Under the cooperation protocol in force since March 28, 2018 between the French Anti-Corruption Agency (“AFA”) and the Parquet National Financier (“PNF”), the two entities are jointly participating in the construction of a French anti-corruption reference framework. Thus, the elaboration of guides and guidelines intended for the different actors of the economic life, makes it possible to communicate the expectations of the authorities in terms of prevention and detection of corruption.

Therefore, in this process of strengthening the culture of integrity, regardless of the size of the structure concerned, and in a similar way to the dissemination of the guide on anti-corruption accounting controls, the authorities have submitted the first version of the Practical Guide to Internal Anti-Corruption Investigations to the public, and in particular to companies. This text is subject to consultation of the various economic actors, who may send their comments to the e-mail address consultation.afa@afa.gouv.fr until the 8 April 2022.

While reaffirming the spirit of collaboration between these two authorities, this draft guide proposes some means for companies to design and deploy their own internal anti-corruption investigation system. [1] In addition, this guide aims to clarify several key concepts and to present the issues in this area with a view to assisting companies in making decisions on internal anti-corruption investigations.[2]

In accordance with the structure of the draft guide, it is appropriate to begin by addressing facts that give rise to an anti-corruption investigation (I) and then to discuss points of vigilance in conducting an internal anti-corruption investigation (II). This will enable us to present the proposed elements concerning the follow-up to be given to an internal anti-corruption investigation (III).

I. The events that give rise to internal anti-corruption investigations are both internal and external to the company

 Before discussing the circumstances in which an internal investigation is relevant, the draft guide first specifies the facts that give rise to internal anti-corruption investigations. The starting point for the AFA is to consider that the internal investigation, which is already well known in employment law, is a reflex of sound management of an organisation, when it is aware of a violation of the anti-corruption code of conduct, or of situations potentially constituting an offence.[3] According to the concept proposed in the draft guide, an internal investigation is defined as all investigations carried out within an organisation, on its own initiative, in order to objectify facts that may constitute violations of the anti-corruption code of conduct, behaviour that does not comply with the company’s procedures or the commission of acts that could be qualified as corruption.[4]

The guide refers firstly to events triggering an investigation occurring in the internal sphere of the company. These are, on the one hand, reports made through the anti-corruption alert system provided in Article 17 of Law 2016-1691 of 9 December 2016 on transparency, combating corruption and modernising economic life, known as the Sapin II Law,[5] and on the other hand, alerts received through a system for collecting alerts adopted by the company under Article 8 of the same law.[6] Likewise, the company’s knowledge of facts may result from an internal audit procedure in the context of a third-level control.[7]

The draft guide goes on to mention events outside the company, such as external alerts collected by opening up the system for collecting alerts to suppliers, subcontractors, external employees or other third parties.[8] It is also specified that in the event of disclosure of information by the press, the announcement of the carrying out of an internal investigation as a direct consequence may reveal an awareness on the part of the company of the seriousness of the facts reproached.[9]

Likewise, the company may become aware of the existence of an abnormal situation through the notification of proceedings by the French or foreign prosecuting authorities. In the first case, it is possible for the company to conduct an internal investigation in a spirit of cooperation to establish the truth, in coordination with the authority concerned, provided that it does not interfere with judicial investigations.[10]

However, for the second case, it is noted that if the company decides to carry out an investigation, it should contact the French authority, which is the only interlocutor for requests for international mutual assistance and should take advice in order to avoid joining the cases covered by the law No. 68-678 of 26 July 1968 on the communication of documents and information of an economic, commercial, industrial, financial or technical nature to foreign natural or legal persons, known as the “blocking law”.[11]

The draft Guide also refers to external audits as triggers for an internal investigation. This would be the case, for example, for acquisition or certification audits[12], controls and administrative investigations carried out by regulatory authorities or an administration [13], and controls carried out at AFA’s initiative .[14]

Finally, it should be noted that the decision to initiate an investigation is a power of the organisation’s top management, which is the first to be approached with regard to the prevention and detection of corruption within the company.

II. The guide proposes that certain guidelines be followed when conducting internal anti-corruption investigations

 After mentioning the different cases that may trigger an internal anti-corruption investigation, the draft guide proposes some points of attention to be considered when conducting such investigations. For example, the document recommends formalising the procedure before initiating it. It is relevant to include a detailed description of the elements necessary to trigger the investigation, the way in which the investigation should be conducted and its potential consequences.[15]

The aim of this formalisation is to organise the procedures for collecting reports, guaranteeing employees’ rights, optimising deadlines and guaranteeing a quality standard.[16] Moreover, the project suggests as a good practice to formalise guidelines or even a charter for internal investigations.[17]

In addition to specifying that the decision to conduct an internal investigation is attributed prima facie to the company’s top management, as the person primarily responsible for the implementation of the anti-bribery system, the guide provides the possibility of creating a committee of qualified persons with decision-making powers on these matters.[18] As for the actors of the internal anti-corruption investigation, the draft refers to the possibility for the company to choose whether to carry it out itself or to use a third party. In all circumstances, the guide recalls that the person in charge of the investigation must act independently and objectively while aiming to preserve the confidentiality of the process and the rights of employees.[19]

As regards the conduct of the investigation procedure, the draft guide stipulates that in the absence of a specific regulatory framework, certain general principles derived from criminal law and social law must be applied. Thus, the guiding principles of the internal investigation include the fairness and lawfulness of actions aimed at obtaining evidence, the proportionality of the measures with regard to the aim sought[20] and the protection of employees’ privacy.[21] Similarly, the text refers to the principles of presumption of innocence [22] and discretion, in addition to the provisions and guarantees arising from the regulations on the protection of personal data .[23]

Similarly, the draft Guide refers to procedural guarantees for persons subject to an internal anti-corruption investigation. In application of the above-mentioned principles, internal investigations include a prior obligation to inform the employee.[24] However, by analogy with the rules for harassment, the authorities consider that this principle does not apply in cases where the employee is directly suspected of having participated in the commission of an act of corruption.[25]

Moreover, while this obligation to inform is not absolute when the investigation is carried out directly by the company, this obligation would be more marked in the context of an investigation carried out externally.[26] In any case, the employee must always be informed about the processing of his/her personal data.[27]

As for the conduct of interviews in the framework of the internal anti-corruption investigation, the draft states that the employee must attend the interviews and answer the questions, otherwise his or her disciplinary responsibility will be compromised.[28] Plus, it is specified that, as a matter of principle, the employee does not have the right to be assisted by a representative during interviews. However, in cases where the investigation is conducted by a lawyer appointed by the company, Article 8 of Annex XXIV of the Vademecum for lawyers conducting an internal investigation[29] referred to in the draft allows the employee to be assisted by another lawyer.[30]

As regards the issues related to investigation methods and respect for employees’ privacy, some clarifications are given in order to distinguish employees’ personal information from professional data. In this respect, the employer may look at documents held by the employee in his office[31] or USB sticks connected to the work computer[32] and access digital files not marked “personal”.[33] However, the information collected relating to the private life of the employee, is private and cannot be used to impose a sanction.[34]

Finally, the project mentions the relevance of drawing up a written report containing the method followed, the acts of investigation carried out, the facts established, and the elements collected.[35] It is further clarified that if the internal investigation takes place at the same time as a preliminary investigation, the report must be communicated to the judicial authorities and may determine the conclusion of a Judicial Public Interest Agreement (CJIP). Indeed, the conduct of an internal investigation and the transmission of the report could serve to demonstrate the soundness and effectiveness of the compliance system to the Public Prosecutor and the AFA. [36]

III. The guide proposes elements to be considered downstream at the end of internal anti-corruption investigations

 Finally, the draft guide proposes some elements to be considered at the end of the internal anti-corruption investigation. In this respect, if the investigation carried out does not confirm the suspicions of corruption or influence peddling, it can be closed and archived after anonymisation, and the data collected will have to be destroyed within two months.[37] However, when the triggering event of the internal investigation is an alert, it is necessary to inform the subject of the investigation, as well as the author of the alert, of its closure.[38] Similarly, the report should be retained if further action is taken by the company based on the results of the survey.[39]

Conversely, when the investigation confirms the suspicions of corruption or influence peddling and the facts are attributable to a natural person, the company should impose disciplinary sanctions.[40] She may also report the facts to the authorities, although this decision does not affect the possibility of her being held criminally liable. [41]

On this last point, the draft guide specifies that in the event of the legal person being held liable, timely and truthful reporting, as well as the transmission of the report, may reduce the penalties following the conclusion of a CJIP.[42] Similarly, the draft guide warns of a possible increase in fines for unjustified delay or lack of information.[43]

The draft also specifies that, regardless of the judicial or administrative consequences, the results of an internal investigation should be used to update the anti-corruption system. Thus, the measures and procedures that make up the anti-bribery compliance program should be reviewed accordingly, and internal controls or audits should be carried out in order to strengthen the points of vulnerability identified.[44]

Finally, the draft proposes a balanced policy of internal communication in that companies remain free in terms of dissemination to employees and the confidentiality of the survey and the follow-up it intends to give.[45]