Sponsored survey: Maximising compliance and minimising risk: corporate investigations in the DACH region

Renewed commitment among US agencies to punishing corporate wrongdoing has pushed investigations to the top of the risk register. We partnered with OpenText to find out how this is impacting GCs in the DACH region

In September 2021 the video games industry suddenly found itself in the spotlight after allegations of sexual misconduct and discrimination at Activision Blizzard – one of the biggest publishers in the world and the target of Microsoft’s largest-ever acquisition – sparked investigation by US regulators. Coming just months after a new Biden administration had pledged to crack down on the full spectrum of corporate wrongdoing, it was a timely reminder of the many and varied investigations risks now faced by global business.

For companies operating in Germany, Austria and Switzerland – the so-called DACH region – there have been more proximate reminders of the long-arm of sanctions. In early 2021, Deutsche Bank agreed to pay more than $130m to resolve investigations following violations of the Foreign Corrupt Practices Act (FCPA) and commodities fraud.

To make sense of these trends, and better understand how businesses are responding, Legal Business teamed up with leading enterprise information management software provider OpenText to survey general counsel (GCs) from across the DACH region. With over 50 GCs and senior counsel responding, the results offer a snapshot of the new normal in internal and external investigations.

Near-universally, the imminent and drastic increase in the volume of internal investigations was highlighted as a key challenge among those we surveyed.

Over the past three years there has indeed been a sharp spike in the number of global investigations, and while the long tail of new and ongoing investigations means a full picture of the current situation may take years to reveal itself, all indications are that this will be a time of unprecedented regulatory scrutiny for business.

According to our survey, internal issues related to the conduct of employees was the most common trigger of internal investigations over the past three years, with 61% citing this. In contrast, lawsuits filed by either individuals or other organisations were responsible for just 11% of all investigations across the region, with notices from regulators (covering antitrust and GDPR-related breaches) responsible for only 8% of investigations.

However, while regulatory notices were not the main driver of investigations, they are still common. Nearly two thirds (63%) of respondents to our survey noted that they had an investigation following a notice from a regulator, with GDPR (21% of all respondents), whistleblower allegations (15%) and antitrust (11%) the most likely triggers.

Near-universally, the imminent and drastic increase in the volume of internal investigations was highlighted as a key challenge among those we surveyed.

And with criminal prosecution, large fines, substantial damages, and negative publicity often resulting from such investigations, a carefully planned and well-executed investigation is critical. Beyond avoiding these penalties, respondents noted the importance of handling any international and external investigation promptly to prevent any additional harm arising. Fully 94% of respondents said their investigations were launched either quickly or very quickly, with nearly half (48%) saying their internal investigation was launched within a week of the issue coming to light. Only a small number of respondents (6%) reported that their businesses were aware of the issue for two months or longer before launching an investigation.

How corporations tackle investigations

The first decision lawyers, compliance officers and internal audit professionals must make when resolving such issues is whether to have the investigation conducted internally or externally. Where the alleged misconduct involves employees and does not implicate potential violations of the law, in-house counsel, often in conjunction with a company’s compliance or internal audit department, can investigate these allegations and recommend appropriate solutions and personnel actions to senior management.

If the misconduct is widespread and may involve senior level management/directors that could affect a company’s governance, their corporate policy, or subject the company to regulatory or a prosecutorial investigation and possible enforcement action, an internal investigation conducted by outside counsel and under the supervision of the board is strongly considered.

Digitalisation

Since the start of the global pandemic in 2020, digital investigations have grown even more complex when the employee under investigation operates in a remote or work-from-home environment, leading to challenges around investigation fidelity and the inability to access 100% of the required evidence. Additionally, discretion is critical in many internal investigations to prevent any potential tampering with or deletion of evidence. Incomplete or compromised evidence due to mishandling of evidentiary data can result in sanctions and fines.

Internal workplace investigations

The Legal Business and OpenText survey has shown that investigations related to the internal conduct of employees was cited as the highest-frequency trigger at 47%, with those investigations focused on allegations of criminal activity by an employee within the business at 43%. Employers and their lawyers will choose to conduct an internal investigation professionally and fairly while obtaining a straightforward view of the facts; that is, what happened, when it happened, who was responsible, who may have been harmed, and what further actions may be necessary to prevent the alleged wrongdoing from reoccurring. Most companies are now using ‘eDiscovery’ platforms and partners to help manage these investigations. These systems are designed to help investigators and lawyers quickly get to the facts and are able to scale up to help them sift through millions of items of potential evidence.

Volume and variety of data

The survey turned its attention to internal issues containing the greatest volume and variety of data that related to the conduct of their business. This came highest at 53% with issues related to the conduct of employees standing at 34% while antitrust investigations also stood at 34%. For multinational businesses across the DACH region, the major challenge is between data protection laws and the requirements imposed by legislation and having a basis to process this data. At the start of any internal investigation, the collation of documents and materials relevant to the facts driving the investigation can include employee emails or communications, personnel records, or other personal, employee-specific information. Any of these types of materials would constitute personal data that is protected by data privacy regimes, and which cannot be collected or used without a basis for doing so that satisfies the relevant parties. Each jurisdiction within the DACH region has its own regulations outlining what, if any, circumstances merit the processing of personal data. Companies should therefore be familiar with the data privacy regimes they are subject to, and what those regimes require for processing data, at the outset of an investigation, before any data is collected and before it is processed for a new purpose. In the context of a regulatory investigation, organisations should also be alert to the potential for tension between the data privacy regime of the relevant jurisdiction and the demands of the investigating regulator.

Incorporating data privacy considerations into investigations requires proactive thinking before an investigation is underway. An organisation should have policies already in place for all relevant data privacy regimes, both to enable an organisation to meet the requirements for actually processing and transferring data, and to aid an organisation in the logistics of doing so. These policies may include having pre-assigned teams ready to oversee certain aspects of an investigation, such as a team whose role is to analyse which bases are legitimate for processing data, or a team whose function is to notify individuals whose data is processed, and to maintain relevant impact assessments for each of those individuals. Much time, effort, and expense can be saved in the long run if these steps are taken ahead of time.

Law suits and whistleblowing

Among those we surveyed, investigations in response to whistleblower allegations ranked at 23%. Lawyers found issues around these the most complex. It is no surprise, as the coronavirus pandemic and the EU Whistleblower Protection Directive present new tasks and challenges for corporate whistleblowing systems. Another complex issue lawyers said they experienced in the survey is lawsuits filed by another organisation, also at 23%.

Human resource related

Internal investigations focused on human resources issues related to furloughs, layoffs and wrongful dismissal stood at 28%. To protect everyone involved in a disciplinary or grievance case, human resources must make sure it follows a fair procedure. The investigation is an important part of this. If the company’s human resource function does not conduct a reasonable investigation, any decisions they make in the disciplinary or grievance case are likely to be unfair. This could risk legal action.

External investigations

The more serious the matter with potential of litigation, the greater the likelihood that external investigations will take place. In terms of process, companies and their lawyers will engage with an external organisation to undertake an investigation, then act on its findings and recommendations.

Reasons to appoint an external investigator:

1. Lack of internal resources to handle the volume of data involved within the prescribed timeline
2. Need for external investigation experts to untangle complex investigations and find the critical evidence fast without a protracted full review of all data.
3. Allegations involving sexual or other serious misconduct against senior executives, where internal investigations may not command the same credibility.
4. Any investigation that covers issues such as culture, practices or procedures – these can be hard to investigate effectively internally, especially with the lack of experience of cultures and industry practices.
5. Allegations that gain media interest – passing the investigation to an external organisation can assist from a reputation management perspective by demonstrating that the company is taking the matter seriously.
6. If the allegation results in litigation, external investigations can show the integrity in the process and help with the defence of any subsequent claim and the process.

And what about the types of external investigations conducted? Our research determined that this is much broader with investigation leads reporting that they have conducted the following forms of external investigations at least once in the past three years: lawsuits filed by an individual; lawsuits filed by another organisation; and antitrust-related notices from a regulator – all scoring at 25.5% each with our respondents. External investigations in response to notices from regulators in relation to whistleblower allegations also figured prominently at 23% among respondents.

Discretion is critical in many internal investigations to prevent any potential tampering with or deletion of evidence.

Time is of the essence

The survey also captured a key fact that investigations are launched very quickly as a sign of how seriously they are taken. Half of respondents reported that investigations were launched within a week of awareness of the issue while 44% reported launching investigations within a month of awareness of the issue. Only 6% reported launching their investigations somewhat slowly, while being made aware of the issues for two months or more before investigations begin. There is no doubt that investigations are a significant burden to organisations and the law firms that support them and arise from a variety of vectors including internal investigations, those initiated by regulators and lawsuits from other organisations and individuals. But the speed at which they are executed, and the recognition of the value of expertise in investigations bodes well for the many requirements to come.

Hiring of external investigators

Forty-three percent of respondents reported bringing in external investigation expertise to support investigations of internal issues related to the conduct of the business while 38% use external experts for internal issues related to the conduct of employees. When an internal investigator does not have sufficient experience and the impartiality/credibility of the investigator is of concern, hiring an external investigator will further highlight that an employer has done their due diligence in the event that any possible litigation arises. Employees will also be more comfortable talking to a ‘neutral outsider’ regarding allegations than to an investigator who they may perceive to have internal bias.

Investigations in response to notices from a regulator, related to antitrust matters and notice from a regulator in response to whistleblower allegations also figured prominently with 28% of respondents citing that they routinely rely on external expertise for these.

The important question to ask when studying these statistics is: what can corporates do to protect themselves against the rising tide of investigations in the first place? Answers ranged from the simple: ‘Of course, we want to do the right thing,’ as one senior legal counsel from the automotives industry put it, to the more in-depth: ‘We want to protect the value of the business. Acting quickly is a win-win situation for us. We have demonstrable evidence that we acted as soon as we became aware of the issue, and we are able to stop any further damage being done. A wait-and-see approach in such a situation would be very risky and incredibly foolish.’

Legal Business partnered with OpenText to canvass leading European lawyers across from the DACH region on internal and external investigations. OpenText Legal Tech delivers investigations services that clients can trust for finding the facts quickly and cost-effectively in compliance audits, internal investigations and regulatory inquiries. We combine industry expertise, proprietary technology and advanced machine learning and analytics, along with proven processes.