info@societejuridique.com
Madrid: Paseo de la Castellana 216 8 ª Planta
Alicante: Av. Ansaldo Nº31, local 16
24h emergencies: 669 30 21 13

Social media:

Internal investigations · professional privilege

Corporate internal investigations: knowing before others do

Under external legal direction · offices in Madrid and Alicante

When an indication appears (a whistleblowing report, an accounting mismatch, an employee’s warning), the company has a brief window to find out what happened before someone else does. That window is worth a great deal.

In brief. It allows the real scope to be known, the conduct stopped, the evidence preserved, a data-based decision on cooperating or defending, and diligence to be proven. At trial, the question will not only be what happened, but what the company did when it learned. And the decisive, least understood argument: only the investigation directed by an external lawyer is protected by professional privilege.

Why it is different

1
A company that investigates, corrects and sanctions stands in a very different position from one that looked away.
Privilege
The report directed by external counsel cannot be seized in a search; the internal department’s report can.
LIWARD
Our own methodology of legal intelligence and forensic analysis.

What investigating first is worth

When an indication appears, a report with concrete data in the channel, an unexplained accounting mismatch, a bank alert, a client’s warning, the company has a brief window to learn what happened before anyone else. That window allows the real scope to be known, the conduct to be cut short, the evidence to be preserved, a decision with data on whether to cooperate with the authority or to defend, and diligence to be accredited. Because at trial the question will not only be what happened, but what the company did when it knew.

Not every indication merits a formal investigation, and opening them lightly wears the organisation down and creates a documentary trail that can later turn against it. It opens where indications look solid and the matter may have criminal, regulatory or reputational relevance. And one rule we do not negotiate: we report what there is, not what the company wants to hear. An internal investigation designed to exculpate whoever commissions it protects nobody: the prosecution detects it and it worsens the company’s position.

The framework

How a lawful investigation is built

Trigger

When it opens, and when not

Solid-looking indications with criminal, regulatory or reputational relevance: a channel report with concrete data, an unexplained mismatch, a bank alert. Vague suspicions are managed otherwise.
Devices

Access to corporate mail and equipment

Conditioned: a prior usage policy, proportionate access limited to the necessary, and data-protection compliance. An indiscriminate extraction renders the evidence unlawful and sinks the case.
Forensics

Preservation with chain of custody

Forensic imaging by experts before anyone touches the equipment: the difference between usable evidence and a challenged file.
Accounting

Forensic accounting

Reconstruction of the money circuit where funds are involved: quantification with accounting rigour, indispensable when there is money in play.
Interviews

Interviews with guarantees

The interviewee is informed; recording requires disclosure. The interview is not an interrogation: a statement obtained under threat of dismissal is contaminated and useless.
Data protection

The GDPR frame

Every measure documented and proportionate: the investigated employee retains rights, and their breach both contaminates the evidence and generates liability.
Report

The final report

A report that serves both internal decisions and, where advisable, production before the authority. Findings, evidence and options: correct and sanction, report and cooperate, or prepare the defence.
Privilege

Why to commission it externally

Directed by an external lawyer, the report and its communications are protected by professional privilege and cannot be seized in a search of the company. Made by the internal department, they are company documents and can end up as the prosecution’s best evidence.
Decision

The three exits

Correct and sanction internally, accrediting diligence; report and cooperate, with the mitigation that can bring the legal person; or prepare the defence if the matter will arrive anyway. Choosing without having investigated is betting blind with the company’s assets.
The process

From the indication to the decision

StepActionGuaranteeThe key point
TriageAssessment of the indicationConfidentialityNot every alert merits a formal file
PlanScope, custodians and measuresProportionalityDocumented from the outset
PreservationForensic imagingChain of custodyBefore anyone touches anything
AnalysisE-discovery and accountingData protectionLimited to what is necessary
InterviewsInformed and voluntaryNo coercionThreat of dismissal contaminates
ReportFindings and optionsPrivilege (external)What there is, not what pleases
DecisionSanction, cooperate or defendStrategicWith data, not blind
AftermathControls correctedDiligence provenWhat the company did when it knew

Each investigation is designed to its facts; this sequence is indicative.

Our differentiator

Privilege, independence and usable evidence

The decisive and worst-understood argument: where the investigation is directed by an external lawyer, both the report and the associated communications are covered by professional privilege and cannot be seized in an eventual search of the company. Where the internal department conducts it, they are not: that report, with all its conclusions, doubts and drafts, is company documentation and can end up in the accusation’s hands as the best evidence against it. It is the difference between knowing what happened and deciding calmly, or knowing it together with whoever will accuse you.

Independence completes the case: the prosecution weighs an investigation credible on its face, and one designed to exculpate is detected and backfires. Our reports state what there is, are built on evidence obtained within the limits, and leave the company with three real options on the table.

01

Legal direction and privilege

02

Digital forensics

03

Forensic accounting

04

Strategic decision

How we work

From the alert to the decision

Phase 01

Triage and investigation plan

Phase 02

Preservation and analysis

Phase 03

Interviews with guarantees

Phase 04

Report and strategic options

Who we assist

Each situation demands a distinct design

E

Companies with an alert

Channel reports, mismatches and warnings: triage and investigation proportionate to the indication.

B

Boards and audit committees

Governing bodies commissioning independent investigations: privilege, independence and a report that withstands scrutiny.

C

Compliance officers

Compliance functions needing external legal direction: guarantees, data protection and usable evidence.

I

Investigated employees

Employees under internal investigation: their rights, the limits of access and the validity of what is obtained.

FAQ

Frequently asked questions

Can I open the suspected employee’s corporate mail?
Under conditions. A prior usage policy must exist, the access must be proportionate and limited to the necessary, and data-protection rules must be respected. An indiscriminate extraction renders the evidence unlawful and sinks the case.
Can I record the interview with the employee?
You must inform them. And the interview is not an interrogation: a statement obtained under threat of dismissal is contaminated and useless.
If the investigation confirms the offence, am I obliged to report it?
Not always, and that is precisely one of the most important strategic decisions. Knowing the facts allows a choice: cooperate with the authority, with the mitigation that brings, or prepare the defence. What cannot be done is decide blind.
Why commission it externally and not my internal department?
For two reasons: independence in the prosecution’s eyes, and professional privilege. The report prepared under external legal direction cannot be seized in a search; the internal one can, and with all its drafts. It is the difference between deciding calmly and handing the accusation its best exhibit.
How long does an internal investigation take?
It depends on the scope: a bounded matter closes in weeks; one with years of accounting and many custodians takes months. The plan fixes scope and deadlines from the start, and the preservation is done in days so that time works for the company, not against it.
What is the LIWARD methodology?
It is our own methodology, Legal Intelligence Warfare for Defense, which integrates legal intelligence, forensic accounting and digital evidence under a single legal direction: investigations designed so that their product is usable where it matters.

Speak to a criminal lawyer

In a fast-track case, the days you have are the case.

Criminal defence in English before the courts of Alicante and the rest of Spain, for residents and for visitors who have flown home.

Logotipos-abogacia-scje
Paseo De La Castellana 216 8º 28046 Madrid
Alicante – Playa de San Juan Av. Ansaldo 31, local 16, 03540 Alicante
Londres: 20 Wenlock Road, N1 7GU, Reino Unido
París: 72 Faubourg St Honoré, 75008, Francia
info@societejuridique.com

Société de Conseil Juridique et Expert es un despacho de abogados con sedes en Madrid, Alicante, Londres y París, especializado en defensa y acusación penal, delitos económicos y corporativos y derecho tecnológico. Trabajamos con orientación estratégica en procedimientos penales complejos, propiedad intelectual y análisis forense avanzado, y prestamos consultoría jurídica, compliance y escudos de protección a particulares y empresas. Atendemos desde Alicante y Madrid, con consulta online en toda España y asistencia al detenido 24 horas. Resuelva sus dudas en las preguntas frecuentes o solicite una primera consulta.

Copyright © 2026 Société de Conseil Juridique et Expert S.L.

EspanolEnglishFrancaisРусскийItalianoDeutsch
WhatsApp · Urgencias 24h