A company discovers a gap in its accounts, a quotation leaked to a competitor, or manipulation of stock. The first reaction is usually hasty: summoning the employee and taking their phone, searching their locker, dismissing them on the spot, or going straight to the police with an incomplete report. Each of these steps can turn the company from complainant into respondent. An internal investigation is a precise legal exercise rather than an administrative step, and its success is measured by whether its findings withstand judicial scrutiny rather than by how quickly it concludes. This article sets out the limits of lawful conduct in that exercise.
Why Most Internal Investigations Fail
- Premature confrontation: confronting an employee before securing evidence gives them the opportunity to destroy or delete it.
- Improperly obtained evidence: material gathered unlawfully may be excluded and may rebound on the company as liability.
- Absence of documentation: an oral investigation without minutes or a chronology is worthless months later.
- Conflating routes: mixing disciplinary sanction, civil claim, and criminal complaint spoils all three.
- Hasty reporting: filing a criminal complaint without sufficient evidence exposes the company to a false-report claim and damages.
First Steps Before Any Confrontation
- Define the scope: precisely what is suspected, over what period, and who may be connected to it.
- Secure the evidence: freezing system access, preserving copies of records and accounting entries, and preventing data deletion. This is by far the most important step.
- Do not alert the suspect: until what can be destroyed has been secured.
- Form a small team: with as few people as possible, as widening the circle of knowledge leaks the investigation and damages reputation.
- Involve a specialist early: as legal advice after a procedural error does not repair it.
- Identify the objective: recovery of funds, ending the relationship, deterrence, or all three, since the objective determines the route.
Limits on Gathering Evidence
This is where the greatest risk lies:
- Work tools: devices, accounts, and email provided by the company remain work tools, and the company may examine them within the scope of the work. This right is considerably stronger where a written policy provides for it and the employee signed it on appointment.
- Personal devices: an employee's personal phone or private accounts may not be searched or accessed by any means, even with consent extracted under pressure.
- Private messages: examining purely private correspondence infringes private life and may constitute an offence, and suspicion does not justify it.
- Personal searches: searching a person or their bag affects liberty and is permissible only within very narrow limits, under a published policy and with genuine consent. The safer course is to leave it to the competent authority.
- Detention: preventing an employee from leaving the office or taking their personal documents may amount to deprivation of liberty, among the gravest acts companies commit without realising it.
- Cameras: surveillance recordings in disclosed workplace areas are ordinarily acceptable, while recording in areas where privacy is expected is unlawful.
- Audio recording: recording an employee without their knowledge is fraught with risk, and the safe alternative is written minutes signed by those present.
- Personal data: data collected must be limited to the purpose, not used for another, and not disclosed beyond those who need it.
Interviewing the Employee
- Written confrontation: a memorandum is served on the employee clearly setting out the allegations, with a period to respond.
- The right of defence: enabling them to respond and to see what is alleged is an essential condition, and its omission invalidates the sanction later.
- Minutes: minutes are prepared recording the date, those present, and the questions and answers, and signed by the employee. If they refuse to sign, the refusal is recorded before two witnesses.
- No coerced admissions: an admission extracted by threat of dismissal or of a police report is worthless and becomes evidence against the company.
- No promises to withhold complaint: promising not to report in exchange for confession and payment is a dangerous arrangement that may be characterised as extortion, and any settlement must be properly drafted.
- Disciplinary time limits: Labour Law No. 6 of 2010 sets tight periods for imposing sanctions and for termination for cause, and exceeding them forfeits the company's right however well founded its case.
Three Routes, Not One
- Disciplinary route: governed by the Labour Law and the sanctions schedule, requiring proportionality and observance of procedure and time limits.
- Civil route: claiming compensation from the employee for the loss caused, assessed by documents rather than estimates.
- Criminal route: where the conduct constitutes an offence such as misappropriation, breach of trust, forgery, or unauthorised access to an information system, a documented complaint is filed.
- Sequencing: termination does not bar a civil claim or a criminal complaint, but haste in one may weaken another.
- Risk of a false report: a complaint without serious foundation exposes the company and the person filing it to criminal liability and a damages claim, the outcome employers most regret.
- Settlement: many files end in a written settlement containing an acknowledgment of debt, a payment schedule, and mutual release, usually preferable to years of litigation.
Protecting the Company in Advance
- Systems use policy: a written document signed by the employee stating that work devices and email are subject to review, the cornerstone of any later examination being lawful.
- Approved sanctions schedule: a sanction unsupported by an approved schedule is exposed to annulment.
- Segregation of duties: no single person should combine requisition, approval, and payment, as most misappropriation arises from that combination.
- Records and backups: a system that preserves records and prevents deletion, since without records there is no evidence.
- Confidentiality and non-competition agreements: drafted within a reasonable scope so as to be enforceable.
- An internal reporting channel: allowing employees to report misconduct with protection, as most incidents are discovered internally.
- Periodic audits: an unannounced audit is a stronger deterrent than any subsequent sanction.
Practical Guidance
- Do not confront an employee before securing records and data, as premature confrontation destroys evidence.
- Do not detain anyone or seize their personal belongings however strong the suspicion.
- Document every step in dated minutes, as memory is no evidence a year later.
- Calculate the statutory sanction periods from the day the conduct was discovered rather than the day you decided.
- Do not file a criminal complaint before a legal review of the sufficiency of the evidence.
- Do not discuss the matter with other employees, as unintended defamation opens a separate claim.
- Put written policies in place now rather than after an incident, as they are what gives you the right to examine at all.
A successful internal investigation protects a company both from its loss and from itself, and its legal limits are what turn its findings into usable evidence. Yamnak Law Firm manages internal investigations and drafts policies and sanctions schedules, and conducts civil claims and criminal complaints arising from employee misconduct.
