Internal Investigations, Whistleblowing and External Monitoring

The establishment and use of internal investigations, whistleblowing and external monitoring is a topic of current importance for scholarship, legislation and corporate practice. Internal investigations into (suspected) legal violations by companies, sometimes triggered by whistleblowing and, of late, sometimes tracked by external monitoring are components of corporate compliance. These three information and enforcement channels relate to the core area of corporate management and they are a task of the management and/or the board. The Board must investigate suspected legal violations in the company, but it has broad discretion as to the manner in which the specific violation of law should be addressed and as to the necessary scope of the inquiry. In practice, a typical sequence of a stages and steps has been established in practice for internal investigations: (1) Indication of an incident: plausibility assessment, preparation, possible ad hoc measures, investigation; (2) Legal assessment of the interim result based on the facts at hand, data analysis and interviews; (3) Result and reporting: measures, tracking, follow-up and identification of lessons learned. There is a broad and detailed body of comparative legal experiences from the USA, the United Kingdom, Switzerland and other European countries on internal investigations, whistleblowing and external monitoring. These experiences are reported in detail in the corresponding article in the European Company and Financial Law Review (ECFR) 2021, October issue.

Empirical studies on all three information and enforcement channels are available, but there is a lack of any broad and empirically processed body of data. For the internal investigations those economic contributions are relevant, that deal with the indirect enforcement of the legality of the company’s operations by the public authorities via conditions and directions in the public interest. Prototypes here are the deferred prosecution agreements and non-prosecution agreements that have been used in the USA since around 2001, but are now common also in the UK, Switzerland and other countries. Economic theory refers to “bargaining in the shadow of the law”, consistent with the key study of Cooter/Marks/Mnookin. This theory overcomes the traditional dichotomy between (state) regulation (command-and-control) and self-regulation and sets out a model of cooperation between the regulator and the (indirectly) regulated that lies between the two forms of regulation. The advantage of cooperative regulation is greater flexibility.

Whistleblowing is a way of addressing and possibly remedying an information deficit of (civil) society, of law enforcement by criminal or other government agencies as well as of companies themselves in relation to some manner of misconduct. Whistleblowing has rightly been described as a key element of compliance. Since whistleblowing often has very negative consequences for the whistleblower, the core regulatory problem is to encourage whistleblowing through incentives, but without losing sight of the interests of the people and companies affected by whistleblowing and without creating a climate of denunciation. The incentives can consist of protecting the whistleblower through anonymity, guarantees of confidentiality, and financial and other reward systems. Particularly controversial are financial incentive schemes based on the US system of bounties. A difficult problem with demarcation is how to handle evidence that is false, carelessly inaccurate, or simply not proven. In economic terms, it is therefore a question of minimizing costs in the implementation and enforcement of the law. From an empirical standpoint, despite various inquiries, the overall benefit of whistleblowing—in terms of information gain, costs, positive and negative effects on the company and the people involved, etc. – remains uncertain. Only the immediate effect, the increased discovery of legal violations and misconduct, is guaranteed. The latter is particularly evident for leniency programs in antitrust law, but it holds true also for the US incentive systems in securities regulation.

External monitoring is a form of externalization of law enforcement by government regulators. The economic question posed here is when does it make sense to employ an external special representative or other expert appointed by the supervisory authority—or instead to use the investigative and enforcement work of a monitor commissioned by the company itself. The latter has recently been increasingly practiced in an international context, not only because the former would usually not be possible extraterritorially, but because such intervention is more flexible and without direct administrative restrictions; it is cheaper for the authorities in terms of personnel and costs, and, with suitable specifications, for example in an agreement, it can be more targeted and effective. When the monitor is seen as having an interest in improving the company’s corporate governance, its reputation on the market and its own successful relationships with the state and supervision authorities, it can be the case that management and employees not only act in accordance with the agreement, but also cooperate with the monitor on their own initiative.

Empirical studies in the strict sense, specifically as relates to external monitoring, seem rare or may have not been found. However, there are at this point numerous findings from practice. Some of these are extremely critical. From the point of view of the US supervisory authorities, on the other hand, the experience with external monitoring appears to be good or at least satisfactory. In any event, monitors are enforcing the agreed requirements, as shown in more detail in the monitors’ annual reports. From the outside, it is difficult to say whether this will really lead to changes in a company over the long term. Beyond the individual case, this can ultimately be answered only in the context of the logic and design of the corporate criminal law regime and a more general efficiency analysis of economic and business law enforcement vis-à-vis large companies. Experiences with US monitors, in particular those that have been or are active in Europe, show that monitoring and enforcement interventions in a company take three or more years, reach deep and far into the company and are extremely time-consuming and costly. On the other hand, the successes of external monitoring—from the company’s point of view, from the point of view of the monitors (for example from Waigel at Siemens or Freeh at Daimler) and from a supervisory authority point of view—have in many cases been assessed positively. Success factors associated with the use of a monitor are identified from experiences in practice: a clear restriction of the monitor’s mandate to a future-oriented assessment without investigating past individual instances of misconduct, selection of the monitor, clear compensation agreements for the monitor and his team in advance, the support given within the company, contract duration and type and the reasons for dismissal, avoidance of the additional involvement of an auditor, and a consistent implementation of the recommendations of the monitor.

The complete paper is available for download here.