A missing bank transfer, falsified purchase order or suspicious customer-data download may require a company to investigate misconduct before deciding whether to approach the police. The immediate commercial desire to identify a culprit often produces legally weak evidence: shared passwords are changed without recording access, files are copied without preserving their original state and staff are interviewed collectively. An internal inquiry should establish what happened and protect the record, not begin by treating a suspicion as a proved criminal offence.
Set a lawful and narrow investigation mandate
The company should first establish who authorised the inquiry and what conduct is under examination. A board resolution or properly delegated instruction may be significant where management is divided or a director is implicated. Scope should identify relevant transactions, people, systems and dates. The inquiry must respect contractual obligations, privacy interests and any legal process required for access to devices or accounts. A corporate investigator does not acquire statutory search powers merely because suspected wrongdoing affects the employer.
Digital evidence requires provenance
Original devices, server logs, payment approvals and access history should be preserved without avoidable alteration. A forensic copy should be accompanied by details of acquisition, hashes where appropriate, custody and the person performing each step. Screenshots can assist an inquiry but may omit underlying metadata and conversation context. The Prevention of Electronic Crimes Act, 2016 and the applicable law of evidence require careful analysis before an allegation of unlawful access or data interference is made. The existence of a suspicious login is not by itself proof of the identity of the operator.
Interviews and disciplinary fairness
Witnesses should be interviewed separately, using neutral questions and notes that distinguish firsthand observation from hearsay. An employee accused of misconduct may also face disciplinary proceedings governed by the applicable terms and labour rules. Counsel should avoid treating a disciplinary interview as a substitute for police investigation or compelling an employee to sign an inaccurate admission. The possibility of individual criminal exposure may justify separate legal representation. The employer's interest in recovery and an employee's defence may diverge substantially.
When a criminal referral is justified
The complaint should identify the legal ingredients of each alleged offence and the evidence supporting them. Failure to perform a contract, disputed authority and poor business judgment do not automatically amount to theft, cheating or criminal breach of trust. A company should not use criminal process as leverage for an ordinary debt. Where forgery, deception or unauthorised system access is genuinely evidenced, the referral should provide a coherent chronology and authenticated supporting material, while avoiding exaggerated statements that cannot later be substantiated.
Parallel civil and employment remedies
Civil recovery, interim injunctions, disciplinary decisions and criminal investigation may serve different purposes. They can proceed in appropriate circumstances but should be coordinated so factual positions remain consistent. A settlement of money owed does not necessarily resolve every public-law concern, and an unsuccessful criminal complaint does not automatically decide a contractual claim. Management should map available remedies, limitation periods and preservation obligations before making public accusations or sending threatening demands.
Points to establish from the record
- Company authority for the internal inquiry
- original electronic data and documented custody
- separate witness accounts and interview notes
- identifiable offence elements versus contractual breach
- consistency of civil, labour and criminal positions
Practical conclusion
A reliable internal investigation protects the organisation whether allegations are proved or disproved. The company needs a documented mandate, proportionate collection methods and a clear distinction between fact, inference and legal offence before it approaches enforcement authorities.
Legal materials and official sources
The governing text and any later amendments or notifications should be checked against the transaction date and the authority with jurisdiction.
The applicable legal position depends on the governing instruments, subsequent amendments and the facts of the matter. How we prepare and maintain legal commentary ↗