Focus on: GUIDE TO INTERNAL INVESTIGATIONS: THE INVESTIGATOR’S PLAYBOOK

Paksoy

Paksoy logo View Firm Profile

A. OVERVIEW

Although the term “compliance” lacks a uniform definition, it is typically understood in corporate law as ensuring that companies and their activities adhere to applicable laws.

Broadly, compliance means that a company, its board members, and employees act in line with laws, ethical principles, internal policies, and regulations. It also involves the process of reviewing whether company operations comply with these standards.

A key function of compliance processes is internal investigation. Effective investigations identify the causes of compliance violations, how they happen, and their consequences. These investigations help detect, prevent, and mitigate losses while also preventing potential future losses by implementing corrective actions.

Compliance violations not only create legal and financial risks but also threaten a company’s principles, ethical culture, and trust environment. Therefore, internal investigations are crucial to ensure company activities comply with laws, internal policies, and contracts, thus safeguarding workplace welfare.

Additionally, conducting investigations is part of an employer’s duty of care to protect and oversee employees, making it a legal obligation.

B. THE DECISION TO INITIATE AN INTERNAL INVESTIGATION

Before starting an investigation, it must first be determined whether the conduct in question violates the law or company policies. This involves assessing whether there is enough suspicion to justify an investigation. Launching an investigation without sufficient grounds may harm workplace culture and expose the company to liability.

The responsible party must ensure they have adequate information before making a decision. If necessary, a confidential preliminary review should be conducted to gather additional facts, which may involve contacting the reporting party for clarification.

C. OBJECTIVE AND SCOPE OF THE INTERNAL INVESTIGATION

Once initiated, the investigation’s objectives and scope must be clearly defined to avoid inefficiencies and ensure effective outcomes. Besides uncovering facts, investigations may aim to:

  • Reinforce that misconduct will not be tolerated,
  • Detect and address inappropriate behavior,
  • Identify responsible individuals,
  • Assess company liability,
  • Identify gaps in internal controls,
  • Manage legal or regulatory risks.

The scope should define which allegations will be investigated, potentially limiting it by geography or specific workplace settings.

D. THE STAGES OF THE INTERNAL INVESTIGATION

Each internal investigation is unique and should follow a procedure suited to its specific characteristics. Generally, the process consists of three main stages, (i) preparation, (ii) collecting evidence, conducting interviews, and examining evidence, and (iii) reporting.

Additionally, sanctions and corrective actions taken after the investigation’s conclusion are closely tied to its findings and may be considered part of the overall process.

1. PREPARATION

a)  Initial Analysis in an Internal Investigation

During the preparation phase, the available information must be assessed to determine key aspects of the allegation, including identifying the parties involved, the nature of the claim, and any supporting evidence. It is essential to establish when and where the incident occurred, whether it is ongoing, and its potential consequences. The investigation should also consider who may be involved or aware, where relevant evidence can be found, and if preservation measures are needed. Internal communication should be managed carefully, deciding who to inform and who to keep unaware. External experts like IT specialists or forensic accountants may be consulted if necessary.

b) Who Should Conduct the Internal Investigation

When conducting internal investigations, it is crucial to identify the necessary expertise, which may include areas such as law, internal audit, human resources, finance, information technologies, forensic accounting, and translation. The investigation team should be formed based on the specific needs of the case.

When assembling the team, key considerations include:

  • Ensuring no conflict of interest, superior-subordinate relationships, or close personal connections exist between team members and the individuals under investigation, even if these are not formally considered conflicts of interest.
  • Maintaining an appropriate team size to avoid unnecessary delays or complications in decision-making.
  • Selecting members based on the specific requirements of the investigation and ensuring they possess the necessary competencies.

Once the team is determined, appointing a leader from within the group and assigning responsibilities will enhance the process’s efficiency. In companies lacking internal investigation expertise, it is advisable to have an experienced legal counsel lead the team.

c) Duration of the Internal Investigation

It is crucial for the investigation to be conducted thoroughly and prudently, while also being completed as soon as possible. The time between receiving information that necessitates the initiation of the investigation and deciding to initiate it should be as short as possible.

Once the investigation decision is made, the planning and execution should follow a pace and timeline that appropriate to the investigation’s scope, avoiding unnecessary delays. The duration should be realistically determined based on the specific circumstances, ensuring that critical steps are not skipped in an effort to completing the process.

When determining the investigation’s timeline, several factors must be considered, including:

  • Internal policies and regulations of the company,
  • Legislative provisions that may be relevant to the subject of the investigation,
  • Term-related provisions of contracts made with third parties that may be affected by the outcome of the investigation,
  • Company’s reporting or notification obligations,
  • Deadlines for investigations or lawsuits to which the company is a party

d) Utilization of Resources

During the planning phase, it is essential to evaluate which resources may be required for the investigation, identify available internal sources, assess their appropriateness for the specific case, and determine if external resources will be required.

Common external resources needed for investigations include:

  • Law,
  • Information technologies,
  • Forensic accounting,
  • Security.

Planning resource usage in advance and initiating confidential communication with potential third-party providers can be helpful before the need arises.

e) Precautions to Apply During the Internal Investigation Process

Certain precautions may be necessary during the investigation concerning employees or third parties to preserve evidence, maintain workplace peace and tranquillity, prevent interference, protect the company from losses, or minimize damages. These precautions must comply with applicable laws, company policies, or contracts. They should also be appropriate for their purpose and proportionate to the circumstances. To ensure proportionality, it is necessary to assess whether less restrictive measures could achieve the same outcome.

i. Precautions for Employees

Precautions for employees during an internal investigation may include placing them on administrative leave (commonly referred to as garden leave), requiring the use of accumulated annual leave, or, in certain circumstances, unpaid leave.

Garden Leave

To ensure effective and uninterrupted internal investigations, it may be necessary to suspend employees’ employment. This precaution prevents them from accessing workplace systems, information or communicating with other employees and customers, thereby the risk of altering or destroying evidence.

Garden leave is a commonly used method for employment suspension in international companies operating in Türkiye. It refers to the period during which an employee is required to stay away from the workplace while continuing to receive wages and social benefits.

Although Turkish law does not explicitly regulate garden leave, it is recognized based on the principle of freedom of contract and mutual agreement between the employee and employer. Garden leave can be established through:

  • as a provision in the employment contract,
  • by a separate agreement,
  • internal company policies and regulations that the employee has been proven to acknowledge.

If garden leave is not clearly regulated in the employment contract or company policies, it is recommended to obtain the employee’s approval before implementing it as a precaution during the internal investigation.

Failure to do so may result in adverse legal consequences. Courts may interpret this as an implied termination by the employer. Alternatively, if the employee terminates the contract with just cause due to being placed on garden leave without consent, the termination may be upheld as legitimate.

ii. Precautions for Third Parties

Depending on the subject of the investigation, additional measures may include suspending contracts with third parties, temporarily halting certain contractual performances—such as product supply—or taking other steps aligned with contractual terms and fundamental principles of the law.

Even when a contract is entirely executed in Türkiye between Turkish entities, international obligations may still apply if one party belongs to a company group based in the U.S. or the U.K. In such cases, compliance with key legislation such as the Foreign Corrupt Practices Act (FCPA)1 and the UK Bribery Act (UKBA) is important, particularly in the context of the combat against corruption and bribery.

For instance, if the commercial partner of a U.S. based Turkish company in Türkiye engages in trade with sanctioned countries, U.S. sanctions may become relevant due to the extraterritorial application of sanctions legislation.

In cases where international sanctions arise, it is crucial to follow these steps, unless the specific situation necessitates a different approach:

  • Determine whether the contracts with the party under investigation include provisions regarding violations of national legislation or international sanctions,
  • Conduct a legal evaluation of established commercial practices within the scope of the ongoing commercial relationship with the party under investigation,
  • Decide whether the current relationship should be suspended until a legal determination is completed,
  • Assess whether the contract includes provisions requiring the procurement of information and documents from the party under investigation,
  • Submit formal and contractual notifications related to the contract to the party under investigation,
  • Manage correspondence and negotiations with the party under investigation during the investigation.

iii. Other Precautions

The investigation team may also decide on additional measures beyond those previously mentioned. For example, alternative precautions appropriate to the situation might include suspending activities or prohibiting the destruction of information and documents to preserve evidence within the company.

2. COLLECTING EVIDENCE, CONDUCTING INTERVIEWS AND EXAMINING EVIDENCE

a) Types of Evidence

The types and sources of evidence collected during an investigation vary depending on the case. While some investigations rely solely on employee interviews, others may be entirely document-based. In general, evidence falls into three main categories (i) oral evidence, (ii) written evidence, and (iii) digital evidence.

b) Sources That Evidence Can Be Obtained

  • Computers, mobile phones, other communication devices,
  • Computer log records,
  • Correspondence on platforms such as e-mail, WhatsApp, Teams, etc.,
  • Images or visuals from communication devices,
  • Documents obtained through physical examination at the workplace,
  • Various internal records such as employee entrance and exit logs, financial records, personnel files,
  • Workplace camera recordings

c) Precautions Can Be Taken to Prevent Damage to Evidence

If there is a risk of evidence being altered, destroyed, or forged, preventive measures may include (i) placing the individual on leave, garden leave, or unpaid leave, (ii) recalling company-owned devices provided to the employee for work purposes, (iii) changing personal passwords to secure access, (iv) revoking remote access permissions, or (v) backing up electronically stored items.

d) Key Considerations in the Production and Examination of Evidence

  • The evidence to be collected must be directly relevant to the subject and scope of the investigation.
  • Necessary precautions should be taken to preserve the evidence if there is a risk of alteration or destruction
  • The process must respect rules regarding the protection of personal data, confidentiality principles, internal company policies, and constitutional rights and freedoms, such as the right to privacy and freedom of communication.
  • The legality of the collected evidence should be carefully evaluated and ensured at every stage, as evidence obtained through illegal means will not be admissible before judicial or administrative authorities in potential litigation.
  • Information technology tools can be utilized to identify investigation-related data within the collected evidence.

e) Considerations for Preserving Evidence

  • Ensure that irrelevant evidence is excluded from the set of evidence retained after collection.
  • Preserve the evidence in an appropriate chronological order or maintain a clear chain of custody.
  • Decide on the physical and electronic storage locations for the evidence during the examination process.
  • For a large volume of digital evidence, consider creating a virtual data room, encrypting it, and implementing a system to protect the database from external hacking attempts—such as firewalls. If such measures are taken, it is crucial to determine who will have access to the data room and the hardware or software to be used for its security.

f) Obligations Regarding the Protection of Personal Data in Internal Investigations

Compliance with personal data protection legislation is critical throughout every stage of internal investigations. In this context:

  • It should be assessed whether the explicit consent of the relevant employee is required or whether the situation falls within the scope of the exceptions listed in Articles 5 and 6 of the Law on Protection of Personal Data No. 6698 (“PPD”).
  • For internal investigations of an international nature, it should be evaluated whether the conditions specified in Article 9 of the PPD regarding the transfer of personal data abroad are fulfilled.
  • Employees or data subjects should be informed of the purposes for which and how their data will be processed.
  • When engaging third-party services, protocols should be signed to ensure the confidentiality and the security of the relevant data.
  • Personal data should be anonymized, deleted or destroyed as soon as the purpose of the investigation has been fulfilled.

g) Considerations During the Examination of Employee’s Means of Communication

To ensure compliance with the law and respect for employees’ rights, the general principles in line with the Turkish Supreme Court in its landmark decisions regarding the examination of employees’ communication tools for evidence are as follows:

  • Legitimate interest: The employer must have a valid reason for the inspection, balancing the interests and rights of both parties.
  • Prior notification: Employees should be informed in advance about the potential examination, ideally in writing and acknowledged by the employee.
  • Purpose and scope: The employer’s actions must be directly related to and limited by the purpose they seek to achieve.
  • Proportionality: It must not be possible to achieve the same objective with less intrusive measures, and the intervention must be necessary to achieve the intended purpose.

h) Important Factors Should Be Taken Into Consideration During Physical Inspections At The Workplace

According to the Supreme Court decisions, physical inspections conducted in areas such as offices, desks, cabinets designated for the employees can be considered lawful under the following conditions:

  • With the employee’s consent,
  • In the presence of a superior special interest,
  • In the presence of a superior public interest,
  • When authorized by law.

Otherwise, the intervention may be considered to be against the right of privacy.

To avoid a potential legal violations, it is recommended that the internal regulations of the company should clearly and explicitly define the circumstances under which the physical areas used by the employees can be inspected or searched. Clear and detailed internal policies can help courts assess whether the condition of consent has been met.

i) Impact of the Timing of Obtaining Evidence from Employees’ Communication Devices on the Investigation Process

Delays in obtaining copies or image records of computers or phones identified as evidence during an audit can compromise their integrity and usability. Therefore, image records must be secured immediately upon seizing the devices.

In 2022, the 9th Civil Chamber of the Court of Appeal ruled that emails from the devices could not be used as evidence because the authenticity of the image records could not be verified. This ruling was based on the fact that the image records of the employee’s computer and phone were taken one year after the devices were seized.

j) Principles That Will Be Considered Throughout the Interview Process

One of the key methods for obtaining critical information in an internal investigation is interviewing individuals who may have witnessed the alleged violation or have relevant knowledge.

  • Preparation: Investigators must thoroughly understand the investigation’s subject and review all available documents and evidence beforehand.
  • Planning: Interviews should be carefully scheduled and structured, but investigators must remain flexible to handle unforeseen situations.
  • Impartiality: A fair and objective approach is essential. Investigators should avoid accusatory or confrontational attitudes unless necessary for specific interview techniques.
  • Confidentiality: Information obtained during interviews must remain confidential, though some details may need to be disclosed for investigative validity.

Disclosing investigation details to the entire company is generally discouraged to maintain confidentiality and effectiveness. However, key individuals, such as managers or essential employees, may need to be informed to facilitate document preservation and interview arrangements.

k) Determine The People Who Are Going To Be Interviewed

The list of interviewees is typically determined in advance, though investigators should remain flexible if new information arises. To avoid delays, only those directly relevant to the investigation should be included. While the approach may vary, it is generally recommended to notify interviewees in advance to allow preparation. Interviews should be conducted individually, with the interviewee’s position and seniority considered. It’s often more effective to organize interviews based on seniority and the incident’s timeline, starting with individuals with minor connections and ending with key figures central to the investigation. This approach helps build a clearer understanding of the case.

I) Preparing For The Interview

Thorough preparation is crucial since there may not be a chance to interview the same person again. Before conducting interviews, key documents like the code of conduct, investigation policies, and organizational charts should be reviewed. Organizing collected evidence chronologically can also enhance the interview process.

Temporary measures to preserve evidence, such as restricting computer access, should be taken before sending interview invitations. The interview venue should be assessed and adjusted as necessary. When notifying interviewees, provide only brief and general information about the investigation.

While preparing questions in advance is helpful, investigators should remain flexible, adapting to the interviewee’s responses. Interviews should be conducted by experienced professionals, with external experts preferred to ensure impartiality. Ideally, the interview team should include a moderator and a note-taker, with legal expertise being beneficial.

The interview environment should be secure and comfortable, ensuring objectivity and fairness. Investigators should avoid biases, build trust, and maintain a polite, patient tone. An accusatory tone should be avoided unless used intentionally as a technique.

Interviewees should not be informed of the specific purpose of their statements and should be assured of confidentiality. When multiple witnesses are involved, they should be interviewed separately to check for consistency in their statements. Open-ended questions should be used, and investigators should avoid directive reactions.

Interviewees should not feel legally obligated to participate and should be reminded they can end the interview at any time. Requests for an attorney should be allowed, but the attorney’s role should be strictly observational. If an employee refuses to participate, they should be reminded of their labor law obligations.

Interviews should be recorded in written minutes that accurately reflect the discussion. The interviewee should review and confirm these minutes for accuracy. The method of documentation should be determined based on the investigation’s specific risks and needs.

3. REPORTING

The information and findings from an internal investigation should be documented in a written report and properly concluded. The key principles governing the reporting process are as follows:

  • Accuracy: All information in the report must be accurate and verified, with supporting documents attached to substantiate the facts and enhance credibility.
  • Clarity: The report should be written in plain language, avoiding technical jargon where possible, or explaining it when necessary, to ensure it is accessible to third parties.
  • Impartiality: The report must maintain an objective tone, free of subjective language, personal opinions, or emotional reflections, to preserve its integrity.
  • Level of Relevance: The report should focus exclusively on findings related to the alleged violation, excluding irrelevant details, or observations that do not pertain to the investigation’s scope.
  • Timeliness: The report should be prepared promptly, ideally during the evidence collection phase, to ensure findings are captured accurately and without unnecessary delays.

a. Content of the Report

An internal investigation report typically consists of the following sections:

  • Background of the allegation and the facts on which the allegation is based
  • Executive summary
  • Objective, subject and scope of the investigation
  • Method adopted in the investigation
  • Findings
  • Conclusion
  • Corrective actions and steps to follow

It is standard practice for investigators to avoid expressing personal opinions, especially on matters outside their expertise, such as determining an employee’s guilt. However, when attorneys are part of the investigation team, their legal expertise enables them to provide qualified opinions on legal matters. In such cases, investigation reports involving attorney investigators may include legal analysis, assessments of violations and their consequences, as well as recommendations for corrective actions.

E. SANCTIONS

1. Criminal Sanctions

Actions identified during an internal investigation may constitute criminal offenses under applicable laws, particularly the Turkish Penal Code No. 5237 (TPC). Whether a violation qualifies as a crime under Turkish criminal law depends on whether the criminal elements specified in the relevant legal provision are met.

Some common crimes that may arise from detected violations include:

  • Fraud (TPC Art.157)
  • Robbery (TPC Art.141)
  • Insider Trading (Capital Market Law Art.106)
  • Abuse of Trust (TPC Art.155)
  • Bribery (TPC Art.252)
  • Corruption (TPC Art.247)
  • Forgery (TPC Art.204)
  • Laundering Property Values Resulting from Crime (TPC Art.282)

2. Administrative Sanctions

The detected violation may fall under regulations requiring the imposition of an administrative fine by authorities such as the Personal Data Protection Authority, Competition Authority, Banking Regulation and Supervision Agency, Insurance and Private Pension Regulation and Supervision Agency or other regulatory and supervisory institutions. In such cases, the relevant authority may impose administrative fines or sanctions depending on the nature and severity of the violation.

3. Disciplinary Sanctions

Following an internal investigation, if it is determined that an employee’s behavior violates laws or company policies, disciplinary sanctions may be applied based on the severity of the violation. Common sanctions include (i) issuing a written warning, (ii) imposing a wage deduction, or (iii) terminating the employee’s employment contract.

Workplace regulations may specify additional sanctions or procedural requirements beyond legal obligations. Therefore, it is essential to review workplace policies and procedures carefully to ensure compliance with both internal regulations and legal requirements. The disciplinary process must be conducted according to established internal processes.

Termination as a Disciplinary Sanction

Termination of an employment contract, as the most severe labour law sanction, may result from an internal investigation and must be based on either a valid reason or just cause.

Termination for Valid Reason

Valid reasons arise from the employee’s competence, behavior, or business requirements. These reasons, while serious, do not meet the threshold for just cause under labour law.

Key Requirements:

  • Written Notification: Termination must be communicated in writing.
  • Clear and Precise Reasoning: The reason must be stated clearly.
  • Right to Defence: If termination is due to behavior or incompetence, the employee must have the opportunity to to present their defence beforehand.

Termination for Just Cause

Under Article 25 of Labor Law No. 4857 (“Labor Law”), just causes typically involve serious misconduct or significant breaches of duty.

Key Requirements:

  • Time Limits:
    • Must be exercised within six business days of the employer becoming aware of the violation.
    • Cannot exceed one year from the date of the violation.
  • Forfeiture of Rights: If time limits are not met, termination for just cause becomes invalid.
  • Ongoing Investigations: The six-day period starts from the issuance of the investigation report, though a preliminary or executive summary report can also trigger the time period.

F. CORRECTIVE ACTIONS

It is crucial to evaluate corrective actions after each investigation and integrate them into company policies to prevent future incidents. Key corrective actions include:

  • Addressing open issues that allow violations and reviewing internal processes.
  • Aligning internal policies and regulations with best practices.
  • Assessing the compliance structure and, if needed, appointing a compliance officer or department.
  • Conducting routine ethics and compliance inspections for ongoing adherence.
  • Reviewing compliance policies for effectiveness and relevance.
  • Evaluating the whistleblowing mechanism—improving it if needed or establishing one with an associated policy.
  • Communicating compliance messages effectively to employees and third parties.
  • Reviewing internal compliance training programs for content, frequency, and effectiveness.
  • Evaluating compliance clauses in supplier and customer contracts for proper protection and alignment with compliance objectives.

About Our Compliance and Investigations Practice

Paksoy advises clients on anti-bribery and corruption reviews and supports them on investigations carried out by administrative authorities including tax authorities, market regulators and customs administration, as well as with compliance checks in connection with the FCPA and UK Bribery Act.

Paksoy’s compliance practice covers assisting clients with FCPA/anti-corruption due diligence on merger and acquisition targets, as well as in internal compliance trainings, drafting crisis manuals, and performing contract and insurance reviews. We work across a wide range of industries such as healthcare, pharmaceuticals, chemicals and energy, which present complex anti-bribery and compliance challenges. We also help design code of conduct and ethics, internal control and monitoring mechanisms, risk assessment procedures, whistleblowing procedures, internal reporting and investigation protocols in compliance with employment and data protection laws, and assist clients with the handling of internal compliance investigations.

1  By virtue of an Executive Order of 10 February 2025, enforcement of the FCPA is effectively paused “to further American economic and national security.