Disclosure becomes a penalty factor

What the planned reform of Sec. 30 and 130 of the OWiG means for internal investigations

The current debate on reforming the Law on Administrative Offences is being conducted primarily from two perspectives: The maximum amounts of the association’s fines are set to rise significantly. At the same time, the effectiveness of the compliance management system is to be explicitly taken into account for the first time when determining the amount of the fine.

However, the reform also has significant implications for internal investigations – The draft legislation refers to internal investigations in two sections. Sec. 30 (2a) of the Act of Regulatory Offences (Gesetz über Ordnungswidrigkeiten – “OWiG“), that is planned in the government’s draft bill to implement the Environmental Criminal Law Directive, expressly mentions for grounds of mitigating penalty, the company’s efforts to uncover the offence, as well as the precautions taken before or after the offence to prevent and detect violations. The Federal Council is taking it a step further: According to his proposal, the investigation of suspicious circumstances should be explicitly included among the appropriate supervisory measures within the context of Sec. 130 of the OWiG.¹

It remains to be seen whether this far-reaching regulation will become law. The German Government initially rejected it. Even after the public hearing before the Legal Affairs Committee on July 6, 2026, the final wording of the bill has not yet to be finalized.² Nevertheless, the direction of the discussion is clear: Company-internal investigations are becoming increasingly more important from a legal perspective. That shifts the focus to a question that, until now, has often been addressed solely from a practical perspective: How should internal investigations be prepared and conducted in future?

Key points at a glance

What’s changing: The government’s draft bill explicitly cites a company’s own efforts to investigate and measures to detect breaches of the law as criteria for determining the amount of a fine imposed on an association. The Federal Council additionally wishes to include the investigation of specific grounds for suspicion in Sec. 130 of the OWiG.

What does not result from this: Not every report requires a comprehensive internal investigation. However, the company must make a well-reasoned decision as to whether, and to what extent, a suspicion should be investigated.

What matters: The value of an investigation is not determined by its scope. Key factor is whether it is capable of establishing a solid factual basis. Furthermore, follow-up actions must be derived from it.

What companies need: Clear criteria for initiating and conducting investigations, minimum procedural requirements, a separation between fact-finding and corporate defense, and regulated procedures for implementing the findings.

Internal investigations are part of effective compliance

The discussion regarding the effectiveness of compliance management systems has so far focused primarily on prevention. Risk analyses, directives, training courses, audits, and whistleblower systems are intended to prevent legal violations or identify as early as possible.

However, this describes only one aspect of effective compliance. No compliance management system can prevent all breaches. It is therefore equally important how the company responds when a specific suspicion arises.

The government’s draft addresses both sides. The proposed Sec. 30 (2a) of the OWiG distinguishes between efforts to uncover the specific offence and to make amends for the damage caused, and general precautions to prevent and detect infringements. The explanatory memorandum to the draft classifies the investigation of the offence as part of post-offence behavior. Particular consideration should be shown in favor to the company if it makes a significant contribution to clarifying the facts of the case.³

Internal investigations therefore acquire a dual significance

On one hand, they serve to investigate a specific suspicion. On the other hand, they demonstrate whether the compliance management system is capable of responding to identified risks, clarifying responsibilities and remedying identified shortcomings.

The Federal Council’s proposal sets out this connection even more clearly. Accordingly, appropriate supervisory measures within the meaning of Sec. 130 of the OWiG are not intended to comprise only risk analyses, directives, training courses and whistleblowing procedures. Investigation cases of suspected misconduct and taking disciplinary action against confirmed misconduct should also be particularly mentioned.⁴

Such a catalogue would, for the first time, explicitly describe internal investigations as an essential part of a proper compliance and supervisory organization. Whether it will become law in this form remains to be seen at this stage. However, the underlying expectation remains the same, regardless of the final wording:

A compliance management system must do more than simply receive reports. It must be able to investigate specific grounds for suspicion in an appropriate manner. This requires not only a reliable whistleblower system, but also ‘investigation readiness’, which outlines the key responsibilities and procedures for an internal investigation.

It is particularly when dealing with a suspicion and the subsequent effective investigation that is becomes clear whether a compliance management system exists merely on paper or actually works.

When does a tip-off form the basis for an internal investigation?

The fact that in-house investigations are now given greater legal weight does not mean that every rumor must lead to a full-scale internal investigation. An anonymous and rather vague tip-off, a document-backed allegation of corruption and a suspicion of systematic accounting fraud require different responses.

The decision is therefore not simply a matter of ‘to investigate or not to investigate?’. Rather, the decision is as to what form of investigation the specific suspicion requires.

The process usually begins with a plausibility check. In particular, the following must be checked:

• How specific is the report?
• Can the facts as described be verified in general?
• How serious is the potential breach?
• Is there a risk of further damage or the loss of evidence?
• Are there any individuals involved that would decide on how to proceed with the report?

Depending on the outcome, a limited preliminary review may be sufficient. It may be limited to reviewing individual documents, clarifying organizational procedures or a few exploratory conversations. If the suspicion is substantiated, a more thorough internal investigation may be required.

This is supported in particular by the seriousness of the potential breach, the involvement of senior management, indications of systematic or repeated misconduct, and significant financial, regulatory or reputational risks. The same applies where the accountability of board members or administrative proceedings are at issue.

The nature and scope of the information provided cannot be definitively determined at the outset. New information may make it necessary to extend the scope of the investigation. Similarly, an investigation may be restricted or terminated if the suspicion is conclusively refuted. In cases where investigative measures concerning third parties have already taken place, it may be appropriate to issue a ‘clearing letter’ stating the outcome to the person concerned.

The debate on reform does not imply any obligation to carry out the most comprehensive investigation possible. However, it does mean that a more detailed justification is required if one does not wish to carry out an investigation. The more serious the potential breach and the more concrete the evidence, the less a company will be able to avoid providing a clear account of how it has dealt with the allegations.

Not every report requires a formal investigation. However, any serious suspicion requires a responsible decision as to how it is to be investigated.

What defines a good investigation?

Internal investigations can be extensive yet provide little insight. Analyzing thousands of emails is, in itself, no more indication of quality than conducting numerous interviews.

The government’s draft therefore quite rightly does not focus on the number of measures taken. The key question is whether these are in fact designed to prevent and detect breaches of the law. According to the explanatory memorandum to the draft, only compliance measures that are genuinely aimed at ensuring legal compliance should justify a substantial reduction. By contrast, structures that merely cover up delinquent behavior may result in higher fines. The Federal Council as well demands that measures taken merely for show – so-called ‘window dressing’ – should not to be rewarded.⁵

For internal investigations, this has a simple consequence, the implications of which are, however, often underestimated: It is not the conduct of the investigation as such that is crucial. The decisive factor is whether the chosen method is suitable for establishing a reliable set of facts.

These include, in particular:

• A clear investigation brief that can be adapted as required;
• The secure storage of relevant data and documents in a timely manner;
• The appropriate selection of the information sources to be evaluated;
• The development and ongoing review of various hypotheses regarding the facts of the case;
• A professional and unbiased interview approach;
• The consideration of incriminating and non-incriminating information;
• The verification of statements against other sources of information;
• The clear distinction between the establishment of facts, assessment and legal evaluation;
• The explicit identification of any remaining uncertainties.

Internal investigations regularly have to work with incomplete information. The statements contradict one another. Documents are open to different interpretations. Even after the investigation has been completed, it is not always possible to reconstruct individual events in their entirety.

A good investigation is therefore not characterized by the fact that it eliminates all uncertainty. It is characterized by its ability to identify uncertainties, assess their significance and take them openly into account in the conclusions made.

It becomes problematic, however, when the outcome is effectively a certainty from the outset. If relevant sources of knowledge are excluded without objective justification, alternative explanations are not examined, or contradictory information is simply dismissed, the investigation loses its open-minded character.

That also applies to the final report. It should not claim a level of certainty that is not supported by the current state of knowledge. A company does not need results that merely appear to be certain. It needs a reliable basis on which to make its further decisions.

An investigation is not valid simply because it has taken place. What matters is how its findings were obtained and how reliable they are.

The investigation report marks the starting point for further measures

Internal investigation initially focuses on the past. They are to establish what happened, who was involved and what factors contributed to the misconduct that has been identified.

However, the government’s draft also explicitly takes into account compliance measures taken after the offence has been committed. This refers in particular to measures designed to remedy the shortcomings that have come to attention as a result of the breach.⁶ That means that the link between establishing the facts and the subsequent improvement of the compliance management system becomes legally relevant.

The necessary measures will depend on the specific findings of the investigation. The following, in particular, may be considered:

• Measures under employment or company law;
• The assertion of claims for damages;
• The adjustment of responsibilities, policies and approval processes;
• Additional or amended checks;
• Updating the risk analysis;
• Targeted training programs;
• Changes to reporting and escalation procedures;
• A comprehensive root-cause analysis to identify the organizational and methodological origins of the misconduct;
• Measures to address structural or cultural causes of misconduct.

In this context, one must not jump to the conclusion that an individual breach indicates a systemic failure of the compliance management system. Even effective controls can be deliberately circumvented. Conversely, it is not enough to place the blame solely on individual employees if unrealistic targets, a lack of resources, conflicting instructions or a problematic management culture have contributed to the misconduct.

An effective response therefore does not merely ask who has broken which rule. It also asks why the breach was possible, why it was not detected earlier, and what needs to be changed to prevent something similar from happening again.

After all, it is not enough simply to decide on follow-up measures. Their implementation and impact must be reviewed. A new policy does not change the actual procedure in itself. Training alone does not eliminate conflicting incentives structures. An additional control measure is of no use if is not implemented in day-to-day operations.

The value of an internal investigation is therefore also evident from what happens once it has been completed.

An internal investigation primarily sheds light on the past. Effective compliance requires drawing lessons from its findings for the future.

Establishing the facts is not the same as defending the company

The increased legal significance of internal investigations also raises the question of their governance. In this context, a distinction must be made between establishing the facts and defending the company.

Both functions relate to the same set of facts. However, they fulfill different purposes.

The aim of the fact-finding process, within the scope of the investigation, is to establish as reliably as possible what happened, which individuals were involved, which statements can be corroborated, and which organizational causes can be identified.

Corporate defense has a different purpose. It assesses the legal risks and advises the company on how to safeguard its interests in dealing with public prosecutors, fine-imposing authorities and other parties to the proceedings.

The difference is not merely a matter of terminology. It becomes more significant if a company wishes to reference its own investigative efforts at a later stage as a mitigating factor in the calculation of fines or as evidence of genuine cooperation. In this case, the investigation must be convincing as an objective clarification of the facts, without prejudging the outcome. Their scope and methodology must not have been determined from the outset by the desired defense strategy.

In cases involving matters that could lead to sanctions, the investigation of the facts and the company’s defense should therefore be kept separate, both in terms of their functions and the personnel involved. The decision on the defense strategy must not be combined with the methodological management of the fact-finding process.

The specific organizational structure required depends on the subject matter, scope and risk profile of the investigation. First and foremost, it is crucial that the various tasks are identified and the respective responsibilities are defined before the investigation begins.

In particular, the following needs to be clarified:

• Who determines and changes the scope of the investigation?
• Who decides on research methods and sources of information?
• To which corporate authority does the investigation team report?
• Who advises disclosure, cooperation and communication with the authorities?
• How are potential conflicts of interest within the Executive Board or Supervisory Board dealt with?

The debate on reform has not yet established a specific framework for this. However, it highlights the need to organize the fact-finding process in such a way that its quality and credibility are not compromised by unclear role definitions. This is further reinforced by the requirements of European law, in particular the EU Anti-Corruption Directive⁷, which must be implemented into German law by spring 2028. The mitigating factor cited is not merely an effort to uncover the offence, but also the fact that its led to evidence which the authorities would not otherwise have obtained – including evidence that helps to identify the (individual) offender. This makes it particularly necessary to draw an even clearer distinction between an internal investigation and individual defenses. In particular, what is known as ‘basic defense’ – that is, limited coordination between corporate and individual defense teams – can hardly be combined with an internal investigation.

Anyone wishing to present their own investigation as a serious contribution to establishing the facts must treat the clarification of the facts and the defense of the company as separate tasks.

Documentation makes clarification comprehensible

Careful documentation does not turn a poor investigation into a good one. However, it is necessary in order to be able to trace how the company dealt with a suspected incident at a later date.

It all starts with the very first decision. The initial grounds for suspicion, the outcome of the plausibility check and the reasons for the chosen method of investigation should be recorded. The decision to carry out only a limited preliminary examination at first, or to refrain from conducting a formal investigation, may also require justification and documentation.

As things progress, the following points in particular should remain clear:

• Subject and aim of the investigation;
• Responsibilities and reporting lines;
• Significant restrictions and extensions to the scope of the investigation;
• The selection of key documents, systems and contact persons;
• Key methodological decisions;
• The factual basis for the findings made;
• Unresolved issues and remaining uncertainties;
• Agreed follow-up measures and their implementation.

The following does not apply: The more documentation, the better. A large volume of unstructured documents makes it impossible to trace the history of a process. Nor is it necessary to record every preliminary thought or every work output indiscriminately.

Rather required is a documentation framework that sets out the key decisions and stages of the investigation, whilst also taking into account legal, data protection and procedural requirements.

Particular importance is attributed to the documentation of the follow-up measures. Anyone wishing to present their investigation as evidence of effective compliance must not only be able to demonstrate that the facts of the case have been clarified. He must also be able to explain what conclusions have been drawn from the findings and how any shortcomings identified have been rectified.

Documentation therefore replaces neither the process of raising awareness nor implementation. However, it does demonstrate that both have taken place.

What Companies should be preparing for now

The final wording of the legislation has not yet been finalized. Companies should nevertheless check whether their existing procedures meet the requirements for a professional investigation.

There are four key points to focus on:

Set out the criteria for deciding whether to carry out an investigation: Companies need a tiered process for assessing the plausibility of reports, conducting limited preliminary checks and carrying out formal internal investigations. In this context, particular consideration should be given to the degree of suspicion, the seriousness of the possible breach, the involvement of senior management and the potential for damage.

Define investigation standards: Minimum requirements for investigation assignments, data backup, document analysis, interviews, plausibility checks, reporting and quality assurance should not be left until a specific crisis arises. At the same time, they must remain sufficiently flexible to do justice to the circumstances of each case.

Clarify roles and reporting lines: In cases where sanctions are a potential issue, separate mandates should be issued for the investigation of the circumstances and for the company’s defense. It also must be specified when the Executive Board, the Supervisory Board or a specific committee is responsible, and how any conflicts of interest are to be dealt with.

Ensuring implementation and verifiability: Responsibilities, deadlines and monitoring mechanisms should be established for follow-up measures. It is important to check not only whether measures have been approved, but also whether they have been effectively implemented and are actually having an effect.

“The effectiveness of a compliance management system is not measured solely by its ability to prevent breaches. It is also measured by how the company investigates specific allegations and what conclusions it draws from the findings.”

Sascha Kuhn

Conclusion: Effective compliance does not end with the submission of a report  

The reform of Sec. 30 and 130 of the OWiG has not yet been finalized. However, the government’s draft bill already makes it clear that companies’ own efforts to investigate, measures to detect breaches of the law and subsequent improvements to the compliance management system are to be given greater weight when determining the amount of a fine imposed on a company.

The federal Council also wishes to expressly enshrine the investigation of specific grounds for suspicion as an element of appropriate supervisory measures in Sec. 130 of the OWiG. At the same time, the Round Table on ‘Compliance and internal investigations’ is calling for stronger and more reliable incentives for professional internal investigations, genuine cooperation and a genuine success in uncovering the facts.⁸

This development does not give cause to any obligation to investigate every report through a comprehensive internal investigation. However, it does place greater demands on how a company handle a serious suspicion.

What matters is the entire process: from the initial plausibility check, through the selection and conduct of the investigation, to the implementation of the findings. These include clear quality standards, transparent decision-making and, in cases where sanctions are a concern, the separation of the investigation of the facts from the company’s defense.

The value of an internal investigation is therefore not measured by the number of documents analyzed, the duration of the project or the length of the final report. It is measured by whether a sound factual basis is established on which the company can make responsible decisions.

We, Pohlmann & Company, support companies in the development and conduct of internal investigations – from the initial assessment of a suspicion, through the establishment of the facts, to the development and implementation of appropriate follow-up measures. We also carry out preventive assessments of existing investigations readiness programs. In doing so, we combine legal expertise with an investigative approach focused on obtaining reliable findings and a clear basis for decision-making.

Would you like to know whether your internal audits processes meet the increasing requirements of terms in quality, governance and audit trail? Please feel free to contact us.

[1] Entwurf eines Gesetzes zur Änderung des Strafrechts – Umsetzung der Richtlinie (EU) 2024/1203 über den strafrechtlichen Schutz der Umwelt sowie zur Änderung der Zustellungspauschalen und Gebühren im Gesetz über Ordnungswidrigkeiten und in den Justizkostengesetzen, BT-Drs. 21/6133, insbesondere § 30 Abs. 2 und Abs. 2a OWiG-E sowie Begründung, S. 87–90.

[2] Stellungnahme des Bundesrates und Gegenäußerung der Bundesregierung, BT-Drs. 21/6668, insbesondere Nr. 15 und 16 sowie Gegenäußerung zu Nr. 15 und 16; öffentliche Anhörung des Ausschusses für Recht und Verbraucherschutz vom 6. Juli 2026.

[3] BT-Drs. 21/6133, Begründung zu § 30 Abs. 2a Satz 3 Nr. 4 OWiG-E, S. 89.

[4] BT-Drs. 21/6668, Nr. 15, vorgeschlagener § 130 Abs. 1 Satz 2 und 3 OWiG.

[5] BT-Drs. 21/6133, Begründung zu § 30 Abs. 2a Satz 3 Nr. 5 OWiG-E, S. 89 f.; BT-Drs. 21/6668, Nr. 16.

[6] BT-Drs. 21/6133, Begründung zu § 30 Abs. 2a Satz 3 Nr. 5 OWiG-E, S. 90.

[7] Richtlinie (EU) 2026/1021 des Europäischen Parlaments und des Rates vom 29. April 2026 zur Bekämpfung der Korruption, zur Ersetzung des Rahmenbeschlusses 2003/568/JI des Rates und des Übereinkommens über die Bekämpfung der Bestechung, an der Beamte der Europäischen Gemeinschaften oder der Mitgliedstaaten der Europäischen Union beteiligt sind, sowie zur Änderung der Richtlinie (EU) 2017/1371 des Europäischen Parlaments und des Rates

[8] Bayerisches Staatsministerium der Justiz, Pressemitteilung Nr. 47/26 vom 27. Mai 2026, Reform des Unternehmenssanktionenrechts – Runder Tisch „Compliance und Internal Investigations“.