How to Conduct Internal Investigations in Germany (2026): Practical, Step‑by‑step Guide

Internal investigations Germany present a demanding intersection of criminal law, employment protections, data privacy and professional privilege, and in 2026 the procedural expectations continue to sharpen. Ongoing debate and professional guidance have refined the standards for how companies handle employee interviews, preserve evidence and document legal advice, making an out-of-date playbook a genuine liability. This guide sets out a defensible, step-by-step procedure for German corporate internal investigations, written for compliance officers, general counsel, managing directors and D&O advisers who must either open a probe or respond to one under pressure. It combines statutory grounding, StGB, StPO, HinSchG, BDSG and GDPR, with practical checklists, a role matrix, timing tables and realistic cost ranges.

Read it as a regulator-style procedural reference, not a marketing brochure.

Overview, What this guide covers

This guide addresses corporate internal investigations in Germany where the underlying conduct may carry criminal or regulatory consequences: fraud, corruption, embezzlement, accounting manipulation, tax offences, sanctions breaches or data misuse. It assumes an audience that must act quickly and defensibly, balancing the need to uncover facts against employee rights, works council co-determination and data-protection constraints. The emphasis throughout is on producing an evidentially sound record that survives later scrutiny by prosecutors, regulators or a court.

The deliverables are practical: a numbered workflow, a Step/Who/Duration timeline table, a required-documents table with privilege flags, deadline guidance, cost ranges and a privilege-versus-confidentiality comparison. Each section is designed to be lifted directly into an investigation protocol.

When to use this guide

Use this guide when a credible trigger, a whistleblower report under the Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG), an audit finding, a regulatory contact, a dawn raid or a suspicious transaction, creates a reasonable basis to investigate. It is equally relevant where you are stress-testing an existing compliance investigation Germany framework before a crisis arrives. It is not a substitute for tailored legal advice on a live matter.

Outcomes and possible escalation paths

An internal investigation in Germany can resolve along several paths. The most common is internal remediation: disciplinary measures, control fixes and policy updates with no external disclosure. A more serious matter may warrant voluntary disclosure to a regulator, or contact with the public prosecutor, where cooperation may be taken into account at sentencing or in the exercise of prosecutorial discretion. In tax matters, a formal self-disclosure (Selbstanzeige) mechanism exists under the Fiscal Code (Abgabenordnung, AO). The chosen path should always follow, not precede, a sober legal assessment of exposure under the German Criminal Code (Strafgesetzbuch, StGB), the Code of Criminal Procedure (Strafprozessordnung, StPO) and the Act on Regulatory Offences (Ordnungswidrigkeitengesetz, OWiG).

Eligibility, When to open an internal investigation in Germany

The threshold question is whether you have moved from vague concern to reasonable suspicion. Information-gathering, clarifying an anomaly before deciding anything, is not yet a formal investigation. Once specific facts point to possible wrongdoing by identifiable persons, corporate internal investigations Germany obligations engage, and you should preserve evidence and involve counsel immediately.

Quick risk triage checklist

• Source credibility. Is the trigger a documented whistleblower report, an audit exception, a regulator letter or an anonymous tip? A whistleblower investigation Germany channel under the HinSchG carries statutory handling and protection obligations.
• Potential offence. Does the conduct plausibly fall under StGB provisions (fraud, breach of trust, corruption) or tax law?
• Scale and duration. Isolated incident or systemic pattern across periods and jurisdictions?
• Evidence volatility. Is there a real risk of data deletion, document destruction or witness coordination?
• Regulatory exposure. Are supervisory or prosecutorial authorities already aware, or likely to become aware?

Assessing criminal exposure & D&O risk

German law does not currently have a general corporate criminal statute in the common-law sense. Instead, companies face administrative fines and confiscation of proceeds primarily under the Act on Regulatory Offences (OWiG), while individual directors and officers face personal exposure under the StGB, and the StPO governs how evidence is gathered and how authorities may search and seize. Managing directors carry organisational duties: a failure to investigate a credible red flag can itself become a breach-of-duty allegation and a director-and-officer liability driver. This is why the eligibility decision should never sit with business management alone, legal input belongs in the triage from the first hours.

Step‑by‑step internal investigations Germany procedure

The internal investigation procedure Germany workflow below is expressed as seven sequential steps. Each has a lead role, supporting roles and a realistic duration. Treat the durations as working spans for a mid-size matter; complex, cross-border probes run longer. The mandatory timeline table follows the narrative.

1. Step 1, Initial intake and triage (1–3 days). Record the allegation precisely (who, what, when, source). Issue an immediate legal hold to preserve documents and data. Assign a single lead investigator and, critically, obtain an early legal-privilege assessment so that sensitive analysis is structured to attract protection from the outset. Where the matter may become adversarial or criminal, engage external counsel at this stage. On selecting counsel, see the appendix guidance on how to find a good lawyer in Germany.
2. Step 2, Scope and strategy (3–7 days). Define the issues, the persons of interest and the evidence universe (IT, finance, HR, procurement). Draft a written scope memo that governs the investigation without over-committing. Complete a data-protection analysis: identify the personal data you will process, the lawful basis under the GDPR and the Bundesdatenschutzgesetz (BDSG), and set proportionality and retention limits before collection begins.
3. Step 3, Evidence preservation and forensic collection (3–21 days). Instruct qualified forensic specialists to image devices with cryptographic hashing, maintain a chain-of-custody log and capture cloud and collaboration data, email, shared drives, and messaging platforms such as Slack or Teams. Access logs and system metadata are often decisive. Defensible collection matters: evidence gathered without documented integrity risks being challenged if the matter reaches court.
4. Step 4, Witness and employee interviews (1–14 days). Plan and conduct interviews once the documentary picture is sufficiently developed. This step carries the highest procedural risk and is addressed in detail below.
5. Step 5, Analysis and legal assessment (7–21 days). Review the collected evidence against the alleged offences, quantify criminal and regulatory risk, and conduct a privilege review of every analytical work-product. External counsel should lead so that legal memoranda are created in a privileged posture. This is where facts become a legal position.
6. Step 6, Reporting and remediation (7–30 days). Prepare the internal report and a remediation plan (controls, discipline, restitution, policy changes). Decide, with counsel, whether to approach a regulator or the public prosecutor. In tax matters, weigh a formal Selbstanzeige. The report should distinguish clearly between privileged legal advice and factual findings that may need to be shared.
7. Step 7, Closure and records retention (ongoing). Archive materials under a defined retention policy, close the legal hold only on counsel’s advice, update policies and controls, and deliver targeted training so the same failure does not recur.

Step 4 in depth, employee interview rights Germany

Interviews are where legal, employment and data-protection risks converge. Plan each interview deliberately: decide who will be interviewed and in what order (typically peripheral witnesses first, key subjects last), where the interview will take place, and whether external counsel will attend to advise the company.

Employee interview rights Germany considerations are distinct from common-law expectations. Employees generally owe a duty to cooperate with legitimate internal inquiries arising from the employment relationship, but this duty is not unlimited, and self-incrimination concerns can arise where conduct may also be criminal. Counsel conducting the interview acts for the company, not the employee, this must be made explicit at the outset (a warning adapted to German practice, comparable to the common-law Upjohn warning) so the interviewee is not misled about whose interests are represented.

Works council co-determination is a frequent trap. Under the Works Constitution Act (Betriebsverfassungsgesetz, BetrVG), the works council (Betriebsrat) has participation and co-determination rights that can extend to investigation-related measures affecting employees, and an employee may in certain circumstances be entitled to request works-council representation. Ignoring these rights can render disciplinary outcomes vulnerable and sour employee relations for the wider probe.

Sample interview checklist, do’s and don’ts

• Do prepare a written interview plan with the key documents and a timeline.
• Do deliver a clear statement that counsel represents the company, not the employee.
• Do record accurately and confirm the interviewee’s account before closing.
• Do observe works council and data-protection obligations from the planning stage.
• Don’t promise confidentiality or immunity you cannot deliver.
• Don’t apply coercion or improper pressure, it undermines both admissibility and fairness.
• Don’t circulate interview notes widely, which erodes any privilege claim.

Role matrix, Step / Who / Duration

The matrix makes accountability explicit. Blurred roles, where a business manager also runs the investigation, are a recurring cause of privilege loss and perceived bias, so keep legal leadership visible at every escalation point.

Required documents

Documentation is the backbone of a defensible internal investigation. Each artefact should be created with its evidentiary function and privilege exposure in mind. The table below sets out the core documents, why they matter and whether they carry privilege risk.

How to label and preserve privileged materials

Legal-advice memoranda should be authored by or expressly for counsel, marked as privileged and confidential, and circulated on a strict need-to-know basis. Note that the protection attaching to lawyer communications in German proceedings is real but narrower than the broad work-product doctrine familiar in common-law systems, and case law (including decisions of the Federal Constitutional Court and the BGH) has drawn important limits on the seizure of materials held at law firms and in-house. Over-distribution is a common way companies weaken their own protection, keep factual records and legal analysis in physically separate workstreams.

Template download: investigation checklist & interview template

Download the Internal investigation checklist, Germany (2026) to standardise intake, scope, evidence handling and interview conduct across your compliance function.

Timeline & deadlines

German internal investigations are governed less by fixed statutory clocks than by the practical imperative to act before evidence degrades, but several timing pressures are non-negotiable. The overriding rule is immediacy on preservation: a legal hold and data preservation should be issued without delay after a credible trigger.

Statute of limitations (overview)

Limitation periods for economic offences are set by the StGB and vary with the offence and its statutory maximum penalty. More serious offences carry longer periods, and limitation can be interrupted by defined prosecutorial acts. Because the analysis is offence-specific and fact-sensitive, confirm the applicable period with counsel before assuming a matter is time-barred, a misjudgement here can be costly.

When to consider urgent escalation to law enforcement

Escalate promptly where there is ongoing loss, imminent evidence destruction outside your control, or a legal obligation to report. Escalation is a legal decision balancing potential cooperation benefits against the loss of narrative control, and it should follow, not replace, the internal legal assessment.

Costs & fees, expectation setting

Cost is the question every managing director asks first. The honest answer is that internal investigations Germany budgets vary enormously with scope, data volume, cross-border reach and the number of witnesses. On the recurring question of what a lawyer typically charges in Germany, specialist economic-crime and compliance counsel generally bill by the hour at rates that reflect seniority and city, with fixed-fee or capped arrangements available for defined phases such as forensic bundles. Note that statutory fees under the Lawyers’ Remuneration Act (Rechtsanwaltsvergütungsgesetz, RVG) provide a fallback framework, but complex investigation work is almost always handled under a negotiated fee agreement. The figures below are indicative only and should be confirmed with the instructed firm.

The lesson for budgeting is that early, disciplined scoping is the most effective cost control: a tightly defined investigation with a clear evidence universe rarely overruns, whereas an open-ended mandate invariably does.

What may change, evolving standards & practical impact

Reform debate continues to push German practice toward greater formality and clearer boundaries. The recurring themes are threefold: clearer articulation of employee rights during interviews; more sharply defined limits on legal-professional protection for in-house and external counsel communications; and stricter, better-documented evidence-handling protocols. An earlier legislative attempt to introduce a dedicated corporate sanctions regime (the proposed Verbandssanktionengesetz) did not enter into force, so companies should treat these as evolving professional standards and policy positions rather than enacted statutory change, and track official materials as they are published.

The likely practical effect is that compliance teams will need to document legal advice more rigorously, keep more formal interview records, and involve the works council earlier and more explicitly. These expectations are increasingly used as benchmarks by which prosecutors and courts assess whether an internal investigation Germany process was conducted properly. Building the discipline now is cheaper than retrofitting it under scrutiny.

Common pitfalls & how to avoid them

Most failed investigations fail on process, not facts. The comparison below clarifies the distinction between privilege and confidentiality that trips up so many teams, treating an internal “confidential” label as if it carried the legal force of privilege.

• Failing to preserve raw forensic images. Use a qualified forensic provider and hash every image; a reconstructed dataset is far more vulnerable to challenge.
• Over-broad disclosure of legal analysis. Wide circulation of counsel’s memos can undermine any protection, segregate legal work-product.
• Ignoring works council co-determination. Overlooking BetrVG rights can invalidate disciplinary outcomes and poison employee cooperation.
• Mixing legal and business roles. Triage without lawyer input creates bias and protection gaps.
• Neglecting data protection. Failing to document a lawful basis and observe cross-border transfer rules under the GDPR and BDSG exposes the company to a second, self-inflicted breach.

Conclusion & practical next steps

Conducting internal investigations Germany well in 2026 comes down to three immediate actions: triage and preserve evidence promptly after a credible trigger; engage specialist counsel early so that protection and strategy are safeguarded from the outset; and standardise your process using a tested checklist and role matrix. Download the Internal investigation checklist, Germany (2026) to operationalise this guide, and treat this article as general information rather than specific legal advice, a live matter should always be reviewed by qualified counsel before you act.

Sources

1. Strafgesetzbuch (StGB), German Criminal Code
2. Strafprozessordnung (StPO), German Code of Criminal Procedure
3. Ordnungswidrigkeitengesetz (OWiG), Act on Regulatory Offences
4. Abgabenordnung (AO), Fiscal Code (self-disclosure/Selbstanzeige)
5. Gesetz zum Schutz von Hinweisgebenden (HinSchG), Whistleblower Protection Act
6. Bundesdatenschutzgesetz (BDSG)
7. GDPR (Regulation (EU) 2016/679), EUR-Lex
8. Betriebsverfassungsgesetz (BetrVG), Works Constitution Act
9. Rechtsanwaltsvergütungsgesetz (RVG), Lawyers’ Remuneration Act
10. Bundesrechtsanwaltskammer (BRAK), German Federal Bar
11. Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
12. Bundesgerichtshof (BGH), decisions/search portal