Cross-Border Investigations: Are You Prepared For The Challenge?

Cross-border
investigations:
Are you
prepared for
the challenge?
kpmg.com
KPMG INTERNATIONAL
Contents
1. Introduction 2
2. Triggering a cross-border investigation 3
3. Triage and protocol for cross-border

investigations 5
Assess the lead or allegation 7
Implement short-term action steps 7
Develop a plan 9
Determine who should be notified 9
Identify who will oversee and conduct the investigation 9
Assess special legal or cultural considerations 10
© 2013 KPMG International Cooperative (“KPMG International”). KPMG International provides no client services and is a Swiss entity with which the independent member firms of the KPMG network are affiliated.
4. Conducting a cross-border investigation 12
Data privacy 13
Interviewing employees 16
Reporting findings 17
5. Remediation across borders 18
6. Concluding remarks 20
2 | Cross-border investigations: Are you prepared for the challenge?
01 Introduction
Conducting cross-border investigations is no simple endeavor. Add the complexities

of legal and cultural differences, and you have arguably one of the biggest challenges
facing global corporations today. There are obstacles at every step of a cross-border
investigation, including initially receiving a claim or allegation; complying with foreign
data privacy laws; using the appropriate staff and resources; respecting diverse
employee rights; and remediating across borders. Understanding where the pitfalls
are along the way and how to navigate them can help you avoid critical missteps.
The goal of this paper is to give you meaningful guidance by discussing ways to
effectively meet these challenges through the experiences of KPMG investigations
professionals working around the world. In addition, we asked sixty worldwide
executives who are responsible for managing their organizations’ cross-border
investigations to tell us about the challenges and obstacles they regularly face.
Ninety-five percent of these executives said that they expect their needs for
cross-border investigations to increase or at least to stay the same over the next
year. We are pleased to share many of their other observations with you as well.
I sincerely hope you find this paper an interesting and useful resource.
Petrus Marais
Global Forensic Chair
KPMG Forensic
Phil Ostwalt
Global Investigations Network Leader
KPMG in the US
Cross-border investigations: Are you prepared for the challenge? | 3
02 Triggering a cross-border
investigation
Cross-border investigations can be The most common trigger of a cross- In addition to cultural differences, the
triggered from a multitude of foreign border investigation is a lead or an laws and regulations governing hotlines
countries, in a variety of languages, allegation made by an employee of the vary greatly from country to country. Data
through different reporting channels, company. Seventy seven percent of the privacy laws in Europe, for instance, may
and at anytime around the clock. It respondents in KPMG’s survey indicated restrict the use of whistleblower hotlines
is critical, therefore, when designing that internal reporting triggered their most or even prohibit them from accepting
intake procedures to receive and recent cross-border investigation. Almost anonymous calls. Some European Union
process allegations to use a global half of these internal leads came through countries require government approval
mindset and consider cultural whistleblower and hotline programs, a or at least notification before establishing
differences. “How a company initially notable figure given that cultures can a hotline, while other countries compel
receives and reacts to an allegation of differ widely regarding the acceptability companies to consult with employees
fraud can be a defining point in a cross- of reporting the conduct of others. “In and sometimes to get their consent
border investigation,” says Alex Plavsic, some cultures, a senior person can be before launching a hotline. Knowing the
KPMG in the UK. Unique challenges committing a very blatant fraud, but no local culture and regulations about the
exist when an investigation originates one under that person would ever think triggers of cross-border investigations
in a foreign jurisdiction. “If proper of telling someone about it. One does can help companies customize reporting
translations of an allegation are not not go against superiors in some places,” channels to best fit the ways in which
made, for example, or if certain people says Mark Leishman, KPMG in Australia. foreign employees might report
are not notified in a timely manner about allegations.
a claim, the investigation will be fraught
with problems from the beginning,”
Plavsic explains. In today’s hyper- Case Study
connected world it is not only possible
but imperative to have well controlled
and efficient processes that allow
When a US-based consumer products company received hotline reports
business to respond to allegations with in foreign languages, the reports were immediately delegated to the
the appropriate level of care, insight, country manager in the local jurisdiction to conduct an investigation.
and promptness. The reality is many However, the company did not have a language-skilled person reviewing
companies may receive complaints, the reports before they were delegated. As a result, a report alleging
especially those from outside their potential corruption involving a customs broker in Germany was sent
home countries, and do not have a
plan to deal with them. Understanding
to be investigated by the country manager who was the actual person
the ways in which a cross-border accused of the alleged wrongdoing. A well-designed intake process
investigation can arise and how to would have prevented this mistake.
respond can ensure that it starts out on
the right track.
When a lead or an allegation is received differences present challenges in cross- investigations. Some countries require
in a foreign language, it is critical to border investigations for more than a notification to an employee who is
get an accurate translation because third of the respondents to KPMG’s the subject of an allegation as well as
even a minor misinterpretation can survey. Companies, therefore, need notification to employee representatives
lead to a significant misstep. Online to have hotlines that are staffed with or work councils, especially if the
translation websites are no substitute appropriate language-skilled operators employee’s data will be reviewed.
for a language-skilled person who and to ensure that translations are Confidentiality laws also may restrict
knows your business and is trained accurate. “Before acting on a translation to whom a company can disclose an
to review allegations. For instance, of a report, consult with someone allegation, even internally. Because the
although Mandarin is the national in the country who knows not only labor laws and data privacy laws in many
language across China, the proper the language, but also local sayings, countries can seem counterintuitive
use of characters, sentence structure, common euphemisms, and double to common practices, it is critical to
and formation of clear thoughts varies meanings of certain words,” advises understand them at the initial intake
dramatically from person to person Shelley Hayes, KPMG in Mexico. stage of an investigation.
and is heavily influenced by the
There are other important differences
upbringing of the individual, which an
between the intake of allegations
automated website cannot detect. It
in domestic and cross-border
comes as no surprise that language
Which of the following has been the primary trigger of most of your company’s recent
cross-border investigations?
11%
Internal audit finding
32% Leads provided by someone (employee) inside

the company (other than whistleblower program)
Leads provided by someone outside the company

(other than a regulatory body or law enforcement)
Notification by regulatory authority or law enforcement
Red flags or findings arising from compliance due diligence

45% Whistleblower program
2%
3% 7%
Source: Cross-border investigations: Are you prepared for the challenge?, KPMG International 2013.
03 Triage and protocol for

cross-border investigations
Around the globe, employees and effective responses when issues While many of the essential procedures
have become empowered to raise are raised,” says Richard Girgenti, KPMG of an effective domestic investigation
concerns through a variety of reporting in the US. Reporting mechanisms and a cross-border investigation are the
channels. For this reason, a company will quickly lose credibility among same, there are certain fundamental
needs to be prepared to act quickly, international employees if their concerns differences that case managers
efficiently, and effectively when are disregarded or are handled poorly. For and investigators need to bear in
responding to allegations. “Given this reason, compliance officers, in-house mind. These differences include: the
the velocity with which compliance counsel, human resources professionals, timeframe within which an investigation
happens, management can never be and other members of management who must occur; data privacy and the
prepared enough when it comes to its work for multinational companies need to transfer of information; notifications
investigation protocols and procedures,” be prepared to respond to allegations in a to employees or their representatives;
noted Timothy Hedley, KPMG in the planned and consistent manner. notifications to governmental agencies
US. Many companies, however, are or law enforcement; and deadlines for
This means that a company should
underprepared to meet this challenge. reporting disciplinary measures taken
proactively develop case management
More than half of those who responded by the company. Such fundamental
and investigative procedures that align
to KPMG’s survey said that their differences can vary widely, depending
with the company’s values, standards,
companies have limited or no protocols on the jurisdiction where the
and principles and take into account
for cross-border investigations. investigation takes place.
region-specific or country-specific
A company’s intake processes and its requirements, customs, and practices. “There should be a fundamental
investigation protocols can be seen Oftentimes, one size does not fit all, and difference between the mindset of a
as two sides of the same coin. “The procedures will need to be customized case manager or investigator conducting
imperative of encouraging employees to meet the requirements of a particular an investigation on foreign soil,” says
around the world to come forward with jurisdiction. Creating regional case Phil Ostwalt, KPMG in the US. “In fact,
legal, compliance, and ethics questions management templates that highlight key there are many differences. For instance,
cannot be realized unless a company also procedural distinctions provides a good case managers need to remember that
has appropriate investigative protocols starting point. “As with most compliance employment law may differ significantly
initiatives, the development of case from country to country.” Additionally, case
management and investigative policies managers and investigators need to be
and procedures should be a collaborative adaptable to the investigative procedures
exercise between compliance leaders at and strategies that can lead to success at
headquarters and their colleagues around the local level. Given these jurisdictional
the world,” says Maurice L. Crescenzi, Jr., and cultural differences, certain tactics
KPMG in the US. considered effective in a particular country
may prove counterproductive in certain
foreign settings.
How important are the following to the execution of a successful cross-border investigation?
Hiring the right external resources 3.4

Effectively utilizing internal resources (including people and technology tools) 3.8
Managing expectations of senior management 3.8
Having a detailed investigation plan 4.0
Effective communications throughout the course of the investigation 4.3
Proper planning and identifying the scope 4.3
0 1 2 3 4 5
Least important Most important
Note: Chart shows average score for each success factor.
Just as cultural and language In addition to cultural differences, there part by a government agency. Failing
sensitivities matter in every other are significant legal differences. Many to modify investigatory practices when
form of cross-border interactions, countries have restrictive data privacy conducting cross-border investigations
they also matter in investigations. and labor laws that can significantly not only could be counterproductive
While this sort of cross-border and impact the scope and depth of an from a cultural standpoint, it also
cross-cultural sensitivity should be investigation. In certain countries, for could carry a consequence for an
applied across all geographies, it is instance, local law may require that investigator – one that serves as an
particularly relevant in certain countries internal investigations be disclosed ironic book-end to what is often the
with a history of governmental to the government, particularly if the focus of the investigation in the first
suppression. Accordingly, when company is owned or controlled in any place: a violation of law.
conducting investigations in foreign
jurisdictions, case managers and
investigators should be mindful of
the words they choose when dealing
Case Study
with foreign employees. For example,
the word “investigation” may elicit A software company initiated an internal investigation of its Russian
negative emotions or connote a subsidiary. The investigators complied with Russia’s strict limitations on
message that will have a chilling removing data from the country and sent a team to Moscow to review all of
effect on the process. “Review,” the documents. As is common in the U.S., they encrypted the data not realizing
“analysis,” or “discussion” are more that it is illegal in Russia to encrypt certain information. When the authorities
impartial. Likewise, rather than saying
“whistleblower,” “informant,” or
learned about it, the investigation was delayed until the situation could be
“witness,” term such as “employee” resolved. Knowing the local data laws could have prevented the issue.
or “colleague” are neutral.
The following steps can assist case • Understand the factual nature and • Assemble an investigation team
managers and investigators in handling substantive issues involved in the involving local team members who
cross-border investigations. allegation; have cultural and language expertise.
Assess the lead or allegation • Pinpoint, to the extent possible, the Implement short-term
geographic source of the allegation;
When allegations involving international action steps
matters are made, the first step in the • Identify the laws and policies that
Just as with domestic allegations,
response protocol involves a preliminary may be relevant;
cross-border matters run the gamut,
assessment of the claim. “We learned • Determine the pervasiveness of the including employee relations concerns,
as children to stop, look, and listen potential wrongdoing; corruption, data privacy breaches,
before crossing the street, and the theft, workplace violence, and so on.
same prudence should be applied • Evaluate the credibility of the
Case managers handling cross-border
before taking any action with regard allegation;
issues need to take certain preliminary
to an allegation of misconduct,” notes • Identify country-specific laws and steps to help protect the integrity of the
Déan Friedman, KPMG in South Africa. cultural norms that may affect the process, employee safety, privacy and
“Taking the time to assess the matter investigative process; confidentiality, company property, and
is critically important for the sake of potential evidence. Depending on local
confidentiality and privacy, as well as the • Determine whether additional
law, such steps could involve temporarily
credibility of the compliance program, subject-matter or local professionals
suspending or placing on leave
the integrity of the investigation are needed;
employees who are the subject of the
progress, and the reputation of those • Develop a preliminary time table and concern or taking measures to preserve
involved.” budget to administer and complete evidence and relevant documentation.
When assessing cross-border the investigation; Some countries also require notification
allegations, the compliance officer, lead to an employee who is the subject
• Determine whether and how to
investigator, or case manager should of an allegation, or to an employee
communicate with the claimant; and
take the following steps: representative or work council.
Which of the following best describes the nature of the cross-border investigations you are
performing or managing?
67% 65% 63%
Bribery and corruption/FCPA Embezzlement or misappropriation Conflict of interest
26% 11% 7%
Fraudulent financial reporting Data breach Industry-specific regulatory issue
Develop a plan of the matter, it may be appropriate serious violations of domestic or foreign
to notify the country manager, the law, fraudulent financial reporting, or
All effective investigations, whether
functional leader, the department head, senior management would require
domestic or foreign, contain certain
or other members of local management. direct board or audit committee
common elements. Before an
It is important to keep the circle of oversight. These oversight groups
investigation is launched, case
trust small and to remind members should help establish the scope of the
managers should develop a plan that
of management about confidentiality investigation, review the investigation
contains these steps outlined above.
and the integrity of the process. “We plan, and ensure that adequate
A thorough and well-designed plan
have seen instances where a member resources are available.
can help investigation team members
of the local country management is
stay focused on the objectives of the “The oversight group plays an important
notified that an investigation is about
investigation, measure progress along role with regard to the framework of
to be launched, and then that person
the way, and strategically incorporate a cross-border investigation,” notes
turns around and shares the news
supplemental steps as they become Maurice L. Crescenzi, Jr., KPMG in
with the subject,” reports Rachael
necessary. An investigation plan the US. “It is critically important that
Layburn, KPMG in China. Such sharing
typically centers on a hypothesis that those who oversee and manage
of information may be seen as violating
posits why and how the misconduct the investigation become intimately
basic investigatory practices, but in
occurred. The plan should establish familiar with the local business and its
some countries it may be common
the scope and objectives for the operations, while at the same time,
practice. Knowing local customs and
investigation, the documents and understanding the legal and cultural
practices can help avoid an unintended
data to be collected, the individuals environment.” In some instances, hiring
disclosure.
to be interviewed, the timeline and local outside counsel to handle the
milestones, and the reporting process. Identify who will oversee and investigation is appropriate. However,
the outside law firm should be an
In a cross-border context, the conduct the investigation independent firm and not the company’s
investigative team also needs to
Allegations vary in substance, severity, regular counsel in the jurisdiction.
take into account any jurisdictional
and priority. Therefore, a company
differences that may impact the Many companies struggle with the
should have a detailed procedure or
investigation, the information that can unique challenges of staffing a cross-
protocol that outlines which department
be collected, and the individuals who border investigation. More than forty
or individuals will bear responsibility for
can be interviewed. For instance, in percent of respondents in KPMG’s
overseeing the investigation. “It is vital
certain European countries, due to survey believe that their companies
to have all the critical stakeholders at
personal data protection laws, the lack sufficient resources to handle
the table early to agree to the work plan
scope of an investigation involving an cross-border investigations. Individuals
and to set communication protocols
anonymous whistle-blower may be need not only to be experienced in
at the very beginning,” advises Pam
restricted. In China, many businesses investigative strategy and tactics, but
Parizek, KPMG in the US. “When
are state-owned or controlled, which they also must understand local law,
an investigation is being conducted
may trigger China’s states secrets laws language, and customs. Investigation
overseas in different time zones, it
and greatly impact the kind of data that teams who do not have local language
creates challenges to keeping these
can be collected and reviewed. A well skills may miss critical aspects of key
stakeholders informed in a timely
thought out plan should predict the documents or interviews conducted in
manner.” The protocols, therefore,
kinds of issues that may arise and lay local language. “I can’t stress enough
need to include not only the planned
out a strategy to address them. the importance of having members of
investigative procedures, but also the
the investigations team who understand
Determine who should channels of communications with those
local culture and local language,”
overseeing the investigation.
be notified says Crescenzi. “You simply cannot
While the legal department would conduct a cross-border investigation
An important early step in the
likely oversee investigations involving using people who do not know the
case-management of cross-border
potential legal matters, human intricacies and idiosyncrasies of certain
investigations is to alert key members
resources may oversee investigations jurisdictions.” These individuals may be
of management that a potentially
related to employee-relations issues, hard to come by, and companies need to
significant compliance allegation has
theft, and physical security. Moreover, be prepared before a need arises.
been filed and that an investigation will
potentially significant compliance
be initiated. Depending on the nature
situations, including those that involve
Case Study
Amid allegations of employee fraud at an international joint venture
in Taiwan, a global consumer products company realized that it did not
have the resources to respond immediately. The matter was exceedingly
sensitive because of the stature of the subject and family-ownership
of the joint venture. For assistance, the company retained a firm that
had familiarity with the local business environment and culture, and
had experience with Taiwanese law enforcement. The investigation
was conducted in way that respected the sensitivities and resulted in a
criminal prosecution.
To be well prepared, companies with in the process of obtaining legal Lastly, case managers and
global operations should proactively advice or assistance. In contrast, the investigators should be sure that
train employees about investigation attorney work product doctrine, which the scope of their investigative plan
protocols in different jurisdictions so is broader, applies to tangible material includes a review of whether the
that they can respond quickly. Trying or its intangible equivalent collected or subject violated local law. While it is
to educate local resources after an prepared in anticipating of litigation or a not uncommon for many companies
allegation has been received may trial, which extends to the investigative to predicate their global standards and
lead to delays that can sidetrack an process. Before a company launches compliance policies on their domestic
investigation. Yet only thirty-five percent an investigation, it should consult with laws, cross-border investigators should
of respondents in KPMG’s survey in-house or external counsel familiar also evaluate whether local law, too,
said that their companies conduct with the law of the relevant jurisdiction has been violated. Many times, these
investigations training each year. Unlike as to whether the investigation can be laws are not in alignment.
domestic investigations, cross-border privileged or protected.
investigations oftentimes require
In an international setting, local law also
specialized staffing that necessitates
may limit the scope of the investigation.
proactive planning. Companies can
For instance, in Europe an investigation
address gaps in resources by developing
into an anonymous complaint cannot
contingency plans for investigative
be as broad as an investigation in which
personnel, such as designating
the allegation is made by an identified
experienced internal people from other
employee. Wherever possible, case
regions to respond if necessary, and
managers and investigators, through
retaining outside local investigators to
their secure and confidential internal
be on call when a situation arises.
case-management systems, should
Assess special legal or attempt to have an anonymous
claimant identify himself or herself.
cultural considerations In some jurisdictions, it can be illegal
Both domestic and international for companies to investigate alleged
investigations almost always involve employee misconduct because the local
data collection, interviews, and other government considers itself to be the
sensitive communications. For this exclusive investigator responsible for
reason, attorney-client privilege and law enforcement. Here again semantics
the attorney work product doctrine are matter. If management refers to the
important considerations. Attorney- activity as a “review” rather than an
client privilege protects confidential “investigation” it could make a legal
information disclosed to an attorney difference.
04 Conducting a cross-border
investigation
The manner that investigative an individual’s emails or confrontational a countryman for the benefit of a
procedures are implemented and interviews may be greatly limited,” foreign company,” explains Mark
the legal framework in which they Helm says. Leishman, KPMG in Australia. It comes
are governed can differ dramatically as no surprise that more than a third
Cultural differences also underlie
from country to country. Companies of the respondents in KPMG’s survey
cross-border investigations and
involved in cross-border investigations identified cultural differences among
can create significant problems if
are faced with navigating a variety of their top challenges in cross-border
investigators do not understand and
foreign laws and regulations that, in investigations.
respect these differences. “In cross-
many respects, change the way an
border investigations, it is important to Proactively identifying and addressing
investigation can be conducted. “Local
understand the traditional culture that legal and cultural differences is the
legislation may significantly influence
is driving how people think, act, and key to conducting an effective cross-
the manner in which investigations are
react, and how the person conducting border investigation. In our experience,
planned and executed,” notes Jimmy
the investigation is being perceived,” significant differences between cross-
Helm, KPMG in the Czech Republic.
says Shelley Hayes, KPMG in Mexico. border investigations and domestic
For example, in certain jurisdictions the
What may be acceptable to say or do in investigations include data privacy
mere observation of conduct, such as
one culture may totally offend someone laws and regulations, interviewing
the weighing process at weighbridges
from another culture. “Loyalties also employees, and reporting findings.
or truck scales, may be regarded as
differ by culture and some employees
an infringement of privacy. “More
may be hesitant to speak out against
invasive procedures such as reviewing
Case Study
Certain local laws that provide a right to access public information
could result in a third party’s obtaining a copy of your confidential report.
The operator of an Italian railway, which was partially owned by Italy’s
Ministry of Economy and Finance, was required to report the findings
of an accounting investigation to the Ministry and its designees. The
report harshly criticized the chief accountant, causing him to lose his job.
Because the report had been disseminated to others, he could not find
employment in the industry. He brought a lawsuit for defamation against
the company. If the company had realized that the report might not remain
confidential, it might have been written in a manner that would not have
exposed it to a potential claim.
Data privacy also can be costly in terms of added expenses, sanctions,

and, in some cases, prosecution. For example, China has
Preserving and collecting information relevant to an
strict laws that prohibit the collection, review, and transfer
investigation is one of the most important steps in the
of “state secrets” and other information that is in China’s
investigative process. Foreign data privacy laws and
national interest. However, China’s laws do not define what
regulations pose some of the greatest challenges to
are state secrets or national interests. Because China is
conducting cross-border investigations because of
highly controlled and managed by the State, most companies
restrictions on the kinds of data that can be collected and
operate with an abundance of caution by keeping as much
transferred out of the jurisdiction. Many countries have
information within China’s borders and by hiring local experts
enacted laws that place a high priority on protecting personal
who are intimately familiar with the risks of violating China’s
data, including establishing a fundamental legal right on the
laws.
privacy of personal data, even if such data are contained on an
employer’s system or computer. In fact, over forty six percent The data privacy laws of some countries may prohibit a
of the respondents in KPMG’s survey reported that their company from reviewing certain data in a company’s own
greatest challenge in conducting cross-border investigations files unless the data originally was obtained for investigatory
is handling data privacy issues. “Being sensitive to data purposes, which many times is not the case. One of the
privacy and regulations in individual countries is a fact of life biggest hurdles is complying with limitations on collecting
in cross-border investigations,” says Rocco deGrasse, KPMG and reviewing data in a company’s readily-accessible files,
in the US. “You cannot, for example, conduct an investigation such as emails on the company’s server, internet use records,
in the European Union, or especially in China, without first documents on an employee’s hard drive, and even hard
understanding what legal limits are placed on collecting and copy documents in an employee’s office. This is a formidable
exporting data.” challenge. Indeed, the respondents in KPMG’s study believe
that the most difficult task in cross-border investigations is
Failing to anticipate the impact of local data protection laws
gathering relevant information, especially electronic data.
not only can significantly impede an investigation, but it
Which of the following are the top 3 challenges your company faces in the course of conducting
cross-border investigations (select up to 3)?
46% 42% 37% 35% 32%
Privacy or information Lack of internal Cultural differences The legal or regulatory Language differences
issues investigation resources environment
23% 19% 14% 9% 5%
Lack of robust publicly Lack of cooperation Identification and Personal security of Lack of cooperation
available information to from others in your retention of competent persons involved from government
supplement investigative organization external resources in investigations agencies
findings
Note: Chart shows the number of participants who chose the specified challenge as a percentage of total participants who responded.
Unlike a common presumption in some in Europe. The EU Directive broadly

countries that a company has the right defines personal data as “any
to search data on company-owned information relating to an identified or
systems and computers, the prevailing identifiable natural person.” It restricts
view in many foreign countries is that the collection and processing of
personal data is protected regardless of personal data to limited circumstances
where it is stored. “Most jurisdictions such as when the individual has
in Central and Eastern Europe require consented, when it is necessary to
the approval of the person before their comply with a legal obligation, or when
email accounts may be extracted and a legitimate corporate interest is not
interrogated as part of an investigation,” overridden by the fundamental rights
says Jimmy Helm, KPMG in the Czech and freedoms of the individual. These
Republic. situations are not always clear, and
foreign regulators may have varying
The model for many foreign data
opinions as to their applicability.
protection laws is European Union
Directive 95/46/EC, the primary
legislation to date on data protection
Case Study
A US company initiated an investigation of certain of its overseas
operations in Europe. The company had a global policy that it could
review emails that were contained on company-owned computers and
systems. In accordance with its policy, the company copied the emails
of a number of foreign employees. However, when investigators
tried to leave the country with the copies of the emails, the data
was confiscated by a customs official until the company could
provide consents from each employee. This led to significant
delays because some of the employees initially refused to
consent, while others could not be located. Creating export
channels beforehand, such as getting consents, could have
prevented the situation.
Obtaining relevant data, however, is only the first step.

“One has to understand whether there are restrictions on
taking data out of the local country,” explains Roy Waligora,
KPMG in South Africa. Many foreign data privacy laws,
including those in Europe and parts of Latin America and
Asia, prohibit transferring data out of the local jurisdiction
without first establishing data export channels. Data export
channels are methods of ensuring that country-specific data
protection procedures will be followed, such as adopting
corporate policies that adhere to foreign data protection
laws; incorporating model contract clauses that provide
a “safe harbor” under laws like the EU Directive; and, in
some cases, obtaining consents by employees. It is vitally
important to establish these data export channels before
an investigation arises to prevent delays or roadblocks in a
cross-border investigation.
Another important difference between domestic and
foreign data privacy laws relates to the confidentiality
of investigation materials. Many countries require that
investigators disclose personal data included in investigation
materials to the individuals who are targets of the
investigation if they request the data. Additionally, labor
laws in some countries may require companies to disclose
investigatory procedures involving data processing systems
to labor unions or employee rights work councils if personal
data could be impacted. “Balancing the integrity of the
investigative process with the legal rights that overseas
subjects enjoy under local law is both an art and a science,”
says Tim Hedley, KPMG’s Global Leader for Fraud Risk
Management. “One way to strike this balance is to wait for
an appropriate time in the investigative process to share this
information once the investigation is mature and the findings
have begun to take shape.”
Important differences in data privacy laws can have an
impact after the conclusion of a cross-border investigation.
Some countries prohibit outdated personal information
from being retained, even if it is contained in investigatory
materials. This runs counter to certain laws and regulations
that may require a US company to maintain investigatory
materials and work product for a period of time. “Having
a solid understanding of the data privacy laws in the
jurisdiction is critical from the beginning through the end of a
cross-border investigation. In most cases, this means relying
on experts who have in-country experience with handling
data,” says Ken Koch, KPMG in the US.
Case Study
During an internal investigation in a European Union member state, the
company’s employee rights council intervened on behalf of an employee,
in part because the company had not notified the council that it was
going to collect the employee’s data. The council claimed that the data
included personal data and it threatened to get a court order to halt
the investigation. The resulting publicity could have threatened the
confidentiality of the investigation. The company ultimately agreed to
segregate any personal information and disclose it to the employee and
to the council before including it in any investigation materials. This
increased the costs of the investigation and caused delays. Working with
the council proactively could have avoided the delays.
Interviewing employees own employees in an investigation. accepted; in others, the same words will
One of the starkest differences put people on edge,” observes Shelley
Interviewing employees who are
between domestic and cross-border Hayes, KPMG in Mexico. Even body
located in a foreign country raises
investigations is the requirement that language may differ. “Looking someone
unique legal and cultural issues that
companies in some countries have to in the eye is considered rude in some
oftentimes are fraught with pitfalls.
inform their employees of procedural countries, so it should not be taken as
In many countries, employees have
rights during the investigation and give a clue that a person is lying if he or she
the right to refuse to cooperate with
them at least some degree of access does not maintain eye contact with an
an employer-led investigation, even if
to investigation materials that identify investigator,” notes Mark Leishman,
they are not its target. For example, in
them. Employees also may have the KPMG in Australia. Conducting an
some jurisdictions, including Europe,
right to have a lawyer or employee interview in a confrontational manner
rules prohibit employers from requiring
representative present at the interview. may be effective, but in many countries,
their employees to report incriminatory
the interviewing style needs to be
information about co-workers. Labor Understanding local culture plays a
softened. These kinds of insights are
laws in many countries mandate pivotal role with interviewing employees
relevant to cross-border investigations
that an employee representative in cross-border investigations. “In some
and investigators should be mindful of
or union committee be consulted cultures, talking about fraud, theft, and
what it will take to put a witness at ease
before an employer may interview its manipulation of financial statements is
during an interview.
Language differences can pose be advantages to providing only an oral who receive data comply with local data
problems at every stage in cross-border report, but the labor laws in a particular privacy laws,” advises Jack DeRaad,
investigations, and they may be most jurisdiction may require a written report, KPMG in the Netherlands. “This can
acute when interviewing witnesses. especially if disciplinary action is taken. be challenging when there are many
Unlike documents that are written in a Many countries have data privacy laws experts involved, such as lawyers,
foreign language, witnesses oftentimes that allow a target or a witness to have forensic accountants, ediscovery
speak with different dialects, or use access to certain investigatory material, vendors, and computer forensic
slang or local jargon. Some spoken including a written investigation report. specialists, especially if they are located
words and terms also do not translate Being compelled to disclose data in in various jurisdictions with different
in exactly the same way between this way could affect the applicability of data privacy regimes.”
languages. It is no wonder that language domestic and foreign legal privileges
An understanding of local law is critical
differences were ranked as a top and could expose the company to data
in reporting the findings of a cross-
challenge in cross-border investigations privacy and defamation claims.
border investigation. The data privacy
by nearly a third of the respondents in
A company needs to keep in mind that laws of some countries restrict an
KPMG’s survey. Using investigators
an investigation report may contain employer from reporting to enforcement
with local language skills, particularly
data that is restricted from being authorities the personal information
those having the appropriate regional
transferred out of a jurisdiction, such found during an investigation. In
dialects, can be essential when
as names of individuals, financial contrast, other countries, such as
interviewing witnesses. When different
information, or personal data. Therefore, Australia, require an employer with
languages are involved, another area
the proper data export channels need evidence of certain criminal offenses to
that poses a high risk is obtaining an
to be established before providing report them to police. It is easy to see
accurate translation of an interview
a report (even a report in draft form) how conflicts might arise between the
into English. Even slight variations in
to management or directors outside reporting restrictions and requirements
translations could create significant
of the country. These considerations of different jurisdictions. Knowing
misinterpretations of the reported facts.
apply likewise to reports and materials beforehand if reporting restrictions exist
Reporting findings prepared by experts and consultants. can help to avoid difficult situations
“A company conducting a cross-border at the conclusion of a cross-border
Careful attention should be paid to investigation needs to make sure that investigation.
the form and content of a report in a all of its outside experts and vendors
cross-border investigation. There may
Case Study
An employee in India who was being interviewed by a company’s U.S.
investigator claimed that she was intimidated and harassed because the
investigator emphasized that he formerly was a federal prosecutor and
that the company would take criminal action against anyone found guilty
of wrongdoing. The harassment claim interrupted the investigation and
caused the employee to refuse to cooperate. Understanding local culture
and practices might have changed the way in which the investigator
approached the employee.
05 Remediation
across borders
Once the fact finding stage of a cross- cause, you have to be careful to follow action is occurring while a longer term
border investigation is complete, a local dismissal procedures,” advises solution is being implemented. Keep in
company may need to remediate any Mike Schwartz, KPMG in the US. “The mind, however, that in some countries
issues identified, which could include first reaction may be to fire a guilty there may be limitations on the ability
correcting books and records, fixing employee as soon as possible, but that of an employer to make substantive
control weaknesses, and disciplining could violate local laws or employee changes to the work environment
employees. Taking remedial action rights.” Even if the evidence appears without consulting labor unions or
can be an important determinant by to implicate a person, the labor laws in workers’ councils.
regulators, both domestic and foreign, some countries contain high standards
The timing of remedial action also
in deciding to charge a company with a that must be met in order to justify a
is a consideration. Oftentimes,
violation of a law or to reduce the size of termination for cause. Domestic and
remediation can and should begin as
a criminal fine or penalty that might be foreign regulators also may complicate
soon as inadequate or compromised
assessed. Remediation across borders, matters by requesting that a company
financial controls have been identified,
however, can create unsuspecting not terminate a culpable employee so
even during the investigative fact
challenges. that the regulator continues to have
finding. “Both the board of directors
access to the employee. Even in this
One of the first considerations is and the regulators will expect, or at
situation, a company should change
how to handle employees found to least welcome, prompt attention to
the responsibilities of the affected
have engaged in wrongdoing. These fixing known gaps, workarounds, or
employee to make sure he or she
employees may have different levels weaknesses in compliance protocols
cannot repeat past misdeeds or be put
of culpability and may be located in or financial controls without waiting
in a position with a comparable level of
jurisdictions with different legal or labor for the investigation to be completed,”
authority, which could be interpreted as
protections against adverse action. advises Rocco deGrasse, KPMG
insufficient punishment.
While it is critical that companies in the U.S. In a complex matter,
punish employees proportionately to Another key area of remediation is remediation of multiple controls across
their role in the misconduct, it also is to adequately address the deficient, multiple countries may take a long
important to follow local regulations insufficient, or ineffective controls time, even years. “Law enforcement
when doing so. For instance, certain or procedures that allowed the and regulatory authorities may be
countries require employers to first misconduct to occur or to avoid being reluctant to finally resolve regulatory
notify an employee if he or she is detected. In a multi-national company, and other proceedings until they know
going to be terminated for cause. And these controls and procedures the company has fixed the gaps in
in some places, such as Austria and need to be examined not only in the all affected countries and has taken
Belgium, this notification may need affected location, but also wherever some sort of action against responsible
to be made within days of obtaining they exist globally, and they need to employees,” says Charlie Patrick,
evidence of wrongdoing. be remediated if necessary. While KPMG in the UK. “The bottom line with
regulators may be impressed with the conducting remediation across borders
While the kinds of punishment can run
overall level of effort, they, along with is to start promptly and to proceed
the gamut, terminating an employee
management and directors, may insist prudently.”
could trigger different requirements
on an interim fix to the controls that
in different jurisdictions. “Even if an
provides assurance that some remedial
employee is being terminated for
06 Concluding
remarks
Given the challenges created by cross- forethought and planning to manage
border investigations, ninety-five percent the risks and to respond swiftly and
of the respondents in KPMG’s survey appropriately. No longer can companies
expected that their needs for cross- rely on procedures and resources used
border investigations will increase or for domestic investigations. Instead,
at least to stay the same over the next they must be customized to comply with
year. Add to this, the increase in global different local laws and to respect diverse
regulations, laws, and enforcement cultures and customs. When allegations
actions, companies with well designed can arise from almost anywhere around
cross-border investigation protocols will the world, at any time around the clock,
be positioned for more positive outcomes and in virtually any language, every
than those that are not prepared. At each company should answer the question:
stage of a cross-border investigation, Are you prepared for the challenge?
there are unique challenges that require
We would like to acknowledge the following individuals

for their assistance:
Laura Alderson Jilane Khakhar
Nina D’Arcangelo Victoria Malloy
William Hanley, III Lissa Mitchell
Special aknowledgement to Scott Hilsen for his significant contributions in helping with the successful
completion of this project.
Contributors
Maurice L. Crescenzi Jr. David Hicks Charlie Patrick
KPMG in the US KPMG in the UK KPMG in the UK
T: 973 912 4861 T: +44 20 76942915 T: +44 20 76945470
E: mcrescenzi@kpmg.com E: david.hicks@kpmg.co.uk E: charlie.patrick@kpmg.co.uk
Rocco de Grasse Scott Hilsen Pamela Parizek
KPMG in the US KPMG in the US KPMG in the US
T: 312 665 1296 T: 404 222 3015 T: 202 533 5362
E: rdegrasse@kpmg.com E: shilsen@kpmg.com E: pparizek@kpmg.com
Shelley Hayes Ken Koch Alex Plavsic
KPMG in Mexico KPMG in the US KPMG in the UK
T: +52 5552468634 T: 404 614 8658 T: +44 20 73113862
E: hayes.shelley@kpmg.com.mx E: kckoch@kpmg.com E: alex.plavsic@kpmg.co.uk
Jimmy Helm Rachel Layburn Mike Schwartz
KPMG in the Czech Republic KPMG in China KPMG in the US
T: +42 0222123430 T: +86 108 5087075 T: 713 319 2258
E: jhelm@kpmg.cz E: rachel.layburn@kpmg.com E: mschwartz@kpmg.com
Timothy Hedley Marc Miller Roy Waligora
KPMG in the US KPMG in the US KPMG in South Africa
T: 212 872 3496 T: 212 872 6916 T: +27 736222319
E: thedley@kpmg.com E: marcmiller@kpmg.com E: roy.waligora@kpmg.co.za
Contact us
KPMG’s Global Forensic

Investigations Network
Phillip Ostwalt
Global & Americas Leader
T: 404 222 3327
E: postwalt@kpmg.com
Dean Friedman
EMA Leader
T: +27 116478033
E: dean.friedman@kpmg.co.za
Mark Leishman
AsPAC Leader
T: +61 7 3233 9683
E: mleishman@kpmg.com.au
KPMG’s Global Forensic

Regional Leadership
Petrus Marais
Global Forensic Leader
T: +27 795159469
E: petrus.marais@kpmg.co.za
Richard H. Girgenti
Americas Region
Forensic Leader
T: 212 872 6953
E: rgirgenti@kpmg.com
Jack DeRaad
EMA Region Forensic Leader
T: +31206 567774
E: deraad.jack@kpmg.nl
Grant Jamieson
AsPAC Region Forensic Leader
T: +85 221402804
E: grant.jamieson@kpmg.com
kpmg.com/socialmedia kpmg.com/app
The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual
or entity. Although we endeavor to provide accurate and timely information, there can be no guarantee that such information is
accurate as of the date it is received or that it will continue to be accurate in the future. No one should act on such information
without appropriate professional advice after a thorough examination of the particular situation.
© 2013 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent
firms are affiliated with KPMG International. KPMG International provides no client services. No member firm has any authority to
obligate or bind KPMG International or any other member firm vis-à-vis third parties, nor does KPMG International have any such
authority to obligate or bind any member firm. All rights reserved.
The KPMG name, logo and “cutting through complexity” are registered trademarks or trademarks of KPMG International.
Designed by Evalueserve.
Publication name: Cross-border investigations report
Publication number: 121643
Publication date: November 2013

Cross-Border Investigations: Are You Prepared For The Challenge?

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Cross-Border Investigations: Are You Prepared For The Challenge?

Uploaded by

Copyright:

Available Formats

Cross-border

2. Triggering a cross-border investigation 3

3. Triage and protocol for cross-border

Assess the lead or allegation 7

Implement short-term action steps 7

Determine who should be notified 9

Identify who will oversee and conduct the investigation 9

Assess special legal or cultural considerations 10

5. Remediation across borders 18

Conducting cross-border investigations is no simple endeavor. Add the complexities

32% Leads provided by someone (employee) inside

Leads provided by someone outside the company

Notification by regulatory authority or law enforcement

Red flags or findings arising from compliance due diligence

03 Triage and protocol for

Hiring the right external resources 3.4

67% 65% 63%

Bribery and corruption/FCPA Embezzlement or misappropriation Conflict of interest

Fraudulent financial reporting Data breach Industry-specific regulatory issue

Data privacy also can be costly in terms of added expenses, sanctions,

46% 42% 37% 35% 32%

23% 19% 14% 9% 5%

Unlike a common presumption in some in Europe. The EU Directive broadly

Obtaining relevant data, however, is only the first step.

We would like to acknowledge the following individuals

KPMG’s Global Forensic

KPMG’s Global Forensic

Publication name: Cross-border investigations report

Publication number: 121643

Publication date: November 2013

You might also like