I. Introduction
Internal investigations are becoming an integral part of organizational management in Italy, as it is demonstrated by last year’s transposition of the ISO 37008/2023 by the Italian Organization UNI. The adoption of such standards confirms the importance of internal investigations in maintaining an efficient compliance system within the organization.
By understanding the process and legal framework surrounding internal investigations, organizations can regularly monitor the adherence to internal procedures, better ensure they are prepared to address potential violations effectively and navigate the complexities of corporate responsibility.
Thus, in exploring the role of internal investigations within a corporate context, it is important to focus on the reason for them, how they are conducted in practice, and their relationship with criminal corporate liability.
In particular, it is essential to know the triggers for initiating such investigations and the procedural guidelines for conducting them, paying attention to the management of interviews and how legal compliance must be ensured.
Finally, it is crucial to determine which elements discovered during internal investigations can be used or considered in judicial proceedings. This is particularly important for a corporation because, as internal investigations are playing an increasingly important role in the context of the criminal liability of legal entities, it allows for the development of an effective defense strategy, should legal proceedings arise.
II. What are internal investigations?
Within a corporate reality, internal investigations are a tool used on one hand to verify the correct implementation of internal policies and protocols through the verification of the level of compliance of the organization; on the other it allows to gather information regarding violations committed within the corporation, including criminal ones, in relation to which the corporation could be held liable pursuant to legislative decree 231/2001 (hereafter, “Law 231”).
Although internal investigations in Italy were initially intended to unveil corporate crimes, they generally aim to bring clarity to any issue detected, whether it pertains to the effectiveness of its policies, a suspected breach of an internal protocol or procedure or whatever violation that could give rise to a profile of liability. The activities carried out in such context seek to identify any potential repercussions, including legal consequences, operational disruptions, decreased productivity, or damage to the company’s reputation, in order to limit the damage that the violation claimed could provide to the organization.
III. What is the relationship between criminal corporate liability and internal investigations?
Criminal vicarious corporate liability is governed by Law 231. To prevent liability, companies must ensure that all employees, including managers, directors, auditors, and executives, comply with established procedures and protocols at all the times. Any misconduct, regardless of who is responsible, should be promptly reported to the appropriate corporate departments and to the Supervisory Body (“Organismo di Vigilanza“) provided for by article 6, paragraph 1, letter b). When a report of this kind is received, the competent offices are required to conduct internal investigations to properly evaluate the seriousness of the issue.
IV. When can a company be requested to conduct an internal investigation?
An internal investigation may become necessary for different reasons. One triggering factor could be a whistleblower’s report, filed through the company’s designated reporting channels. Whistleblower reports can be internal or external: in general, reports must be made internally through the reporting channels instituted by the organization; however, they can be made externally when the activation of such channels is not mandatory, when the whistle-blower has already made an internal report and it has not received any response by the set deadline, when it has concrete reasons to believe that an internal report would not be considered or when it has concrete reasons to believe that the violation to report is a danger for the public interest.
An internal investigation may also be initiated following investigative actions conducted by the Prosecution Service or an independent regulatory authority, such as the Bank of Italy, CONSOB, or IVASS.
Additionally, the internal control body may request a corporate investigation if irregularities emerge during its oversight activities. Similarly, media reports about alleged misconduct by an executive or employee – along with the potential launch of a criminal or regulatory inquiry – could indicate the need for a compliance review by internal or external auditors.
V. What shall the corporation do when it receives a report from a whistleblower?
The legislative decree n. 24, 10th March 2023 (hereafter, “Whistleblower decree”) provides a punctual discipline on how the corporation shall act in case it receives a report from a whistleblower.
The organization must give credit to such report, informing the whistleblower of the receipt within seven days and verifying the foundations of the allegations made by three months. This is done by acquiring any useful elements for assessing the case, taking care to adopt measures suitable to ensure the confidentiality of the whistleblower’s identity when further investigations require the necessary involvement of third parties.
Although there is no explicit obligation to start an internal investigation following the report of a whistleblower, this is what the law implicitly requires, considering the aforementioned compulsory feedback and the strict timeframe provided for.
The Whistleblower decree, in fact, imposes sanctions (ranging from Euro 10.000 to 50.000) upon a corporation when it has been ascertained that the entity has obstructed a report by a whistleblower or that a reporting channel has not been instituted, procedures to follow up on such reports have not been implemented, or are not conform to the law or when it is found that the reports have not been adequately verified or analyzed (art. 21, Whistleblower decree).
VI. How must internal investigations be conducted?
In the Italian system there are no specific rules regulating how to carry out internal investigations.
Usually, internal investigations can be conducted either by people internal to the organization, for instance in-house counsels or internal auditors (corporate investigations) or by external consultants that intervene to support the organization (independent investigations). The decision on the method to be adopted is left to the organization, depending on the facts to be verified and its needs.
Nevertheless, it has to be pointed out that only when an external counsel conducts the investigation, articles 327-bis and article 391-bis to 391-nonies apply, as well as the legal privilege (attorney-client privilege between the company and the lawyer) and all the related guarantees provided by the law.
In this sense, the lawyer has the right to prevent the seizure of documents and papers related to the defense, held at their office, unless they constitute corpus delicti and wiretapping of communications; moreover, seizure of any correspondence between the attorney and its client is prohibited, unless the Judicial Authority stipulates otherwise.
In general, internal investigations can be carried out following settled practices that provide for three phases (ISO 37008/2023).
A preliminary assessment phase, consisting of a preliminary evaluation of the seriousness and credibility of the allegations, the determination of the scope of the investigation, and the related action plan which should indicate: (a) the allegations of misconduct or concerns reported internally or emerged from external sources; (b) the functions and external parties who will manage and conduct the investigation; (c) the activities to be carried out, both documental analysis and interviews; (d) the time frame for the investigation.
The actual investigative phase, focused on the gathering of information, both through documents and interviews. All the activities must be carried out fully respecting the privacy of all involved parties and maintaining confidentiality of the documentation obtained.
Finally, the post investigation phase, consisting of the report on the activities carried out and proposing appropriate corrective measures based on the results of the investigation, in order to minimize the impact of violations and improve internal controls, addressing the concerns that gave rise to the investigation itself.
VII. What do if profiles of criminal liability emerge from the internal investigation?
Following the completion of the internal investigation, if the unlawfulness of the reported or emerging facts is confirmed, it may be necessary to plan and adopt corrective measures, appropriate disciplinary actions, or file a complaint/report with the Judicial Authority.
In this regard, the Court of Cassation, with a recent ruling (Cass. Pen. n. 10934/2024), extended to internal investigations a principle that had already been stated regarding private investigations: the statutory period for filing a complaint commences only when the victim has precise, certain, and direct knowledge of the criminal act, both from an objective and subjective standpoint, in order to have all the elements of assessment to make a decision. Mere suspicion or even certainty of potential discrepancies is not sufficient.
Therefore, in the case where the necessary investigations are carried out, the term for filing a complaint does not start from the moment when the victim becomes aware of the objective fact of the crime, nor from when, based on mere suspicions, the investigations are directed towards a specific person, but rather from the outcome of such investigations.
VIII. How should the investigation team manage the interviews?
Interviews are generally the core activity carried out during an internal investigation, as well as the most delicate one. Both employees and executives can be called to render statements on the alleged violation.
Although no specific regulation has been provided in Italy yet, the settled practice has defined several “recommendations”: (a) firstly, any interview should always be recorded, or at least documented and reported; (b) secondly, it is advisable that at least two interviewers take part in the interview; (c) moreover, the in-house counsel should not participate in the interview, since the interviewee could misjudge his or her role; (d) furthermore, no threat, bribe or pressure towards the interviewee should ever be performed; (e) the interviewer should remind the interviewee: (e.1.) that he represents the company and, since he is not his or her lawyer, he would not preserve the interviewee’s personal interests; (e.2.) the object of the interview; (e.3.) that the substance of the interview should not be discussed with anyone; (e.4.) his or her constitutional rights, especially if criminal/disciplinary proceedings or a civil trial could arise. If the interview is performed within a defense investigation, the external criminal defense counsel in charge has to comply with the Code of Criminal Procedure, providing the interviewee with a further series of warnings.
IX. Is the employee or executive entitled to legal assistance during the interview?
Generally, the employee or executive is not allowed to have legal representation during the interview. The employee’s obligation to cooperate and provide answers stems from their ongoing employment relationship (in fact, employees cannot refuse to answer and are expected to assist the investigation team), and the investigation’s primary focus is to collect information about actions that may have violated internal procedures, protocols, or the law.
If the employee is already under criminal investigation by the Prosecutor’s Office, their right to defense allows them to invoke the privilege against self-incrimination; moreover, if they decide to render a statement, they are entitled to be assisted by a lawyer.
X. How does the law protect the interviewed?
During internal investigations, interviews are usually conducted with the people involved in the alleged violation. In this scenario, those who are suspect to have committed a crime can be exposed to possible abuses by those who carry out such interviews.
The privilege against self-incrimination (or “right to silence”) is a fundamental principle in the Italian legal system that, among other things, is designated to protect the person called to render a declaration in relation to a law violation. This privilege is recognized by the European Convention on Human Rights (ECHR) and the Italian Constitution as a part of the right of defense.
However, this privilege applies only if external counsels are the ones conducting the interview.
In fact, in this case, the Italian Code of Criminal Procedure provides that it is required to interrupt the gathering of information if the interviewee makes statements that implicate themselves, admitting guilt.
XI. What is the jurisprudential approach on the matter?
Recently, the Court of Cassation issued a judgment (Cass. Pen. n. 10934/2024) relating to the application of article 220 of the implementing provisions of the Code of Criminal Procedure, in the context of internal investigations. The article states that “when, in the course of inspection or supervisory activities provided by laws or decrees, indications of crime emerge, the necessary acts to secure sources of evidence and collect anything else that may be useful for the application of criminal law, are carried out in compliance with the provision of the Code”.
Thus, more specifically, the Cassation Court, in its criminal composition, was questioned on the possibility of extending the guarantees provided by the Code of Criminal Procedure to the acquisition of declarations in the context of interviews conducted as part of an internal investigation by the company.
In the case at stake, the appeal to the Court of Cassation was proposed by the defense, who argued that the scope of application of the norm comprises activities of inspection and surveillance carried out in the private law sphere by the company, based on the interpretation of article 6 CEDU, which provides that procedural guarantees must apply also in private and labor law controversies.
However, with judgment n. 10934/2024, the Court of Cassation deemed it appropriate to adopt the opposite approach, providing that article 220 cannot be applied to interviews carried out during internal investigations. The reasons behind this decision are that the application of the aforementioned article is based on one hand on the existence of a norm regulating the investigation powers (non-existent in the case at stake); on the other, it lays on the nature of the private-public relation between the person rendering the declaration and the person acquiring it, who is a subject exercising a public function (whilst in this case the interviewer was a private subject, representative of the company).
XII. Can the information gathered be used in criminal proceedings?
Before initiating an internal investigation, it is essential to carefully assess the potential use of information or documents, considering their source and the procedure followed. As previously stated, if the interview is conducted in accordance with the Criminal Procedure Code’s rules for defense investigations by an external counsel, all the outcome is covered by legal privilege.
However, if the company decides to collaborate with the Authority, all the documents collected during the investigation can be submitted as part of the criminal case file, where they may be reviewed and considered by the judge in their decision. In the absence of an explicit prohibition, even minutes relating to the interview can be included in the criminal proceedings.
During the preliminary investigation phase of criminal proceedings, the interview records could also be added to the defense lawyer’s file, which is kept at the office of the Preliminary Investigation Judge. In such cases, the judge could use this evidence if a decision needs to be made without involving the company’s defense counsel.
Additionally, the statements in the lawyer’s file may be used during trial to challenge all or part of a witness. If, due to unforeseen circumstances, the interviewed employee cannot be summoned, their interview transcript can still be used.
XIII. What is the role played by internal investigation in judicial proceedings?
First and foremost, conducting internal investigations through external legal counsel under article 391-nonies of the Code of Criminal Procedure (in a preventive manner, before criminal proceedings arise) can play a crucial role in shaping an effective defense strategy.
They serve as a valuable tool for reconstructing the events leading to the alleged violation, providing essential insights for the defense case and making the corporation ready to answer the Authority in case of criminal investigations.
Once criminal proceedings have initiated, the conduct of internal investigations and their findings are key elements considered and assessed by the Authority.
Firstly, article 17 of Law 231 establishes that when determining whether to impose a sanction on an entity, the judge must evaluate if the organization’s conduct “has eliminated the organizational deficiencies that led to the crime by adopting and implementing organizational models suitable for preventing crimes of the kind that occurred”. In this regard, internal investigations can be considered an integral part of such corrective measures: in order to put in place an effective reaction to the specific issue, in fact, it is necessary to assess all the relevant circumstances throughout in-depth investigations.
Secondly, it must be recognized that certain offenses can only be deterred through the effective application of sanctions. However, deterrence is only achieved if an enforcement system operates efficiently, which requires a structured and systematic approach in monitoring the compliance of all the employees with the internal procedures of the company. Internal investigations play a crucial role in implementing this process.
Furthermore, the imposition of a sanction must be directed at the liable individuals. Therefore, it is essential that internal investigations are conducted in a manner that accurately determines each person’s actions, identifies those accountable for the violations, and assesses the extent of their responsibility. Collecting such information serves as evidence that Model 231 is effectively implemented, demonstrating that, even if the violation could not be prevented, the organization was able to detect and address it appropriately.
Finally, the regular and timely initiation of an internal investigations reflects the organization’s firm stance against violations of protocols, procedures, and laws, reinforcing its commitment to compliance and ethical governance.
This approach is also supported by case law, which is increasingly embracing the view that a corporation’s interest or advantage in relation to a committed crime must be assessed within the broader context, including an evaluation of whether there was a “fault in organization” (Cass. Pen. n. 31665/2024). This perspective allows for the exclusion of corporate liability in cases where an isolated instance of negligence occurs within a framework of consistent legal compliance and diligence; and where the isolated violation occurred but the corporation acted promptly to eliminate the organizational deficiencies.
XIV. Conclusion
Internal investigations play a pivotal role in the context of corporate criminal liability in Italy, particularly under Law 231.
These investigations help companies ensure compliance with internal policies, identify potential risks and prevent misconduct that could lead to criminal liability.
While the legal framework surrounding these investigations is not fully regulated, the use of guidelines and best practices, as well as the interventions of the Courts on the matter, provide a structured approach to ensure their effectiveness.
By understanding the relationship between internal investigations and criminal corporate liability, organizations are able to develop a robust defense strategy and ensuring that companies can navigate legal challenges effectively. In fact, by addressing key concerns such as the triggers for initiating investigations, the interview management, and the potential use of gathered information in legal proceedings, organizations can mitigate legal risks and safeguard their reputation.
