Employees as suspects and the company's position: step by step means treating the company and the individual as two separate legal subjects from the first hour, not after the first interview. The company preserves evidence, decides on suspension only through documented process, and keeps its own legal exposure separate from the employee's defence. Waiting for the police to define the sequence is the most common way a company ends up as a co-suspect rather than a witness.
Who this concerns
This is written for a management team, general counsel or board member who has just learned, or strongly suspects, that an employee is a target of a fraud, bribery, embezzlement or accounting-offence investigation, whether the trigger is a whistleblower report, an auditor's flag, a counterparty's complaint or a direct approach from the Economic Crime Authority (Ekobrottsmyndigheten) or the police.
It applies whether the employee is a junior accounts clerk or a member of the executive team, because the procedural obligations of the employer do not scale with seniority. What changes with seniority is the risk that the company itself becomes a subject of interest, not only a source of documents.
It does not apply once formal charges have already been filed and the company has engaged counsel to run a coordinated defence. At that stage the sequence described here has already happened, correctly or not, and the questions become tactical rather than procedural. This material is aimed at the window before that point, where most of the avoidable damage is done.
What the law says
There is no single statute titled "employer response to a suspect employee." The relevant obligations sit across employment law, criminal procedure, data protection and, where the employee sits on the board or holds a senior executive role, company law duties owed to the company itself.
Under Swedish law as it currently stands, an employer is entitled to conduct its own internal fact-finding in parallel with, or ahead of, any police investigation, provided that fact-finding does not amount to obstructing the criminal process, does not breach the employee's data protection rights, and does not step outside the powers the employment relationship actually gives the employer. None of those three limits is self-evident in practice, and each is where companies lose the advantage of having acted first.
The employer's own position as a legal person is separate from the employee's position as a suspect. A company can be a victim of the employee's conduct, a witness to it, a party liable in tort for it, or in narrow circumstances itself the subject of a corporate sanction connected to the same facts. Which of these applies determines almost everything else in this guide, including who inside the company should even see the file.
How it works in practice
First decision: open an internal review or wait for the authorities
The first branching point is whether the company opens its own fact-finding before or after the authorities make contact. Opening early preserves evidence and control of the narrative; it also creates a paper trail that a later defence lawyer, on either side, will read closely. The decision belongs with someone senior enough to own it, documented in a short memo stating the date, the trigger and the scope of what is being looked at.
Preserving evidence before anyone inside the company is told
Access logs, email retention settings, expense system exports and physical documents connected to the suspected conduct should be secured before the wider organisation knows there is a problem. A preservation instruction sent too late is functionally the same as no instruction at all, because the relevant material has often already been altered by ordinary business use, not by anyone acting in bad faith.
Deciding who inside the company needs to know
Every additional person told about the suspicion increases the risk of the employee being tipped off, of the matter leaking to a counterparty or the press, and of an unauthorised person forming their own view of guilt that later contaminates the process. A short, named list of people entitled to know the facts, kept separate from the wider HR file, is the practical answer.
The suspension question
Suspension is a labour law act with its own requirements, not an automatic consequence of suspicion. Suspending without documented grounds tied to specific, described conduct, or suspending in a way that is disproportionate to the actual risk the employee poses if left in post, converts an economic crime matter into a parallel employment dispute, which then has to be run and resourced separately.
Interviewing the suspect employee
An internal interview is not a police interview and does not carry the same procedural protections, which cuts both ways. The company can ask direct questions the police cannot yet ask; the employee can refuse to answer without any privilege against self-incrimination applying in the way it would in a criminal interrogation. What the company cannot do is present the interview to the employee, later, as something other than what it actually was.
Coordinating with the prosecutor or Economic Crime Authority without becoming a defendant by proxy
Once the Economic Crime Authority or the police make contact, the company is usually asked, informally at first, for documents, access or an account of internal controls. Responding fully and quickly is normally the right instinct, but every document handed over should be logged, and every request should be matched against what the company is actually obliged to produce at that stage of the process, as distinct from what is simply convenient to hand over.
When the suspect reports into a foreign parent or the counterparty is abroad
Where the suspect employee's line reports to a parent company outside Sweden, or the transactions under suspicion involve a foreign counterparty, two additional layers appear. The parent's own compliance function will usually want a role in the investigation, which can conflict with Swedish employment procedure if the parent is not familiar with it. Separately, if the underlying conduct touches a foreign counterparty, exposure connected to that relationship, for example around improper benefits, should be assessed alongside the employment question rather than after it; see bribery involving a foreign counterparty for how that risk is typically framed.
Documenting the process as it happens
Every decision point above should leave a dated written record: who decided, on what information, and what alternative was rejected and why. This record is what later distinguishes a company that acted as a responsible corporate citizen from one that improvised, a distinction that matters directly if the company's own conduct is ever reviewed alongside the employee's.
What to check before the next step is taken
- Whether the suspected conduct falls inside the employee's authority or clearly outside it
- Whether any evidence sits on personal devices or private accounts, which changes what the company can lawfully access
- Whether an external auditor or supervisory authority already has a parallel reporting obligation triggered by the same facts
- Whether the company's insurance, in particular crime or D&O cover, has a notification deadline running from the moment suspicion arose, not from formal charges
- Whether any contract with a counterparty contains a disclosure or representation clause that the suspected conduct puts at risk
- Whether the employee holds signing authority, payment access or system rights that need to be adjusted, distinct from suspension
Common questions at this stage
Can the company interview the employee before the police do?
Yes, and doing so is usually advisable, but the interview should be framed and recorded as an internal fact-finding step, not as an interrogation. The employee should be told the purpose of the meeting and, in most cases, given the opportunity to bring a representative, even though the formal right to legal representation under criminal procedure has not yet arisen.
Does reporting to the police protect the company from its own liability?
Reporting establishes that the company treated the matter seriously once it knew, which is relevant to how any later liability question is assessed, but it does not retroactively cure gaps in internal control that existed before the report, if those gaps are themselves part of what is examined.
What happens if the employee resigns during the review?
Resignation does not close the internal review and does not remove the company's document preservation obligations. It does remove most of the leverage the company had through the employment relationship itself, which is one reason the timing of any suspension or restriction decision matters more once resignation becomes likely.
The numbers
There is no fixed statutory timetable that applies uniformly to every step described above. The deadline that actually governs a given step, whether it is a notification period under an employment agreement, an insurance policy's reporting window, or a procedural deadline once the prosecutor formally opens a preliminary investigation, depends on the specific instrument and the specific authority involved, and should be read from that document rather than assumed from general practice.
What is consistent is the direction of the risk: every deadline in this area runs from the moment the company knew or ought to have known, not from the moment it chose to act. A company that waits for legal advice before starting the clock on notification periods it is contractually or statutorily bound by is, in most structures, still bound by the original date.
Where it usually goes wrong
The most frequent failure is not inaction but premature action taken by the wrong person. A line manager suspends an employee on the spot, in the heat of a difficult conversation, without the documented grounds that a later tribunal or court will ask for. The suspicion may have been entirely correct; the process around it is what gets challenged.
A second recurring failure is treating the internal investigation and the criminal investigation as one track. Material gathered for internal, employment-facing purposes is not automatically usable, or usable in the same way, in a criminal file, and material shared informally with the police can limit what the company itself can later do with it internally.
Where the suspected conduct is embedded in ordinary business processes, for example routine approvals or standard payment runs, the exception to nearly everything above is that the company cannot simply freeze the process without disrupting operations that have nothing to do with the suspected employee. In that situation the sequence has to be adapted around continuity, and the usual advice to preserve everything and restrict access immediately has to be balanced against keeping the business running, which is precisely the kind of judgement call that benefits from being made with someone who has seen the pattern before.
Where the employee holds a board seat or a formal executive role, the ordinary employment sequence above is not sufficient on its own: removal from that role follows company law procedure separate from, and in addition to, anything done under the employment relationship, and skipping that separate procedure is a distinct point of exposure for the company.
What to do next
Everything above is the sequence a company can run itself, with internal resources, before external exposure crystallises. It stops being a self-run process once any of three things happen: the police formally open a preliminary investigation naming the company as a party of interest, a regulator issues a formal information request rather than an informal contact, or the internal fact-finding itself uncovers conduct that implicates the company's own controls rather than only the individual employee. At that point the question is no longer procedural, it is an assessment of the company's own exposure, and that assessment is best done before the next document is produced, not after.
For companies that are also listed, or preparing a public statement about an internal investigation, the disclosure obligations run on a separate and often faster clock; see what listed companies must disclose for how that interacts with the sequence above.
The economic crime defence practice at Lodline runs this kind of assessment for companies at exactly this stage, before positions have hardened and before documents have been produced that cannot be un-produced. Requests are reviewed within two hours on a working day; the assessment itself starts from what has already happened, not from a generic checklist.
Related situations companies in this position often face in parallel
Can tax criminal proceedings run alongside an internal investigation into the same conduct?
Yes, and the two tracks run on different deadlines that do not pause for each other. A tax criminal file opened on the same facts as an internal fraud review does not wait for the company's own process to conclude, and treating them as sequential rather than parallel is a common cause of missed deadlines; see parallel tax and criminal proceedings.
If the employee's conduct involved payments to a foreign counterparty shortly before insolvency, does that create a separate recovery risk?
It can. Payments made in the period before insolvency are subject to separate recovery rules regardless of whether the person who authorised them is also a suspect in a criminal file, and a foreign counterparty adds a jurisdictional layer to any recovery action; see pre-insolvency payment recovery involving a foreign counterparty.
Can enforcement action reach a director personally while an employee below them remains under suspicion?
In defined circumstances, yes, particularly where the director's own conduct or oversight is separately in question. The employee's status as a suspect does not shield a director from personal enforcement if the underlying facts also implicate the director directly; see personal enforcement against directors explained.