First it was ”Corporate governance” that came into focus around the turn of the millennium. Corporate governance is all about how corporations are controlled and operated. Governance structures and principles aimed to identify the allocation of rights and responsibilities among different participants in the corporation and to include the rules and procedures for making and executing decisions.

Then came ”Compliance”, i.e. conforming with rules and requirements. Compliance can be achieved through management processes which identify the applicable requirements (defined for example in laws, regulations, codes of conduct, contracts, strategies and policies), assess the state of compliance, assess the risks and potential costs of non-compliance against the projected expenses to achieve compliance, and prioritize and initiate any actions deemed necessary.

Recently ”Whistleblowing” emerged on the agenda of corporates. A whistleblower is a person who exposes information or activity that the whistleblower deems illegal, unethical, or not correct within the organization. The alleged wrongdoing can be classified in many ways: violation of company policy/rules, laws or regulations. A whistleblower may expose e.g. fraud or corruption. The EU has just passed legislation protecting whistleblowers.

After ”Corporate governance”, ”Compliance” and ”Whistleblowing” comes ”Internal investigations”. It is the logical next step when compliance fails, whistles have been blown and there are suspisions of wrongdoings.

What do we need to understand about internal investigations?

An internal investigation is an investigation instigated by a company’s management or board to find out whether a breach of compliance/a wrongdoing has occured, without (at least initially) engaging the authorities. The goal is to identify the problem so as to allow for its rectification.

There are no uniform rules for how an internal investigation is to be conducted.

Some of the best known internal investigations that have led to published reports in the Nordics have been by Telia, Nordea and Danske Bank. Each of these investigations have been related to suspisions of serious misdoings by employees of the companies in question.

It is interesting to note how different the reports are. Two of the reports have been prepared by external law firms and one by the corporate’s own organisation. The internal investigation carried out by the corporate’s own organisation was validated by an external law firm.

So what should the management or the board think of when considering instigating an internal investigation?

The following is a brief list of certain key issues to consider when launching an internal investigation:

• The objectives of the investigation
• The scope of the investigation
• The method for reporting of findings
• Publicity and media
• Possible legal exposure
• The identity of the investigator
• The independence of the investigator

It can be argued that the result of an internal investigation is all the more reliable the wider the scope, the more transparent the process and the more qualified and independent the party conducting the investigation.

But situations vary and one size definitely does not fit all when it comes to internal investigations. There is no one right recipe for how to best further the interests of a company in a situation where suspisions of wrongdoings emerge.

Wrongdoings and even potential wrongdoings by high-profile corporates always raise a lot of public interest and may significantly affect the brand value and share price of the company in question.

Since internal investigations are carried out under sensitive circumstances, it is important that the investigation itself is carried out properly and without breaching any rules or violating any rights of employees or third parties.

Above all, it is crucial to really understand all the implications of publicity or secrecy around potential misdoings.

An internal investigation may be the right first step in a number of different scenarios involving potential compliance problems or serious potential wrongdoings. But a responsible management or board needs to carefully consider how to use this diverse tool.