13 July 2023

AFA and PNF publish a guide to anti-corruption internal investigations

On 14 March 2023, the French Anti-Corruption Agency (“AFA”) and the French National Financial Prosecutor's Office (“PNF”) jointly published a guide to anticorruption internal investigations for companies. The guide outlines the situations in which an internal investigation into alleged breaches of the anti-corruption code of conduct should be carried out, lists the points to watch out for when conducting such an investigation, and details the possible follow-up action to be taken.


On 14 March 2023, the AFA and the PNF published a practical guide (“the Guide””) to help companies set up and deploy their own internal anti-corruption investigation system.[1] The Guide, which has been put out to public consultation,[2] is aimed at companies whether or not they are subject to Article 17 of the Sapin II law.[3]

The Guide is particularly important in view both of the growing number of situations that could lead to an internal anti-corruption investigation since the entry into force of the Sapin II Law and the Law 2022-401 of 21 March 2022 to improve the protection of whistleblowers, known as the Waserman Law, and of the development of negotiated justice under the judicial public interest agreement (“CJIP”).

The Guide deals with the facts that give rise to an anticorruption internal investigation (A), the points to watch out for when conducting an anticorruption internal investigation (B) and the follow-up to be given to such an investigation (C).[4]

Internal investigations are an essential tool in the detection of corruption and influence peddling, and are fundamental to the prevention and management of criminal risk for those involved in economic activities. The aim of the Guide proposed by the AFA and the PNF is therefore to provide companies with an overview of best practices for conducting anticorruption internal investigations, enabling them to act within an effective framework that respects individual rights and freedoms.[5]


The events prompting an anticorruption internal investigation


The Guide stresses that the events giving rise to an internal anti-corruption investigation may be internal (internal alert by an employee, result of an internal audit), or external (external alert by a third party, initiation of proceedings by a French prosecuting authority, request for information by a foreign authority, external audit or control).[6]

In the event of an internal control or an internal audit leading to a report revealing suspicions of corruption, it is up to the governing body or the qualified persons it has appointed to decide whether to open an internal investigation.[7]

However, if the internal control or audit has revealed criminal offences, the Guide recommends, even before an internal investigation is launched, that the management body should immediately inform the judicial authorities and preserve the evidence.[8]

With regard to third-party alerts, the Guide also recommends, subject to the appropriateness of immediate referral to the judicial authorities, that an internal investigation be carried out as soon as possible to establish the facts.[9] According to the Guide, conducting an internal investigation and, where appropriate, reporting the facts to the judicial authorities, are in the company’s interest, as it has no control over the disclosure of information by the third party.[10] The Guide also points out that, in the case of a report made by a customer or supplier, conducting an internal investigation can prevent possible negative consequences, up to and including termination of the contract if it provides for this possibility, which could be decided by the third party who made the report.[11]

Similarly, in the event of disclosure by the press, the Guide notes that conducting an internal investigation may be part of an external communication strategy aimed at preserving the company’s reputation, demonstrating that the company is up to date with the facts concerning it.[12]

In the context of an investigation by a French prosecuting authority, the Guide considers the internal investigation as a tool for cooperation with the authorities, whereby the company, directly or through its lawyers, contacts the judicial authority in charge of the proceedings and makes known its wish to cooperate as far upstream as possible, in order to enable the judicial authority to evaluate and assess the risks of interference or the benefits to be gained from carrying out an internal investigation with regard to the progress of the judicial investigations.[13]

The Guide indicates that an early exchange of information helps to ensure that the internal investigation is properly coordinated with the investigations carried out by the judicial authorities.[14] According to the Guide, this contact should take place as soon as the elements known to the company make it possible to establish the existence of an offence and waiting for the conclusions of the internal investigation could prove detrimental to the gathering of evidence for the judicial investigation, if there is a risk of evidence dissipation or pressure on witnesses.[15]

The Guide also considers the possibility of an internal investigation to contextualize the facts behind a request for information from a foreign authority, whether the request is made in a judicial, administrative or negotiated justice context. In this context, the Guide, which recommends cooperation with the foreign authority, invites companies to be extremely vigilant,[16] and notably to  approach the Strategic Information and Economic Security Department (“Service de l’information stratégique et de la sécurité économique” –“SISSE”), to ensure compliance with their obligations under the so-called “blocking statute” of 26 July 1968.[17]

Finally, the Guide emphasizes that an internal investigation may be carried out as part of the detection of criminal acts following an external audit or control, carried out by third parties to the company, some of whom are subject to the provisions of article 40 paragraph 2 of the Code of Criminal Procedure (such as the company’s statutory auditors, the financial market authority or the AFA), which require them to notify the public prosecutor without delay of any crimes or offences of which they become aware in the course of their duties.[18]

In practice, as soon as the question of carrying out an internal investigation arises for a company, the assistance of a lawyer is strongly recommended, particularly insofar as he or she is able to advise the company effectively on the opportunity of taking any steps to report the facts to an authority, whether French or foreign.


The key aspects of an anticorruption internal investigation


According to the Guide, companies conducting anticorruption internal investigations must define and formalize the internal investigation procedure in advance, paying particular attention to the choice of those involved in the internal investigation and to the conditions under which it is conducted, in order to ensure the legal robustness of the investigation and to be in a position to draw the appropriate legal and disciplinary consequences if necessary.[19]

Establishing an internal investigation procedure upstream enables companies to achieve a number of key objectives, including organizing the procedures for collecting and storing evidence, guaranteeing compliance with confidentiality obligations and employee rights, optimizing investigation implementation times and ensuring the quality of investigations, in particular through traceability.[20]

Among the elements that can be formalized, the Guide highlights the following:[21]

  • the criteria required to trigger an internal investigation, and any exemptions that may be contemplated
  • the various stages of the internal investigation process
  • the quality and role of those involved at each stage
  • a description of the objectives and scope of the investigation
  • the format and composition of the investigation team
  • the investigation methods and resources available
  • measures to guarantee the absence of reprisals, the confidentiality of the the identity of those involved and the information gathered, as well as the procedures for protecting, preserving and storing data, particularly personal data
  • criteria for determining the follow-up to be given to internal investigations.


In addition, the Guide suggests providing employees with an easily accessible document explaining the guiding principles followed by investigators, the rights of employees in this context (witnesses, experts, persons targeted) and the behavior expected of them by the employer.[22]

With regard to the decision to launch an internal investigation, the Guide points out that this can be taken by the management body, or by a special or ad hoc committee.. The management body must be informed of the opening of the investigation, except in cases where it is implicated. In thatcase, the Guide recommends setting up a procedure for referring the matter to a body such as the audit committee or the ethics committee.[23]

Concerning the people in charge of the investigation, the Guide indicates that the composition of the investigation team and the resources to be mobilized will be decided in accordance with the previously established internal investigation procedure, by the management body or the qualified persons it has appointed to sit on the special or ad hoc committee.. These must be proportionate to the facts reported and their potential impact on the company.[24]

Those involved in the internal investigation, who may be company employees, third parties or a mixed team, must have sufficient independence and expertise to carry out the investigation, particularly with regard to compliance with the procedural guarantees provided for under French labor law.[25]

It is important to point out that the Guide recommends that if a lawyer is used to carry out the internal investigation, he or she should be different from the lawyer handling the criminal defence of the company or the employees concerned by the investigation, and indicates that in any event, the document drawn up at the end of the internal investigation is not be protected by any professional secrecy.[26]

With regard to the first recommendation, it should be noted that there is in fact nothing to prevent a lawyer from carrying out an internal investigation on behalf of a company for which he is acting as criminal defense counsel, provided that he complies with the best practices in this area, as set out by the National Bar Council (“Conseil National des Barreaux”)[27] and the Paris Bar Association,[28] according to which he must only refrain from acting against a person interviewed during the internal investigation.

The second recommendation also appears to be unfounded. Under articles 56-1-1 and 56-1-2 of the French Code of Criminal Procedure, it is possible to oppose the seizure of documents relating to the exercise of the rights of the defence and covered by professional secrecy, except in the case of certain offences (notably corruption, influence peddling, tax fraud and money laundering) when the consultations, correspondence or documents held or transmitted by the lawyer or his client provide evidence of their use to commit or facilitate the commission of the said offences.[29] The application regulations relating to the law from which these articles derive (known as the “Loi Confiance”), also specify that the absolute protection of lawyer-client confidentiality concerns not only the confidentiality of the defense, which exists as soon as a lawyer is appointed by an accused person, but also the confidentiality of advice when it relates to the exercise of the rights of the defense, in the case, for example, of a person seeking advice from a lawyer after the potential commission of an offence and prior to any criminal proceedings.[30] Insofar as they are fully in line with the company’s rights of defence, in that they constitute the tools needed to establish the veracity of the facts useful in devising its criminal strategy, the lawyer’s working documents produced as part of the internal investigation, the communications with his client in the course of the investigation, and the investigation report necessarily benefit from the protection of attorney-client privilege.

In addition, to ensure that the internal investigation runs smoothly, the Guide points out that it must be conducted in compliance with certain case law principles, which may vary from one jurisdiction to another, relating to the guiding principles of the internal investigation, the procedural guarantees afforded to individuals, the means of investigation that may be used and the drafting of the internal investigation report recording the facts and setting out the elements that establish them.[31]


The follow-up to the anticorruption internal investigation


Finally, the Guide addresses the immediate consequences of an internal anti-corruption investigation, as well as the longer-term consequences for the company.[32]

In the event that the investigation does not confirm suspicions, the Guide recommends that the report be archived in such a way as to ensure that access is strictly limited to those authorized to know about it, while respecting obligations relating to the protection of personal data.[33]

In addition, the Guide underlines the obligation to inform the author of the alert when the event giving rise to the investigation is an alert falling within the scope of the Sapin II Law.[34]

Should the investigation confirm the suspicions, the Guide recommends that sanctions be taken against the individuals to whom the facts are attributable, in a manner proportionate to the seriousness of the behavior and according to the scale of sanctions provided for by the company’s disciplinary system.[35]

In the event of the legal entity’s criminal liability being brought into play, the Guide, in line with the PNF guidelines, recommends that the company report the facts to the judicial authorities, since such a report may constitute a factor reducing the fine imposed under a CJIP.[36] Here again, the lawyer’s role appears to be particularly important, to enable the company to assess the appropriateness of such a denunciation.

Finally, the Guide underlines that the follow-up to be carried out following an internal investigation must take into account any vulnerabilities discovered during the course of the investigation, so as to enable the implementation of corrective measures, such as the updating of anticorruption procedures, in order to avoid any repetition of similar facts.[37] The vulnerabilities identified, and the corrective measures put in place, should be the subject of closer attention during subsequent internal control and audits.[38]

Lastly, the Guide refers to the possibility, regardless of the outcome of the investigation, of issuing an internal communication at the end of it, and stresses that while it may be appropriate to reiterate the company’s “zero tolerance” policy on corruption in the event of an investigation having corroborated an alert in this area, any communication must be made in a format that guarantees the anonymity of personal data relating to the facts reported and to any disciplinary sanctions imposed, in compliance with the principles of presumption of innocence and the right to privacy.[39]

Related content

12 July 2024
Overview of 2024: Ethics & compliance
Overview of decisions and events relating to ethics and compliance which have occurred in France over the last twelve months.
Press review
28 June 2024
Press review – Week of 24 June 2024
This week, the press review covers the conviction of Jean-Paul Huchon for illegal taking of interests, the case of Jean-Christophe...
Press review
21 June 2024
Press review – Week of 17 June 2024
This week, the press review covers the admissibility of the actions against Total and EDF relating to breaches of the...
19 June 2024
Compliance and forensic investigations: optimising how companies, lawyers and forensic professionals work together
Grant Thornton France invited Stéphane de Navacelle to take part in a panel with Jean-Marie Pivard (Publicis Groupe), Jennifer Fiddian-Green...
2 min
19 June 2024
Discussion on harassment prevention and exposure
Invited by Colas Rail, Stéphane de Navacelle discussed with 100+ group top managers during their Management Committee 2024, on 19 June 2024.
2 min
13 June 2024
Future prospects for International Anti-Corruption Court
A panel held during the 20th Annual IBA Anti-Corruption Conference hosted at the OECD in Paris.
Press review
7 June 2024
Press review – Week of 3 June 2024
This week, the press review covers the trial of several Île-de-France’s elected officials including concealment of misappropriation of corporate assets...
5 June 2024
Update on Sanctions Litigation, Arbitration, and Enforcement – with EU, French and Swiss perspectives
A panel held on 5 June 2024 in Berlin, during the C5's European Forum on Global Economic Sanctions.
3 June 2024
Internal investigations by lawyers: how to approach labor & criminal law issues?
An animated debate on benefits brought by investigating lawyers on criminal or labor law investigations, i.e. independence, secret protection, confidentiality...
1 min
Press review
31 May 2024
Press review – Week of 27 May 2024
This week, the press review covers the conviction of a French senator for illegal taking of interest, the adoption of...
29 May 2024
The challenge of regulating generative artificial intelligence
On February 14, the French National Assembly's Law Commission published a report on the challenges posed by generative artificial intelligence...
16 May 2024
Anticorruption initiatives in Latin America: Lessons from the last decade (webinar)
To contribute to the Latin America and Caribbean Weeks event, organised by the French Ministry of Europe and Foreign Affairs...