Internal investigations in Germany

Protecting a company’s financial interests by creating a proper organisation and exerting adequate controls are core obligations of German directors. This requires managers to examine and investigate alleged misconduct or rumours of irregularities which they become aware of. Launching a thorough investigation is often the only means to ensure that potential wrongdoings can be identified and stopped. It can also be essential in order to take the necessary steps to prevent the reoccurrence of such misconduct.

Failing to initiate an investigation can have severe consequences. It will expose those responsible not only to civil liability for any damages and losses incurred by the company1 but also to penal law risks for breach of trust (Untreue), section 266 StGB (Criminal Code). Similarly, board members have a duty to supervise the management and take reasonable steps to investigate wrongdoing and improper performance in running the company. If directors and board members take insufficient steps to investigate any wrongdoing within the company or to properly respond to discovered misconduct, this also constitutes a violation of section 130 of the Administrative Fines Act (OWiG) and can be fined up to €1 million.

Even though the decision to launch an internal investigation is often clearly warranted, great care needs to be taken when designing the investigation. Internal investigations are subject to a multitude of rules, which need to be strictly observed. A company must ensure that it does not encroach upon the rights of the persons concerned, particularly data protection and labour law rights. Non-compliance during investigations can pose a compliance risk in itself (ie, it endangers the admissibility of evidence in civil and labour law matters and puts the investigators at risk for violation of penal and administrative offence rules).

Privacy and data protection

As far as personal data is concerned, privacy rules restrict internal investigations. Pursuant to section 4(1) of the Federal Data Protection Act (BDSG), the processing of personal data is permitted only if it is authorised, either by statutory or other means. Personal data (ie, all information containing the name of an individual or from which an individual can be identified) is everywhere: in books and data records as well as bookkeeping entries, and correspondence contains personal data of at least the sender and the recipient, often of other people as well. Privacy laws not only apply to electronic data but also to printed documents, notes and similar. Any use of personal data, including collection, review, storage, processing and transfer is subject to the provisions of the BDSG.

Generally, personal data may be used in internal investigations if the individuals concerned have given their consent or if use is authorised by law. Reliance on statutory authorisations is the preferred option as consent is effective only if given voluntarily and, in practice, active employees are free to withhold such consent without any drawbacks. The disadvantage of relying on consent is that the consent can be withdrawn at any time. In particular, sections 32 and 28 BDSG contain provisions on authorisation where the personal data of employees or other third parties is concerned. Both provisions provide for the weighing of the interests of individuals whose personal data is affected with those of the employer. Any use is permitted only if the employer’s interest outweighs the interest in confidentiality. Notwithstanding this, the interest in the use of personal data must be necessary, adequate and proportionate and the mildest means for achieving the intended results in the investigation. This requires each investigative step to be separately assessed and for the investigation to be designed in various steps from the outset in order to ensure that the inference of personal data is kept to a minimum. In case of alleged criminal conduct, section 32 BDSG requires that a criminal offence be suspected and that both this suspicion and the need to process personal data are adequately documented.

E-mail review requires special scrutiny as it must be ascertained that telecommunication secrecy does not apply. This is the case if the employer has prohibited the use of e-mails for private purposes. However, if private use is allowed or has not been restricted, it is disputable whether the employer has to be regarded as a telecommunication provider so that it is bound by telecommunication secrecy. Some state labour courts2 deny this, but a decision by the highest judicial authority is not yet available.

Particular attention must be drawn to privacy laws if the internal investigation is made at group companies and information containing personal data transferred to the parent company or other third parties, in particular if personal data is transferred to countries outside the European Union.

Appropriate agreements between the investigating entity and the data holder must be put in place prior to the commencement of any internal investigation. Usually, the investigator cannot be regarded as having been commissioned to process data as he or she will not work at the instruction of the data holder; there will be a transfer of functions since the investigator him or herself usually decides which investigative measures to use.

Consent of works council

Generally, internal investigations do not require the consent or information of the works council, in particular if they are directed against individual employees. However, participation rights pursuant to section 87(1) of the Works Constitution Act may exist if the investigation process affects a larger group of employees and has collective effects. This particularly applies if standardised questionnaires or technical means are used. Except where a labour-management agreement containing regulations on the review of electronic data has been concluded in the past, any e-mail review may require the consent of the works council irrespective of whether particular search software is used or data is processed with existing software.

Interviews of employees

Employees are obliged to participate in interviews and give correct and complete answers to all questions relating to their work duties including comments on other employees. They are obliged to answer all questions even if they have to admit to wrongdoing or poor performance. This does not apply to former and retired employees. Employees are not entitled to be accompanied by a member of the works council or a privately engaged lawyer during the interview unless the employer himself has instructed outside counsel for such interviews. Employees can neither request a list of questions prior to the interview nor ask for a certain procedure to be followed. In particular, the German Federal Bar’s recommendations on conducting interviews3are not binding.

It must be decided on a case-by-case basis whether formal written records of the interview are to be taken and signed by the employees or the interviewer is merely to take internal notes. Formal records can easily be used as documentary evidence in other proceedings but they will also be subject to disclosure in pretrial discovery. Furthermore, the employee has a right to request a copy of such documents. Notes are better protected but can be challenged by allegations of incorrectness, misunderstanding and misinterpretation.

In order to avoid facing a wall of silence, the employer can grant amnesty4 to employees, usually waiving damages claims and termination notice in consideration for full and accurate information by the employee. The employer has a wide discretion on whether amnesty is granted to a single or a broader group of employees; employees cannot generally demand equal treatment. Amnesty rules need careful consideration to exactly define the scope, conditions and consequences and their effects on other areas of law, particularly procurement law.

Attorney–client privilege

Attorney–client privilege protects attorneys, auditors and their assisting personnel from seizure of all documents obtained or created during an investigation and from being interrogated as a witness. Although not undisputed, it also covers third-party service providers assisting law firms or auditors, such as IT experts. Documents are subject to attorney–client privilege only if they are held in the possession of attorneys and auditors, whereas attorney–client privilege does not protect documents in the possession of the company or of witnesses.5 Attorney–client privilege also does not apply to in-house counsel or to internal auditing and compliance staff. They can be heard as witnesses to the observations made during the internal investigations or in information and reports received by the investigators. Attorney–client privilege can be waived by the instructing party at any time during or after the investigation.

Notification requirements

Under German law there is no obligation to report any wrongdoings to prosecutors or law enforcement agencies. However, in certain regulated industries a company is required to report misconduct to the regulatory authority. As regards tax matters, section 153 AO (Fiscal Code) provides that the taxpayer, its successors, its legal representatives and persons with power of disposal are obliged to inform the tax authorities without undue delay if they subsequently realise before the period of assessment has elapsed that tax returns were incorrect or incomplete. This notification requirement is incumbent on any of the previously mentioned position holders in person. Failure to notify the tax authorities in due time is a criminal offence (tax evasion, section 370 AO).

Immunity programmes, leniency programmes and cooperation

In cases of (intentional) tax evasion (section 370 AO), which often is committed together with bribery offences, or reckless understatement of taxes (section 378 AO) perpetrators can protect themselves from prosecution by voluntary self-disclosure pursuant to sections 371 and 378(3) AO provided that all requirements of law are met and none of the reasons for blocking exist. Otherwise, leniency programmes do not apply for other criminal offences except of cartel violations.6

Notwithstanding this, internal investigation and cooperation with law enforcement is a substantial mitigating factor for sanctions against companies and individuals. Prosecutors have discretion to refrain from indictment if there is no public interest in prosecution or if public interest in prosecution can be eliminated by imposing monetary conditions (payment of a certain amount of money to a charitable institution or to the treasury, which is not regarded a fine). Voluntary and early cooperation with law enforcement agencies is an important factor. Often prosecutors expect internal investigations to be carried out in the course of criminal investigations and companies to share their information, in particular if it relates to offences committed abroad. Voluntary disclosure to prosecutors requires detailed analysis. On the one hand, it mitigates administrative fines imposed on the company, on the other hand it will lead to forfeiture orders and damaged parties will gain access to the investigation files. Internal investigations are also essential for self-cleaning procedures under procurement law to avoid blacklisting or debarment.

Anti-corruption laws

German law penalises both bribery of public officials and commercial bribery as well as bribery of members of a legislative assembly. Although these differ in detail, the basic criminal act is to offer, promise or grant an unlawful benefit to a public official, employee or agent of a business or a member of a legislative assembly directly or to a third party. A benefit is anything of material or immaterial value, including cash, goods and services, travel, accommodation, leisure, side-employments or consultancy engagements even if the services provided are paid at market value. There are no de minimis limits. As a rule of thumb contributions below a threshold of €20 with respect to public officials or €50 for business partners will often be accepted unless made with the intent to bribe. It must be noted that contributions to third parties may qualify as bribes. Even the employer, the employing public institution or the principal of an agent may be regarded as a third party. Activities of public officials, employees and agents to the benefit of their employer can nevertheless be qualified as corruption. This applies in particular to the sponsoring of public institutions unless all applicable public law rules and regulations are met.

Public officials are civil servants at federal, state or local level, employees of public authorities and institutions or other companies and entities with a public remit, such as utilities. It is punishable if the contribution is made for the discharge of a duty of the public official (ie, each activity or omission related to the public official’s position or duties), irrespective of whether such duties are violated or not. Activities in which the public official has discretion, such as planning or purchasing decisions, are always regarded as violations of duties. Consent of the competent authority to a contribution can exclude criminal liability. However, in certain circumstances it may be difficult to identify which authority the competent authority is. Bribery of foreign public officials is punishable if the contribution relates to any future act or omission in which the public official would be in violation of his duties. Facilitation payments are prohibited with respect to German public officials, whereas they are prohibited with respect to foreign public officials if the expedited activity is in violation of the foreign public officials’ duties.

Commercial bribery applies to employees or agents of a business. Agents are anybody who has a contractual or other relationship with a business and can exert influence in decision-making processes. Contributions are prohibited if they are made to obtain or retain a preference against competitors in the purchase of goods or services. This not only applies to purchasing decisions but also to admission and qualification processes and all activities in the performance and execution of contracts. Contributions meeting the principles of free and fair trade are permitted, as well as contributions for maintaining business relations in general. However, the employer’s consent is as irrelevant as the fact that the intended purpose is in the employer’s interest. Thus, the scope of commercial bribery is wider than in many other jurisdictions.

Members of legislative assemblies, such as federal, state or local parliaments, are not regarded as public officials. Bribing such members requires that a benefit be provided either for a specific vote in an election or ballot or for the performance of any activity in connection with their mandate. Political positions, political donations or other contributions that are in accordance with rules and regulations of Parliament are exempt.

The granting of bribes will in most cases also constitute a breach of trust pursuant to section 266 StGB. In certain situations, bribery may also constitute fraud.

Since bribes are not tax-deductible, bribery is often accompanied by tax evasion. Both investigators and tax authorities are obliged to share information on suspicion of bribery and criminal investigations are often carried out by prosecutors and tax inspectors.

Prosecution of directors and managers

In recent years prosecutors have been particularly focusing on prosecuting directors and managers for misconduct. Generally, directors and managers are obliged to prevent crimes committed by the company, its employees or for the company’s benefit. Directors or managers actively participating in any wrongdoing will be prosecuted. Failing to take action on imminent criminal conduct or not following up on hints for illegal business practices might be interpreted as a tacit consent to such conduct and can be prosecuted for aiding and abetting an offence by omission. But even if directors and managers are not aware of criminal offences committed by employees or for the company’s benefit they may be subject to fines. Section 130(1) OWiG requires that they duly organise the company or any part thereof and exert sufficient control and supervision in order to prevent or impede the violation of rules on crimes or administrative offences. Violations of section 130(1) can incur a fine of up to €1 million.

Sanctions on companies

Prosecution of directors and managers for white-collar crime has increased in recent years, not only for corruption but for all kinds of offences. While German law does not yet acknowledge the criminal liability of corporate bodies, pursuant to section 30 OWiG, companies can be subject to administrative fines if directors, employees with managerial duties, proxy holders or persons entrusted with powers of supervision commit a criminal or administrative offence. The fines have been increased to €10 million and €5 million for every criminal and administrative offence, respectively. Furthermore, everything a company has obtained for or from an offence may be subject to forfeiture. The gross principle applies; costs and expenses cannot be deducted. The Federal Supreme Court held that in bribery cases, direct and indirect profits are subject to forfeiture,7 whereas in other cases of illegal contracts the entire turnover is to be declared forfeited.8 If companies have been the subject of an internal investigation and cooperated with prosecutors, this is a mitigating factor in sanctions against them.

Civil law consequences

If it turns out that directors committed or participated in criminal offences or if they failed to properly organise the company or to exert sufficient control and supervision the board is obliged to examine whether damage claims for intentional or negligent violation of duties exist and to assert such claims. There is only limited room for discretion. Failing to pursue damage claims will put the board at risk of being liable for damages and for the offence of breach of trust.


  1. Regional Court Munich, decision of 10 December 2013 – 5 HK O 1387/10.
  2. State Labour Court Lower Saxony decision of 31 May 2010 – 12 Sa 875/09; State Labour Court Berlin-Brandenburg decision of 16 February 2011 – 4 Sa 2132/10.
  4. For details on amnesty programmes see Pelz/Annuß, Amnestieprogramme – Fluch oder Segen? BB Spezial 4 (2010), page 14 et seq.
  5. Regional Court Mannheim, decision of 3 July 2012 – 24 Qs 1/12; 24 Qs 2/12.
  7. Federal Supreme Court, decision of 2 December 2005 – 5 StR 119/05.
  8. Federal Supreme Court, decision of 30 May 2008 – 1 StR 166/07.

Get unlimited access to all Global Investigations Review content