Corporate fraud policy for your company

Employment law and the right to privacy restrict the ways a company can investigate fraud internally. The GDPR requires a legitimate purpose, a clear description of that purpose, and an approach that goes no further than necessary for any monitoring of staff.

Does your policy also cover monitoring of e-mail and internet use? You then need one of the four purposes of CAO nr. 81, such as preventing unlawful acts or protecting your confidential business interests. You inform the works council, or the staff concerned where there is none, clearly of that purpose. You only identify a named employee after an information phase, when the monitoring targets compliance with your own IT rules.

Since 16 December 2024, an investigation into an employee is also only allowed where the permission and the detailed rules for that investigation appear expressly and transparently in written workplace rules. Article 65 of the Law of 18 May 2024 regulating private investigation sets that out, and article 101 of the same law prescribes that duty on pain of nullity: without those rules, the evidence from the investigation is void.

Your company has two years from the entry into force of the law, so until 16 December 2026, to put those rules in place. A policy that already contains those rules, alongside the code of conduct and the reporting rules, stops an investigation from later failing on a point of form. Waiting until an incident occurs is too late to draft those rules.

After we have assessed your company, usually by means of a fraud assessment, our specialists help you draft a fraud policy that transparently sets out which measures against fraud are available within your company, in compliance with the applicable legal provisions.

If you wish, we also draft a fraud procedure and an emergency response plan, so that you have a manual to follow when fraud is suspected. A Belgian SME trading internationally previously asked us to draft such a policy proactively, while respecting the privacy rights of its employees.

A corporate fraud policy works best alongside a whistleblowing procedure for reporting irregularities, and a delegation of powers that sets out who carries which responsibility. A company subject to anti-money laundering legislation has no exemption at all for the internal reporting channel, regardless of staff numbers. We wrote earlier about the new law on the whistleblowing procedure. Back to our page for company directors.

Yes, whenever the policy allows an investigation into the company’s own staff. Article 65 of the Law of 18 May 2024 regulating private investigation requires that the permission and the detailed rules for such an investigation appear expressly and transparently in written workplace rules. Without those rules, you may not investigate an employee under this law. Your policy should therefore set out in advance who conducts the review and under which rules.

It is void. Article 101 of the Law of 18 May 2024 regulating private investigation prescribes article 65 on pain of nullity, so an investigation carried out without the required rules produces no valid evidence. A court cannot then use that evidence, even where the investigation itself was thorough and its findings accurate.

Two years from the entry into force of the law, so until 16 December 2026. Article 180 of the Law of 18 May 2024 regulating private investigation grants that transition period to every principal who wants an employee investigated. After that date, the rules are a condition, not a recommendation, and a delay risks a court later rejecting the evidence.