Whistleblowing channels and internal investigations: what to do in the first hours after a report lands determines whether the case survives scrutiny later. The fixed sequence is: acknowledge receipt, secure evidence before anyone can alter it, appoint a case handler with no stake in the outcome, and decide quickly whether the matter needs to leave the compliance function.
Who this concerns
This concerns any organisation operating in Sweden that has set up, or should have set up, an internal channel for receiving reports of misconduct: private employers above the threshold that triggers the obligation, public authorities, and any company that receives a report even where no formal channel exists yet. The practical scope is wider than the legal obligation. A report can arrive through a manager, an anonymous letter, or a throwaway comment in an exit interview, and once it has arrived, the clock on how it is handled starts regardless of whether a dedicated channel was in place. Work carried out under the compliance, sanctions and cyber practice sits precisely at this intersection: the reporting obligation itself, the sanctions and financial crime exposure a report often uncovers, and the investigation that has to follow.
Where the group's parent company sits outside Sweden, the picture changes on three points. Reporting lines that route a Swedish report to a compliance function abroad create a cross-border data transfer that has to be justified separately from the domestic reporting duty. Decisions on suspension or dismissal of the person under investigation may need sign-off from a foreign board that does not operate on Swedish employment-law timeframes. And the identity protection owed to the reporting person under Swedish law does not travel automatically with the file once it leaves the jurisdiction; it has to be rebuilt contractually.
What the law says
Under Swedish law as it currently stands, an organisation that operates a reporting channel owes the reporting person three things: a channel that keeps their identity confidential from anyone not directly handling the case, protection against any retaliatory action taken because of the report, and a response within a reasonable time. None of these three obligations is optional once a channel exists, and protection against retaliation applies even to organisations that never set up a channel at all: a person who reports wrongdoing through any route available to them is protected regardless of the route taken.
The obligation sits alongside the ordinary duties an employer already carries: data protection law governing how the report and any personal data in it are processed, employment law governing what can be done to the accused employee, and, where the conduct reported touches financial crime or sanctions, reporting duties that apply independently of the whistleblowing channel itself. A report about a sanctioned counterparty does not stop being a sanctions question because it arrived through the whistleblowing channel; the underlying obligation to screen and report continues to run in parallel, and sanctions screening of counterparties has its own stopping point that the investigation has to respect.
Confidentiality is the obligation most often broken in the first days, typically through process failures rather than malice: a case handler forwards an email without redacting the sender, or a line manager is looped in because they happen to have access to the relevant system. The identity of the reporting person is protected as a matter of law, not as a matter of good practice, and a breach of that protection is a separate exposure from whatever the report was about.
How it works in practice
Acknowledging the report
Acknowledge receipt promptly, tell the reporting person what happens next in general terms, and do not ask them to prove the claim before it is even logged. The acknowledgment is procedural, not evidential.
Choosing who runs the case
The case handler needs no reporting line to the accused and no stake in the business area concerned. In a smaller organisation this often means there is no genuinely conflict-free candidate inside the company at all, and the case has to go outside from the start.
Preserving evidence before anything else moves
Before interviews begin, systems access and mailboxes relevant to the allegation should be preserved and routine deletion schedules paused. This is the step most often missed, because IT operates on its own retention cycle that has no reason to know an investigation has opened.
Deciding the scope of the investigation
Scope is written down and dated before interviews start. Scope creep, expanding the inquiry into conduct not actually described in the report, is one of the most common reasons an investigation loses credibility later. The investigation examines the conduct reported, not the person who reported it or the person accused as a general matter.
Interviewing the reporting person and witnesses
The reporting person is interviewed first, not last, and the questions are structured around what they directly know rather than what they suspect. Witnesses are then approached in order of proximity to the alleged conduct, not seniority within the organisation.
Handling the person under investigation
The accused has a right to be heard before any disciplinary decision is taken. The presumption in their favour should not be reversed simply because a report exists. Any restriction on their systems access is proportionate to what has actually been alleged and is documented as a decision, not applied automatically.
Documenting decisions as they are made
Contemporaneous notes on scope, on who was interviewed and why, and on what was deliberately excluded from the inquiry are worth more than a reconstruction produced later for a dispute. Documentation built at the time of the decision carries weight that documentation built afterwards does not.
Closing the case and deciding on consequences
Findings are recorded separately from the decision on consequences. The reporting person is told that the case is closed, not necessarily what was decided. Consequences for the accused follow the ordinary disciplinary or criminal-reporting route rather than the whistleblowing channel itself.
What to check:
- Whether the channel used met the confidentiality standard before the report was even opened
- Whether the case handler has any reporting line to the accused or to the business area concerned
- Whether IT has paused routine deletion for the systems and mailboxes in scope
- Whether the scope of the investigation is written down and dated
- Whether the reporting person has been told, in writing, what happens next
- Whether any restriction placed on the accused employee is proportionate to what has actually been alleged
- Whether a parallel reporting duty, sanctions, financial crime, or data protection, has been triggered independently of the whistleblowing process
Can assets be seized while an internal investigation is still running?
Yes, and the two processes run on different clocks. A criminal or civil seizure order is not paused because an internal investigation into the same conduct is still open; a court or prosecutor can act on its own timetable regardless of where the internal process stands. Companies that assume the internal investigation buys time before assets are frozen are working from the wrong premise; see who decides on seizure and forfeiture for how that decision is actually made.
Does an internal investigation need to unmask nominee arrangements behind a reported counterparty?
If the report concerns a counterparty rather than an employee, usually yes, because the identity of the person actually controlling that counterparty is often the fact the investigation is trying to establish. A nominee structure that hides the beneficial owner is not incidental to that question, it is the question itself. The mechanics of how ownership behind a nominee is established are covered in nominee arrangements and beneficial ownership.
What does tillträde mean in an internal investigation?
Tillträde is the Swedish term for the right of access, to premises, systems, or documents, that an investigation needs in order to gather evidence. It is not automatic: access to an employee's device or mailbox has to be justified against data protection and employment-law limits before it is asserted just because an investigation is open. The term and its boundaries are set out in the glossary entry on tillträde.
The numbers
No fixed figure describes how long a whistleblowing investigation should take or what it should cost, and any figure quoted without knowing the specifics of the report is a guess dressed up as an estimate. What actually drives both is the volume of underlying conduct rather than the length of the report itself: a single, well-documented allegation with clear system logs closes faster than a vague allegation touching several business units, even where the second report reads shorter on paper.
Cost is driven by three variables that can be assessed before the investigation starts: the number of custodians whose devices and mailboxes need to be preserved and reviewed, whether the conduct reported crosses into a parallel reporting duty such as sanctions or financial crime that pulls in a second workstream, and whether the case handler needs to be brought in from outside the organisation because no internal candidate is free of conflict. None of these three is fixed by company size alone; a small company with a single high-value counterparty can face a larger investigation than a large company with a low-value, contained allegation.
The acknowledgment stage is typically resolved within days: a reporting person who hears nothing for an extended period draws their own conclusions about whether the report was taken seriously, and those conclusions shape whether they cooperate with the rest of the process.
Where it usually goes wrong
The most common failure is anonymity that was never actually built into the channel. A forwarding chain that preserves message headers, or a case file shared as an email thread rather than a redacted document, can unmask a reporting person who was told their identity would stay protected. By the time this is noticed, the damage to trust in the channel is already done.
A second failure appears when the conduct reported plausibly amounts to a criminal offence and the internal process continues on its own track without anyone checking whether a separate notification duty to an authority has been triggered. The internal investigation and the external reporting duty are not the same obligation, and closing the internal file does not discharge the second one.
A third failure is structural: the accused sits senior enough, a board member, a controlling shareholder's associate, that no internal case handler is credibly independent of them. Running the case internally anyway does not produce a defensible finding; it produces a finding that will be challenged on independence grounds the moment it matters.
A fourth appears at the cross-border seam. The file is sent to a foreign parent for review because that is where the group's compliance function sits, and nobody runs the data protection assessment that transfer actually requires. The assessment is not a formality attached to the transfer; without it, the transfer itself is the exposure.
A fifth failure is assuming legal privilege over investigation materials that were never prepared under legal advice in the first place. Privilege attaches to how a document was created, not to the sensitivity of what it discusses, and a report drafted by an internal HR team before counsel was ever involved does not become privileged retroactively because a dispute later arises.
What to do next
Everything above can be run internally, provided the organisation has a case handler genuinely free of conflict and the discipline to document decisions as they are made. Self-directed work stops being sufficient at three points: when the conduct reported plausibly amounts to a criminal offence and a parallel notification duty is triggered, when the accused sits senior enough that no internal case handler is credibly independent, and when the report touches a system or data incident that brings the organisation within scope of separate cyber obligations. Where a report surfaces a security incident affecting critical systems, the question of whether the entity falls within entities covered by the Cyber Security Act has to be answered before the investigation report is finalised.
An assessment call is the right next step once the internal work has reached the point where the remaining decisions carry legal consequence rather than procedural ones: whether to notify a regulator, whether privilege has been properly established over the file, and whether the consequences for the accused employee are proportionate to what the evidence actually shows. Get in touch with the specifics of the report and the stage the case has reached; the call is scoped around what has already been done rather than a restart of the process.