Compliance & Investigations.

Compliance refers to a company and its employees adhering to legal requirements, internal policies and ethical standards in order to avoid risks such as fines, liability or reputational damage.

Relevant areas include, among others, anti-corruption and anti-bribery, competition, data protection, antitrust law, employment law, export controls, anti-money laundering and IT/data security.

Compliance affects internal structures, decision-making processes and corporate culture; it requires operational implementation, training, controls and regular adjustments to new risks or regulations.

A CMS should be introduced as soon as legal risks, headcount, business processes or international activities create an increased risk exposure — i.e., early on, to minimise liability risks.

Key components include: risk assessment, policies & codes, training, reporting channels (speak-up), monitoring and audit, sanction mechanisms, incident investigations, and continuous improvement.

A compliance risk analysis identifies and assesses risks in business processes, products or markets in order to prioritise preventive measures in a targeted manner and use resources efficiently.

Typically, compliance is led by a Chief Compliance Officer (CCO) or a compliance function within the executive board/management, supported by functional owners in the specialist departments.

Compliance relates to law and integrity, while an ICS ensures the reliability of financial reporting and proper business processes. Both systems are complementary, but differ in purpose and focus.

Only if responsibilities, resources and escalation paths are formally defined can compliance function sustainably and not remain a “brand” without impact.

A compliance code is a binding set of ethical principles and rules of conduct that apply to all employees, e.g., on conflicts of interest, gifts, benefits or data processing.

Compliance policies must be clear, accessible and trained on regularly; in addition, evidence of participation and understanding is required (training certificates, e-learning).

Reporting systems enable employees to report unlawful conduct or risks anonymously or in a protected manner before they escalate into significant harm. They are an early-warning and protection mechanism.

Whistleblowing systems must ensure confidentiality, protection against retaliation and traceable case handling; in the EU, there are minimum standards for this (Whistleblower Directive).

Consequences may include: fines, criminal and civil liability risks for the company and responsible individuals, reputational damage, contractual penalties or competitive disadvantages.

Compliance enforcement means identifying violations, investigating them and sanctioning them consistently, as well as implementing lessons learned. This is done through monitoring, internal audits, case analyses and disciplinary measures.

Internal investigations are structured fact-finding exercises within a company, conducted when there are indications of possible compliance violations, breaches of duty, potentially criminal conduct or other irregularities. They serve internal clarification and risk management.

Objectives include, in particular, establishing the actual facts, legally assessing potential violations, preparing remedial measures, and reducing liability, sanctions and reputational risks vis-à-vis authorities, business partners and shareholders.

Early and structured preservation of relevant data is essential to secure evidence and prevent manipulation or data loss. This includes, in particular, emails, files, chats, server and cloud data, as well as mobile devices.

The collection and analysis of information in the context of internal investigations must always comply with employment law, data protection law, personal rights and other third-party rights. It must be reviewed on a regular basis which data may be collected, analysed and disclosed, and in what form. Whether and to what extent findings can be used procedurally is always assessed on a case-by-case basis. The question of admissibility of evidence is therefore not a downstream step; it is anticipated already when designing and conducting the investigation, in order to minimise later risks of inadmissibility and to comply with legal limits. In practice, it may be necessary to redact documents or communication content to exclude irrelevant or particularly sensitive information (e.g., private content, third-party references or personal data of uninvolved persons). The handling of audio or sound recordings is also particularly sensitive, as their collection and use may be legally problematic.

In complex commercial disputes and internal investigations, the file record alone is often insufficient because key information lies outside the company’s own systems or assets are deliberately “moved.” In such cases, involving specialised forensic and investigation partners is particularly advisable — for example, for data preservation and analysis (e.g., forensic imaging, analysis of large volumes of communications and documents) and for asset location / asset tracing (locating assets, reconstructing ownership and control structures, identifying beneficial persons or target jurisdictions). Especially in cross-border constellations, asset tracing can also clarify strategically whether proceedings are economically worthwhile, where claims can be enforced most effectively, and how subsequent enforcement of a judgment or arbitral award can actually be achieved (e.g., through asset discovery, ownership evidence, preparation of interim measures). For this reason, in relevant cases we work with a network of proven forensic and investigation specialists and closely integrate this work into the legal strategy — from early risk and enforceability analysis through to contentious enforcement and execution.

For extensive datasets, technical analysis tools and AI-supported software solutions are increasingly used to help identify relevant content efficiently, detect patterns and set priorities.

AI-supported systems enable faster, structured and traceable analysis of large volumes of data, reduce manual review and support focusing on relevant documents and communication threads.

The results serve as a basis for internal measures, such as organisational adjustments, employment-law steps or compliance improvements, and may also be relevant for communication with supervisory or law enforcement authorities.