Focus on…
GUIDE TO INTERNAL INVESTIGATIONS: THE INVESTIGATOR’S PLAYBOOK

A. OVERVIEW
Although the term "compliance" lacks a uniform definition, it is typically understood in corporate law as ensuring that companies and their activities adhere to applicable laws.
Broadly, compliance means that a company, its board members, and employees act in line with laws, ethical principles, internal policies, and regulations. It also involves the process of reviewing whether company operations comply with these standards.
A key function of compliance processes is internal investigation. Effective investigations identify the causes of compliance violations, how they happen, and their consequences. These investigations help detect, prevent, and mitigate losses while also preventing potential future losses by implementing corrective actions.
Compliance violations not only create legal and financial risks but also threaten a company's principles, ethical culture, and trust environment. Therefore, internal investigations are crucial to ensure company activities comply with laws, internal policies, and contracts, thus safeguarding workplace welfare.
Additionally, conducting investigations is part of an employer’s duty of care to protect and oversee employees, making it a legal obligation.
B. THE DECISION TO INITIATE AN INTERNAL INVESTIGATION
Before starting an investigation, it must first be determined whether the conduct in question violates the law or company policies. This involves assessing whether there is enough suspicion to justify an investigation. Launching an investigation without sufficient grounds may harm workplace culture and expose the company to liability.
The responsible party must ensure they have adequate information before making a decision. If necessary, a confidential preliminary review should be conducted to gather additional facts, which may involve contacting the reporting party for clarification.
C. OBJECTIVE AND SCOPE OF THE INTERNAL INVESTIGATION
Once initiated, the investigation’s objectives and scope must be clearly defined to avoid inefficiencies and ensure effective outcomes. Besides uncovering facts, investigations may aim to:
The scope should define which allegations will be investigated, potentially limiting it by geography or specific workplace settings.
D. THE STAGES OF THE INTERNAL INVESTIGATION
Each internal investigation is unique and should follow a procedure suited to its specific characteristics. Generally, the process consists of three main stages, (i) preparation, (ii) collecting evidence, conducting interviews, and examining evidence, and (iii) reporting.
Additionally, sanctions and corrective actions taken after the investigation’s conclusion are closely tied to its findings and may be considered part of the overall process.
1. PREPARATION
a) Initial Analysis in an Internal Investigation
During the preparation phase, the available information must be assessed to determine key aspects of the allegation, including identifying the parties involved, the nature of the claim, and any supporting evidence. It is essential to establish when and where the incident occurred, whether it is ongoing, and its potential consequences. The investigation should also consider who may be involved or aware, where relevant evidence can be found, and if preservation measures are needed. Internal communication should be managed carefully, deciding who to inform and who to keep unaware. External experts like IT specialists or forensic accountants may be consulted if necessary.
b) Who Should Conduct the Internal Investigation
When conducting internal investigations, it is crucial to identify the necessary expertise, which may include areas such as law, internal audit, human resources, finance, information technologies, forensic accounting, and translation. The investigation team should be formed based on the specific needs of the case.
When assembling the team, key considerations include:
Once the team is determined, appointing a leader from within the group and assigning responsibilities will enhance the process's efficiency. In companies lacking internal investigation expertise, it is advisable to have an experienced legal counsel lead the team.
c) Duration of the Internal Investigation
It is crucial for the investigation to be conducted thoroughly and prudently, while also being completed as soon as possible. The time between receiving information that necessitates the initiation of the investigation and deciding to initiate it should be as short as possible.
Once the investigation decision is made, the planning and execution should follow a pace and timeline that appropriate to the investigation’s scope, avoiding unnecessary delays. The duration should be realistically determined based on the specific circumstances, ensuring that critical steps are not skipped in an effort to completing the process.
When determining the investigation's timeline, several factors must be considered, including:
d) Utilization of Resources
During the planning phase, it is essential to evaluate which resources may be required for the investigation, identify available internal sources, assess their appropriateness for the specific case, and determine if external resources will be required.
Common external resources needed for investigations include:
Planning resource usage in advance and initiating confidential communication with potential third-party providers can be helpful before the need arises.
e) Precautions to Apply During the Internal Investigation Process
Certain precautions may be necessary during the investigation concerning employees or third parties to preserve evidence, maintain workplace peace and tranquillity, prevent interference, protect the company from losses, or minimize damages. These precautions must comply with applicable laws, company policies, or contracts. They should also be appropriate for their purpose and proportionate to the circumstances. To ensure proportionality, it is necessary to assess whether less restrictive measures could achieve the same outcome.
i. Precautions for Employees
Precautions for employees during an internal investigation may include placing them on administrative leave (commonly referred to as garden leave), requiring the use of accumulated annual leave, or, in certain circumstances, unpaid leave.
Garden Leave
To ensure effective and uninterrupted internal investigations, it may be necessary to suspend employees’ employment. This precaution prevents them from accessing workplace systems, information or communicating with other employees and customers, thereby the risk of altering or destroying evidence.
Garden leave is a commonly used method for employment suspension in international companies operating in Türkiye. It refers to the period during which an employee is required to stay away from the workplace while continuing to receive wages and social benefits.
Although Turkish law does not explicitly regulate garden leave, it is recognized based on the principle of freedom of contract and mutual agreement between the employee and employer. Garden leave can be established through:
If garden leave is not clearly regulated in the employment contract or company policies, it is recommended to obtain the employee's approval before implementing it as a precaution during the internal investigation.
Failure to do so may result in adverse legal consequences. Courts may interpret this as an implied termination by the employer. Alternatively, if the employee terminates the contract with just cause due to being placed on garden leave without consent, the termination may be upheld as legitimate.
ii. Precautions for Third Parties
Depending on the subject of the investigation, additional measures may include suspending contracts with third parties, temporarily halting certain contractual performances—such as product supply—or taking other steps aligned with contractual terms and fundamental principles of the law.
Even when a contract is entirely executed in Türkiye between Turkish entities, international obligations may still apply if one party belongs to a company group based in the U.S. or the U.K. In such cases, compliance with key legislation such as the Foreign Corrupt Practices Act (FCPA)1 and the UK Bribery Act (UKBA) is important, particularly in the context of the combat against corruption and bribery.
For instance, if the commercial partner of a U.S. based Turkish company in Türkiye engages in trade with sanctioned countries, U.S. sanctions may become relevant due to the extraterritorial application of sanctions legislation.
In cases where international sanctions arise, it is crucial to follow these steps, unless the specific situation necessitates a different approach:
iii. Other Precautions
The investigation team may also decide on additional measures beyond those previously mentioned. For example, alternative precautions appropriate to the situation might include suspending activities or prohibiting the destruction of information and documents to preserve evidence within the company.
2. COLLECTING EVIDENCE, CONDUCTING INTERVIEWS AND EXAMINING EVIDENCE
a) Types of Evidence
The types and sources of evidence collected during an investigation vary depending on the case. While some investigations rely solely on employee interviews, others may be entirely document-based. In general, evidence falls into three main categories (i) oral evidence, (ii) written evidence, and (iii) digital evidence.
b) Sources That Evidence Can Be Obtained
c) Precautions Can Be Taken to Prevent Damage to Evidence
If there is a risk of evidence being altered, destroyed, or forged, preventive measures may include (i) placing the individual on leave, garden leave, or unpaid leave, (ii) recalling company-owned devices provided to the employee for work purposes, (iii) changing personal passwords to secure access, (iv) revoking remote access permissions, or (v) backing up electronically stored items.
d) Key Considerations in the Production and Examination of Evidence
e) Considerations for Preserving Evidence
f) Obligations Regarding the Protection of Personal Data in Internal Investigations
Compliance with personal data protection legislation is critical throughout every stage of internal investigations. In this context:
g) Considerations During the Examination of Employee’s Means of Communication
To ensure compliance with the law and respect for employees' rights, the general principles in line with the Turkish Supreme Court in its landmark decisions regarding the examination of employees' communication tools for evidence are as follows:
h) Important Factors Should Be Taken Into Consideration During Physical Inspections At The Workplace
According to the Supreme Court decisions, physical inspections conducted in areas such as offices, desks, cabinets designated for the employees can be considered lawful under the following conditions:
Otherwise, the intervention may be considered to be against the right of privacy.
To avoid a potential legal violations, it is recommended that the internal regulations of the company should clearly and explicitly define the circumstances under which the physical areas used by the employees can be inspected or searched. Clear and detailed internal policies can help courts assess whether the condition of consent has been met.
i) Impact of the Timing of Obtaining Evidence from Employees' Communication Devices on the Investigation Process
Delays in obtaining copies or image records of computers or phones identified as evidence during an audit can compromise their integrity and usability. Therefore, image records must be secured immediately upon seizing the devices.
In 2022, the 9th Civil Chamber of the Court of Appeal ruled that emails from the devices could not be used as evidence because the authenticity of the image records could not be verified. This ruling was based on the fact that the image records of the employee's computer and phone were taken one year after the devices were seized.
j) Principles That Will Be Considered Throughout the Interview Process
One of the key methods for obtaining critical information in an internal investigation is interviewing individuals who may have witnessed the alleged violation or have relevant knowledge.
Disclosing investigation details to the entire company is generally discouraged to maintain confidentiality and effectiveness. However, key individuals, such as managers or essential employees, may need to be informed to facilitate document preservation and interview arrangements.
k) Determine The People Who Are Going To Be Interviewed
The list of interviewees is typically determined in advance, though investigators should remain flexible if new information arises. To avoid delays, only those directly relevant to the investigation should be included. While the approach may vary, it is generally recommended to notify interviewees in advance to allow preparation. Interviews should be conducted individually, with the interviewee's position and seniority considered. It’s often more effective to organize interviews based on seniority and the incident’s timeline, starting with individuals with minor connections and ending with key figures central to the investigation. This approach helps build a clearer understanding of the case.
I) Preparing For The Interview
Thorough preparation is crucial since there may not be a chance to interview the same person again. Before conducting interviews, key documents like the code of conduct, investigation policies, and organizational charts should be reviewed. Organizing collected evidence chronologically can also enhance the interview process.
Temporary measures to preserve evidence, such as restricting computer access, should be taken before sending interview invitations. The interview venue should be assessed and adjusted as necessary. When notifying interviewees, provide only brief and general information about the investigation.
While preparing questions in advance is helpful, investigators should remain flexible, adapting to the interviewee’s responses. Interviews should be conducted by experienced professionals, with external experts preferred to ensure impartiality. Ideally, the interview team should include a moderator and a note-taker, with legal expertise being beneficial.
The interview environment should be secure and comfortable, ensuring objectivity and fairness. Investigators should avoid biases, build trust, and maintain a polite, patient tone. An accusatory tone should be avoided unless used intentionally as a technique.
Interviewees should not be informed of the specific purpose of their statements and should be assured of confidentiality. When multiple witnesses are involved, they should be interviewed separately to check for consistency in their statements. Open-ended questions should be used, and investigators should avoid directive reactions.
Interviewees should not feel legally obligated to participate and should be reminded they can end the interview at any time. Requests for an attorney should be allowed, but the attorney’s role should be strictly observational. If an employee refuses to participate, they should be reminded of their labor law obligations.
Interviews should be recorded in written minutes that accurately reflect the discussion. The interviewee should review and confirm these minutes for accuracy. The method of documentation should be determined based on the investigation’s specific risks and needs.
3. REPORTING
The information and findings from an internal investigation should be documented in a written report and properly concluded. The key principles governing the reporting process are as follows:
a. Content of the Report
An internal investigation report typically consists of the following sections:
It is standard practice for investigators to avoid expressing personal opinions, especially on matters outside their expertise, such as determining an employee's guilt. However, when attorneys are part of the investigation team, their legal expertise enables them to provide qualified opinions on legal matters. In such cases, investigation reports involving attorney investigators may include legal analysis, assessments of violations and their consequences, as well as recommendations for corrective actions.
E. SANCTIONS
1. Criminal Sanctions
Actions identified during an internal investigation may constitute criminal offenses under applicable laws, particularly the Turkish Penal Code No. 5237 (TPC). Whether a violation qualifies as a crime under Turkish criminal law depends on whether the criminal elements specified in the relevant legal provision are met.
Some common crimes that may arise from detected violations include:
2. Administrative Sanctions
The detected violation may fall under regulations requiring the imposition of an administrative fine by authorities such as the Personal Data Protection Authority, Competition Authority, Banking Regulation and Supervision Agency, Insurance and Private Pension Regulation and Supervision Agency or other regulatory and supervisory institutions. In such cases, the relevant authority may impose administrative fines or sanctions depending on the nature and severity of the violation.
3. Disciplinary Sanctions
Following an internal investigation, if it is determined that an employee’s behavior violates laws or company policies, disciplinary sanctions may be applied based on the severity of the violation. Common sanctions include (i) issuing a written warning, (ii) imposing a wage deduction, or (iii) terminating the employee’s employment contract.
Workplace regulations may specify additional sanctions or procedural requirements beyond legal obligations. Therefore, it is essential to review workplace policies and procedures carefully to ensure compliance with both internal regulations and legal requirements. The disciplinary process must be conducted according to established internal processes.
Termination as a Disciplinary Sanction
Termination of an employment contract, as the most severe labour law sanction, may result from an internal investigation and must be based on either a valid reason or just cause.
Termination for Valid Reason
Valid reasons arise from the employee’s competence, behavior, or business requirements. These reasons, while serious, do not meet the threshold for just cause under labour law.
Key Requirements:
Termination for Just Cause
Under Article 25 of Labor Law No. 4857 (“Labor Law”), just causes typically involve serious misconduct or significant breaches of duty.
Key Requirements:
F. CORRECTIVE ACTIONS
It is crucial to evaluate corrective actions after each investigation and integrate them into company policies to prevent future incidents. Key corrective actions include:
About Our Compliance and Investigations Practice
Paksoy advises clients on anti-bribery and corruption reviews and supports them on investigations carried out by administrative authorities including tax authorities, market regulators and customs administration, as well as with compliance checks in connection with the FCPA and UK Bribery Act.
Paksoy’s compliance practice covers assisting clients with FCPA/anti-corruption due diligence on merger and acquisition targets, as well as in internal compliance trainings, drafting crisis manuals, and performing contract and insurance reviews. We work across a wide range of industries such as healthcare, pharmaceuticals, chemicals and energy, which present complex anti-bribery and compliance challenges. We also help design code of conduct and ethics, internal control and monitoring mechanisms, risk assessment procedures, whistleblowing procedures, internal reporting and investigation protocols in compliance with employment and data protection laws, and assist clients with the handling of internal compliance investigations.
1 By virtue of an Executive Order of 10 February 2025, enforcement of the FCPA is effectively paused “to further American economic and national security.