1. Identify Legal Exposure Behind Misconduct Reports
A complaint may reveal a breach of corporate policy, a violation of law, or both. The company must decide whether corrective action, investigation, or statutory reporting is warranted. That depends on the underlying facts, not the complaint's label.
Distinguish Policy Breaches from Suspected Legal Violations
Exceeding an expense approval limit may violate company rules without breaking the law. Falsified invoices or concealed payments, however, may raise fraud or accounting concerns.
Review approvals, transactions, and applicable laws to determine who authorized the conduct, whether records were altered, and whether violations recurred. A corporate compliance review should separate verified facts from allegations and identify relevant legal requirements.
Check Whether External Reporting Is Required
An internal complaint does not automatically trigger agency notification. Reporting requirements depend on the violation and applicable regulations.
California Civil Code § 1798.82 generally requires notification within 30 calendar days of discovering a qualifying data breach, subject to statutory exceptions and permitted delays. This requirement does not extend to ordinary corporate policy disputes.
Identify the reporting trigger, recipient, and deadline. Evaluate voluntary disclosure, contractual notices, and insurance obligations separately.
2. Choose Investigation Oversight and Preserve Relevant Records
An accused executive may control records or the reporting channel. Before interviews, decide who sets the investigation's scope, receives findings, and handles legal issues.
Resolve Conflicts Involving Senior Management
An accused executive should not direct the investigation. Oversight may shift to an uninvolved officer, authorized board committee, or outside investigator.
Under California Rule of Professional Conduct 1.13, corporate counsel represents the organization, not individual officers. Certain serious violations involving substantial organizational injury may require escalation under the rule. Conflicting personal interests may warrant separate representation.
Preserve Records without Assuming Everything Is Privileged
Relevant evidence includes messages, approvals, accounting records, and earlier complaints. An internal investigation should identify custodians, relevant systems, and deletion settings while preserving original records and metadata.
Evidence preservation duties may arise when litigation is reasonably anticipated, but not automatically upon every complaint. Attorney involvement also does not make existing business records or every investigative communication privileged. Access should remain limited and comply with applicable privacy requirements.
3. Evaluate Whistleblower Protection and Retaliation Risk
Whistleblower protection does not turn solely on whether an allegation proves true. A reasonably based disclosure may be protected even without a proven violation. Refusal to participate in unlawful conduct has separate statutory protection.
Apply Labor Code Section 1102.5 to Internal Reports
California Labor Code § 1102.5 generally prohibits retaliation against employees who disclose information they reasonably believe reveals a statutory or regulatory violation.
Protection may extend to reports made to supervisors or employees authorized to investigate violations, including disclosures made during ordinary job duties. The employee need not prove the suspected violation occurred.
However, disagreement with company policy alone does not automatically qualify. Federal whistleblower retaliation protections may apply separately.
Review Employment Decisions and Statutory Notices
Demotion, reduced hours, discipline, or termination following protected reporting may raise retaliation concerns. Employers should document legitimate reasons for employment decisions.
Under Labor Code § 1102.6, once an employee proves protected activity contributed to an adverse action by a preponderance of the evidence, the employer must establish by clear and convincing evidence that the same action would have occurred for legitimate, independent reasons.
Labor Code § 1102.8 requires a prominent whistleblower-rights notice in lettering larger than 14-point type, including the state hotline number. Confidentiality instructions cannot restrict legally protected government reporting.
4. Turn Investigation Findings into Compliance Program Changes
A finding that one employee broke a rule does not establish why existing controls failed to detect or stop the conduct. Review which controls failed and whether corrective action addresses the cause.
Match Corrective Measures to the Control Failure
If one manager controls vendor approvals and payment reconciliation, training alone may not address the risk. Independent reviews, separation of duties, or restricted system access may be necessary.
Document each control gap, corrective action, responsible owner, and effectiveness test.
The DOJ's Evaluation of Corporate Compliance Programs examines investigations, root causes, and remediation in federal corporate criminal matters. It is prosecutorial guidance, not a universal legal requirement.
Regular testing can determine whether revised compliance programs work in practice.
Separate Board Escalation from Regulatory Disclosure
Management should report material findings to authorized decision-makers, distinguishing confirmed facts from unresolved allegations. Board involvement depends on governing documents and applicable law.
The DOJ's March 2026 Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy addresses qualifying federal corporate criminal cases, while criminal antitrust matters follow separate procedures. Eligibility depends on disclosure, cooperation, remediation, and other policy conditions.
Before external disclosure, evaluate reporting duties and privilege risks. Sharing investigative materials may affect applicable legal privileges.
03 Nov, 2026
