Internal Investigations at a Company: How to Do It Lawfully

A shortage in the warehouse, or a suspicion that an employee is siphoning off money, is no reason to act on emotion. If you want to hold the culprit accountable and recover the loss — rather than lose the case on a technicality — the internal investigation has to be conducted by the book. Below is a step-by-step algorithm that I, as a forensic economic expert, look at primarily from the evidence side: what the file must contain for it to stand up.

When an internal investigation is justified: grounds and purpose

An internal (in-house) investigation is usually triggered by one of these situations:

• a shortage of inventory items or cash discovered during a stocktake or reconciliation;
• suspicion of theft, misappropriation, embezzlement, or abuse of office;
• a tip-off from staff, a counterparty, or an auditor, or accounting data that simply does not add up.

The goal of the investigation is not to “find someone guilty at any cost” but to establish four things: whether a violation actually occurred, its size in money, who was involved, and which documents prove it. It is on these four supports that the disciplinary sanction, the recovery of damages, and — if necessary — the criminal proceedings will later rest. If even one support is put together carelessly, the whole structure wobbles.

Step by step: the lawful algorithm

Step 1. The manager’s order and the commission

An investigation begins with a written order from the manager, not with a verbal “look into it.” The order should:

• create a commission (not a single person): an accountant or chief accountant, a lawyer, a security officer, the head of the relevant unit; and appoint a chairperson;
• record the grounds, purpose, powers, and time limits of the commission’s work;
• exclude anyone potentially involved or interested from its membership.

Why this matters: an act drawn up by one person and backdated is easily discredited in court. Collegiality and a fixed date are the first layer of protection for the file.

Step 2. Inventory under Regulation No. 879 — the foundation of shortage evidence

This is the most underrated step. The size of a loss cannot be “eyeballed” — it is established by an inventory count. The Regulation on the Inventory of Assets and Liabilities, approved by Order No. 879 of the Ministry of Finance, expressly lists the discovery of theft, abuse, or damage to valuables among the cases where an inventory is mandatory.

What must remain in the file:

• the order to carry out the inventory and the composition of the inventory commission;
• inventory lists signed by the financially responsible person;
• reconciliation statements;
• written explanations from the financially responsible person regarding the causes of the discrepancies;
• a protocol (act) with the commission’s conclusions and the established shortage amount.

In my expert practice, it is precisely the “holes” in the inventory — a missing signature from the financially responsible person, undated lists, incorrect paperwork — that destroy a case before it ever reaches court. If the shortage is not documented under Regulation No. 879, then from an evidentiary standpoint it effectively does not exist.

Step 3. Written explanations from the employee (Art. 149 of the KZpP)

Before applying any disciplinary sanction, the employer is obliged to request a written explanation from the employee — this is expressly required by Article 149 of the Labour Code of Ukraine (KZpP). This is no formality: the absence of a requested explanation is one of the most common reasons courts overturn a disciplinary order or a dismissal.

How to do it correctly:

• put the request for an explanation in writing and hand it over against signature;
• give a reasonable deadline (usually one or two working days);
• if the employee refuses to explain or to sign, draw up an act of refusal in the presence of witnesses.

It is important to understand the balance here: requesting the explanation is the employer’s duty, while giving it is the employee’s right. A refusal does not halt the procedure, but it must be documented. The key point is that the file should clearly show the person was given the opportunity to explain themselves.

Step 4. Observing the deadline (Art. 148 of the KZpP)

Article 148 of the KZpP sets strict limits on disciplinary sanctions:

• a sanction is applied no later than one month from the day the misconduct is discovered (not counting the employee’s sick leave or vacation);
• and no later than six months from the day the misconduct was committed.

A reminder: as a general rule there are only two types of disciplinary sanction — a reprimand and dismissal (Art. 147 of the KZpP); the law does not provide for “fines” for a disciplinary offense. The one-month window runs out faster than it seems while the commission is “gathering documents.” That is why the disciplinary track and the criminal/civil-liability track should be pursued in parallel, not one after the other. A guide to the types of liability:

Type of liability	Legal basis	Key deadline	What supports it
Disciplinary	KZpP (Arts. 147–149)	1 month from discovery of the misconduct	explanations, commission acts, order
Material (civil)	KZpP (Chapter IX; Arts. 135-1, 233)	1 year from discovery of the damage (Art. 233 KZpP)	inventory, loss calculation, full-liability agreement
Criminal	Criminal Code, investigation under the KPK	limitation periods under the Criminal Code	evidence, forensic economic expert opinion

The limits of legality: where the employer’s powers end

An internal investigation is not a “home search.” The most frequent violations — the ones that later hurt the employer — are:

• searching an employee’s personal belongings, bag, or phone: this is a violation; you may only inspect company property, and only in a lawful manner;
• coercion, psychological pressure, detaining a person, or barring them from work without grounds: a violation of labour rights;
• unlawful disclosure of the personal data of the employee or of third parties (a breach of the Law “On the Protection of Personal Data”);
• covert video surveillance without warning: such recordings are easily ruled inadmissible; employees must be warned in advance about video monitoring at their workplaces.

The rule is simple: everything you do during the investigation should be something you would not be embarrassed to show a court. Evidence obtained through a violation is more likely to harm your case than help it.

When and how to hand materials to the police or the BEB

If the facts point to a criminal offense — theft, misappropriation, embezzlement, or taking property through abuse of office — the matter moves beyond labour law. Here the Criminal Procedure Code of Ukraine (KPK) applies: on a report of a criminal offense, the information is entered into the Unified Register of Pre-Trial Investigations (ERDR) and a pre-trial investigation begins.

Where to turn:

• the National Police — general property crimes (theft, misappropriation, embezzlement);
• the Bureau of Economic Security (BEB) — offenses in the economic sphere, especially where significant sums, schemes, or tax and financial components are involved; on tax aspects the State Tax Service (DPS) may also be brought in;
• where needed, a forensic economic examination is ordered in the case, and financial operations bearing signs of money laundering may fall within the view of the State Financial Monitoring Service.

How to preserve evidence before handing it over:

• do not give out the originals of primary documents, orders, or material-liability agreements “into people’s hands”; keep an inventory of what has been transferred;
• capture electronic correspondence, files, and accounting-system data so that the source and date are visible (exports, screenshots with metadata, and, where possible, notarial certification);
• keep video recordings on the original medium, not merely as a copy;
• ensure all commission acts carry signatures and dates.

The core principle: the chain of evidence must be unbroken and clear to an outsider. If you cannot explain where a document came from and who received it, its evidentiary weight drops.

The role of forensic economic examination

When a matter reaches court or a pre-trial investigation, the size of the loss and the mechanism of the abuse are most often confirmed by a forensic economic examination — a study of accounting and tax records and reporting, of financial and economic activity, and of financial and credit operations. It is ordered by the investigator or the court, or commissioned by a party. The procedure is governed by the Law of Ukraine “On Forensic Expert Examination” and the Instruction on the Ordering and Conduct of Forensic Examinations (approved by Order No. 53/5 of the Ministry of Justice). A practical detail: documents collected properly at the internal-investigation stage directly affect whether the expert can give a categorical conclusion rather than settle for a merely probable one.

Common mistakes that devalue an investigation

• a sanction imposed without a requested written explanation (a breach of Art. 149 of the KZpP);
• a shortage “counted by eye,” without an inventory under Regulation No. 879;
• the one-month deadline under Art. 148 of the KZpP missed;
• materials drawn up by a single person, without a commission, signatures, or dates;
• limits overstepped: searching personal belongings, applying pressure, disclosing personal data;
• evidence collected chaotically, without an inventory and without preserving originals.

Any one of these mistakes on its own can cost you the case. Together they all but guarantee that even an obvious abuse will go unpunished, while the dismissed employee returns through the court with reinstatement and back pay.

An internal investigation is, above all, about the quality of the documents, not the speed of punishment. If you suspect a shortage or an abuse and want the collected materials to survive judicial scrutiny, seek a consultation or a forensic economic examination: it is far cheaper to build the evidentiary base correctly from the first step than to rescue a lost case afterward.