1 Introduction
Multiple actors with different professional backgrounds are active in the corporate investigations field (Williams, 2014: 59). These different actors have their own laws and regulations to adhere to, which are described in this chapter. Some rules are specific to the professional group, while others apply to all. In addition to the specific rules applicable to them, corporate investigators with different backgrounds seem to adhere to a similar set of general principles of law (most notably fairness, proportionality and subsidiarity ). These general principles of law are codified for some but not for others (NIVRA/NOvAA, 2010; NVb, 2015). The differences in legal frameworks provide some corporate investigators with strategic advantages compared to others. As this chapter will show, all four groups have their specific selling points (which may or may not be directly related to the legal frameworks): in-house security departments are internal to an organisation, therefore providing a unique level of specialised knowledge about the organisation. In-house investigators and investigators working for a private investigation firm often also have a police background and are skilled interviewers. Private investigation firms are furthermore permit holders and are external to the client, bringing with them an air of objectivity. This latter circumstance also applies to forensic accountants , who furthermore may be seen as financial experts. Investigators with a legal background finally are experts in the legal interpretation of the findings and they may assist with settlements. In addition, forensic legal investigators may make use of their legal privilege to protect the outcomes of the investigations.
The fact that there are different rules for different players produces a rather scattered regulatory landscape, in which it is not altogether clear for those involved which rules they have to adhere to. The way in which the topic is handled by legislators does not really do much in clearing up this confusion. The issue of legislation pops up every once in a while in Dutch Parliament; however, this has not led to systematic, uniform legislation (Klerks, 2008: 17). An interesting point made by White (2014) in this regard is that legislators tend to regulate the kind of private security activity that is most visible, and thus, most threatening to the legitimate position of the police. White focuses on the difference in regulation of in-house and external security (guards) in the UK more generally; however, his argument could be extended to corporate investigations. The legal framework provided by the Dutch Law on Private Security Companies and Private Investigation Firms (hereafter: Wpbr) is mainly focused on the more traditional security activities. There are many specific rules in this law about security guards, cash-in-transit and private alarm companies but on private investigations the law is very general. The law concerns itself for an important part with the most visible parts of the private security industry, regulating such matters as the use of uniforms. The inclusion of a requirement for private security firms to notify the police about security activities is interesting in the absence of such an obligation for private investigators. As this chapter shows, within the already limited mention of private investigations in the Wpbr, the law seems even more narrow as it specifically focuses on the most visible corporate investigators: the private investigation firms . The other types of investigators discussed in this chapter are excluded from the Wpbr.
While it is certainly not the case that the sector is unregulated, one might suggest that the consequence of the dispersed nature of regulation is that many opportunities for forum shopping are created. Forum shopping is the process in which parties pick and choose from certain ‘forums’ to suit their specific interests. In international business relations, parties will, for example, choose a jurisdiction for the settlement of a dispute that will produce the most favourable outcome (Whytock, 2010). In the context of this book, it means that both clients and (to a certain extent) corporate investigators may choose from different legal frameworks. As this chapter illustrates, in the Netherlands, different actors are liable to different legal frameworks. The diversity in the legal frameworks applicable is a prime example of the interdisciplinary nature of corporate investigations and the remarkable position of the sector. The market for corporate investigations constitutes a commercial sector (regulated by private law), offering a product that may have an outcome either relating to public law (criminal proceedings), private law (contract or tort), labour law (labour relations) or internal regulations. Chapter 4 of this book focuses specifically on these different outcomes in the form of corporate settlements.
While there are also other players active in the field of (corporate) investigations,1 the focus in this book is on four main groups: private investigation firms , in-house security departments , forensic accountants and forensic legal investigators . The different rules and regulations applicable to these four groups, and their respective advantages for clients compared to other investigators, are discussed. Some particular legal requirements are left to be discussed in more detail in following chapters, as they, for example, apply specifically to certain investigative methods.
Although the four professional groups of corporate investigators have their own specific legal framework, some general rules apply to all. Section 2 starts by focusing on these general legal frameworks. Sections 3–6 go on to discuss the specific legal frameworks applicable to different corporate investigators. All of this leads to differences between corporate investigators, leaving room for clients to choose the corporate investigator who is most suited for their present situation (forum shopping). Section 7 looks into the respective selling propositions of each group compared to others, through a focus on the themes of professional background and knowledge, and legal frameworks and position with respect to the client. A discussion concludes the chapter, reflecting on the legal context of different corporate investigators.
2 General Rules and Legal Frameworks for Investigations
One of the defining characteristics of criminal investigations is their far-reaching nature. In legal terms, ‘investigating’ is defined in the Dutch Code of Criminal Procedure as ‘the investigations into criminal acts under auspices of the public prosecutor, aimed at a decision in criminal proceedings’ (article 132a). ‘Investigating’ in this sense is limited to the actions of law enforcement officers (article 141 and 142). Powers of investigation are exclusively granted to law enforcement agencies and since a large scandal in the 1990s, the more intrusive of these are explicitly regulated in the Dutch Code of Criminal Procedure as special powers of investigation [‘BOB’] (Title IVa and Title IV). Corporate investigators do not have powers of investigation (see also Chapter 3) so these laws do not apply to their work. A corporate investigator is, however, bound to adhere to the Criminal Code, as are all natural and legal persons. This means, for example, that they cannot detain or use force against a person and that they have to respect other people’s rights to privacy.
2.1 Privacy Legislation
As a result of EU legislation , the Dutch privacy law has, as of May 2018, been replaced by the implementation law for the General Data Protection Regulation (GDPR).2 This law has a far wider reach than merely corporate investigations; however, privacy regulation serves as an important guide for investigations. Although privacy regulation restricts the gathering and use of personal data, it simultaneously leaves room for this . To collect and process personal data, the processor needs a valid reason. The law defines six valid reasons, one of which is the protection of a legitimate interest. The prevention of fraud is explicitly mentioned as an example of this. In the decision whether or not the processing of data is indeed legitimate depends on the question of necessity, based on the weighing of the principles of proportionality and subsidiarity (Schermer, Hagenauw, & Falot, 2018).
Many rights and possibilities of corporate investigators are derived from the rights the client has as an employer (Williams, 2014: 68). In general terms, employers are allowed to exercise control over their employees; however, they should take certain restrictions into account (Autoriteit Persoonsgegevens, n.d.-a). Firstly, there should be a legitimate reason for such control, which may be constituted by suspicions of criminal or other undesirable behaviours. Furthermore, the control should be necessary, which means that less intrusive ways to gather the necessary information should have proven ineffective (in accordance with the principle of subsidiarity). The control should also be approved in advance by the works council of the organisation. Employees should furthermore be made aware of the rules, the possibility of control and the manner of control (e.g. through a code of conduct). Finally, the employer should respect the right to confidential communication of his employees. This does not exclude the possibility of control over, for example, telephone or email communications; however, the employer should distinguish between professional and personal communications. In case of suspicion of a crime, the employer is allowed to record telephone conversations. If the control is large scale or has a structural nature, the employer should do a data protection impact assessment in advance (ibid.).
If the control that is to be exercised is covert, there should be a reasonable suspicion of a crime committed by one or more employee(s). Furthermore, other efforts to put an end to the criminal behaviour should have proven ineffective. Importantly, covert control should always be incidental. The employer is obliged to inform the employees after the covert control, also in cases in which the covert control did not yield any useful results. Finally, just as is the case with structural and large-scale forms of control, the employer is obliged to execute a data protection impact assessment in advance (Autoriteit Persoonsgegevens, n.d.-a).
With regard to some specific types of control, the Data Protection Authority (AP—previously called CBP) has issued guidelines, for example, in case of camera usage (Autoriteit Persoonsgegevens, n.d.-b). The principles of law of subsidiarity and proportionality are important here. Because the breach of privacy is substantial, employers should have a legitimate reason for the use of cameras (see above) and should weigh the necessity and the interests being served with the use of cameras against the interests of the involved person (in accordance with the principle of proportionality). If the goal that is to be reached by the use of cameras may be reached through less intrusive means, these should be applied (subsidiarity). When the use of cameras is necessary, the breach of privacy should be kept to a minimum. This means, for example, that sound should not be recorded and the use of cameras in certain places (such as locker rooms) is illegal. The use of cameras is not allowed as the only measure, it needs to be part of a bigger policy of control measures. People should furthermore be made aware of the presence of cameras (although covert use of cameras is allowed in the cases related above). In addition, the use of cameras should be approved by the works council and the employer should execute a data protection impact assessment in advance. Hidden cameras are allowed in special circumstances, one of which is (the investigation of) suspicions of theft or fraud. This type of camera usage may only be of temporary nature (ibid.).
The above possibilities for employers and, by extension, corporate investigators leave ample room for information gathering in the context of corporate investigations (see also Chapter 3). However, the use of certain personal data is restricted though. The law prohibits use of personal data regarding ethnic or religious background, information about political opinions or membership of a workers’ union, genetic and biometric information, health, sexuality and sexual orientation and information about criminal past unless the law has granted an exception (which are listed in the articles 22 through 33 of the implementation law GDPR). For example, article 22 under 2d and article 32 under c of the implementation law of the GDPR state that personal data that have been made public by the involved person may be used. In a time when many people are actively using social media and hereby exposing much personal information, this means that corporate investigators may gather and use personal data quite easily (see also Chapter 3). Another relevant exception on the prohibition to use special personal data is granted in the articles 22 under 2e and 32 under d: these data may be used in the context of a legal claim. Article 33 under 2 allows for the use of data regarding someone’s criminal past based on the protection of one’s interests. This means that employers (and by extension in-house investigators) are allowed to use and process data about (prospective or former) employees. Interestingly, article 33 under 4a of the implementation law of the GDPR explicitly frees parties that have a permit based on the Law on Private Security Companies and Private Investigation Firms from the prohibition to work with (gather/process) criminal data. Not all corporate investigators have such a permit though (see below). Those who do not have a permit might still be able to use these kinds of data, based on the exceptions discussed above.3
2.2 The Civil Code (BW) and Anti-money Laundering Legislation (Wwft)
In addition to criminal law and data protection legislation , the system of the Civil Code (BW) is another general set of rules relevant to corporate investigators. The Civil Code is important when it comes to settlement of internal norm violations (see Chapter 4), but it also provides guidance in a more general way as the Civil Code captures the relations between civilians and private entities. As laid down in the Civil Code, anyone who commits a wrongful act towards another may be held liable to repay damages (article 6:162 BW). On the basis of this article, corporate investigators may be held accountable for any wrongful and unlawful actions during their investigations. In addition to creating this accountability, the Civil Code also provides corporate investigators with possibilities to execute their profession. Chapter 7, Sect. 10 of the Civil Code concerns the labour relations between employer and employee and provides the employer with certain rights, for example, to set rules and control the compliance of said rules (article 7:660 BW). Through these rights, the employer (and by extension, a corporate investigator) is granted the possibility to control his employees, investigate when necessary and take (disciplinary) action (Schaap, 2013).
But – we still have obligations, for example in connection to the reporting of unusual transactions. The client knows this because he is made aware of it in the confirmation document for the assignment. We will not communicate to him that we make a Wwft notification, but we will notify authorities when required. This may be a risk in an investigation. Clients might think that if they hire a forensic accountant , he has to notify. So sometimes we recommend to the client to make the assignment run through a law firm, to protect the client’s interests. (Respondent 40—corporate investigator)
Some concern has been voiced about the use of (derived) legal privilege by lawyers to circumvent the applicability of the GDPR and Wwft. The current interpretation of this question is that both laws are applicable in general but legal privilege may protect investigations from scrutiny based on these laws (Minister of Justice and Security, 2015).
This section has set the stage with regard to general legal frameworks, applicable to all corporate investigators. In addition to these, other (general) laws and regulations may apply, depending on the context within which the investigations take place. For example, if the investigations are within a financial institution such as a bank, financial regulation applies as well. Taking into consideration that corporate investigations take place within all sectors of economic activity (but also within the sphere of public administration), it would be impossible to map all these different legal contexts here. However, it is wise to keep in mind that in addition to what is discussed in this chapter, further regulations may apply in different contexts.
The rules and regulations discussed in the sections below are specific to the specific professional background of the investigator. However, on a more ‘normative level’, there are commonalities between the four groups discussed. All corporate investigators interviewed for this research mention the importance of certain principles of law to guide them in their investigations. For some, these principles have been codified in a code of conduct, while for others they may just be an ‘internal compass’. Leading principles of law which are often mentioned are fairness (treating the subject with respect and keeping his interests in mind),6 proportionality (the method used should be proportional to the goal) and subsidiarity (when a less intrusive method is available, this should be used). Another widely used principle is that investigations should have a reasonable foundation: investigators should refrain from accepting an assignment without merit, for example, when an employer merely wants to get rid of a troublesome employee.
3 Private Investigation Firms—Those with a Wpbr-Permit
The Wpbr is the only Act of Parliament that is specific to us. And then there is the code of conduct, made generally binding by the Minister [of Justice and Security] and approved by the Data Protection Authority. That’s about the investigative activities. But that’s all there is really. Ok we’re not allowed to commit crimes or to act wrongfully; that would make us liable. And general principles of law are important but they are in the code of conduct. And we try to keep up with case law and adapt our own code of conduct if necessary. (Respondent 1—corporate investigator)
For a long time, private investigators in the Netherlands have been regulated as a ‘by product’, falling under the law prohibiting militia until 1999 (Wet op de Weerkorpsen). The law against (politically oriented) militia was created in 1936 (Fijnaut, 2002). Although the law was created to prohibit the formation of militia belonging to the NSB, a Nazi-oriented political party, the definitions used were broad enough to also include private security companies. The Minister of Justice issued a decree in 1939 to exempt private security companies from the interdiction, simultaneously creating some rules for private security companies to comply with.7 Interestingly, in the Wet op de Weerkorpsen, there is no mention of private investigation companies, and the focus is on private security as such. Because of the growth of the private security sector after the Second World War, it was deemed desirable to regulate private security in a separate law. A working group (1974) and later an advisory committee (1979) were formed, both indicating that a separate law was necessary. However, because of the urgency of the matter, the Wet op de Weerkorpsen was amended to provide a better fit with the private security industry in the intermediate period. This amendment also meant that the law was renamed to explicitly include private security and private investigations (Wet op de Weerkorpsen en Particuliere beveiligingsorganisaties en recherchebureaus) (ibid.).8 This was the first (explicit) mention of private investigations in Dutch law.
A person or legal entity, who, in the performance of a profession or [as a] company for profit, does investigative work in as far as these activities are carried out at the request of a third party in connection with a private interest of that third party and in as far as they relate to one or more specific individuals. (article 1 under 1 (f) Wpbr)
This definition of a private investigation firm has some consequences. First of all, as the law is applicable to private investigation firms, others who are not included by this definition are not subject to the Wpbr. This means that in-house security departments are excluded from the legal framework provided by the Wpbr. In-house departments do not perform services for a third party as they are part of their ‘client’ (State Secretary of Justice & Minister of the Interior, 2009). Additionally, most forensic accountants are exempt from the Wpbr because they are investigating as part of their legally defined task (article 1 under 3 Wpbr). Forensic accountants who are chartered accountants are by that definition no private investigators in the sense of the Wpbr.
The Wpbr is fairly broad scope; however, more specific rules are provided by the ministerial ordinance on private security organisations and investigation firms (Regeling Particuliere beveiligingsorganisaties en Recherchebureaus—hereafter Rpbr). This ordinance regulates some practical matters, such as permits and education . It is illegal to maintain a private investigation firm without a permit (article 2 under 1 Wpbr), which is criminalised as an economic crime in the Law on Economic Crimes (article 1 under 4 Wed). Private investigation firms and management need to have a permit issued by the Ministry of Justice and Security (article 2 and 7 under 1 Wpbr). Employees and individual investigators are required to get a permit issued by the chief of police (article 7 under 2 Wpbr). Permits are granted to people who are ‘competent and reliable’ (article 7 under 4 Wpbr). As proof of competence, private investigators should possess a certificate of an accredited course on private investigations.9 Reliability means that a permit will be refused when someone has either been convicted for a crime resulting in a fine, a penal order or a transaction within the last four years; when he/she has been sentenced to imprisonment or community service within the last eight years; or in case of ‘other known and relevant facts’. These other facts may, for example, be grave suspicions of (involvement in) crimes or known criminal associates.10 Police employees are not allowed to be employed by, or own a private investigation firm (however, special exemption is possible).11
The official identification card for private investigators in the Netherlands (also known as the ‘yellow pass’) contains a photograph and some personal details of the investigator and of the company the investigator belongs to. A card is valid for a maximum of five years and the expiration date is displayed. Interestingly, the front of the ID card states that ‘you [the person to whom the card is shown] are not obliged by the government to cooperate with an investigation of a private investigation firm’. As we shall see in Chapter 3, this ‘voluntary’ cooperation with investigations is very important for corporate investigators. The back of the card portrays the signature of the chief of police, the statement that the cardholder is allowed to execute investigative activities and—if applicable—some restrictions.
The Wpbr states that employees of private investigation firms have an obligation to be discrete about the information they gather during their work, unless they are legally required to divulge the information (article 13 Wpbr). It should be noted that the circumstance that a criminal act is discovered may mean that confidentiality does not apply. However, there is no such thing as a duty to report for private investigators. Whether or not a crime is reported to the authorities is up to the client (more on this in Chapter 4). The Rpbr furthermore dictates that investigation companies make sure that personal and other confidential data are stored securely (article 4 Rpbr). The aforementioned privacy legislation handles these matters in more detail.
The actual regulation of specifics of investigative work was left to the industry itself. It is, however, mandatory for private investigation firms to have a complaints procedure (article 18 Rpbr). The specific rules that apply to investigative activities of private investigation firms have been articulated by representative organisations of the Dutch security sector (The NVb and Bpob). This code of conduct is not merely binding to members of these representative organisations, since the Rpbr makes it mandatory for all private investigation firms. This code of conduct has been approved by the Data Protection Authority and is added to the Rpbr as attachment.12 All private investigation firms are obliged to have a code of conduct in place that is in accordance with the privacy code of conduct as approved by the AP .
The Wpbr places the control over the permit system in the hands of the police (article 11). Private investigation firms that do not adhere to the law may be fined or their permit may be revoked. Even though the control function consists of both preventative control (in the shape of the issuance of permits) and repressive actions (reacting to rule violation by private investigation firms), the control system for private investigation firms largely revolves around the control upfront (Inspectie Veiligheid en Justitie, 2015) (see for more on this below).
The number of licensed investigation firms has been growing steadily over the years. On the first of April 2018 were some 456 licensed investigation firms in the Netherlands (Minister of Justice and Security, 2018). The corporate investigations market is, however, much bigger than merely those who are licensed under the Wpbr. Below, we will first focus on in-house security departments, after which our attention will turn to forensic accountants and investigators with a legal background.
4 In-House Security Departments
I take it you know the Wpbr, that law puts certain demands on investigation firms. Well, we are an investigation firm, it’s just that we investigate internally and not for externals, for others. It has pros and cons. The biggest pro is that we are not required to have a permit. (Respondent 39—corporate investigator)
As mentioned above, Dutch law does not regard in-house security departments as private investigation firms, and as such, they are excluded from the Wpbr and Rpbr. The question of whether or not in-house departments should fall within the reach of the law has been discussed in Parliament. The idea behind the exclusion is that because a security department is part of a larger organisation, there will be internal checks and balances in place that should suffice. Making the Wpbr and other legal frameworks applicable to in-house departments would ‘lead to a substantial administrative burden for these organisations. This, when compared to the way the public (privacy) interest is protected, leads to the conclusion that extension of the reach of the law is not within reason’ (State Secretary of Justice & Minister of the Interior, 2009). However, there are still many voices that suggest that the law should apply to in-house departments as well, by making the nature of the activities the criterion for applicability of the law (see, e.g., Klerks & Eysink Smeets, 2005). Although many respondents from in-house departments appreciate that they do not have to comply with (the mostly) administrative demands of the Wpbr, at the same time, they feel it is based on an arbitrary distinction.13 As the above quote shows, many in-house investigators see themselves as being an investigator in the sense of the Wpbr because their work is largely similar to that of private investigation firms. In practice, many in-house departments follow the Wpbr regardless of their exclusion from it.
What we did is, we made a privacy code of conduct for our investigations, which is more or less the same as the one that investigation firms use. Because we don’t want to act differently from them. So we work within the same limitations. We have published these documents on the intranet, so everybody in the company knows what the rules are we play by. Also to make sure that no deviations occur and you don’t get in trouble in court. We can show that we work the way the market works, just like the others. So the official one may not apply to us but we made our own anyway and we agreed that this is the way we do our job. (Respondent 19—corporate investigator)
Of course you also receive some education internally for specifics related to the job. But the basic skills, knowledge of criminal law, that’s important. If they want to report in the end you need to know what kind of information the police need to prove theft etc. What I see in our line of business is that most investigators working for organisations, security managers, they have followed some course on this. And there are registers for security experts, with the right credentials. (Respondent 15—corporate investigator)
In addition to internal regulations and more generally applicable legislation such as privacy legislation and the Criminal Code, the laws regulating specific branches of industry mentioned above are especially relevant for in-house investigators. Banks, for example, have to adhere to the Law on Financial Institutions (Wft), telecommunications companies to the Telecommunications Law and so on. It goes too far to discuss all these specific regulations here but it should be noted that this does affect the day-to-day business of the company and as such, of the in-house security department to a greater extent than it does for other investigators. In-house investigators work for one client—the organisation they are a part of. The legal context of this organisation thus constitutes the background for all their investigations.
5 Forensic Accountants
We have always advocated the opinion that the rules for accountants are more strict than those for private investigators. Some of our colleagues have filed for a permit just in case, but we think: look, the rules we use are more stringent than the Wpbr so it is nonsense to get a permit. So we won’t. And the minister has agreed with that standpoint. (Respondent 27—corporate investigator)
Many accountancy firms now have their own specialised forensic departments, those of the ‘Big Four’ (Deloitte, Ernst & Young, KPMG, PwC) being the most well known. According to recent research by Taminiau, Heusinkveld, and Cramer (2019), there are approximately three hundred forensic accounting specialists in the Dutch market. The authors state that most of these forensic accounting specialists work for the Big Four companies (about two-thirds). The first to establish a forensic department in the Netherlands was KPMG in 1993 (van Almelo & Schimmel, 2014). Although the ‘forensic accountant ’ has positioned himself as a leading actor in the field of private (financial) investigations, the Dutch legislator does not differentiate between forensic accountants and normal accountants (de Graaff, 2007). There is no legal definition of forensic accountancy and there are no specific laws regulating the forensic branch.14 There are, however, more general laws that also apply to the forensic accountant (as he still is an accountant), most notably the law regulating the profession of accountant (Wet op het accountantsberoep; hereafter Wab) and the law regulating the control over accountants (Wet toezicht accountantsorganisaties; hereafter Wta). In the Netherlands, there are two kinds of accountants: the chartered accountant (RA) and the accountant-administration consultant (AA). The RA and AA are different only with regard to their types of clients and their educational background, with the RA being educated on university level and the AA on college level. While the RA caters mostly to large and multinational companies and ‘organisations with a public interest element’, the AA finds his clientele in small to medium businesses. They have the same tasks and responsibilities and both are mandatory members of the association of accountants (NBA).15 The different laws regarding the RA and AA have been combined in 2012 in one law (the Wab).16
To be allowed to use an accountancy title, it is obligatory to be listed in the register (article 41 Wab). Those who are legally allowed to call themselves accountant are subject to disciplinary proceedings (article 42 Wab). Since 2012, when the Wab came into force, the disciplinary proceedings are dealt with by the accountancy chamber of the court in Zwolle, which consists of a mixture of judges and accountants. The appeals are dealt with by the court for trade and industry. The five disciplinary measures which may be administered are a warning, a reprimand, a fine, a temporary removal from the register and a permanent removal from the register (article 2 Wet tuchtrechtspraak accountants; hereafter Wtra).
Some respondents indicate they have been removed from the register at their own request. One reason mentioned for this is that the mandatory ‘permanent education’ hours (NBA, 2016) are superfluous and expensive for accountants who are not active as a traditional accountant. For accountants working as corporate investigators, being registered doesn’t have much added value. Without registration, they are not allowed to use the title RA or AA; however, they do not need this title when working for a private investigation firm (or in-house security department ). ‘I have requested to be removed from the register but I am still perfectly able to look at the books and when they want me to report what’s in the administration and how much money went to account A, B or C, I can do that’ (Respondent 13—corporate investigator). No longer an accountant in the official sense, these investigators are no longer subject to the rule of the disciplinary court. This is mentioned as another reason for removing oneself from the register (van Almelo & Schimmel, 2014). That would, of course, be a perverse effect of the regulations; however, it does not necessarily mean that the investigator in question is now ‘unregulated’. Depending on the position of this investigator, he or she then falls within the regime of the Wpbr (when working for an investigation firm) or the internal regulations of the company (when part of an in-house security department).
Because of the lack of a specific legal framework, respondents feel that the rules regulating accountancy do not align well with the activities of the forensic accountant. There are some guidelines designed by the NBA; however, they should not be regarded as having a binding nature (NIVRA/NOvAA, 2010). The accountancy chamber does take these guidelines as a point of reference in disciplinary proceedings though, and deviation from the guidelines requires explanation (see, e.g., ECLI:NL:TACAKN:2016:49; ECLI:NL:TACAKN:2018:84; ECLI:NL:TACAKN:2019:4; ECLI:NL:TACAKN:2019:15). Within the profession, there have been voices claiming that the forensic activities of a forensic accountant do not align with his legally determined duties and the investigations should be left to private investigators (van Almelo, 2007).17
It is odd though – some minister has said that [the Wpbr is not binding to accountants] as a reaction to questions from Parliament, based on the lobby of the big accountancy firms. But it’s strange if you think about it – those accountancy firms who are doing person-oriented investigations should fall under the Wpbr. (Respondent 40—corporate investigator)
It may be argued that the rules binding forensic accountants are more based on principles of law than on actual hard and fast laws (van Wijk, Huisman, Feuth, & van de Bunt, 2002). These principles of law have been codified in the rules regarding professional conduct for accountants, as issued by the NBA (2014). As ‘fundamental principles’ have been noted: competence and diligence, integrity, objectivity, professional conduct and discretion.18 Other important principles of law identified by the NBA are proportionality and subsidiarity , the adversarial principle , the principle of fair play, the principle that results need to be verified, the principle that the accountant should refrain from giving a judgement and that he should be independent and impartial.19 Although these general principles of law may be of guidance in many situations, they may not be of much help in some circumstances more specific to investigative activities (van Wijk et al., 2002). Van Wijk et al. conclude that forensic accountants do not always have enough rules to guide them and that they should be subject to the Wpbr (which was under construction at the time of their research). This suggestion was not implemented by legislators though, and as shown above, the recent change in accountancy legislation and regulations has not brought specific (written) rules for forensic accountants either. The fact that accountancy regulation does not include rules for forensic work results from the fact that ‘these situations [in which there are no adequate rules] are connected to the detective part of the job, not to the use of accounting methods’ (van Wijk et al., 2002: 229).
It’s rather odd that for example the forensic departments of the Big Four don’t have to have a permit, while we do. I think that’s quite extraordinary. Because, just because they are part of an accountancy firm, they don’t have to meet that requirement. We, as private investigators, have to pass an exam, not that that’s very difficult but at least it is some kind of check. And they don’t have to do that. It’s as if when you’re part of an accountancy firm they think that you know everything. (Respondent 5—corporate investigator [forensic accountant working for an investigation firm])
We are contracted-in to do fact finding, assigning value or giving meaning is not an accountant’s job. At the most you may describe the rules and describe the act. These are then laid side by side but a report should not state that the act has therefore been improper. (Respondent 36—corporate investigator)
It seems though that it is not the mere fact that a conclusion is drawn from the findings but rather the way in which this is done that is problematic. Accountants should refrain from giving a legal interpretation and from using normative language (such as ‘right’ or ‘wrong’) but it seems nearly impossible to avoid drawing any type of conclusion whatsoever (van Almelo & Schimmel, 2014: 50). A recent decision by the court for trade and industry seems to suggest that the crucial point here is not the interpretation of facts as such, but rather the way these conclusions are supported by the report (ECLI:NL:CBB:2016:118). This resonates well with the requirement from the accountancy code of conduct that all conclusions made by an accountant should have a sound basis. ‘According to accountancy rules we should have a reasonable foundation for our findings. Which means that if you say, ‘this is red’, you should have the facts to substantiate that conclusion’ (Respondent 41—corporate investigator).
The accountancy profession has suffered considerable reputational damage since the start of the economic crisis of 2008. The role of the accountant in the years leading up to the crisis and the (often sideways) share accountants have had in scandals have led to substantial criticism. These criticisms focus primarily on the control task of accountants. In 2014 (and the years before that), the Authority for the Financial Markets (AFM) published a report in which it concluded that there were structural deficiencies in the major audit firms (the Big Four) and that fundamental reforms of the sector were necessary (AFM, 2014). Since then, the NBA has made several attempts to reform the sector and improve its reputation (Werkgroep toekomst accountantsberoep, 2014).20 One of the ways this is to be done is the oath accountants are required to take as of June 2016 (from May 2017 onwards, every accountant should have taken the oath) (Verordening op de beroepseed voor accountants).
6 Investigators with a Legal Background—Forensic Legal Investigators
In those cases in which we are hired as an independent advisor there are no fast and hard rules, you have to formulate that together with the client. But I don’t think that this is causing many issues. I believe that you need to make rules when they’re needed, not before. And I’m not using any investigative powers, I ask people would you come over to answer some questions, you may bring a lawyer, you don’t have to, that’s it. It’s a developing profession, seven years ago it didn’t even exist and now there are many large firms who are getting into the market. So there is probably going to be some kind of regulation in future, to set standards for our investigations. (Respondent 30—forensic legal investigator/client)
The most recent player added to the field of corporate investigations is the lawyer (Jennen & Biemond, 2009). Recent research suggests that about twenty-five Dutch law firms now offer specialised investigative services (Taminiau et al., 2019). Lawyers have long been involved in corporate investigations, however, before they were mostly clients. As clients, lawyers are often also partly involved in the investigations, for example, because there are some (simple) actions they may do themselves, or they may be involved in the role of expert on the legal aspects of the investigations (e.g. whether or not the behaviour might [or should] be framed as criminal or as a private law matter) (van Almelo & Schimmel, 2014). At the conclusion of the investigations, when decisions are to be made about the steps that are to be taken, (labour) lawyers are often involved in the processes of advising and decision-making. More and more (large) legal practices have now developed their own investigative branch and smaller legal firms that specialise in private investigations have also emerged.
Much like the legal framework in place for accountants, there are no rules for lawyers that specifically focus on investigations. Some firms have put their own guidelines in place for investigations; however, over-arching regulation specific to investigative activities is lacking (Knoop & Piersma, 2017). There are, however, more general laws regulating ‘traditional’ activities of lawyers, the Advocatenwet [the law on the legal profession] being the most important. Lawyers need to be registered to be able to act as a lawyer (article 1 Advocatenwet) and only those who are registered may call themselves lawyer (article 9a Advocatenwet). Like accountants, lawyers have a system of permanent education, with which they must comply (article 4.4 Verordening op de advocatuur).21 The basic education is university (or college) level. An oath is required for lawyers (article 3 Advocatenwet). All lawyers are required to be a member of the Dutch order of lawyers (Nederlandse orde van advocaten; NOvA). This is a public body and its ordinances are legally binding (article 29 Advocatenwet). Disciplinary proceedings are held by councils of discipline (presided over by a judge with two (or four) lawyer members and assisted by a clerk) in the district in which the lawyer operates and appeals may be made to the court of discipline (presided over by a judge with one (or two) (judge) members and one (or two) lawyer members and assisted by a clerk). Disciplinary measures that may be taken are a warning, a reprimand, a fine, a one-year suspension and a removal from the Bar register (article 48 Advocatenwet). It is also possible to take no disciplinary action.
The law dictates that a lawyer is responsible for the protection of his client. He does this in a way that is independent (from government), yet partial to his client and he should be competent, act with integrity and be a confidant to his client (article 10a Advocatenwet). In this sense, there is a difference with the other types of investigators, as this partiality is only for lawyers explicitly regulated by law. As the law is designed to regulate more traditional types of legal assistance and not investigations, this is not surprising. In the moderately inquisitorial judicial system of the Netherlands, lawyers have an important obligation to protect the interests of the suspect, who is more the object of investigations than an equal party to the proceedings (Cleiren, 2001).
The code of conduct, issued by the Dutch society for lawyers (NOvA), is an elaboration of the general principles as laid down in the Advocatenwet but remains focused on the lawyer’s ‘core business’ (NOvA, 2018). The code of conduct is not legally binding; rather, it is meant as a guideline for practitioners and disciplinary proceedings. Some specific parts of the guidelines can be used by lawyers when doing investigative work as well. Rule 9 of the code of conduct, for example, states that the role of the lawyer should be clear in all communications with (clients and) third parties. In disciplinary proceedings, this rule has been used to claim that the roles of the (fundamentally partisan) lawyer and the (independent and objective) fact finder should not be blurred (ECLI:NL:TADRSHE:2012:YA2502).22 In the ruling referred to here, the court decided that the complaint that was launched had no merit, arguing that a lawyer always is a partial service provider because of his profession, even in the capacity of investigator (which ruling has been confirmed by the court of appeal) (ECLI:NL:TAHVD:2013:33). In the same way, rule 8 of the code of conduct may also apply to corporate investigations. This rule states that a lawyer should refrain from providing false information. This could apply to, for example, an interview situation, in which it would be considered wrong to provide the person who is interviewed with false information. Similarly, rule 4 may apply as it states that a lawyer has to obtain prior consent in relation to the recording of a conversation without the prior consent of the person. Still, there is no specific legal framework available for investigative activities by lawyers, either by law or in the form of self-regulation.
In case study 1, Observation Company 1 was hired by a legal firm to do the investigations. This course of action was chosen over a direct relationship with the organisation in which the norm violation had taken place for several reasons, but the most important one was the derived legal privilege that may protect the outcomes of the investigations. All reports and communications with the law firm are protected by a derived legal privilege. This means that the reports do not need to become public. Since a public organisation was involved in this case, and legislation provides any citizen with the right to ask for inspection of documents of public authorities (Wet Openbaarheid Bestuur), without the protection of legal privilege, privacy sensitive information might have become public before the investigations were concluded. (Case study 1)
We as forensic accountants have no legal privilege but lawyers do. If we’re involved by a lawyer we get derived legal privilege. But the thing is, if you do your internal investigations under the protection of legal privilege, a prosecutor or a supervisory authority will not accept the outcomes of the investigations. Because lawyers are really careful about what is written down in the end and everything that may harm a client will be left out. But if you don’t use legal privilege they might use your report and might not investigate fully themselves as well. You can use legal privilege, that’s the choice an organisation will have to make. But just know that your report will be judged differently if you choose to report to the authorities in the end. (Respondent 27—corporate investigator)
It is not inconceivable that we act as legal representative to defend the position of our client in a legal procedure – well in such a case it is perfectly legitimate to do this in your capacity as legal privilege holder. And all the auxiliaries you use – whether that is your secretary or a translator, another expert or accountant – all act under the banner of your privilege. (Respondent 28—forensic legal investigator/client)
What you should not allow to happen is misuse of your privilege. Say, for example, that a forensic accountant is investigating and that he finds something which he thinks is disagreeably sensitive. Without legal privilege, such a report is very convenient for the prosecution office, prosecutors could say ‘great we don’t have to investigate it further, thank you very much’. That’s the danger. Doing internal investigations without someone who has legal privilege to protect it, well, all the prosecution office has to do is ask for the report. But as a lawyer you shouldn’t allow your privilege to get abused. A lawyer shouldn’t just do some trivial things for show so that legal privilege will be applicable. No, that can’t be. (Respondent 28—forensic legal investigator/client)
In a ruling in a civil court case between the housing association Vestia and its managers, the court of The Hague has decided that the report following internal investigations by a law firm is not protected by legal privilege if the investigations are purely intended as fact finding (no juridical findings, qualifications or conclusion being presented). The court sentence states that ‘according to its assignment the investigation’s purpose was to acquire an independent and objective image of the facts. (…) This makes the claim that the report falls within the (functional) legal privilege of the (lawyers of) De Brauw void’ (ECLI:NL:RBDHA:2015:248). For legal privilege to be applicable, it should be relevant for the (traditional) position of the lawyer as partisan representation of the client in legal proceedings.
Many voices have suggested that the lack of regulation applicable to lawyers who operate as corporate investigators is problematic. Especially, the use of legal privilege for investigations is subject of debate (see, e.g., Knoop & Piersma, 2017). It has been suggested that the new version of the code of conduct for lawyers should include specific rules on investigative activities and the use of legal privilege (see, e.g., Mr. Online, 2016). However, the 2018 update of the code of conduct does not contain such rules (NOvA, 2018). Others feel that the corrective effects of ‘the market’ and the judicial system ensure the quality of investigations (see, e.g., van Almelo, 2013). This argument, however, could also be applied to the other investigators (with the possible exception of in-house investigators) who are regulated. In addition, as we will see in Chapter 4, many corporate investigations never end up in court. It would therefore be very difficult for the judicial system to correct misbehaviour by investigators in these cases.
Now that the legal frameworks regulating the activities of the different investigators have been discussed, the next section focuses on the way the differences between investigators are used by the different groups—and valued by their clients.
7 The Selling Propositions of the Different Types of Investigators
Although the backgrounds of and rules for investigators differ, their actions (discussed in the following chapters) are for a large part similar (see also Kopp, 2014). The question then remains, what are the selling points of the different investigators—in other words why do clients choose them over others? This section discusses the different strengths and weaknesses of the four groups discussed above, based on the research data.
7.1 Background and Specialist Knowledge
7.1.1 In-House Investigators
One of the reasons why we are so good at this, is that we understand the company better than an investigation firm would. Look, if you want to find deviations, you’re going to have to know normalcy first. And once you understand the normal process, then you may start to see deviations. We know this company, we know our way around and we understand its culture. (Respondent 39—corporate investigator)
Observation Company 2 is the security department of a large Dutch company. The security department doing the investigations consists of eleven people who have some role in the investigations, with three full-time investigators and three desk researchers. Throughout the larger organisation there are also security officers located, one for every specific field in which the company is active. These security officers may assist in investigations when their segment is involved. In addition, specific IT questions (for example, when electronic data is needed) are posed to the IT department, which will then provide support. Compliance matters are left to the compliance department and Legal and HR may assist as well. In this way, the security department is the specialist on the investigations and has easy access to additional expertise from inside the company. As the manager said: ‘You see what kind of specialist knowledge is necessary, my guys have this knowledge about the specific electronics we as a company use and all of that. It’s useless to get someone from the outside to look into it, it’s impossible for him to understand all our systems and have the specialist knowledge necessary to investigate these matters. [If you don’t understand the way this company operates and the systems and tools needed for that, you will draw the wrong conclusion]’. (Excerpt from observation 2)
If I report to the authorities and I have made my own case [the private investigative report], my chances of the report being taken up are much larger because it saves them some trouble but also because they know that it’s something serious. My advantage is that I know what they need. It’s just faster that way. A normal citizen who doesn’t have much experience with reporting to the police will find it difficult to find his way into the [police] organisation. (Respondent 15—corporate investigator)
7.1.2 Private Investigation Firms
The camera aimed at the cashier, doing a little stake-out and taking some pictures… They [private investigation firms] are not equipped to do quality work when it comes to fraud of course. Fraud, that’s being done by people at the top of the tree, it’s about a lot of money and they are being advised by expensive lawyers and tax experts from fancy firms. There is a lot of intellect hidden in a fraud. You’re not going to solve that with a camera and someone with a police background. (Respondent 32—forensic legal investigator/client)
What we often hear is ‘oh so you are private detectives’. I wouldn’t say is a derogatory term but… it’s a different category of work. They are often very perpetrator-oriented. That’s not really our focus, who is ‘guilty’. It is the conclusion to our investigations but not our main focus. We focus on analysing facts. And usually these facts are complex and require intelligent background research, complex accounting, to get the full picture. (Respondent 40—corporate investigator)
This perception that corporate investigators working for private investigation firms are incapable of complex investigations into fraud comes in part from the general opinion in the sector that police officers are not skilled enough for this type of work. Former police officers in this line of reasoning would then also lack the skills and knowledge. Furthermore, the (many) courses given about private investigations (some of which are accredited) are below academic level (Klerks, van Meurs, & Scholtes, 2001). Many respondents feel the educational standards for private investigators are too low. ‘I would suggest that the educational standards and the representative organisation should focus more on the specialised work. Now my investigators have had to follow a course which is practically useless to them’ (Respondent 13—corporate investigator).
You know, an investigation has different dimensions, you have a financial part, a technical part, an operational part. And sometimes you need one investigator because he is better at that particular part than others because of his background and experience. (Respondent 13—corporate investigator)
Observation Company 1 is a small investigation company, known for specialised knowledge on different subjects. As one of the owners stated: ‘We’re trying to deliver a high quality product’. Because of the law enforcement background of one of the owners and another investigator, the company has a large network in both law enforcement and the commercial sector. Many assignments originate from this network or are based on positive word of mouth among organisations. The private investigation firm prides itself on its reputation of being a high-end and independent investigation firm. (Excerpt from observation 1)
When our assignment comes directly from the organisation, with no lawyers involved, we will also take on an advisory role for the client and we may then also report to the authorities for the client. The question is then, how will you go about this. You could go to the local police station but our experience is that that’s a dead end. It might help to go directly to the chief public prosecutor, send him a letter with appendices – meaning our investigative report. (Respondent 2—corporate investigator)
7.1.3 Forensic Accountants
When it comes to interviewing people, you might not want to leave that up the financial investigator who has looked into the administration. It might be best to let someone with a police background do the interview, because he might not have the know-how with regard to the content but he knows how to interview. He can assess how someone behaves, he understands that kind of stuff much better than the competent accountant who knows very well what the administration says but is much less equipped to respond to the involved person and read his body language. (Respondent 13—corporate investigator)
I can give you examples of investigations which have cost a small fortune but looking at it, you think ‘What on earth did these guys do?’ So you have high rates but also – if you would get a second opinion on what they actually did, it makes no sense from an investigations-perspective. For example the Big Four [accountants], they are reproached now and then for their investigations, that they don’t yield much results and basically just map what the client already knows. That it costs a lot of money but actually yields no results. That they for example won’t find the money that has been defrauded or get it back. (Respondent 13—corporate investigator)
7.1.4 Forensic Legal Investigators
When it comes to an investigation in need of a decent analysis with regard to the facts and the law, and when there is need for an advice regarding corporate governance – I would use a law firm for that. Other investigators say they can do it but in reality they deliver a poor result. (Respondent 28—forensic legal investigator/client)
We assist our clients when incidents occur within their organisation, we will investigate for them, we advise them on what kinds of measures are to be taken and in the event that a regulator or the justice department is to be involved, we will advise them about how to deal with these agencies. (Respondent 30—forensic legal investigator/client)
7.2 Rules and Ethics and Position Regarding the Client
7.2.1 In-House Investigators
As we have seen in this chapter , different investigators have different rules to follow. This has some implications for the choices made by clients. In-house departments, which, it goes without saying, can only be used when an organisation has such a department, are subject to internal regulations . The fact that the regulation is mainly internal to the organisation (apart from more generally applicable legislation such as privacy legislation) is not necessarily problematic; however, it does put much responsibility on the organisation itself. The rules are constructed inside the organisation and the control over the application of these rules is also largely organised within the organisation (although a civil claim against the organisation remains a possibility). The general control by the works council of the organisation (approving the rules) and the specific control of higher management on the actual investigations in case of a complaint both keep things close to the organisation. This has value for the organisation, as there is less danger of matters becoming public knowledge. However, sometimes an organisation needs an independent outsider to investigate because of the issues at stake. In those cases, internal investigations by the in-house department are not deemed sufficient and another corporate investigator is contracted to either execute or validate the investigations. ‘Sometimes they have done their own investigations and fraud has been found but they feel they need an independent third party to validate the investigations as it were, or draw an independent conclusion’ (Respondent 27—corporate investigator).
We are independent from others in our investigations. When we have by-catch we will investigate that in principle as well. The by-catch can be pretty big, for example a case that we’re still working on now was initially by-catch. The organisation was also investigated, apparently it was possible for these things to happen without the processes noticing it. In these cases, we need some extra pairs of hands so we use some external investigators. But there can be tension between us and HR. We have a separation of powers, we are in charge of the investigations, HR decides on the sanctions. When we hear that a sanction is much lower than we would have liked and than what we find reasonable based on previous cases, that can generate friction. Especially [investigator] can go to extremes to make his point, he can be very fierce. In principle, we decide on content and scope of the investigations, there’s no influence from others on that. But of course, when it comes to the higher echelons the top has its opinions on it. That’s the way it goes isn’t it. The higher up the tree, the more interests are involved. (Excerpt from observation 2—informal conversation)
I’m considered to be the paranoid one, who sees fraud everywhere. We have to convince them all, every time around. That’s how we all [the in-house investigators] feel. Because it clashes with the business of making money. When we investigate and one of our stores is affected or we lose a business partner, that looks like it costs a lot of money but in the end, you’re not making any money on the fraudulent behaviour you know. All of that is fictitious. You actually lose money over it as you are unjustly paying bonuses and commissions. (Respondent 48—corporate investigator)
You have to weigh everything during your investigations: am I going to continue, do I have all the information I need, is it useful to keep investigating? The question always is, what do you want to achieve and what do you need to achieve it? If you want to fire someone, you don’t need to prove he’s committed fraud a hundred times, a couple of times is enough. [But] it might be relevant with regard to retrieving the money. And for the processes inside the organisation. It is so hard to set limits, but it is important. You have to prioritise, the more time I spend on case X, the longer cases Y, Z and others have to wait. We’re only a small department for a lot of cases after all. (Respondent 43—corporate investigator)
I am going to get more staff next year, we have shown that doing something about fraud can generate money by multiple business cases. If you lose one credit of 500.000 euro, that means you will have to get, say, 400 new ones to compensate for it. That is a lot of new business you will need if you have 10 of these cases. And the same goes for internal fraud. (Respondent 31—corporate investigator)
In principle we make a report for every investigation. I say in principle, because in fact this is not necessarily the case. Some cases are slam-dunks, we’re not writing an entire report for that. Often things are handled by HR or the manager and that’s it then, some milder, internal sanction. Look, when it’s clear what the facts are, when he has stated yes I did that, stupid, it won’t happen again – we don’t really need to make a report. We have his statement, we store that and record the sanction in our systems and that’s it. (Respondent 19—corporate investigator)
7.2.2 Private Investigation Firms
Private investigation firms are commercial entities in their own right, external to the clients who hire them. The relationship to clients is therefore somewhat different from that of in-house departments. The fact that they are external to the organisation gives an investigation done by a private investigation firm an air of objectivity, although the commercial relationship between client and investigator somewhat dilutes the independence of investigators. While they are more expensive than in-house investigators, many (especially smaller sized) organisations do not have their own in-house security department and are as such reliant on external investigators. The hourly rates of private investigation firms are often lower than those of forensic accountants and investigators with a legal background. Their clientele consists of an important part of small and medium-size companies and (semi) government organisations but larger companies may also call upon private investigation firms for investigative services.
If you try to gather information on how many private investigation firms have a permit you will find that the numbers known to the justice department and those known to the police do not match. And some have no identification card, which means that they have a permit but are not eligible for an identification card… And also that they might not be known to the police. So the supervision, that’s just really bad. And the police do not give it any priority either, it’s a purely administrative process for them. (Respondent 41—corporate investigator)
Before the revision of the Wpbr in 2006, private investigation firms had to report on a yearly basis to the police about their activities, a requirement that has since been lifted (Klerks, 2008: 16). This mandatory report was not very informative and many private investigation firms did not see its point. ‘We had to report every year about the number of cases we did, but that’s just a checklist. It does not contain any information whatsoever on nature, size etc. Nothing about the type of client, it’s useless. But we report because that’s the law’ (Respondent 1—corporate investigator). According to the official announcement in which the change in legislation has been made, the government felt that the costs connected to this obligation for the private sector outweighed the benefits for the state in receiving them.27 Hence, the requirement to file a yearly report was removed from the Wpbr.
In addition to the permit, some private investigation firms have a quality certification issued by one of the representative organisations NVb or Bpob. However, not every private investigation firm is a member of these organisations and some respondents even indicate they have discontinued their membership as they did not feel represented. ‘We have debated whether or not to be a member but we decided not to. Their focus is on the lower tier of the market, those whose clientele consists of private persons and smaller companies, the simple cases’ (Respondent 13—corporate investigator). To complicate matters further, there are also other representative organisations available, such as (the Dutch chapter of) the American Society for Industrial Security (ASIS) or the European Corporate Security Association (ECSA). As such, there is not one representative organisation exercising control over all private investigation firms.
During the inventory of cases for the case studies I came across some records of cases which were turned down or handed back to the client. When asked about this [investigator] explained that, in principle, all cases within the field of expertise are accepted. Observation Company 1 is a commercial entity and needs clients. However, there are cases in which there are conflicts of interests or in which there does not seem to be a just cause for investigating, or the assignment the client wants performed is not just. ‘I have had a situation in which the chair of the board of directors wanted us to look into the expenses of one of the other board members. But then you continue your conversation and then it becomes clear that there is no cause for that. That it’s just a conflict within the board of directors and that this director thinks it is very convenient if that person could be removed. That’s no just cause for an investigation’. (Excerpt from observation 1)
Once you get started you should remain in contact with the client because when an organisation is confronted with fraud this will have a lot of impact on that organisation. Tensions will occur so you need to be aware of that. But it is also important to keep them informed about your actions of course, what are you doing, what do they think you are doing. You can and sometimes should consult with the client about the course of your investigations but in the end it is our decision. Because we are investigating independently. Our investigations are concluded by a report and that report may be used as the basis for criminal procedures or a civil suit so you need to make sure it is done properly and will hold up in court. (Respondent 5—corporate investigator)
Private investigation firms need to balance their independence and objectivity with the commercial relationship they have with clients. This is of course easier to do in a time where there are many assignments available than in a time of economic austerity. While it was impossible to make such a comparison in the context of this research, it would be interesting to focus on this subject in further research.
7.2.3 Forensic Accountants
I wouldn’t hire a forensic accountant. For the simple reason that you don’t really get value for money. They do the same as investigation firms but their prices are sky high. I wonder why a company would hire them; I guess because of the Big Four logo. ‘Look, we have hired a big company and spend a lot of money so it should be ok’. But in my opinion there’s not much to separate them from a private investigations bureau. (Respondent 31—corporate investigator)
In spite of the scepticism of this (in-house security) respondent, many large clients feel that it is safer to go for the big name than to hire a smaller investigation firm. Big Four (and other large) accountancy firms are well known and are largely considered to be experts on corporate investigations. In addition, forensic accountants have an image to be more strictly regulated than other investigators. This would provide them with more legitimacy than the other investigators, who are sometimes referred to as ‘cowboys’. As we have seen in this chapter, this is not the case in the strictly legal sense. The legal framework applicable to accountants is put in place for their more traditional core tasks and they are not specifically adapted to (or very helpful in) the context of investigative activities. The (not legally binding) guidelines for person-oriented investigations and the more general rules of professional conduct for accountants, issued by the Dutch association of accountants, are not very specific either. They are focused on general normative considerations and principles of law, and as such, respondents seem to regard these guidelines and rules as normatively restrictive and stringent. As related above, these guidelines and rules are used in disciplinary proceedings, and as such, there is a reasonable measure of control.31 The case law provided by the accountancy chamber is effectively used as regulation by forensic accountants. Still, the fact that disciplinary proceedings are quite regularly launched against forensic accountants may be an indication that the rules to follow are not quite clear as of yet.
Our disadvantage compared to large accountancy firms is that our services are limited to forensics. [But that is also] an advantage because we will not get in the conflict of interest situation, we can take any job and we can be firm in our report, we never have to be afraid that what we report has negative effects for colleagues who are doing the auditing services because we don’t have those. But on the other hand, it also means we don’t have our own steady customer base. (Respondent 2—corporate investigator)
7.2.4 Forensic Legal Investigators
There are now more and more lawyers who focus on [investigations]. They pretend to do independent investigations, which is obviously not true. Because they are lawyers, and they do not confirm by contract that their investigations are independent. If I was an accountant, I would be very critical about that. Ok so you have a report and it states many findings but whether it represents that which should have been investigated, you can’t tell. Nor whether they have written down everything that should have been written down. (Respondent 32—forensic legal investigator/client)
This respondent, a lawyer himself, is quite sceptical about a lawyer’s ability to act as an independent and objective investigator. This situation is not improved by the possibility of the use of legal privilege by lawyers. The legal privilege may be problematic from the point of view of control and independence , and it is at the same time a major benefit for clients (Knoop & Piersma, 2017). As mentioned above, corporate investigations carry the risk of their findings being used in a criminal proceeding against the client. (Derived) legal privilege may protect against this risk, and for this reason, lawyers are often involved in one way or another in investigations. However, as mentioned above, when an investigations report does not contain legal qualifications and is purely about fact finding, the court has ruled that this is not protected by the legal privilege.
For me, as a lawyer, I don’t have to do anything. I’m not bound to rules. So I can do it [investigate] any way I see fit. On the other hand, accountants are regulated. They have a stamp of approval – I’m not sure anyone would believe in accountants anymore but if they do, the rules surrounding accountancy make for a sort of quality hallmark. A lawyer doesn’t have that, he only has his own name and reputation. (Respondent 32—forensic legal investigator/client)
Accountants have a set of guidelines for [investigations] which are actually quite inconvenient. When they interview people, their rules for person-oriented investigations may work against them. They are not completely illogical safe-guards but they can be very annoying because you have to for example give information to some person who might be a suspect, while you have to keep your client in the dark. So sometimes we work without the accountants. They are only detrimental to your investigations then. (Respondent 28—forensic legal investigator/client)
7.3 The Matter of Forum Shopping
The overview provided in this chapter, and summarised in Table B.1 (see Appendix B), allows us to draw out an interesting concept, already introduced in the preceding chapter. Forum shopping happens in multiple ways within the market for corporate investigations, two of which become apparent when we focus upon legal frameworks and unique selling points of different investigators. The first is part of the commercial reality of the market: by stressing their own qualities, corporate investigators may attract clients, who look for the professional who is best suited to investigate the norm violation with which the organisation is faced. The other, forum shopping based on applicable legal frameworks, may be considered somewhat more problematic.
So if there’s only limited control and the control that is executed is only done afterwards – you would have to admit that the control exercised by a judge over the use of the material that has been collected is very limited as well. That is, if it happens at all. There is a great ruling about a case in which the adversarial principle has been broken. And the judge just doesn’t care. He just accepted the report. If this is the way we treat this issue, you can make all the rules you want but if there’s no-one connecting consequences to the infringement of the rules… And the same goes internationally, most of the cases never reach a court in which control could be exerted over the ways in which information is collected. And if it does happen, there’s no hard and fast legal framework to compare the behaviour to. (Respondent 41—corporate investigator)
Forum shopping on the basis of regulation creates room for abuse. Clients who have ‘bad intentions’ (e.g. to get rid of a troublesome whistle-blower) are provided with the opportunity to do so, even without corporate investigators breaking any regulation. It is unclear to what extent this happens in practice; however, the mere theoretical possibility can be considered problematic.
8 Discussion
This chapter has delineated the different legal frameworks surrounding corporate investigations in the Netherlands. Although one conclusion may be that there are many differences between the various investigators, it is important to note that while this may be the case, there are more similarities still. In their ‘pure form’, there are substantial differences between in-house departments, private investigation firms , forensic accountants and investigators with a legal background. However, there are very little corporate investigation units in this pure form. In-house departments and investigation firms predominantly staffed with former police officers recruit accountants, lawyers and IT specialists, forensic (departments of) accountancy firms employ former police officers, lawyers and IT specialists and investigative (departments of) law firms also hire people with an IT or public sector background (in their case, mostly former prosecutors). Should some expertise be required that is not available to the corporate investigators, specialists are contracted-in for that part of the investigations. While the field is thus simultaneously specialising and generalising, the legal frameworks in which corporate investigators operate remain dispersed and unclear to most of the people involved.
The overview presented in this chapter is not exhaustive. Specific laws are applicable to specific fields of industry, which, for example, may render disclosure to a supervisory agency necessary. It would be overly complicated and confusing to the reader to go into detail regarding all these regulations. However, this circumstance makes the context of legal frameworks fragmented and complex and many respondents are not up to date on all the rules they need to comply with (even when they think they are). One case in point is the controversy over the (non-)necessity for forensic accountants to have a Wpbr-permit. As stated in this chapter, forensic accountants are explicitly exempt from the permit obligation. The fact that there remains confusion about this point is an indication that this is considered peculiar by many of the investigators involved. Even more peculiar may be the relative silence in this regard about whether or not corporate investigators with a legal background should have a Wpbr-permit. While there are voices calling for regulation for forensic legal investigators , there is silence on the subject of the applicability of the permit. In my opinion, it would be beneficial to the sector to have one set of rules, applicable to all involved. The fact that the different types of investigators try to incorporate each other’s strengths makes the fragmentation within the legal frameworks problematic, both from a level playing field point of view and from the perspective of rights of the people involved.
While it proves difficult for investigators to be sure of the legal frameworks that apply to them, it is even more difficult for clients and maybe more importantly, for involved persons. Not being a suspect in the sense of a criminal justice procedure places the subject of investigations in a precarious position. Cooperation with investigations by individuals might be voluntary, but this does not mean that the subject is safe from pressure to cooperate, exercised by the employer. The fact that rules differ between investigators makes it more difficult to ensure fair play. Many respondents feel this and commit themselves to the rules they deem most stringent, usually a mixture between the privacy code of conduct for private investigation firms and the more general principles of law guiding forensic accountants and lawyers (which are in part already incorporated in the privacy code of conduct). However, as a result of the voluntary nature of this, and the lack of control over their application, these rules and principles of law are vulnerable to deviation. Respondents stress their own reputation and their commitment to rules and principles of law, and my research does not give strong indications of widespread problems. However, as Chapter 3 illustrates, even when following the rules, investigators may, for example, place involved persons under duress. And, additionally, Chapter 4 shows the profound impact which corporate investigations may have on individuals.
The corporate investigations industry thrives on the basis of the marketing of discretion and trust. This means that the sector is not very visible, neither to the public eye, nor to the state. White (2014: 44) has argued that ‘because of the distinctly ‘un-police-like’ way they perform these functions’ and the fact that they ‘also undertake functions which are not usually performed by police officers’ (e.g. forensic accountancy), corporate investigators tend not to be associated with the police, which ‘equates to near zero visibility through the state-centric lens’.32 The lack of transparency has been problematised before; however, the (political) discussion remains largely focused on private security more generally (see, e.g., State Secretary of Justice & Minister of the Interior, 2009). Even when private investigations are mentioned, the discussion usually remains centred on private investigation firms instead of the entire corporate investigations industry (see, e.g., State Secretary of Security and Justice, 2016). As a consequence, all those investigators without a permit remain out of the (regulatory) gaze of the state (White, 2014). By abolishing the obligation to provide the chief of police with a yearly report on investigative activities (again, for those with a permit), the state could be said to actually further diminish its information position (even though the yearly report was not very informative). One suggestion to enhance the state’s information position on investigative activities, made by inter alia Fijnaut (2002), is to institute a duty to report every crime to the police. Even leaving aside for the moment other issues such as capacity and expertise problems within the police and prosecution, such an obligation would prove counterproductive in my view. The flexibility in the legal venues chosen for the settlements of internal norm violations, as well as the use of discretion in investigations and settlements and the trust clients place in investigators, is highly important to the success of the sector (Williams, 2005).
As van Wijk et al. (2002: 226) rightly state, such a duty would furthermore lead to a kind of ‘junior partnership’, with corporate investigators working as the junior in a field defined by the priorities of the senior (the state). As mentioned in the previous chapter, such a view of the corporate investigations industry does not align well with its practical reality. In addition, a duty to report would require a (legal) interpretation of the facts by the investigators, something which forensic accountants tend to stay clear of. Van Wijk et al. (2002) suggest that if such a duty would be considered desirable, it should be applied to the client, not to the investigator. Investigators are bound to discretion; this is one of the selling points of corporate investigation services. A duty to report would therefore put the investigator in a difficult position towards his client.33 Furthermore, corporate investigations are not restricted to the investigation of criminal behaviour, other unwanted behaviour being included as well—in these cases, there would remain a lacuna in control even when there would be a duty to report every crime to the police.
A less drastic measure, which is more in line with the abovementioned practice in the corporate investigations field as well, would be to include all those who investigate professionally in the permit system of the Wpbr. As related in this chapter, respondents do not think highly of this system—there is very little actual control and educational and other demands on permit holders are regarded to be quite low. It would therefore be constructive to upgrade these in the process. One benefit of having a comprehensive permit system is that it would render control possible (at least in theory—in practice this also depends on prioritising of the supervising authority). Another is that the privacy code of conduct, used already by most corporate investigators in practice, would be applicable to all corporate investigators. As suggested before by inter alia Klerks and Eysink Smeets (2005) and CBP (2007), the nature of the activities would then be the primary concern in the decision whether or not a permit is necessary, instead of the current situation in which the permit obligation is connected to an investigator’s professional background and relationship to the client. This would also make those who define themselves as, for example, ‘mediator’ or ‘information broker’ and occasionally provide clients with investigative services, liable to the law.
There have been voices advocating the formation of a representative organisation for (all) corporate investigators. At the moment of writing, there are multiple representative organisations available (both nationally and internationally), however none that brings together all four major groups of corporate investigators. In the same vein, the formation of a central register for (corporate) investigation experts in the Netherlands has been suggested. At the moment, there is a multitude of certification and educational institutes, resulting in a vast number of different professional titles and accompanying professional registers (Dubbeld, 2015). ‘I feel like our Dutch market is relatively juvenile. For example, we don’t really have a good institute to represent us. Look at the ACFE [Association of Certified Fraud Examiners], with all due respect, some of its members got their membership as a free gift or something’ (Respondent 13—corporate investigator). This quote from a manager of a private investigation firm expresses the feelings of many respondents: even though there is a multitude of representative and certification-type associations available, many corporate investigators do not feel represented by them because of a perceived focus on certain types of investigators within the association, or as a result of the perception that the quality standards of these associations are low. This research has not investigated the validity of these perceptions. However, the result is that many corporate investigators are not members of a representative association, and those that are are divided among many different associations. Recently, new initiatives have attempted to create the desired uniformity by the formation of a representative organisation for financial forensic experts, with an accompanying register—and title.34 In the field of education, new initiatives are also formed to create courses in fraud examination.35 The question remains whether these initiatives will be successful. At the moment of writing, it seems that rather than constituting a representative organisation which may represent all corporate investigators, the new initiatives add to the fragmented corporate investigations landscape. Because of the fragmented nature of the sector, combining all different actors into one representative organisation seems a considerable challenge. In the words of Thumala, Goold, and Loader: ‘if the industry is not a coherent whole, it cannot be represented as such’ (2011: 293).
Unifying the legal frameworks for corporate investigations into one would not mean that there is no room for additional (self-)regulation with regard to the specific elements in which certain investigators differ from others. The legal privilege, for example, should not be rendered completely obsolete in cases of corporate investigations. Legal privilege is an important principle of law, and when used correctly, it protects those involved in legal disputes. However, as the court ruling in the Vestia-case has indicated, the applicability of legal privilege to ‘fact finding’ investigations should not be taken at face value. Additional (self-)regulation is likely to occur as a way for the different types of investigators to market their perceived superiority. This is already done at the moment as this chapter has shown. One could envision a system in which more specific (self-regulatory) codes that are desired by different professional groups of investigators are incorporated in the existing privacy code of conduct. If all investigators fall under the Wpbr, it follows that the privacy code of conduct applies as well. This is essentially self-regulation which has been approved by the Data Protection Authority. Any addition to the privacy code of conduct by distinct professional groups may then also be handed over to the Data Protection Authority for approval. In practice, the different groups of investigators seem to be largely following the same rules already—but only one group does this based on an explicitly codified legal framework (private investigation firms).
This brings me back to the appetite to be licensed because if the police could see this is a licensed, regulated occupation then they would have to say well ok you’re recognised now, you’re a lawful entity. You’re not criminals, you’re a profession and you can be regulated, you can have your license revoked if you don’t comply with the rules. (UK Respondent 3)
This connects to the point of applicable legal frameworks, in relation to which a notable difference with the Netherlands may be discerned. As Button already remarked in 1998, ‘there are no special statutory requirements to become a private investigator in the U.K.’ (1998: 3). In spite of a 2013 announcement by the home secretary that the private investigations industry was to be regulated, a permit system and the accompanying legal framework have yet to be arranged (Home Office, 2013).37 As such, the situation is that ‘there aren’t any all-encompassing rules, no. As long as they stick by the law of the land then they virtually do whatever the company expects them to do to carry out the company procedures and enforce the company regulations’ (UK Respondent 1). In the meantime, representative organisations have introduced their own licensing-type arrangement; however, this is not obligatory. The very modest work done in the context of this research with regard to the UK points to a situation in which the corporate investigations market is (even) less regulated than in the Netherlands and the legal frameworks (even) more fragmented. It would be interesting to make a proper comparison between the Dutch situation (in which a licensing system and a formalised legal framework do exist—at least for private investigation firms ) and the UK situation (in which no such obligation rests upon corporate investigators). An important question in such a comparison would be whether the type of regulation and the absence of a licensing system (combined with an even greater lack of control over the sector than in the Netherlands) have bearing on the manner in which corporate investigators provide their services and whether this affects the perceived legitimacy of the sector.
As this chapter has shown, there are both similarities and differences between the four groups of corporate investigators. The differences are used as a marketing tool, setting each type of investigator apart from the others. The nature of these differences does not justify a separate account of each group of investigators in the remainder of this book though. When the differences are relevant, mention will be made. The above suggestion to unify legal frameworks for all corporate investigators should not be considered as the solution to the problem of control over the corporate investigations sector. As the following chapters show, the corporate investigations industry has, by its marketing and professionalisation of its unique characteristics, created a private legal sphere in which it operates. Corporate investigators largely remain out of sight of the state, making effective control very challenging (Williams, 2006). To fully understand the extent to which corporate investigators may stay within the private legal sphere, it is important to examine their day-to-day business. Thus, the investigative process is discussed in the next chapter, after which the ways in which the investigations are used by clients to deal with the matter at hand are examined in Chapter 4.