An internal investigation before the authority arrives: what to do in the first hours after a whistleblower report, an unexplained invoice, or a call from a bank determines whether legal privilege holds, whether documents survive intact, and whether the board can answer with facts rather than guesses if the authority does make contact. The window is short, and the first move is rarely one you get to take back.
Who this concerns
This concerns Swedish companies, and Swedish subsidiaries of foreign groups, that have received a signal of possible economic crime before any prosecutor, tax authority, or supervisory body has made contact directly. The signal rarely arrives labelled. It shows up as a whistleblower report through an internal channel, an audit finding that does not reconcile, a resigning employee making allegations on the way out, a bank asking questions about a payment pattern, a journalist requesting comment, or a counterparty receiving a request for information that mentions your company by name.
It also concerns the board and general counsel who sit in the gap between two duties that pull in different directions. One duty is to run the company with ordinary care, which usually means finding out what happened as quickly as possible. The other is to preserve a defensible legal position if the matter becomes formal, which means not finding out in a way that destroys privilege or creates a written record that reads worse than the underlying conduct.
Where the parent company sits outside Sweden, a further layer applies: the parent's own reporting obligations, insurance conditions, or listing rules may require disclosure on a timeline that has nothing to do with what Swedish procedure requires, and the two clocks are rarely synchronised.
What the law says
Under Swedish law as it currently stands, the board's duty of care extends to acting on credible indications of wrongdoing inside the company, not to waiting passively for an authority to make the first move. Once conduct is suspected to be criminal, the formal process is opened and controlled by the prosecutor through a preliminary investigation, which the company does not control and cannot pause by starting its own review in parallel.
Legal professional privilege attaches to communications made for the purpose of obtaining legal advice from external counsel. It does not extend automatically to material produced by compliance staff, HR, or a forensic firm engaged directly by the company without counsel instructing the work. That distinction is fixed at the point the review is set up, and it cannot usually be repaired afterwards by relabelling documents that already exist.
Under Swedish law as it currently stands, employees have no general right to refuse to attend an internal interview conducted by the employer, but their answers in that setting sit in a different legal position from a statement given under caution once a preliminary investigation has been opened, and treating the two as interchangeable is one of the more common errors in this area.
How it works in practice
Recognising the trigger before it becomes a case
The first task is not investigation, it is classification. A finance manager flagging an unusual reconciliation is not the same event as a subpoena arriving from a bank, but both can end at the same authority. The classification decision, whether this is an operational irregularity, a compliance gap, or a matter with criminal exposure, should be made by someone with the authority to instruct counsel, not left to whoever happened to receive the report first.
Who inside the company decides, and who should not
The person who receives the signal is frequently the wrong person to decide what happens next, particularly if that person's own conduct might later be examined. Decisions about scope, counsel, and document handling belong with the board, the audit committee, or a designated officer with no personal exposure in the underlying matter. Where that structure does not already exist, building it in the first meeting is the priority, ahead of substantive fact-finding.
Engaging counsel before any file exists
Privilege is easiest to establish when counsel is instructed before the first document is collected, not after a file already exists that someone then tries to bring under privilege retroactively. The instruction letter itself matters: it should record that the purpose of the engagement is legal advice in connection with a specific, identified concern, not a general compliance health check that happens to touch on the same facts.
The document hold: what freezes, what doesn't
A hold notice needs to reach the people who control the systems, not only the people implicated in the concern. Email retention, backup rotation, device replacement schedules, and shared drive clean-up routines all continue by default unless someone actively stops them. A hold that names three employees but leaves automated deletion running on the mail server has not achieved anything.
Interviews: sequence, scope, and who sits in the room
Interview order affects what each subsequent interview can safely assume. Interviewing a junior employee before establishing what senior management already knew can lock in an account that later interviews cannot contradict without appearing to coach the witness. A written note of each interview, taken by counsel or under counsel's direction, is what preserves the privilege position; a casual conversation that nobody writes down properly often ends up reconstructed later from memory, under worse conditions than the first attempt would have allowed.
When the counterparty, data, or witnesses sit outside Sweden
Where the counterparty, the relevant data, or key witnesses sit in another jurisdiction, several assumptions stop holding. Document collection may need to follow that jurisdiction's own rules on employee data and cross-border transfer before anything can be reviewed in Sweden. A parent company's own disclosure obligations abroad may require reporting on a timeline that runs ahead of the Swedish review, which means the internal investigation is sometimes racing a deadline set entirely outside Sweden. Interviews conducted with an employee based abroad raise questions about which jurisdiction's rules on legal privilege and employee rights actually govern that conversation, and the answer is not automatically Swedish law simply because the employer is a Swedish company.
What to check before the first substantive meeting
- Who received the original signal, and in what form: written, verbal, anonymous
- Whether a hold notice has gone to IT, not only to the individuals concerned
- Whether counsel has been instructed in writing, and for what stated purpose
- Which board members or officers have any personal connection to the underlying facts
- Whether any parent company disclosure clock has already started running
- Whether any regulator, bank, or counterparty has already made contact separately
- Whether any employee involved has already resigned or is serving notice
Does starting an internal investigation stop the authority from opening its own?
No. A prosecutor's preliminary investigation, once opened, runs independently of anything the company does internally. An internal review can shape how the company presents itself once contact happens, and can sometimes support a case for cooperation, but it has no power to prevent or suspend a formal investigation that the authority decides to open on its own information.
Can employees be compelled to attend an internal interview?
There is no general statutory right for an employee to refuse an internal interview requested by the employer as part of a workplace review. What changes the position is the point at which a formal criminal process begins: a statement given voluntarily to the employer sits differently, in terms of how it can later be used, from one given under caution in a criminal procedure.
What happens to material gathered internally once a formal investigation opens?
Material collected during an internal review does not disappear once a formal investigation starts, and it does not automatically become privileged or protected simply because counsel later becomes involved. Whether it can be withheld, and from whom, depends on how and why it was created, which is why the instruction to counsel and the stated purpose of the review at the outset matter more than anything decided afterwards.
The numbers
There is no fixed schedule that fits every internal investigation, and any figure quoted without knowing the scope of a specific matter would be a guess rather than a fact. What actually drives cost and duration is consistent across matters: the volume of documents and communications that need review, the number of employees to be interviewed, whether forensic accounting or e-discovery tooling is required to reconstruct a transaction history, and whether more than one jurisdiction is involved in the data or the witnesses.
A narrow review confined to a single suspected transaction, with a small document set and one or two interviews, is a materially different undertaking from a review that spans several business units, multiple jurisdictions, and a period of years. The decision to self-report to an authority, where that route is available and appropriate, also changes the shape of the work, because the review then needs to be structured to a standard the authority will accept, not only to the company's own internal comfort.
Where it usually goes wrong
The most common failure is delay disguised as thoroughness: waiting for a clearer picture before instructing counsel or issuing a hold notice, while the systems that would preserve the evidence keep running their default deletion routines in the background. By the time the picture is clear enough to act on, the material that would have made it clearer is often already gone.
A second failure is treating an internal review as a substitute for, rather than a preparation for, contact with the authority. If the authority already has independent information, whether from a bank's own reporting duty, a counterparty's disclosure, or a parallel regulatory referral, an internal investigation conducted in isolation and disclosed late can read as concealment even where nothing was concealed.
A third is running the review through people with a personal stake in the outcome, whether as the subject of the concern or as the person who would be blamed for missing it earlier. Their involvement in scoping or interviewing does not automatically taint the review, but it gives an authority, or a court, grounds to question independence that a properly structured review would not have created.
A fourth is assuming privilege exists because a lawyer eventually reviewed the file. If the collection and interviews happened before counsel was instructed, or without counsel directing the purpose and scope, the privilege position is often weaker than the company assumes, and that gap is usually discovered at the worst possible moment, when the material is already being requested.
Finally, where the matter is already public, through media coverage, a counterparty's own disclosure, or a regulator's public statement, the value of a quiet, controlled internal process is reduced, and the priority shifts from control of information to accuracy of the position the company is prepared to state publicly and to the authority.
What to do next
This is the point where reading stops being useful and the specific facts of your matter start to matter more than general structure. Working out what is genuinely at risk, and how an authority is likely to assess it, is covered in a related piece on how corporate fines are set, which is the natural next question once the investigation itself is under control.
Beyond that, the useful next step is not another article but an assessment of the specific facts: what has actually been collected so far, whether privilege is already compromised, and what a defensible position looks like from here. That conversation is best had directly, through the firm's contact route, before more material is generated or more interviews are conducted on the current basis. For the wider set of situations this practice covers, the economic crime defence overview sets out where this question sits alongside related ones.