Principles and Guidelines for Internal Investigations in Germany

Introduction

Past and current cases show that non-compliant business conduct may have a significantly negative impact on a company’s financial capabilities and business prospects, both in its home markets and abroad. It is therefore more important than ever for companies to implement effective compliance management systems. Such systems should not only include strategies to prevent non-compliant behaviour, but also provide measures to detect and sanction misconduct. An essential element of detection is the internal investigation of suspected improper conduct.

In this way, it is possible to: (i) identify if there really is misconduct; (ii) take appropriate action to remedy the issue and minimise the damage; and (iii) improve the internal controls and processes ensuring that this misconduct does not occur again in the future.

In light of the above, an internal investigation can be defined as a formal procedure that seeks to establish whether obligations applying under the relevant law or internal corporate regulations have been violated, and possibly define the corrective measures.

In deciding whether to conduct an investigation, a company should take into consideration that internal investigations may have a positive effect with regard to cooperation with the authorities. Furthermore, investigations may help ring-fence liability risks and can cover not only liability risks of the company itself, but also of its directors and officers. Internal investigations may also limit reputational risks.

In Germany, the Siemens case in 2006 put a spotlight on investigations. While internal investigations were initially limited to US-related matters, they have become more and more a part of the corporate and criminal legal landscape of various European jurisdictions over recent years. In Germany, the current coalition agreement explicitly states the government’s intention to establish legal incentives to encourage companies to support governmental investigations by carrying out internal investigations and disclosing the findings to the public authorities.

Today, the majority of listed companies in Germany and an increasing number of medium-sized enterprises have implemented guidelines for conducting internal investigations. Even where such guidelines are not already in place, internal investigations are increasingly being triggered by, among others, proceedings initiated by public authorities or by the company’s own supervisory board.

However, there are no specific laws in Germany detailing how such investigations are to be conducted and that could serve as a guideline. This chapter will analyse the key questions that may arise when conducting an internal investigation in Germany and summarise the main principles that must be observed.

General aspects

Legal obligation to conduct an investigation

Under German law there are no specific legal provisions obligating companies to conduct an investigation. However, where there is reason to suspect a violation of law, other non-compliant business conduct or a breach of duty within the company, the management board has an obligation to investigate the suspicion to avoid their own liability under both corporate law and the law governing regulatory offences. Consequences as regards liability may result from the German Stock Corporation Act and the German Administrative Offences Act. Therefore, in practice, management has no discretion as to ‘whether’ to conduct an investigation, but it does have discretion as to ‘how’ the investigation is conducted (with internal resources only or with the help of outside counsel) and with regard to which measures are taken within the applicable legal framework.

Initiating an investigation

From a legal perspective, conducting an investigation could be regarded as a management task or might qualify as a specific instrument to supervise the company and its management. As a consequence, in many cases the question is whether it is the management board or the supervisory board that should be in charge (in a two-tier system) or whether the executive or non-executive directors should take the lead (in a one-tier system). However, as the saying goes, one should not put the fox in charge of the henhouse. In the event of a material involvement of management in the suspicious actions or alleged omissions, therefore, the task of setting up an investigation shifts to the supervisory board or the non-executive directors. At the time when an investigation is initiated, however, it is frequently not possible to say for sure whether the legal violations or infringements were limited to persons outside the board or not. Therefore, if an investigation is conducted within a company, it is necessary at the outset to be mindful of how a shift in responsibility from the management board to the supervisory board or from executive directors to non-executive directors might affect the investigation.

Sources of information

The main source of information in investigations is the company’s employees, in particular their personal recollection and knowledge of the case, as well as electronic data and other documents in their possession. It is, therefore, especially important to interview employees and review their data.

Other important sources of information for investigations are, inter alia:

• Any relevant business documents, files, working papers, project-related documents or emails associated with the purpose of the investigation.
• The company’s accounting data, which is usually accessed by the internal audit department during an investigation. It is very rare for an investigation to not include the accounts as part of the material under examination.
• Information from third parties, including suppliers, clients, business partners and competitors, that is provided in good faith and lawfully. Experience shows that very valuable information can come from third parties or people external to the company. It is best practice in compliance to have a whistleblower channel that is open to third parties and allows anonymised reporting.
• Freely accessible sources are also an important source of information for investigations. Public registries and courts are classic sources, but it is surprising how the internet and social media are gaining importance in investigations as a way of identifying wrongdoers or gathering information on suppliers’ or clients’ relationships with employees.

Conducting investigations

Specific legal provisions

In Germany, there are no specific legal provisions regarding the conduct and procedure of investigations. However, relevant legal provisions may be established in the near future, as the current coalition agreement explicitly provides for the introduction of legislation governing investigations, especially with regard to seizure of documents and searches.

Who should conduct the investigation?

Depending on the nature of the conduct in question and the scope of the investigation, a company has various options as to who should handle it. An investigation can be conducted by the company’s in-house counsel, the compliance department or the internal audit department or external experts (eg, legal counsel or auditors). Generally, it is advisable to engage external and specialised lawyers to conduct the investigation.

Particularly where sensitive measures are concerned, engaging outside legal counsel may allow the company to benefit, at least to a certain extent, from legal privilege and attorney work product confidentiality. As at the time of writing, neither audit nor forensics firms, nor in-house legal counsel enjoy legal privilege in Germany. With regard to external legal counsel, it is not conclusively clarified in Germany in which cases results of investigations (ie, investigation reports and interview minutes) are privileged and not subject to seizure by public authorities. However, investigations conducted by external legal counsel provide the best possible protection of legal privilege and confidentiality.

Roles of the compliance officer and the internal audit department

The compliance officer and the internal audit department play a key role in investigations. From the very beginning, when an investigation needs to be opened, the compliance and internal audit teams detect potential wrongdoings, internally uncover misconduct, and operate the whistleblower channels. During the investigation, the importance of the role played by the compliance officer and the internal audit department not only rests in their ability to gather and analyse all types of evidence, but also in their experience in ensuring the investigation complies with the law and internal policies. Once the investigation is concluded, the compliance and internal audit teams are mainly responsible for guaranteeing the appropriate upstream reporting along the reporting lines and for ensuring that the decisions made in light of the investigation are implemented effectively.

In addition, it is important to highlight that the top-end corporate governance bodies do not always get involved in investigations to the same extent. In some cases, particularly in those with limited exposure, it is the compliance officer or the internal audit department that leads the investigation.

Mandatory legal requirements when conducting interviews with employees

Works council consent

Interviews with employees as part of an investigation into a specific case generally do not require the works council’s consent. Co-determination rights of the works council may be triggered if the employer selects the group of interviewees pursuant to abstract and general criteria (eg, as part of a preventive investigation) or conducts interviews based on standardised questionnaires or with the help of IT tools. Works agreements concluded with the works council can stipulate a specific process to be followed during the investigation and provide the works council with further rights.

Works council representatives in employee interviews

Statutory law provides for very limited cases in which a member of the works council can, upon the request of the employee, participate in an employee interview; that is, if the interview concerns the calculation and elements of the employee’s remuneration, performance appraisal or career development, or if the employee consults his or her personnel file. These conditions are usually not fulfilled in interviews as part of an investigation. Further rights of works council members to participate in interviews can be provided in works agreements. In practice, interviewees are frequently granted the right to be accompanied by a member of the works council to enhance their willingness to provide information.

Employees’ obligations

Employees are obliged to participate in interviews conducted by their employer or lawyers representing their employer. They are obliged to provide full and true information on their employment duties (tasks and responsibilities, including supervision duties if these are part of their function), their conduct in the business, and impressions they gained in performing their duties, even if this means incriminating themselves or other employees. Under current employment law, a right to remain silent with regard to one’s employer does not exist. This might change in the future if the envisaged legislation is introduced on criminal liability of companies that might give employees a right to remain silent to avoid incriminating themselves. In practice, employee interviews are sometimes organised according to criminal procedure standards to avoid having different standards with regard to obligations to testify (eg, if the employer cooperates closely with the prosecution authorities and provides them with interview minutes).

The right not to incriminate oneself

The constitutional right not to incriminate oneself only applies in criminal proceedings with regard to public authorities, not in investigations with regard to one’s employer or the corporate investigator. The conflict between the obligation to make truthful disclosure to one’s employer and the criminal procedural right to remain silent has to be resolved by the prosecutors. As the investigation is conducted by private individuals, the German Criminal Procedure Code and its provisions protecting the suspect in the course of criminal proceedings do not apply. However, with respect to the fair trial principle and the rule of law, there are – depending on the individual case – certain possibilities to instruct and inform the employees (eg, about possible consequences under labour law or the possibility to consult legal counsel). The guidelines drawn up by the Federal Chamber of Lawyers for this purpose may serve as points of reference in this area; however, they are not binding.

Cooperation of employees during the investigation

Measures to encourage employee cooperation

There are several measures intended to encourage employees to cooperate during an investigation, in particular various amnesty or leniency programmes; for example, the waiver of employment law measures, the waiver of assertion of claims for damages, assumption of the costs for the employee’s legal counsel and a guarantee of confidentiality. On the other hand, it is not possible to protect employees against potential investigations by public authorities. Rewards for whistleblowers are not common in Germany.

Leniency programmes

Setting up an internal leniency programme for employees is more common practice in antitrust investigations than in white-collar investigations. Nevertheless, the option to offer a leniency programme always has to be considered carefully. In appropriate cases, tailor-made programmes can significantly accelerate the investigation and improve its results. For example, in antitrust cases it would be very difficult, if not impossible, for the company to fully clarify the facts and successfully apply to the authorities for leniency without the full cooperation of its employees. Collusive behaviour usually takes place in a covert way, leaving little traces in the company’s documents and data – all the more so with regard to employees who have received antitrust and compliance training and are therefore fully aware of the illegal nature of their behaviour. Their testimony constitutes the key evidence that the company needs to secure a substantial cooperation bonus with the competition authorities. The company therefore faces the dilemma that it most likely will not be able to minimise the risk of financial sanctions by filing for leniency unless it offers its employees internal leniency to ensure their full cooperation, even though they deliberately violated the law and the corporate compliance programme. Therefore, companies usually try to limit internal leniency to what is strictly necessary to get sufficient cooperation from employees and balance it with the need to protect the credibility of its compliance programme. If senior management is involved in the alleged wrongdoing, the granting of internal leniency might need approval from shareholders or the supervisory board.

Data protection requirements for conducting investigations

Electronic devices and data

As far as personal data is concerned, privacy rules and data protection laws restrict investigations. The law provides for a balancing test between the legitimate interests of the company in sourcing the personal data and the privacy interest of the employee. According to this, a review of electronic devices or electronic data is only permitted if: (i) statutory law allows the review of personal data; and (ii) the company’s interests prevail. According to German law, initial suspicion of a criminal offence, which is documented, constitutes a valid legal reason to review personal data. Further, the balancing decision must also be documented. The scope of the review in terms of subjects and data must be limited to what is strictly necessary for the purposes of the investigation. Furthermore, the review or use of personal data must be adequate and proportionate when it comes to achieving the intended results in the investigation. In cases where employees are allowed to use their email accounts and devices for private purposes, all private emails and documents must be screened out as the first step of the investigation and left unreviewed.

Sharing information internally

The company can use personal data for sharing information without obtaining prior consent from the data subject if it is necessary to safeguard legitimate interests of the data recipient, provided that there is no overriding interest of the data subjects in having their data excluded from the data transfer.

If the data recipient is situated outside the EU, one must establish that the country has been recognised by the EU Commission as having an adequate level of data protection. Otherwise, additional safeguards must be applied (eg, by entering into a data protection agreement on the basis of the EU model clauses).

Sharing information externally

With regard to authorities in Germany and other EU member states, the company is entitled to share personal data if it is either obligated under statutory law to disclose the data in question or if it has at least a legitimate interest in sharing the data in question that is not overridden by conflicting interests of the data subject. Data transfers to public authorities in non-EU member states that have not been recognised by the EU Commission as having an adequate level of data protection are permissible only if an exception pursuant to article 49 of the General Data Protection Regulation applies (eg, if the transfer is necessary for the exercise or defence of legal claims).

Electronic data in civil lawsuits

The disclosure of personal data for the purposes of a civil law suit is permissible under the same prerequisites that apply to the sharing of data with public authorities.

Dealing with public authorities during investigations

Informing public authorities

There is no legal requirement to inform public authorities about a planned or ongoing investigation. However, particularly in cases where public authorities have already initiated proceedings against the company, it is advisable to inform the relevant authorities and coordinate the investigation (especially interviews with employees) with them to ensure that official investigations are not jeopardised and avoid negative consequences for the company.

Disclosure and self-reporting

Management and the company are generally not obliged to disclose and self-report suspected corporate compliance violations to public authorities. However, a reporting obligation can exist in the following cases, inter alia:

• serious criminal offences (eg, robbery and blackmail by using force against a person or threats of imminent danger to life or limb, but not in cases of typical compliance violations like bribery, fraud, embezzlement and abuse of trust);
• factual circumstances that indicate that the assets or property connected with a transaction or business relationship are the product of money laundering; and
• where a taxpayer realises after the fact (before the period for assessment has elapsed) that a tax return submitted by or for him or her is incorrect or incomplete.

Attorney–client privilege

In Germany, there is no legislation that expressly address the attorney–client privilege and the protection of documents created in the course of investigations. However, according to current draft bills, legislation of this kind may be introduced in the future.

In the meantime, whether such documents can be seized has to be assessed based on the provisions of the Criminal Procedure Code and the relevant – inconsistent – case law. Generally, when work products of investigations are not subject to seizure has not been established for certain. As a rough guide, the following may apply:

• If proceedings are initiated against the company or if the company becomes involved in criminal proceedings before the investigation opens, the work products are probably not subject to seizure (however, in practice, the prosecution often orders the participation of the company at a very late stage of the proceedings).
• Some regional courts have confirmed that documents are protected against seizure if criminal proceedings have not yet been opened against the company, but are likely to be in the near future. According to the German Constitutional Court, it is not imperative – with respect to the German Constitution – to guarantee the protection of documents against seizure in cases where criminal proceedings are only foreseeable. However, the Court finds it acceptable to confirm protection against seizure where objective criteria suggest that the company may become involved in the criminal proceeding. However, the details of the criteria that must be applied for this are unclear. Moreover, in practice they are interpreted very restrictively, so that the vast majority of relevant court rulings result in documents from an investigation being seized.
• In all other cases, the prevailing opinion has it that work products of investigations are subject to seizure.

Strategies to de facto limit searches and seizures

The most effective method of de facto limiting searches and seizures is to cooperate with the authorities and establish a relationship of trust. Within the scope of cooperation, the company can, for example, offer to conduct an investigation and share the results (or at least some of them) with the authorities. If the authorities ask for specific documents, these can be selected and voluntarily handed over to the authorities.

Cooperation with public authorities

German antitrust law provides guidelines as to how cooperation by the defendant will be considered by the investigation authority in its decision. No other areas of the law provide for comparable rules. Thus, the extent to which cooperation is rewarded in the setting of the amount of a fine is a matter for the discretion of the investigating body – or, later on, the deciding court.

In practice, when determining the amount of a regulatory fine or issuing an order for confiscation, German public prosecutors usually take into account a company’s cooperation with the authorities in the form of an investigation of the facts and a subsequent disclosure of the findings. For companies that cooperate, the sanction is regularly significantly lower. According to a recent Federal Court of Justice judgment, the authorities have to consider the efficiency of the compliance management system in place in the company and its efforts to optimise this and remedy existing shortcomings in the aftermath of a compliance violation as mitigating factors when calculating a fine.

Only antitrust authorities restrict access to their files for such interested third parties, whereas prosecution authorities and authorities in administrative offence investigations are obliged to provide access to the files for anybody who can claim a ‘legal interest’ (eg, as a victim of the offence).

Disclosure of critical information in case of a settlement

Under German procedural rules, a settlement only occurs in the form of a ‘negotiated’ order issued by the public prosecution authorities or the courts. The order will focus on the fine and on the disgorgement of profits. A settlement in the form of a deferred prosecution agreement or a non-prosecution agreement is currently not possible.

New laws (eg, the Anti-Money-Laundering Act and laws regulating the financial industries) provide for disclosure rules and a ‘naming-and-shaming’ approach if an administrative fine is imposed. However, in the field of criminal convictions, disclosure of this kind is limited by data protection laws, and sometimes it can be negotiated with the authorities that the settlement and the issue remain confidential.

In corruption and antitrust proceedings, inter alia, fines can be entered in public procurement registers, even if they were imposed as part of a settlement. This may also provide information on the procedure to those entitled to inspect the registers.