Internal investigations
A harassment report, an alert from an elected works council (CSE) member, a suspected fraud or data leak: the employer must react quickly, without imposing sanctions blindly or letting the situation take hold. The internal investigation is the tool that makes it possible to decide on established facts. MOSAIK conducts it as lawyers, bound by legal professional privilege (secret professionnel), able to apply to the court when the investigation is no longer enough, with a team that interviews witnesses in French, English, Cantonese, Mandarin and Spanish. A 360° law firm, it brings together around the investigation all the skills that a sensitive situation calls into play: employment law, business criminal law, company law, compliance, personal data and international matters.
Key contacts: Pascal-André Gérinier (Lawyer - Founder), William Mak (Lawyer - Founder)
An internal investigation is a structured process for verifying facts reported within the company. It gathers the relevant documents, collects testimony and compares the accounts given, without presuming anyone's guilt. Its report distinguishes the facts that are established from those that are not, or that remain insufficiently corroborated. It enables the employer to take a proportionate decision: to protect, to reorganise, to impose a sanction if the facts warrant it, or not to impose one. It also helps to build evidence that can be used in the event of litigation. The investigation therefore concerns the company as much as the employees who say they are victims or who are implicated.
When should an internal investigation be opened?
The law does not require an internal investigation in every case, but it does require the employer to protect the health and safety of its employees (Article L. 4121-1 of the French Labour Code) and to react to what it learns. In practice, ten situations lead to an investigation:
- a report of psychological or sexual harassment, or of sexist behaviour;
- a complaint of discrimination;
- violence, threats or an altercation;
- an alert from an elected works council member, for an infringement of individual rights or for serious and imminent danger;
- a report received through the whistleblowing channel;
- a suspicion of fraud, theft, misappropriation or conflict of interest;
- a suspicion of corruption, influence peddling, money laundering or accounting irregularity;
- a data leak, cyber fraud or an employee leaving with the customer list;
- a contested automated decision or artificial intelligence tool: algorithmic discrimination, surveillance, personal data;
- a serious accident or collective signs of distress at work.
The guide Which HR risks require an internal investigation to be opened? details each situation and what the employer who fails to act risks.
Two situations call for particular vigilance. When an elected works council member triggers the right of alert for an infringement of individual rights, the employer investigates without delay together with that member, in accordance with Article L. 2312-59 of the French Labour Code. In companies with at least fifty employees, the Sapin II Act and the Decree of 3 October 2022 require reports to be processed: acknowledgement of receipt within seven working days, appropriate verification and feedback within three months. A formal report is not required in every case. Evidence may be adduced by any means: the absence of an internal investigation, which the Labour Code does not require, is not sufficient to exclude the evidence produced by the employer (Cass. soc. 14 janvier 2026, n° 24-19.544, handed down in a case concerning a report of sexual harassment). It may nevertheless weaken the evidence and expose the employer with regard to its duty of safety (Article L. 4121-1 of the French Labour Code).
What should be done in the first 48 hours?
Four decisions are taken before any interview:
- protect the person making the complaint, with their agreement, without removing them against their will;
- preserve the evidence: IT access, connection logs, emails, badges, without opening any personal mailbox;
- take no measure against the person who reported in good faith, on pain of nullity (Articles L. 1152-2 and L. 1152-3 of the French Labour Code);
- decide who will investigate, in writing, with a scope and a timetable.
A time limit is also running: the employer has two months from the date on which it acquires precise knowledge of the facts to initiate disciplinary proceedings (Article L. 1332-4). Where an investigation is necessary to ascertain precisely the reality, nature and extent of the facts, the time limit runs only from its conclusions; it runs earlier if the employer already had that knowledge, and an investigation that drags on does not extend it.
"Am I obliged to investigate?" Not in general. An alert from an elected works council member requires an investigation; the Sapin II Act requires reports to be processed. Otherwise, investigating remains the safest course. "Must I remove the implicated person immediately?" Not systematically. A paid exemption from work, notified as a protective measure, may be preferable. A precautionary suspension requires the disciplinary procedure to be initiated promptly, although the needs of the investigation may justify a delay. "How long do I have to impose a sanction?" Two months to initiate proceedings, from the time the facts are precisely known (Article L. 1332-4 of the French Labour Code). A necessary investigation, conducted without delay, may defer that starting point.
Who should conduct the investigation?
| Investigator | Strengths | Limits |
|---|---|---|
| HR department or management | Knows the company, quick, inexpensive | Impartiality open to challenge if the hierarchy is implicated; no privilege; the investigators are employees who may be called as witnesses |
| Committee with elected works council members | Legitimacy with the teams; after an alert from an elected member, the law requires the investigation to be conducted with that member (Article L. 2312-59) | Slower; confidentiality harder to maintain; elected members sometimes involved parties |
| Lawyer | Legal professional privilege when investigating as the company's counsel; method governed by the profession's ethical rules; access to the court; the firm then handles the defence, through a lawyer other than the investigator | Engagement to be defined in writing |
| HR consultancy | Psychosocial expertise; availability | No privilege; the author of the report may be heard as a witness; cannot apply to the court on the company's behalf |
| Private investigator (CNAPS professional licence) | Enquiries outside the company | Surveillance permitted only if indispensable and strictly proportionate; no privilege; cannot apply to the court on the company's behalf |
The choice depends first on the seriousness of the facts and the independence required. Where the hierarchy is involved, entrusting the interviews to an external party may limit conflicts of interest. The expected confidentiality, the witnesses' languages, the locations concerned and the need to preserve evidence also guide the method. If a judicial measure appears useful, the lawyer may in particular consider an application under Article 145 of the French Code of Civil Procedure. The options are not mutually exclusive: a lawyer may conduct the work while elected works council members are involved within the applicable framework. The guide Why entrust the internal investigation to a lawyer? details these differences.
When the internal investigation is no longer enough: what the lawyer can ask the court for
It happens that the evidence is not within the company: at the competitor that hired the employee who left with the customer list, at a service provider, in a personal account. Beyond that point, only the court can make orders; the lawyer prepares and presents the application. An ex parte evidentiary report (constat sur requête) under Article 145 of the French Code of Civil Procedure, carried out by a court bailiff (commissaire de justice) without the opposing party being forewarned; interim proceedings (référé) to obtain documents under a periodic penalty payment; a protective attachment of the accounts of the perpetrator of a misappropriation; a criminal complaint, which opens up the investigators' powers; a participatory procedure agreement with an employee who agrees to cooperate. A consultancy or a private investigator has access to none of these procedures; the company may lodge a complaint on its own, but the form of the complaint and how it fits with the investigation call for advice, and before the judicial court (tribunal judiciaire) representation by a lawyer is in principle compulsory. The guide Why entrust the internal investigation to a lawyer? presents each measure, its condition and its limit.
Who MOSAIK acts for: management, works councils, employees, organisations of every size
An alert may come from an employee, an elected works council member, a trade union, a manager, management or the reporting channel. Whatever its origin, it calls for the same rigorous and impartial examination. The firm advises management and employers on the handling of reports, the conduct of investigations and the decisions that follow. It also advises works councils and employee representatives: analysis of reported situations, exercise of the right of alert, recourse to an expert assessment for serious risk, monitoring of preventive measures. Where management and employee representatives so wish, a shared investigation framework can be defined from the outset, with a clear mandate, a common method and reporting arrangements suited to each: an investigation is not meant to set the parties against each other, but to give them established facts on which to build responses. The firm never represents two parties with opposing interests in the same matter, and every engagement begins with a conflict of interest check.
A single situation rarely falls under a single area of law. Harassment may reveal breaches of employment law, a criminal offence, a governance failure or a breach of personal data; fraud brings into play business criminal law, company law, employment law and compliance. That is the strength of a 360° law firm: MOSAIK brings these skills together, employment law, business criminal law, company law, compliance, personal data, public law and international matters, around a lead lawyer, so that the situation is dealt with in all its dimensions without changing contact person, and it involves external professionals as needed: chartered accountants and auditors for financial flows, digital forensics specialists for mailboxes and servers, data protection officers, occupational psychologists and psychosocial risk specialists, former human resources directors, local counsel abroad. Sensitive situations spare no organisation: a very small business faced with harassment, an SME with internal fraud, a group with suspected corruption, a public body or an association with a governance dispute. Engagements are sized according to the seriousness of the facts, the size of the organisation and its resources, from the ten-employee company to the international group, from the private sector to public authorities, healthcare institutions and associations.
How MOSAIK conducts an internal investigation
- Written scoping. MOSAIK defines in an engagement letter the scope of the facts, the timetable, the persons in charge of the investigation and the recipient of the report.
- Protective measures. The team examines the protections required, without prejudging the conclusions, and arranges for the preservation of material likely to disappear.
- Interviews. Two investigators interview the complainants, the witnesses and the implicated person. Each written record is read over and then signed on the spot, subject to the agreement of the person interviewed.
- Proportionate investigations. Searches follow a written scope. The IT department makes, if necessary, a frozen copy of the professional data; personal items are set aside and the GDPR is complied with: the processing rests on the employer's legitimate interest or legal obligation, not on the consent of the employees, who are informed.
- Report. The document distinguishes established, unestablished and uncorroborated facts, sets out the evidence relied on and presents recommendations suited to the situation.
- Follow-up. The employer decides on organisational measures and, where appropriate, initiates disciplinary proceedings within the two-month period provided for in Article L. 1332-4 of the French Labour Code. Follow-up then verifies their implementation.
What counts before the court is the method. The Cour de cassation leaves it to the trial judges to assess the probative value of the report in the light of the other evidence produced (Cass. soc. 18 juin 2025, n° 23-19.022): a report in which nine of the fourteen interview records were not produced, without the reason given being substantiated, and in which passages had been truncated, was held to be insufficiently probative. Conversely, the investigation does not have to be announced to employees as a monitoring system (Cass. soc. 17 mars 2021, n° 18-25.597). Hence our rules: two investigators per interview, reading over and signature on the spot, anonymised versions of the interview records ready to be produced, data processed in accordance with the GDPR and kept for as long as is useful. The guide How to conduct an internal investigation into harassment or discrimination? describes each step.
Why a multicultural team changes the investigation
An interview is not merely a translation of questions and answers. A witness may express disagreement indirectly, hesitate to contradict their superiors or seek to avoid losing face. A polite "yes" does not necessarily mean that they are confirming the facts. A lawyer who conducts the interview personally in the witness's language can rephrase, check what has been understood and better distinguish facts from insinuations, without depending on consecutive interpretation. MOSAIK works in French, English, Cantonese, Mandarin and Spanish, from Paris, Hong Kong and Mexico City. For investigations involving China or Africa, the firm coordinates its work with local counsel.
In a group, three questions precede the first interview. Who decides and who interviews the witnesses: the subsidiary or the parent company? Which data may leave the country: Hong Kong, Mexico and China benefit from no adequacy decision within the meaning of the GDPR, and China subjects transfers to its own personal data law. Which confidentiality protects the work: French legal professional privilege, Hong Kong's legal professional privilege, limited protection in China, where the lawyer is bound by confidentiality without comparable procedural protection. A French rule is added: subject to applicable treaties and legislation, the Blocking Statute of 26 July 1968 prohibits the communication of documents of an economic, commercial, industrial, financial or technical nature intended to serve as evidence in foreign proceedings; some of the documents in an internal investigation may fall within this scope, which requires an analysis before any direct transmission to a foreign authority. The guide How to conduct an internal investigation in an international group? answers country by country; our Hong Kong and Mexico pages present the offices.
Beyond the investigation: a complete chain of protection
The investigation is only one link. A report often reveals a failure of prevention upstream and calls for corrective measures and training downstream. Thanks to its 360° approach, MOSAIK builds with the company a response that covers the whole chain: prevent, alert, investigate, defend, correct, train. Each company receives not a catalogue but a combination of services suited to its risks, its size and its locations, settled with the lead lawyer from the first exchange.
| Step | What MOSAIK offers | What the company gains |
|---|---|---|
| Prevent | Mapping of harassment, fraud and non-compliance risks; internal rules, single risk assessment document, whistleblowing procedures and IT charter brought up to date; GDPR compliance and framework for artificial intelligence | Up-to-date obligations and evidence of prevention, the first documents in the file in the event of litigation |
| Alert | An external channel for receiving reports, with acknowledgement of receipt, a first response within 24 working hours, information given only to authorised persons and an aggregated monthly summary; an information campaign for employees at launch | Facts detected early, a system compliant with the Sapin II Act and a management that acts in time |
| Investigate | Legal characterisation within 48 hours, protective measures, investigation scoped in writing, interviews in five languages, report that can be produced in court | Established facts, a sound decision, a disciplinary time limit kept under control |
| Defend | Judicial measures to preserve or obtain evidence, representation before the labour court, the criminal court or the CNIL, by a lawyer other than the investigator | Continuity between the investigation and the litigation, with no loss of information |
| Correct | Action plan, sanction or reasoned closure, reorganisation, mediation, confidential support for employees and executives affected by the facts, with qualified practitioners | A situation resolved and a recurrence avoided |
| Train | Collective awareness-raising, one-day training for managers and designated officers on receiving an alert, anti-corruption training, six-month follow-up | Teams that react without investigating themselves, and evidence of the employer's response |
The typical path for a company of a few hundred employees comes down to six moments: the alert received; legal characterisation and urgent measures within 48 hours; the investigation and its report over four weeks; the legal follow-up and the updating of the internal rules in the second month; awareness-raising and training of managers in the second and third months; the assessment of the effectiveness of the measures at six months, with a written review. Each step is the subject of a separate fee quote and engagement letter, and the company commits only to what it needs.
How long does it take, and what does the cost depend on?
An investigation takes weeks rather than months. The two-month disciplinary time limit laid down in Article L. 1332-4 of the French Labour Code constrains its timetable. The cost depends on the number of interviews, the languages, the countries concerned, the IT analysis and any judicial measures. The employer funds the investigation it decides on. In the event of serious risk, the expert assessment decided on by the works council under Articles L. 2315-94 and L. 2315-80 of the French Labour Code is entirely at its expense. The employee does not fund the employer's investigation: making them bear the cost, for example through a deduction from salary, would constitute a financial penalty prohibited by Article L. 1331-2 of the French Labour Code. The guide Who should pay for an internal investigation? details each case.
How to instruct us, and what to prepare
An initial exchange, confidential and without commitment, makes it possible to characterise the situation and decide whether an investigation, a simple verification or immediate measures are needed. It is useful to gather, without yet communicating anything to the persons concerned: the report or alert as received, the department's organisation chart, the internal rules and the IT charter, the list of persons likely to be interviewed and the timeline of the known facts. If the chief executive or the HR director is personally implicated, it is the competent body of the company, the board or the chairman, that gives the mandate: the firm then deals with that body, and not with operational management. No personal document belonging to an employee should be copied or transmitted before the framework of the investigation has been set.
And after the investigation?
The report is not an end in itself: it is the basis for a decision. A sanction, the procedure for which is initiated within the two-month period. A closure, explained in writing to the complainant and to the implicated person alike. Organisational measures where the facts are not established but the situation requires them: separation of teams, training, mediation, which the firm organises with qualified practitioners. Follow-up at three and six months, concluded by a written review of the effectiveness of the measures. If litigation follows, MOSAIK represents the company before the labour court (conseil de prud'hommes), the criminal court or the CNIL, through a lawyer other than the one who conducted the investigation, in accordance with the profession's ethical rules and after a conflict of interest check. The firm also defends employees and executives who are implicated or victims, in their own cases, never both parties to the same matter. The Employment law page presents the firm's employment practice as a whole.
Our practical guides
- Who should pay for an internal investigation: the employer, the works council, the insurer or the employee?: works council expert assessment, insurance, private investigator, and what the employee never pays.
- Which HR risks require an internal investigation to be opened?: thirteen situations, what the employer who does not investigate risks, the time limits.
- How to conduct an internal investigation into harassment or discrimination?: interviews, digital investigations, GDPR, report, difficult situations.
- Why entrust the internal investigation to a lawyer?: legal professional privilege, ethical rules, judicial measures, comparison with other practitioners.
- What are the rights of the employee who is a victim or implicated?: interview, assistance, access to data, remedies.
- How to receive and process a whistleblower report?: channel, time limits, confidentiality, protection against retaliation.
- How to conduct an internal investigation in an international group?: Hong Kong, Mexico, China, Africa, data, confidentiality, integrity checks.
Frequently asked questions
Is an internal investigation mandatory?
No, not for every report. An alert from an elected works council member concerning an infringement of individual rights requires an investigation conducted without delay together with that member, under Article L. 2312-59 of the French Labour Code. In companies with at least fifty employees, the Sapin II Act requires a procedure for processing alerts, with the necessary verification. Otherwise, the investigation often remains relevant to establish the facts, protect employees and comply with the duty of safety under Article L. 4121-1 of the French Labour Code.
Must the implicated employee be informed that an investigation has been opened?
The law does not require them to be informed that the investigation has been opened: it is not a system for monitoring activity subject to prior information of employees (Cass. soc. 17 mars 2021, n° 18-25.597). In practice, the implicated employee is informed at the time of their interview, when the facts are put to them so that they can respond. Informing them too early puts the evidence and the witnesses at risk; never interviewing them weakens the report before the court. The GDPR, on the other hand, requires individuals to be informed of the processing of their data: at the interview for what they state, and within one month for information collected from other persons, subject to exceptions.
Can the investigation report be used before the labour court?
Yes. The employer may produce an investigation report to substantiate the facts alleged against an employee. The labour court assesses its value in the light of the other evidence, as Cass. soc. 18 juin 2025, n° 23-19.022 points out. An incomplete or truncated report risks losing probative force. An investigation triggered after a report of psychological harassment is not treated as a monitoring system requiring prior information of the employee (Cass. soc. 17 mars 2021, n° 18-25.597).
Who pays for the internal investigation?
The employer pays for the investigation it decides on. Where the works council appoints an accredited expert for a serious, identified and current risk, the employer also pays, in full (Articles L. 2315-94 and L. 2315-80 of the French Labour Code), and may only challenge it before the court within ten days. The employee never funds the employer's investigation: making them bear the cost, in particular through a deduction from salary, would be a prohibited financial penalty (Article L. 1331-2). They fund their own counsel, sometimes through legal expenses insurance.
Can you investigate in our Hong Kong or Mexican subsidiary?
Yes. MOSAIK can conduct an investigation from its Hong Kong or Mexico City offices, in coordination with local management. The interviews, access to documents and the follow-up must take account of local employment law and the rules applicable to personal data. Transfers of information to France are examined in the light of the GDPR and, depending on the country, local requirements. In China and Africa, the firm works in coordination with local counsel to organise the necessary verification.
Do you also defend employees targeted by an investigation?
Yes. MOSAIK advises employees and executives who are implicated or victims: preparation for the interview, access to data, challenge to a sanction based on an unfair investigation, protection against retaliation after a report made in good faith. The firm never represents both parties to the same matter: every case is subject to a conflict of interest check before being accepted.
Do you also act for a works council or employee representatives?
Yes. The firm advises works councils and employee representatives: analysis of a reported situation, exercise of the right of alert for an infringement of individual rights or serious and imminent danger, recourse to an expert assessment for serious risk, monitoring of preventive measures. Where management and elected members so wish, a shared investigation framework can be defined from the outset, with a clear mandate and reporting arrangements suited to each. The firm never represents two parties with opposing interests in the same matter.
What do you offer beyond the investigation itself?
A complete chain, built to measure: upstream, risk mapping, updating of the internal rules, procedures and whistleblowing system, and an external channel for receiving reports with a first response within 24 working hours; during the investigation, protective and judicial measures; downstream, disciplinary or litigation follow-up, mediation, confidential support for those affected, training of managers and designated officers, then a review at six months. Each step is the subject of a separate fee quote.
