When is an internal investigation needed?
A report landing on the whistleblower line, an inconsistency surfacing in an audit, a customer’s complaint, or management’s intuition… An internal investigation begins the moment an allegation must be taken seriously. Decisions to terminate or to file a criminal complaint made without an investigation can later turn against the company; a procedurally proper investigation, on the other hand, keeps every option open.
Practical guidance
When an investigation begins, the “who needs to know” list should be put in writing and kept narrow; a breach of confidentiality harms both the investigation and the company.
Let us conduct the investigation with legal assurance
We handle internal investigations with confidentiality, evidentiary discipline, and bilingual reporting.
Planning: scope, team, confidentiality
A good investigation starts narrow: the allegation is defined in writing, scope and duration are limited, and a team free of conflicts of interest is formed. The “need to know” list is written and short. Another critical decision at this stage is that the investigation be conducted under the coordination of a lawyer; this provides protection in terms of confidentiality and evidence strategy.
Evidence gathering and the limits of KVKK
Examining corporate e-mail and systems is possible; however, it is subject to the conditions of proportionality, a previously notified policy, and purpose limitation. Instead of an unannounced, blanket scan, a targeted review connected to the allegation should be carried out, and every step should be recorded. Areas such as personal devices, private correspondence, and audio recording require a separate and sensitive assessment.
Interviews
The order of interviews is strategic: peripheral witnesses first, the suspect last. The aim of an interview is not to extract a confession but to build a consistent picture of the facts. A written record, the participants, and, where needed, the option of being accompanied are the elements that document the fairness of the process and become decisive in a possible reinstatement lawsuit.
The report and final decisions
The report should present the facts, the evidentiary bases, and the options (discipline, termination, settlement, criminal complaint, recourse) together. A criminal complaint is often at the company’s discretion and is decided together with the commercial and reputational dimension. In structures with foreign shareholders, preparing the report in two languages and in line with group standards speeds up the process.
Five common procedural mistakes
In our matters, the mistakes that weaken an investigation recur: (1) failing to define the allegation in writing and letting the scope expand during the investigation; (2) interviewing the suspect immediately on an HR reflex, giving them the chance to destroy evidence; (3) conducting a general e-mail scan, including personal folders — a proportionality violation that lowers the evidentiary value of the findings; (4) keeping no written record, with interviews resting on “remembered notes”; (5) announcing a termination decision before the report is written. Each of these mistakes is read against the company in a reinstatement lawsuit or a Board review. For the limits on processing employee data, the principles in our Data focus area apply to investigations as well.
The post-investigation map of options
Once the findings are clear, there is a fork with four paths. Labour law sanctions: from a warning to termination for just cause; the yardstick is the gravity of the act and the strength of the evidence — for the subtleties of structuring a termination, see our labour law guide. Criminal complaint: arises in cases of breach of trust in the course of employment (TCK art. 155(2)), fraud and — in banks, cooperatives and other structures where special statutes treat the perpetrator as a public official — embezzlement. These offences are prosecuted ex officio; the company’s discretion extends only to whether it files a complaint, not to the outcome of the prosecution. The decision should be taken together with the commercial and reputational dimension. Damages and recourse: recovering the loss from those at fault and, where necessary, from the insurer — asset investigation comes into play at this stage. Compliance repair: incorporating the process gaps revealed by the investigation into the compliance programme. A good report presents these four paths comparatively.
The Köksal approach
Our internal investigation service combines planning, digital evidence, interviews and reporting into a single discipline. In Turkish-German structures, we report the investigation in two languages and keep the expectations of the group headquarters and the mandatory rules of Turkish law on the same plane. For the collection of digital evidence, we use our e-discovery infrastructure; in matters where the crisis dimension predominates, we coordinate with our Crisis Management focus area.
Conclusion
An internal investigation is not a reflex but a discipline. Investing in procedure ensures that the outcome is defensible in every forum — in the labour court, before the prosecutor, in arbitration. Building investigative capability before an incident arrives is the cheapest insurance against white-collar risk.
