Crisis Management

Internal Misconduct Investigations and Response

Embezzlement, kickbacks, false expense claims, data theft and other misconduct by officers or employees can occur at any company, however well its internal controls are designed. What matters is how the company responds once misconduct comes to light. Delays and missteps can lead to the loss of evidence, further damage and secondary problems such as labor disputes. We advise on the legal response from the first signs of misconduct through investigation, disciplinary action, recovery of losses, disclosure and prevention of recurrence. For technical work such as digital forensics we coordinate with external specialist vendors, and where an independent third-party committee is required, we help design the framework after confirming independence and conflicts of interest.

Last updated: August 17, 2026

Checklist before Starting an Investigation

Record when and how the matter was reported or discovered and what facts have been confirmed, and limit the people with whom the information is shared
Preserve objective evidence, within lawful limits, before approaching the person under investigation
Strictly protect the confidentiality of whistleblowers and reporting persons, and prevent any detrimental treatment
Check whether management is involved and whether conflicts of interest exist, and decide who should lead the investigation and who should receive reports
Take interim measures to stop ongoing misconduct, and confirm deadlines for regulatory reporting, timely disclosure and similar obligations

How we can helpEvidence preservation and investigation design / disciplinary action and pursuing liability / disclosure and prevention of recurrence

Contact Form

Contents

1. Typical Cases
2. How Misconduct Comes to Light and the First Decisions
3. Initial Response: Evidence Preservation and Dealing with the Person Concerned
4. Designing and Conducting the Internal Investigation
5. Disciplinary Action and Pursuing Officers' Liability
6. Criminal Action and Recovery of Losses
7. Disclosure, Regulators and Prevention of Recurrence
8. How We Support You
FAQ

1. Typical Cases

Embezzlement by accounting staff or officers; kickbacks received through fictitious or inflated orders
False expense or travel claims; private use of company assets
Accounting fraud (fictitious sales, cost shifting and other forms of window dressing)
Taking customer or technical data, competing with the company, and conflict-of-interest transactions
Harassment, falsification of data, inspection fraud, and concealment of legal violations

2. How Misconduct Comes to Light and the First Decisions

Internal misconduct comes to light through many routes: whistleblowing, internal audits, findings in tax audits, information from business partners and others. At this stage, three things matter most: (i) a provisional assessment of the seriousness of the matter (amounts, duration, the range of people involved and whether laws have been violated); (ii) control over the confidentiality of the investigation and who is informed; and (iii) evidence preservation.

Not every internal report qualifies as a "whistleblowing disclosure" under the Whistleblower Protection Act, but for reports that meet the statutory requirements, dismissal and other detrimental treatment by reason of the report are prohibited. Under the amended Act (Act No. 62 of 2025) taking effect on December 1, 2026, searching for whistleblowers without justifiable grounds and obstructing reports will be prohibited, and criminal penalties will be introduced for dismissal or disciplinary action taken against workers by reason of whistleblowing, further strengthening the protection. Regardless of whether the statutory requirements are met, investigations should be conducted with care for the confidentiality of the reporter, prevention of detrimental treatment and elimination of conflicts of interest.

3. Initial Response: Evidence Preservation and Dealing with the Person Concerned

(1) Preserving Evidence

If the person under investigation senses that an investigation is under way, emails may be deleted, records destroyed and stories coordinated, making proof difficult. Before conducting interviews, it is important to preserve objective evidence — email servers, accounting data, entry/exit records, company-issued PCs — within lawful limits. Depending on the case and the state of the data, digital forensics may make it possible to recover deleted data and identify traces of tampering.

That said, the company's investigative powers are not unlimited, even for company-issued PCs and business email. The content and dissemination of work rules, information security policies and monitoring rules, the connection to the purpose of the investigation, the proportionality of the scope, period and search terms, and consideration for employees' privacy and personal information all need to be checked. Personal devices and private accounts require particular caution, including questions of access rights and consent.

(2) Interim Measures concerning the Person Concerned

To prevent continuation of the misconduct and destruction of evidence, measures such as restricting system access, changing duties and ordering home standby can be considered. In implementing them, confirm the basis in work rules and the employment contract, the risk of evidence destruction or continued misconduct, and the scope and duration of the measures, and review their necessity and proportionality regularly. Home standby during an investigation cannot automatically be unpaid.

In harassment cases, establish the facts promptly and accurately while ensuring the safety of the reporting person and victims, separating them from the alleged harasser, protecting the privacy of everyone involved, and preventing detrimental treatment or secondary harm arising from the report or cooperation with the investigation.

4. Designing and Conducting the Internal Investigation

(1) Choosing the Investigation Framework

Depending on the involvement of management, doubts about the effectiveness of internal controls, the social impact of the matter and the need for accounting or technical expertise, an appropriate framework should be chosen from an internal investigation, an investigation committee including outside counsel, or an independent third-party committee. Where a third-party committee is established, it is important to secure independence, neutrality and expertise — including in the selection of members — with reference to the Japan Federation of Bar Associations' guidelines on third-party committees and the Japan Exchange Group's principles on corporate misconduct. Where management itself is under investigation, it must not be allowed to influence the framework, scope or selection of members in a way that compromises the independence of the investigation. Depending on the company's governance structure, the investigation and its primary reporting line should be built around the audit & supervisory board members, audit committee members or independent outside directors.

(2) Conducting Interviews

As a rule, interviews follow the preservation and analysis of objective evidence, though early interviews may be needed to prevent further damage or protect those involved. The order and timing of interviews should be designed in light of the risk of evidence destruction, the safety of those involved and the risk of information reaching the person under investigation. In interviews with that person, the facts should be explained and an opportunity to respond given; changes in the account should be documented; and, where appropriate, a written statement confirming the account may be prepared on the basis of the person's free will. Coercive questioning can undermine the evidentiary value of statements and create separate legal liability, so the involvement of counsel should be considered as the case requires.

5. Disciplinary Action and Pursuing Officers' Liability

(1) Disciplinary Action against Employees

Disciplinary action requires a basis in work rules that have been made known to employees. In addition to the conduct falling within the grounds for discipline, the action must be objectively reasonable and socially proportionate (Article 15 of the Labor Contracts Act), taking into account the nature of the conduct, the damage caused, the person's responsibilities, past precedents within the company, and remorse and restitution. Following the procedures in the work rules and providing an opportunity to be heard are also important. Disciplinary dismissal in particular tends to lead to disputes, and requires careful analysis in light of case law, including the treatment of retirement benefits.

(2) Action against Officers

Where officers are involved, options include removal of representative authority, dismissal of directors and requests for resignation, depending on the officer's position and the company's governance structure. For dismissal of directors, note the risk of damages where there is no justifiable ground (Article 339 of the Companies Act). For recovery or reduction of remuneration and claims for damages based on breach of duty (Article 423 of the Companies Act), the legal basis and the corporate approvals required should each be confirmed. Depending on the circumstances, other directors may also face questions concerning their monitoring duties and the internal control system.

6. Criminal Action and Recovery of Losses

(1) Criminal Action

For embezzlement, kickbacks and false claims, examine who had custody of the assets, the person's authority, any deception, the purpose of benefiting oneself or a third party and the financial damage to the company, to assess possible offenses such as embezzlement in the course of business, fraud, breach of trust and aggravated breach of trust under the Companies Act. For data theft, examine whether the information qualifies as a trade secret under the Unfair Competition Prevention Act and whether the statutory elements of infringement are met. Whether to file a criminal complaint or report should be decided in light of the prospects of establishing the offense, the state of the evidence, the seriousness of the harm, the risk of recurrence, the burden of cooperating with the investigation and the implications for disclosure. Criminal proceedings and civil recovery differ in purpose and procedure, and the overall strategy should keep the two distinct.

(2) Recovering Losses

Consider claims for damages or restitution based on tort, unjust enrichment or contract, and provisional attachment where the requirements and supporting evidence exist — early attention to preservation measures is important where assets may be dissipated. As to claims against personal guarantors: where a personal guarantee entered into on or after April 1, 2020 amounts to a guarantee of unspecified future obligations, it is void unless a maximum guaranteed amount was agreed, so the timing of execution or renewal, the maximum amount, the guarantee period and the notice obligations and limitations under the Act on Personal Guarantees should be checked. Withholding or reducing retirement benefits, or setting them off against damages claims, is not automatically permitted either: the retirement benefit rules, the full-payment principle for wages under the Labor Standards Act and the employee's free consent all need to be considered.

7. Disclosure, Regulators and Prevention of Recurrence

Listed companies must promptly assess whether timely disclosure is required, and regulated businesses whether reports to supervisory authorities are needed. Where accounting fraud affects past financial statements, corrections and coordination with the auditors will also be necessary. Any public statement and Q&A materials must be accurate, grounded in the established facts and consistent with the investigation's findings. After resolution, the response should extend to revising internal controls, rules and the whistleblowing system (including compliance with the amended Whistleblower Protection Act) based on the root-cause analysis.

8. How We Support You

Advice at the first signs of misconduct or upon receiving a report, investigation planning, and legal advice on evidence preservation (including coordination with digital forensics vendors)
Support for internal investigations and company-side investigation committees, conducting interviews, and preparing investigation reports
Assistance in forming independent third-party committees, or serving as committee members, after confirming independence and conflicts of interest
Assessing the lawfulness of disciplinary action and officer liability claims, implementing the procedures, and handling labor disputes
Support for criminal complaints and reports, and recovery of losses through preservation measures and damages claims
Timely disclosure, regulatory reporting, public announcements and media response
Designing recurrence prevention measures and whistleblowing systems (including compliance with the amended Whistleblower Protection Act)

FAQ

Q1. Can we start by asking the person concerned directly?

Approaching the person before objective evidence has been preserved risks destruction of evidence and coordination of stories. In general, we recommend first preserving emails, accounting data and other records and organizing the objective facts, and conducting the interview only once prepared. However, where the harm is ongoing or the safety of those involved is at stake, protective measures or early interviews may be needed without waiting for the analysis to finish.

Q2. Are we obliged to report the matter to the police?

There is no law that uniformly obliges private companies to file criminal complaints or reports for internal misconduct in general; whether to go to the police is the company's decision. Depending on the case and the industry, however, other legal obligations may arise, such as reports to supervisory authorities, timely disclosure or suspicious transaction reports. Even where you decide not to report, it is important to document the reasoning so the decision can be explained afterwards.

Q3. Can we immediately dismiss an employee who committed fraud?

Established misconduct does not by itself justify immediate disciplinary dismissal. A basis in work rules made known to employees, objectively reasonable grounds, social proportionality and the prescribed procedures all need to be confirmed. Even for disciplinary dismissal, dismissal without notice or payment in lieu requires, in principle, approval for exemption from advance notice from the head of the Labor Standards Inspection Office — and obtaining that approval does not guarantee that the dismissal itself is valid. Establish the facts, provide an opportunity to be heard, and choose a sanction proportionate to the case.

Q4. The employee has already resigned. Is it too late to pursue them?

Resignation does not extinguish civil liability for damages or unjust enrichment, or criminal liability. Depending on the evidence and the prospects of establishing an offense, civil claims and criminal complaints remain available after resignation. On the other hand, new disciplinary action is in principle no longer possible once the employment relationship has ended. Withholding unpaid retirement benefits or reclaiming benefits already paid is not automatically permitted either, and requires case-by-case analysis of the retirement benefit rules, the seriousness of the misconduct and the legal basis. Bear in mind limitation periods — both civil and criminal — and the risk of evidence and assets being dissipated, and consider your options early.

Responding to internal misconduct involves the intersection of employment law, corporate law, criminal law, information management and disclosure regulation. Early advice is important to preserve both the evidence and your options. Please consult us first.

Contact

Contact Us at an Early Stage

Consulting us early helps preserve your options for response.