Which HR risks require an internal investigation to be opened, and what does the employer who fails to investigate risk?

Updated 9 November 2026

Key contacts: Pascal-André Gérinier (Lawyer - Founder), William Mak (Lawyer - Founder)

The internal investigation is not a general legal obligation, and the Cour de cassation points out that evidence may be adduced by any means (Cass. soc. 14 janvier 2026, n° 24-19.544). But the employer must react without delay to a report of harassment, discrimination or danger: doing nothing engages its liability under the duty of safety, and imposing a sanction without established facts exposes it to a finding of dismissal without real and serious cause. Three provisions require action: Article L. 2312-59 of the French Labour Code, for an alert from an elected works council (CSE) member in the event of an infringement of individual rights, Article L. 4132-2, for serious and imminent danger, both of which prescribe an immediate investigation together with the elected member, and the Decree of 3 October 2022, for a whistleblower report, which requires its admissibility to be checked and the accuracy of the allegations to be assessed, which in practice involves an investigation.

Key points

• No general provision requires an investigation, but the duty of safety requires a reaction, and the investigation is the surest way to prove it.
• Three cases require action: an alert from an elected works council member for an infringement of individual rights and an alert for serious and imminent danger, with an immediate investigation conducted together with the elected member, from eleven employees; a report through the whistleblowing channel, in companies with at least fifty employees, with an admissibility check, then an assessment of the accuracy of the allegations, in practice through an investigation.
• Failing to investigate exposes the employer to damages, to the nullity of a dismissal or measure imposed because of harassment suffered or reported in good faith and, in the event of an accident or illness, to a finding of inexcusable fault if the employer was or should have been aware of the danger.
• Investigating badly also has a cost: a truncated or incomplete report weakens the employer's position.
• Two months: that is the time limit for initiating disciplinary proceedings, by summons to the preliminary meeting, from the time the facts are precisely known.

The real question is not only "must I investigate?" but "what happens if I do not?". Article L. 4121-1 of the French Labour Code requires you to take the necessary measures to protect the physical and mental health of employees. Article L. 1152-4 requires the prevention of psychological harassment. Article L. 1153-5 requires sexual harassment to be prevented, stopped and sanctioned. An investigation makes it possible to verify the facts and demonstrate your reaction.

The thirteen situations that lead to an investigation

1. Psychological harassment: repeated conduct that degrades working conditions; the employer must prevent it (Article L. 1152-4 of the French Labour Code) and, under its duty of safety, put an end to it.
2. Sexual harassment and sexist behaviour: comparable obligations (Article L. 1153-5 for sexual harassment, Article L. 1142-2-1 for sexist behaviour), with a criminal risk for the perpetrator and media exposure for the company.
3. Discrimination: hiring, pay, promotion, sanction; before the court, the employee presents facts suggesting discrimination and the employer must prove that its decision rests on factors unrelated to any discrimination.
4. Violence, threats, altercations: immediate danger, protective measures the same day.
5. Alert from an elected works council member: investigation required "without delay", conducted together with the elected member, from eleven employees and a works council (Articles L. 2312-59 and L. 2312-5); in the event of serious and imminent danger, immediate investigation together with the elected member (Article L. 4132-2).
6. Report through the whistleblowing channel: admissibility check, then assessment of the accuracy of the allegations, in practice through an investigation; acknowledgement of receipt within seven working days, feedback within three months.
7. Fraud, theft, misappropriation: accounting and IT evidence; to preserve disciplinary powers, setting the public prosecution in motion should be considered within the two-month period, a simple complaint not being sufficient.
8. Conflict of interest, corruption, gifts: code of conduct and whistleblowing system imposed on large companies by the Sapin II Act.
9. Data leak, employee leaving with the customer list: preservation of connection logs, ex parte evidentiary report, action for unfair competition.
10. Parallel or competing activity by an employee: breach of the duty of loyalty, evidence often outside the company.
11. Alcohol, drugs, safety breaches: internal rules, regulated checks, protection of third parties.
12. Serious accident, collective signs of distress: successive sick leave, alerts from the occupational physician; this is the territory of the works council's expert assessment for serious risk.
13. Contested artificial intelligence tool or automated decision: algorithmic discrimination in hiring or appraisal, employee surveillance, undeclared data processing; the investigation covers how the tool works, its deployment and the information given to individuals and to the works council.

These situations fall into three families. Harm to persons covers harassment, discrimination, violence, serious accidents and collective risks. They call for interviews, testimony and, depending on the circumstances, an exchange with the occupational physician, in compliance with medical confidentiality. Harm to assets concerns in particular fraud, data leaks, misappropriation of files and unfair competition. The investigation then focuses on accounting documents, contracts and IT logs. Compliance breaches cover in particular corruption, conflicts of interest, regulated alerts and non-compliant use of digital or artificial intelligence tools. Depending on the facts, you will call on human resources, the finance or compliance functions, or even an external party. The labour inspectorate, the public prosecutor or a supervisory authority may be concerned.

The three cases where a provision requires an investigation or verification

The first provision is Article L. 2312-59 of the French Labour Code: where an elected works council member finds an infringement of individual rights, of physical and mental health or of individual freedoms, in particular through acts of harassment or a discriminatory measure, they refer the matter to the employer, which "shall without delay conduct an investigation together with the member of the staff delegation" and take the necessary steps to remedy the situation. In the event of failure to act or disagreement, the labour court (conseil de prud'hommes) rules under the expedited procedure on the merits and may order any measure under a periodic penalty payment. This right of alert also belongs to elected members in companies with eleven to forty-nine employees (Article L. 2312-5). The second is Article L. 4132-2: where an elected member alerts the employer to a serious and imminent danger, the employer "shall immediately conduct an investigation" together with them and take the necessary steps. The third is the procedure for receiving whistleblower reports, compulsory in companies with at least fifty employees: acknowledgement of receipt within seven working days, check of the admissibility of the report, assessment of the accuracy of the allegations, in practice through an investigation, and feedback within three months (Decree No. 2022-1284 of 3 October 2022, Article 4); the fifty-employee threshold derives from Article 8, I, B, of the Sapin II Act.

"Without delay" implies a rapid reaction, generally within a few days rather than several weeks. When an elected works council member exercises their right of alert, define with them the scope of the verification, a timetable and the confidentiality rules. Take the first steps without waiting for a full report. For a whistleblower report, first check its admissibility under the system, then examine the allegations and the appropriate follow-up. Inform the author in writing, within the applicable deadlines. In the event of failure to act or an unresolved disagreement, the labour court may be seised under the expedited procedure on the merits and order measures under a periodic penalty payment (Article L. 2312-59 of the French Labour Code).

Investigation, verification or simple check: how to decide

Outside these three cases, the decision is taken on five criteria. The seriousness of the alleged facts: violence or sexual harassment calls for an investigation, an organisational disagreement for a simple discussion. Their credibility: a detailed, dated report with witnesses carries more weight than a rumour. Whether the risk is current: facts that are continuing require swift action, old and closed facts call first for verification. The material already available: where the documents establish the facts on their own, documentary checks are sometimes sufficient; where accounts have to be compared, interviews are essential. The position of the persons involved: where the hierarchy or management is implicated, an external investigation becomes necessary. The decision, whatever it is, is recorded in writing with its reasons: it is that record that demonstrates the employer's reaction, even where the facts are ultimately not established.

What the employer who fails to investigate risks

Failing to react to a report exposes the employer to several risks, which are cumulative:

• damages for breach of the duty of safety (Article L. 4121-1), and the possibility for the employee to have the termination of their contract held to be attributable to the employer;
• time-barring of the misconduct: in the absence of an investigation initiated without delay, the two-month period runs from the report and the sanction becomes out of time (Cass. soc. 29 juin 2011, n° 09-70.902);
• nullity of a dismissal or of any measure imposed because of harassment suffered, refused or reported in good faith (Articles L. 1152-2 and L. 1152-3 for psychological harassment, L. 1153-2 and L. 1153-4 for sexual harassment), with reinstatement or compensation;
• in the event of an accident at work or occupational disease linked to the facts, a finding of inexcusable fault, which increases the compensation due to the victim, where the employer was or should have been aware of the danger and did not take the necessary measures;
• criminal liability of the perpetrator and, where applicable, of the company: psychological harassment is punishable by two years' imprisonment and a fine of 30,000 euros (Article 222-33-2 of the French Criminal Code);
• deterioration of the workplace climate and of the company's image, often more costly than the litigation itself.

The absence of an investigation does not automatically lose a case. Evidence may be adduced by any means before the labour court: the judge cannot disregard the facts on the sole ground that no internal investigation was conducted (Cass. soc. 14 janvier 2026, n° 24-19.544). But if you dismiss for misconduct, you must present convincing evidence. Where doubt remains, the benefit goes to the employee (Article L. 1235-1 of the French Labour Code). Without verification, some accusations remain difficult to establish. The risk also exists the other way round: removing or sanctioning an employee who has reported harassment in good faith may lead to the nullity of the measure (Articles L. 1152-2 and L. 1152-3 of the French Labour Code).

What the employer who investigates badly risks

Investigating badly is no better than not investigating. A report in which nine of fourteen interview records were missing without explanation, in which passages had been truncated and in which the statements were not corroborated led the Cour de cassation to uphold the judges who had held it to be insufficiently probative (Cass. soc. 18 juin 2025, n° 23-19.022). Conversely, mere shortcomings do not exclude the report from the proceedings provided no unlawful investigation has been carried out (Cass. soc. 29 juin 2022, n° 21-11.437). A hasty and humiliating accusation of the person implicated may constitute a breach of the duty of safety towards them. Disclosing the identity of a whistleblower is a criminal offence (Sapin II Act, Article 9). And disproportionate data processing exposes the employer to the CNIL. The guide How to conduct an internal investigation into harassment or discrimination? sets out the method.

The decision matrix

The time limits to keep

You have two months to initiate disciplinary proceedings from the day on which you have precise knowledge of the reality, nature and extent of the facts, in the words of the Cour de cassation (Article L. 1332-4 of the French Labour Code; Cass. soc. 17 février 1993, n° 88-45.539). Where an investigation is necessary to acquire that knowledge, the period runs only from its conclusions, provided it is initiated and conducted without delay; the investigation does not suspend the period by itself, and an employer which, informed of a report, refrains from investigating allows the period to run from that knowledge (Cass. soc. 29 juin 2011, n° 09-70.902). After a precautionary suspension, initiate the disciplinary procedure without delay, unless there is a valid reason, in particular indispensable investigations. Criminal proceedings set in motion within the two months interrupt that period; the opening of a preliminary police investigation is not sufficient (Cass. soc. 13 octobre 2016, n° 15-14.006), and the same applies to a simple complaint, which likewise does not set the public prosecution in motion. For whistleblowers, provide for an acknowledgement of receipt within seven working days and written feedback within three months. An alert from an elected works council member calls for an investigation "without delay". Finally, carry out the verification within a few weeks, depending on its complexity.

Acting before the report: what MOSAIK offers in prevention

The thirteen situations above can be prepared for. The firm offers companies a mapping of harassment, fraud and non-compliance risks, built on an analysis of documents, interviews and, depending on the size of the company, questionnaires, then delivered in the form of a matrix of priority situations, their causes and the recommended measures. It updates the internal rules, the single risk assessment document, the whistleblowing procedures and the IT charter, and sets up the reporting channel described in the guide How to receive and process a whistleblower report?. Finally, it trains managers and designated officers, in one day: identifying weak signals and prevention obligations, distinguishing harassment, discrimination and sexist behaviour, receiving a report without investigating oneself, choosing immediate measures on a practical case, recording and directing the escalation. Collective awareness-raising, tailored to the company's issues, completes the system. These actions are also, in the event of litigation, the evidence that the employer has fulfilled its duty of prevention.

What changes according to the facts

The size of the company first: below fifty employees, the elected members' right of alert exists from eleven employees and a works council (Article L. 2312-5), but there is neither a compulsory reporting channel on the basis of headcount alone, nor a works council expert assessment for serious risk; the duty of safety and the risks of nullity are the same. The status of the implicated person next: the dismissal of a protected employee requires authorisation from the labour inspectorate, which will examine the quality of the investigation. The nature of the facts: criminal conduct calls for a complaint within the two-month period and a chain of custody for the evidence. The international dimension finally: a foreign subsidiary investigates under its own law, and interview records do not circulate freely, as explained in the guide How to conduct an internal investigation in an international group?. For what follows, the guide Who should pay for an internal investigation? settles the question of cost, and the Internal investigations page presents the firm's approach.