Employees as suspects and the company's position: what to do in the first ten days determines whether the business keeps control of its records, its privilege over internal findings, and its standing as a party rather than a target. The priority is separating the company's interest from the employee's defence and securing documents before they move.
Who this concerns
This concerns any company where an employee's conduct at work has become, or is about to become, the subject of a criminal investigation into economic crime: internal fraud found by finance, a whistleblower report escalated beyond HR, a bank or auditor raising a flag, or the police announcing a search. It applies whether the company reported the matter itself or found out from someone else, and it applies from the moment the possibility becomes real, not from the moment charges are filed.
It is worth separating, early, an employee under suspicion from the company under suspicion. In Sweden a company cannot itself be charged with most economic offences, but it can face a corporate fine, företagsbot, where an offence was committed in the course of business activity and the company failed to prevent it. That exposure is exactly what turns the first ten days into a company decision rather than a personal matter for the individual concerned, and it is the reason the company needs its own position from day one, independent of whatever the employee decides to do.
When the employee holds a foreign passport, the parent company sits outside Sweden, or relevant systems and mailboxes are hosted abroad, further considerations apply immediately. There may be a notification obligation to a foreign parent or group compliance function, cross-border restrictions on what personal data can be transferred to or reviewed by the Swedish authorities, and a practical difficulty in interviewing, suspending or dismissing someone who could leave the jurisdiction before the investigation is complete. None of this changes the urgency of the first ten days, but it changes the order in which people need to be told and the care with which any document leaves the company.
What the law says
Under Swedish law as it currently stands, a criminal investigation, förundersökning, is opened and led by the police or the public prosecutor once there is reason to suspect an offence. The company is not automatically a party to that process. Depending on the facts, it can be the injured party, a witness, the recipient of a production order for documents, or itself a subject of a company-fine assessment running in parallel with the case against the individual. A company frequently occupies more than one of these positions at once, and each carries different rights and different obligations toward the authorities.
The employee under suspicion keeps the ordinary protections of a criminal suspect, including the right not to incriminate themselves in dealings with the police. That protection does not automatically carry over into an interview the employer conducts as part of its own internal inquiry, which sits under employment law and data protection principles rather than criminal procedure. Treating an internal interview as if it carried the same protections as a police interview is a mistake that tends to surface only once the material is already in someone else's hands.
Privilege under Swedish law protects communication with an external advokat retained for legal advice. It does not, as a rule, extend in the same way to communication with in-house counsel, and it does not attach to an internal investigation report simply because a lawyer drafted it after the fact. Whether a specific document, interview note or internal report is protected turns on who commissioned it, for what stated purpose and at what point in the sequence of events, which is why the order in which the company acts in the first ten days shapes what can later be shown to a prosecutor and what cannot.
Separately, the company has its own data protection obligations while gathering and reviewing personal data for an internal inquiry. That obligation does not pause because a criminal investigation has started; it runs alongside it and needs its own basis, proportionate scope and retention plan, distinct from anything handed over to the police.
How it works in practice
The first signal and the first decision
The company typically learns of the situation in one of three ways: internally, through finance, HR or a whistleblower channel; externally, through a bank, auditor or counterparty; or directly from the authorities, through a request for documents or an announced or unannounced search. Each entry point sets a different clock. A whistleblower report gives room to plan before anyone outside the company knows. A police visit does not, and the first decisions have to be made in the hours that follow rather than the days.
Deciding who represents the company
The decision that shapes everything after it is who speaks for the company, as distinct from who speaks for the employee. In most matters involving an economic offence these cannot be the same lawyer without creating a conflict that weakens both positions once interests diverge, even where the divergence is not obvious on day one. The company's exposure to a corporate fine, its relationship with the authorities and its standing with commercial counterparties need a mandate held separately from whoever ends up advising the individual, regardless of who is initially paying the fees.
Securing documents and systems before anything moves
Emails get deleted on a retention schedule nobody in HR is thinking about, laptops get reissued, and access logs roll over. The task in the first ten days is to freeze, not to draw conclusions: identify which systems, accounts and physical files the employee could access, suspend routine deletion and device reassignment for that material, and record who accessed what before the freeze took effect. Analysis of what any of it means can wait; the freeze cannot.
The employee's status: witness, suspect, or something in between
Status inside an investigation can shift, and the company's obligations shift with it. Someone treated as a witness in week one can become a suspect once the prosecutor reviews the material further. Internal fact-finding should be built to survive that shift rather than assume the initial characterisation will hold, which in practice means keeping the gathering of facts separate from any internal conclusion about guilt or innocence.
Internal investigation running alongside the criminal one
Running an internal inquiry at the same time as a police investigation is normal, and is often required by the company's own reporting and governance obligations. The two processes serve different purposes and should not be allowed to contaminate each other. An internal interview conducted without care about self-incrimination can hand the prosecution material it would otherwise have had to obtain through formal channels, and a company that behaves as an extension of the police risks losing control of its own account of what happened.
Talking to police and prosecutors, and to the outside world
Cooperation is generally the right posture for a company that is not itself the target, but cooperation offered before the company has a settled, internally consistent account of the sequence of events tends to be read as either evasive or naive, whichever way it comes across. Contact with customers, lenders or the press before that account exists carries the same risk in a different direction: an early, informal characterisation of events is hard to correct once repeated outside the building.
What to check in the first ten days
- Who currently has access to the relevant systems, accounts and physical documents, and whether that access has changed since the issue surfaced.
- Whether the company's own insurance, in particular directors' and officers' cover, imposes a fixed notification window.
- Whether a regulator, lender covenant or listing obligation independently requires disclosure of the fact of an investigation, separate from its outcome.
- Whether the suspected conduct touches contracts, tenders or counterparties where the company carries its own reporting duty.
- Whether the employee, through their role or access rights, is still in a position to affect evidence, customers or transactions in progress.
- Whether separate legal representation for the employee has already been arranged, and on whose instruction.
Can the same lawyer advise the company and the employee?
Only until their interests diverge, which in an economic crime matter is usually early rather than late. Once the company's own exposure to a corporate fine becomes a live question, or once the employee's account of events starts to differ from what the company needs to say, a single lawyer cannot properly advise both without one side being underserved. Separate representation from the outset avoids the cost and disruption of switching counsel later, once a conflict has already caused damage.
Does the employee have to cooperate with an internal investigation?
Employment law generally requires reasonable cooperation with a lawful internal inquiry, but that duty is not identical to the protections and limits that apply in a police interview. What the employer can ask, how the answers can be used, and whether the employee has a right to their own adviser present depend on the specific process the company has set up, not on assumptions carried over from criminal procedure. Building that process correctly is part of the first ten days, not an afterthought.
What happens if the company already spoke to the police before taking advice?
An informal account given before the company had a settled position is difficult, though not always impossible, to correct later. The realistic response is to establish, quickly, exactly what was said, by whom and on what authority, and to build the company's formal position around that reality rather than around what should ideally have been said. Pretending the informal contact did not happen tends to cause more damage than the contact itself.
The numbers
There is no fixed timetable that applies across matters of this kind. Whether the work involves freezing a handful of accounts, a full forensic review of a mailbox archive, or a formal response to a prosecutor's document request changes the workload from days to weeks, and no two files run to the same clock.
Cost follows the same pattern rather than any published scale. It rises with the number of systems that need securing and reviewing, the number of individuals who require separate representation, and whether the matter moves from an internal question into a formal exchange with the prosecutor. It falls where the company acts early enough that the freeze, the mandate and the account of events are settled before anyone outside the company is asking for them. In practice, the single largest cost driver is not the investigation itself but rework: material gathered without a clear purpose in the first ten days often has to be regathered properly once the criminal process is under way.
Where it usually goes wrong
Everything above assumes the company is not itself accused of directing or tolerating the conduct. Where the suspected offence appears to have been organised, or knowingly allowed, at management level, the company's own position shifts from managing an employee's situation to managing its own exposure to a corporate fine, and the entire sequence needs reworking around that exposure as the starting assumption rather than a late discovery.
The position also breaks down once the company has already acted before taking advice: dismissing the employee summarily on incomplete facts, sharing internal findings informally with the police to appear cooperative, or letting one lawyer continue advising both the company and the employee after their interests have diverged. Each of these steps is hard to reverse. A summary dismissal on incomplete facts can itself become a separate employment dispute, running alongside and complicating the criminal matter. Material shared informally cannot be un-shared. And a lawyer who has already advised the employee cannot simply switch sides once a conflict becomes apparent.
Finally, the sequence above assumes an ordinary employment relationship. It applies differently where the person concerned is a contractor, an agency worker or a board member acting outside an employment contract. Each of those categories carries a different starting point on what the company can lawfully instruct, what control it actually has, and what protections apply to internal questioning, and the ten-day plan needs adjusting to the actual relationship rather than applied by default.
What to do next
The work described here, freezing access, separating mandates, and building an internally consistent account of events, is work a company can begin on its own within its existing lines of authority. It stops being work the company can safely finish alone once a corporate fine becomes a realistic exposure, once the prosecutor makes formal contact, or once the outcome turns on the legal status of specific documents that were, or were not, privileged when created.
Lodline's economic crime defence practice advises companies through that transition, from the first internal signal through formal contact with the prosecutor. Where the suspected conduct involves payments to a counterparty rather than an internal loss, the first ten days are structured somewhat differently, covered separately in bribery and improper benefits: what to do in the first ten. For a structured assessment of where the company currently stands, and what the next irreversible step actually is, get in touch.