Drafting a fraud and integrity policy for your company

Drafting a fraud and integrity policy means formulating a clear set of rules through which a company tries to prevent, detect and correct fraud and other unethical behaviour. The policy typically includes a code of conduct for employees and other stakeholders, with rules on transparency, on reporting a suspicion of fraud and on sanctions for breaches. A good policy speaks the language of your own organisation, not that of a generic template.

If the policy should also allow the employer to check an employee’s email on suspicion, it must describe that purpose in advance, clearly and explicitly, within one of the four purposes under CAO nr. 81. The employer then informs the works council or, failing that, the trade union delegation, and informs the employees concerned individually.

For the first three purposes under CAO nr. 81, the employer may identify an offender immediately. For monitoring compliance with the company’s own IT rules, an information phase must come first, followed only then by a meeting with the employee concerned.

If the policy should permit an investigation into a company’s own employee, the code of conduct alone is not enough: since 16 December 2024, the law on private investigation requires separate written rules that set out the permission and the conditions of such an investigation expressly and transparently, on pain of nullity of the evidence.

If the policy should permit an external investigation firm to be engaged, that firm must hold the required licence, and both parties sign a written investigation assignment document in advance, precisely describing the assignment and its legitimate purposes.

Our team has extensive experience in developing effective policies specifically tailored to your organisation’s needs. We work closely with you to draft a policy that fits your corporate culture and complies with the applicable law. A policy is not a one-off document: we review it with you whenever the law changes or your company’s activity, size or structure changes, so the rules you draft today still hold tomorrow. We draft the text in plain language your staff will actually read, not legal shorthand nobody opens.

An effective policy helps you manage risks, prevent reputational damage and maintain or improve stakeholder trust. If you also want to know the legal limits of a concrete internal investigation, you find those on our corporate fraud policy page.

If an internal reporting channel fits your needs better than a written policy alone, we point you to our whistleblowing procedure implementation, which covers the channel rather than the underlying rules.

Company directors find on the company directors page the eight other assignments we carry out for them, including our anti-fraud audit and our criminal liability audit.

This policy typically contains a code of conduct for employees and other stakeholders, with rules on transparency, on reporting a suspicion of fraud and on sanctions for breaches. It thereby formulates a clear set of rules through which the company tries to prevent, detect and correct fraud and other unethical behaviour.

Not on its own. The policy must describe the purpose of that monitoring in advance, clearly and explicitly, within one of the four purposes under CAO nr. 81. The employer also informs the works council or, failing that, the trade union delegation, and informs the employees concerned individually before introducing the monitoring.

Yes, since 16 December 2024 the law on private investigation requires separate written rules that set out the permission and the conditions of an investigation into a company’s own employee, expressly and transparently. Without those rules, the evidence from such an investigation is void, even if the policy itself is in order.

Yes, if that firm holds the required licence and the policy permits it. Both parties sign a written investigation assignment document in advance, precisely describing the assignment and its legitimate purposes.