who would it have investigating themselves — is usually answer enough. A confidential conversation with a senior principal is how these engagements begin.