Victims of fraud
A suspicion of fraud in your company raises an immediate second question: what can you check yourself, and how? Before you take any step against staff fraud or breach of trust, you want to know the limits of an internal investigation. A Fraud Assessment maps those limits, before you look at camera footage, emails or a desk.
What a Fraud Assessment maps out
Large, medium sized and even small companies are all confronted with a suspicion of fraud at some point, such as staff fraud or breach of trust. A Fraud Assessment maps out which facts did or did not take place within the company, and which investigation options exist. Our specialists test every investigation method against the right to privacy, which also applies inside a company. You then know in advance whether camera footage, an employee’s emails or a colleague’s desk are within reach. A suspected misuse of company assets falls within that scope too.
On that basis, we advise on the investigation methods you can make legally possible within your company, as part of our wider support for victims of fraud. That advice usually results in a Fraud Policy, an internal framework that sets out who may investigate and under what conditions. If the assessment confirms a concrete suspicion, a fraud audit is the next step, from suspicion to a legally grounded report.
A Belgian financial institution had a legal review carried out of how it handled internal and external fraud cases. We advised it on the adjustments needed to stay in line with current legislation and case law. A firmer suspicion usually points more quickly towards a fraud investigation.
What limits an investigation in your company must respect
If you investigate in house, your personnel department sits under lighter rules than an external agency. The Act of 18 May 2024 regulating private investigation exempts your personnel department from an identification card. That applies when the department carries out incident enquiries against your own employees. The other rules of the Act still apply, including the duty to report to the public prosecutor. If you still engage an external agency, check its licence first: without a licence, the evidence is void. Our guidance on private investigations steers that choice and its follow up.
If you want to extend the enquiry to systematic monitoring at the workplace, you need internal rules first. Article 65 of the same Act only allows an enquiry against an employee where internal rules expressly set out the authorisation and the detail of that enquiry. The Act gave you two years from its entry into force on 16 December 2024 to put that in order. Without those rules, the evidence you gather is also void.
If you want to monitor email or internet use, that is allowed only within the four purposes of collective labour agreement no. 81, such as protecting your confidential business information. Linking the data to a named employee is allowed only after an information phase and a conversation, except for one of the first three purposes. For camera surveillance aimed at an employee’s work, collective labour agreement no. 68 allows monitoring on a temporary basis only. We wrote earlier about the conditions for a camera against theft.
Record the purpose of the investigation and the retention period for the results before you start. Article 30 of the GDPR requires a record of your processing activities. The exemption for companies with fewer than 250 people falls away as soon as the processing is not occasional. Article 10 of the Act of 30 July 2018 lets you process data on criminal offences for your own disputes, and requires a list of who has access to the file. The other audiences of the firm are set out on Who we act for.
Frequently asked questions
Can our personnel department investigate a colleague itself?
Yes, your personnel department may carry out incident enquiries against your own employees, without a licence and without an identification card. Article 43 of the Act of 18 May 2024 regulating private investigation makes that exception expressly. The other rules of the Act still apply, including the duty to report to the public prosecutor once the facts are clear. The Act draws no line between a personnel department and a structurally organised internal investigation unit. Have that line assessed before you start the enquiry.
May we read an employee’s emails?
That is allowed only within the four purposes of collective labour agreement no. 81, and in two steps. Collection of the data starts at aggregate level. For one of the first three purposes, you may link the data to a named employee immediately. For compliance with your own IT rules, an information phase comes first, followed by a conversation with the employee. The Belgian Data Protection Authority does not accept the employee’s consent as a legal basis, because of the relationship of subordination.
Can evidence we gathered irregularly still be used?
Sometimes yes, because a Belgian criminal court may still admit evidence gathered irregularly in three cases. Article 32 of the preliminary title of the Code of Criminal Procedure excludes that only for a formality prescribed on pain of nullity, an irregularity affecting the reliability of the evidence, or a breach of the right to a fair trial. An enquiry without the required licence or without the internal rules of Article 65 falls under the first exception. A Fraud Assessment maps that risk in advance.
May we use camera footage to monitor an employee?
For camera surveillance aimed at an employee’s work, collective labour agreement no. 68 allows monitoring on a temporary basis only. You then know in advance whether camera footage, an employee’s emails or a colleague’s desk are within reach. Record the purpose of the investigation and the retention period for the results before you start.