On 14 March 2023, the AFA and the PNF published a practical guide (“the Guide””) to help companies set up and deploy their own internal anti-corruption investigation system.[1] The Guide, which has been put out to public consultation,[2] is aimed at companies whether or not they are subject to Article 17 of the Sapin II law.[3]

The Guide is particularly important in view both of the growing number of situations that could lead to an internal anti-corruption investigation since the entry into force of the Sapin II Law and the Law 2022-401 of 21 March 2022 to improve the protection of whistleblowers, known as the Waserman Law, and of the development of negotiated justice under the judicial public interest agreement (“CJIP”).

The Guide deals with the facts that give rise to an anticorruption internal investigation (A), the points to watch out for when conducting an anticorruption internal investigation (B) and the follow-up to be given to such an investigation (C).[4]

Internal investigations are an essential tool in the detection of corruption and influence peddling, and are fundamental to the prevention and management of criminal risk for those involved in economic activities. The aim of the Guide proposed by the AFA and the PNF is therefore to provide companies with an overview of best practices for conducting anticorruption internal investigations, enabling them to act within an effective framework that respects individual rights and freedoms.[5]

The events prompting an anticorruption internal investigation

The Guide stresses that the events giving rise to an internal anti-corruption investigation may be internal (internal alert by an employee, result of an internal audit), or external (external alert by a third party, initiation of proceedings by a French prosecuting authority, request for information by a foreign authority, external audit or control).[6]

In the event of an internal control or an internal audit leading to a report revealing suspicions of corruption, it is up to the governing body or the qualified persons it has appointed to decide whether to open an internal investigation.[7]

However, if the internal control or audit has revealed criminal offences, the Guide recommends, even before an internal investigation is launched, that the management body should immediately inform the judicial authorities and preserve the evidence.[8]

With regard to third-party alerts, the Guide also recommends, subject to the appropriateness of immediate referral to the judicial authorities, that an internal investigation be carried out as soon as possible to establish the facts.[9] According to the Guide, conducting an internal investigation and, where appropriate, reporting the facts to the judicial authorities, are in the company’s interest, as it has no control over the disclosure of information by the third party.[10] The Guide also points out that, in the case of a report made by a customer or supplier, conducting an internal investigation can prevent possible negative consequences, up to and including termination of the contract if it provides for this possibility, which could be decided by the third party who made the report.[11]

Similarly, in the event of disclosure by the press, the Guide notes that conducting an internal investigation may be part of an external communication strategy aimed at preserving the company’s reputation, demonstrating that the company is up to date with the facts concerning it.[12]

In the context of an investigation by a French prosecuting authority, the Guide considers the internal investigation as a tool for cooperation with the authorities, whereby the company, directly or through its lawyers, contacts the judicial authority in charge of the proceedings and makes known its wish to cooperate as far upstream as possible, in order to enable the judicial authority to evaluate and assess the risks of interference or the benefits to be gained from carrying out an internal investigation with regard to the progress of the judicial investigations.[13]

The Guide indicates that an early exchange of information helps to ensure that the internal investigation is properly coordinated with the investigations carried out by the judicial authorities.[14] According to the Guide, this contact should take place as soon as the elements known to the company make it possible to establish the existence of an offence and waiting for the conclusions of the internal investigation could prove detrimental to the gathering of evidence for the judicial investigation, if there is a risk of evidence dissipation or pressure on witnesses.[15]

The Guide also considers the possibility of an internal investigation to contextualize the facts behind a request for information from a foreign authority, whether the request is made in a judicial, administrative or negotiated justice context. In this context, the Guide, which recommends cooperation with the foreign authority, invites companies to be extremely vigilant,[16] and notably to  approach the Strategic Information and Economic Security Department (“Service de l’information stratégique et de la sécurité économique” –“SISSE”), to ensure compliance with their obligations under the so-called “blocking statute” of 26 July 1968.[17]

Finally, the Guide emphasizes that an internal investigation may be carried out as part of the detection of criminal acts following an external audit or control, carried out by third parties to the company, some of whom are subject to the provisions of article 40 paragraph 2 of the Code of Criminal Procedure (such as the company’s statutory auditors, the financial market authority or the AFA), which require them to notify the public prosecutor without delay of any crimes or offences of which they become aware in the course of their duties.[18]

In practice, as soon as the question of carrying out an internal investigation arises for a company, the assistance of a lawyer is strongly recommended, particularly insofar as he or she is able to advise the company effectively on the opportunity of taking any steps to report the facts to an authority, whether French or foreign.

The key aspects of an anticorruption internal investigation

According to the Guide, companies conducting anticorruption internal investigations must define and formalize the internal investigation procedure in advance, paying particular attention to the choice of those involved in the internal investigation and to the conditions under which it is conducted, in order to ensure the legal robustness of the investigation and to be in a position to draw the appropriate legal and disciplinary consequences if necessary.[19]

Establishing an internal investigation procedure upstream enables companies to achieve a number of key objectives, including organizing the procedures for collecting and storing evidence, guaranteeing compliance with confidentiality obligations and employee rights, optimizing investigation implementation times and ensuring the quality of investigations, in particular through traceability.[20]

Among the elements that can be formalized, the Guide highlights the following:[21]

• the criteria required to trigger an internal investigation, and any exemptions that may be contemplated
• the various stages of the internal investigation process
• the quality and role of those involved at each stage
• a description of the objectives and scope of the investigation
• the format and composition of the investigation team
• the investigation methods and resources available
• measures to guarantee the absence of reprisals, the confidentiality of the the identity of those involved and the information gathered, as well as the procedures for protecting, preserving and storing data, particularly personal data
• criteria for determining the follow-up to be given to internal investigations.

In addition, the Guide suggests providing employees with an easily accessible document explaining the guiding principles followed by investigators, the rights of employees in this context (witnesses, experts, persons targeted) and the behavior expected of them by the employer.[22]

With regard to the decision to launch an internal investigation, the Guide points out that this can be taken by the management body, or by a special or ad hoc committee.. The management body must be informed of the opening of the investigation, except in cases where it is implicated. In thatcase, the Guide recommends setting up a procedure for referring the matter to a body such as the audit committee or the ethics committee.[23]

Concerning the people in charge of the investigation, the Guide indicates that the composition of the investigation team and the resources to be mobilized will be decided in accordance with the previously established internal investigation procedure, by the management body or the qualified persons it has appointed to sit on the special or ad hoc committee.. These must be proportionate to the facts reported and their potential impact on the company.[24]

Those involved in the internal investigation, who may be company employees, third parties or a mixed team, must have sufficient independence and expertise to carry out the investigation, particularly with regard to compliance with the procedural guarantees provided for under French labor law.[25]

It is important to point out that the Guide recommends that if a lawyer is used to carry out the internal investigation, he or she should be different from the lawyer handling the criminal defence of the company or the employees concerned by the investigation, and indicates that in any event, the document drawn up at the end of the internal investigation is not be protected by any professional secrecy.[26]

With regard to the first recommendation, it should be noted that there is in fact nothing to prevent a lawyer from carrying out an internal investigation on behalf of a company for which he is acting as criminal defense counsel, provided that he complies with the best practices in this area, as set out by the National Bar Council (“Conseil National des Barreaux”)[27] and the Paris Bar Association,[28] according to which he must only refrain from acting against a person interviewed during the internal investigation.

The second recommendation also appears to be unfounded. Under articles 56-1-1 and 56-1-2 of the French Code of Criminal Procedure, it is possible to oppose the seizure of documents relating to the exercise of the rights of the defence and covered by professional secrecy, except in the case of certain offences (notably corruption, influence peddling, tax fraud and money laundering) when the consultations, correspondence or documents held or transmitted by the lawyer or his client provide evidence of their use to commit or facilitate the commission of the said offences.[29] The application regulations relating to the law from which these articles derive (known as the “Loi Confiance”), also specify that the absolute protection of lawyer-client confidentiality concerns not only the confidentiality of the defense, which exists as soon as a lawyer is appointed by an accused person, but also the confidentiality of advice when it relates to the exercise of the rights of the defense, in the case, for example, of a person seeking advice from a lawyer after the potential commission of an offence and prior to any criminal proceedings.[30] Insofar as they are fully in line with the company’s rights of defence, in that they constitute the tools needed to establish the veracity of the facts useful in devising its criminal strategy, the lawyer’s working documents produced as part of the internal investigation, the communications with his client in the course of the investigation, and the investigation report necessarily benefit from the protection of attorney-client privilege.

In addition, to ensure that the internal investigation runs smoothly, the Guide points out that it must be conducted in compliance with certain case law principles, which may vary from one jurisdiction to another, relating to the guiding principles of the internal investigation, the procedural guarantees afforded to individuals, the means of investigation that may be used and the drafting of the internal investigation report recording the facts and setting out the elements that establish them.[31]

The follow-up to the anticorruption internal investigation

Finally, the Guide addresses the immediate consequences of an internal anti-corruption investigation, as well as the longer-term consequences for the company.[32]

In the event that the investigation does not confirm suspicions, the Guide recommends that the report be archived in such a way as to ensure that access is strictly limited to those authorized to know about it, while respecting obligations relating to the protection of personal data.[33]

In addition, the Guide underlines the obligation to inform the author of the alert when the event giving rise to the investigation is an alert falling within the scope of the Sapin II Law.[34]

Should the investigation confirm the suspicions, the Guide recommends that sanctions be taken against the individuals to whom the facts are attributable, in a manner proportionate to the seriousness of the behavior and according to the scale of sanctions provided for by the company’s disciplinary system.[35]

In the event of the legal entity’s criminal liability being brought into play, the Guide, in line with the PNF guidelines, recommends that the company report the facts to the judicial authorities, since such a report may constitute a factor reducing the fine imposed under a CJIP.[36] Here again, the lawyer’s role appears to be particularly important, to enable the company to assess the appropriateness of such a denunciation.

Finally, the Guide underlines that the follow-up to be carried out following an internal investigation must take into account any vulnerabilities discovered during the course of the investigation, so as to enable the implementation of corrective measures, such as the updating of anticorruption procedures, in order to avoid any repetition of similar facts.[37] The vulnerabilities identified, and the corrective measures put in place, should be the subject of closer attention during subsequent internal control and audits.[38]

Lastly, the Guide refers to the possibility, regardless of the outcome of the investigation, of issuing an internal communication at the end of it, and stresses that while it may be appropriate to reiterate the company’s “zero tolerance” policy on corruption in the event of an investigation having corroborated an alert in this area, any communication must be made in a format that guarantees the anonymity of personal data relating to the facts reported and to any disciplinary sanctions imposed, in compliance with the principles of presumption of innocence and the right to privacy.[39]