Whistleblowing channels and internal investigations: cost and likely outcome depend on how many people are interviewed, how much data has to be reviewed, and whether the matter must be reported outward before it is fully understood inside the company. A contained complaint handled well internally rarely runs long; a report that touches financial statements, sanctioned counterparties or a foreign parent usually does, and the outcome shifts from a closed file to a disclosure decision.
Who this concerns
This is a live question the moment a report lands, not before. Someone inside or connected to the company, an employee, a contractor, a supplier's staff member, has used a reporting channel to flag conduct they believe is wrong: misstated accounts, a bribe to win a tender, a breach of sanctions screening, harassment covered up by a manager. The channel exists because the organisation was required to build one; the investigation is what happens after it is used.
The people who face the immediate decision are usually HR, the compliance function, or, in smaller companies, the managing director directly. The board finds out later, often only when the first cost estimate or the first regulator letter arrives. What decides whether the next months are manageable or expensive is not the seriousness of the underlying conduct alone, it is how the first ten days are handled: who is told, what is preserved, and who runs the review.
Companies of every size operating in Sweden, including Swedish subsidiaries of foreign groups, can be brought into this position by a single anonymous submission. The trigger is rarely dramatic. It is a form filled in late at night.
What the law says
Under Swedish law as it currently stands, organisations of a qualifying size must maintain a channel through which workers and connected persons can report suspected wrongdoing, must protect the identity of the person reporting, and must acknowledge and respond to a report within defined periods. The obligation runs alongside, not instead of, data protection law: personal data collected during the investigation, interview notes, emails, access logs, has to be processed lawfully, kept only as long as needed, and shared only with people who need it to do their job.
None of this removes the underlying employment law framework. Disciplinary action taken on the back of an internal investigation still has to meet the ordinary standard for dismissal or warning that applies in any Swedish workplace; a poorly run investigation can undermine that standard even where the original allegation was accurate.
The foreign element changes the calculus in a specific way. Where the Swedish entity is a subsidiary of a foreign parent, a global whistleblowing policy drafted abroad frequently assumes powers, such as suspending an employee pending investigation without pay, that Swedish employment law does not straightforwardly permit. Where the conduct reported involves a foreign counterparty, the review has to sit alongside any ongoing sanctions screening on that relationship, see our separate note on sanctions screening for counterparties with a foreign element, because a whistleblower report and a sanctions flag on the same counterparty are treated as connected facts, not two separate files.
Wider context on how the reporting obligation sits within the compliance function generally is set out on the practice hub.
How it works in practice
Setting up the channel itself
The channel has to be genuinely accessible and genuinely confidential, not a shared inbox that three people can read. Whether it is run in-house or outsourced to a third-party platform is a cost decision, not just a compliance one: an outsourced channel removes the argument that identity was not properly protected, at a modest running cost; an in-house channel is cheaper to run but puts the burden of proving confidentiality on the company itself if it is ever challenged.
Receiving and triaging the report
Not every report needs a full investigation. The triage decision, made early and recorded in writing, is what protects the company later if the outcome is questioned. A report that on its face describes a criminal offence, fraud, bribery, market abuse, is triaged differently from a workplace conflict dressed up as a compliance concern.
Deciding who runs the investigation
An internal HR-led review is proportionate for most workplace complaints. It stops being proportionate the moment the allegation touches senior management, involves potential criminal conduct, or could expose the company to regulatory reporting duties. At that point the investigator has to be someone with no reporting line to the people implicated, which in a small or mid-sized company usually means bringing in outside counsel.
Preserving evidence before anyone is told
The single most consequential early step is what gets preserved before word spreads. Emails get deleted, laptops get wiped, calendars get edited, all often without malicious intent, simply because nobody told the relevant people to stop. A short, written instruction to preserve specific data sources, issued on day one, is cheap; reconstructing what was lost after the fact is not.
Conducting interviews
Interviews have to be structured, minuted, and conducted in a way that does not put words in the interviewee's mouth. Where the interviewee is not a native Swedish speaker, or the matter involves a foreign subsidiary's staff, interpretation and translation add real time and real cost, and have to be planned for rather than improvised.
Reviewing documents and data
Document review scales with the number of custodians and the time period covered. A review confined to one manager's mailbox over three months is a different exercise from a review spanning a finance team's shared drive over two years. This is usually the largest single cost driver in the whole process.
Writing the findings and deciding consequences
The findings report has to distinguish clearly between what was established as fact, what remains disputed, and what could not be determined on the evidence available. Disciplinary or contractual consequences that follow have to be built on that distinction, not on the loudest version of events.
Deciding whether to report outward
Some findings create an external reporting obligation, to a regulator, an auditor, or a counterparty under a contractual notification clause. This decision is usually the one that determines whether the matter stays contained or becomes public, and it should be made deliberately, with legal input, rather than by default because someone assumed disclosure was required.
What to check once a report has come in:
- Whether the channel used meets the confidentiality standard the company is obliged to provide
- Who currently has access to the report and whether that list needs to be narrowed immediately
- Whether a written preservation instruction has gone out, and to whom
- Whether the person named in the report has any reporting line to the person deciding how to handle it
- Whether the underlying conduct, if confirmed, would trigger an external notification duty to a regulator, auditor or counterparty
- Whether the company's insurance covers the cost of an external investigator, and under what conditions
What people ask before they instruct anyone
Does a whistleblowing report ever lead to a search of company premises?
It can, if the conduct reported looks criminal on its face and the matter reaches the prosecution authority before the company has finished its own review. A raid conducted under husrannsakan, the Swedish term for a search of business premises, is a separate and faster-moving track from the internal process; see our note on what happens during a search of company premises for what changes once that happens.
Can an internal investigation affect due diligence on a foreign counterparty?
Yes. If the report concerns a counterparty already subject to screening, the two files should be read together rather than closed independently, because a finding in one changes the risk assessment in the other.
What happens if a whistleblowing complaint involves a shareholder dispute?
Where the person named in the report is also a shareholder or party to a shareholders' agreement, the investigation can feed directly into an unrelated governance dispute; our note on shareholder deadlock, cost and likely outcome covers how that overlap is typically handled.
The numbers
No fixed figure is quoted here because none applies generally: cost is a function of scope, not a tariff. What drives it up is the number of custodians whose data has to be reviewed, the number of interviews conducted, whether translation or interpretation is needed, and whether the matter has to be coordinated with a foreign group entity's own legal function. What drives it down is a narrow, well-defined mandate agreed at the outset rather than an open-ended instruction to "look into everything."
Timing works the same way. There is no standard duration that applies across cases; what determines how long a review takes is how much evidence has already been lost by the time it starts, how many people need to be interviewed, and whether the company is waiting on a third party, an auditor, a bank, a foreign subsidiary, to provide documents. A review with cooperative witnesses and intact records moves considerably faster than one where key data has already been overwritten.
Where it usually goes wrong
The most common failure is not dishonesty, it is structure. An investigation run by someone who reports to the person under investigation, even informally, is compromised from the outset, regardless of how carefully it is documented. The finding may be correct, but it will not hold up if challenged, and the company loses the benefit of having investigated at all.
A second recurring problem is treating the whistleblower's identity as protected in name only. Confidentiality that survives a written policy but not an office conversation is not confidentiality, and a retaliation claim that follows is difficult to defend once it is clear that the reporter's identity was known more widely than the policy allowed.
A third is applying a foreign parent's global investigation protocol without checking it against Swedish employment law. Suspension without pay, mandatory polygraph-style interviews, or blanket data collection permitted elsewhere can each independently expose the Swedish entity to an employment claim that has nothing to do with the original allegation.
Finally, matters that look like ordinary workplace complaints sometimes turn out to touch sanctioned counterparties, bribery of a foreign official, or accounting fraud material enough to affect audited financial statements. Once any of those elements is present, the case has moved outside what an HR-led internal review can safely close on its own, whatever the original report looked like on paper.
What to do next
Reading this settles the framework, not the specific report sitting on someone's desk. The point at which self-directed handling stops working is the point where the allegation could involve criminal conduct, a regulator, or a person with authority over the investigation itself; from there, the question is no longer how to run the process but how exposed the company already is.
An initial assessment call establishes exactly that: what has already happened, what has to be preserved immediately, and whether the review can stay internal or needs an independent investigator from the outset. Related exposure under cyber incident reporting duties is covered separately in our note on which entities the Cyber Security Act covers, and what it costs, relevant where the report also touches a security incident. To talk through a specific report, get in touch.