Anonymous email names a sales VP
Preserve the VP’s finance and messenger data before the first conversation. Do not assign the VP’s skip-level to ‘handle it quietly’.
Skip to guide content
01 02 03
Internal Investigations · 02 Editorial guide
How to Conduct an Internal Investigation in China
Structure allegation triage, evidence preservation, interview plans, governance and defensible findings. This topic routes; it does not decide the legal outcome on your facts.
First job Structure allegation triage, evidence preservation, interview plans, governance and defensible findings.
Decision railallegation → preservation → team → interviews → data → findings → remediation
See routing factsStart here
Key considerations
The first questions are about urgency, governance and preservation — before collection expands or interviews begin.
- Who received the allegation, what is actually alleged and what evidence may disappear or change first?
- Who can commission and supervise the investigation without a conflict, and which legal, compliance, HR, privacy or criminal tracks must be separated?
- What preservation can begin now without broad collection, premature interviews or a company-wide alert?
Direct answer
What this page decides
Owner
02
02
This page owns investigation design after an allegation exists: first-hour control, independent sponsorship, preservation before collection, interview sequence, and a findings record that does not mix facts with HR or criminal conclusions. It does not own whether a payment is bribery (Commercial Bribery L4), what to do when officials are in the lobby (Dawn raids), or whether WeChat may be reviewed (Quick Answer). Evidence types — email, devices, WeChat, CCTV, accounting — are mapped here rather than on a second national evidence URL. Cross-border export of investigation data is a Data / PIPL problem; do not treat a global e-discovery playbook as China-ready.
At a glance
Which fact changes the next route
Use the fact that changes ownership or urgency to decide the next move.
| Question | Why it matters | Next route |
|---|---|---|
| Evidence may disappear tonight? | Holds beat interviews. | Targeted legal hold; see evidence table below. |
| Implicated manager wants to ‘look into it’? | Independence is the first governance fact. | Reassign sponsor before scoping. |
| Need WeChat or a phone image? | PIPL, employment and authenticity constraints. | WeChat Quick Answer, then this evidence map. |
| Raid or inspection in progress? | Different first speaker and log. | Dawn raids L4. |
| Reporter fears retaliation? | Intake design is a whistleblowing issue. | Whistleblowing L4. |
| Police already involved? | Criminal procedure is a different owner. | Criminal Defense hub. |
Scope
What this page owns — and what it does not
Whocompany investigation team, GC, CCO, or instructed counsel inside mainland China operations.
Eventinternal allegation or detected anomaly, not a regulator’s on-site inspection.
This page owns process, evidence map and findings hygiene.
Exclusionsdawn-raid choreography; bribery legal characterisation; labour arbitration procedure; criminal defence strategy.
No separate ‘investigation evidence’ L4the evidence map lives here.
Practical workflow
Action, evidence, legal gate, output
| Action | Documents / evidence | Legal gate | Output |
|---|---|---|---|
| First 24 hours: hold the scene | Allegation note, systems list, key custodians | No company-wide email | Hold + limited distribution list |
| Name an independent sponsor | Org chart, reporting lines, prior involvement | Conflicted managers out of the room | Mandate and scope memo |
| Preserve before collect | Mailbox, finance, access logs, CCTV retention | PIPL / employment notice analysis | Preservation log |
| Build chronology then interview | Evidence matrix, question list, interpreter plan | Do not promise outcomes to witnesses | Interview record |
| Assess cross-border transfer | Data map, vendor location, legal basis | Data Privacy owner | Transfer decision |
| Issue findings without mixing tracks | Fact section vs legal vs HR vs regulator | Counsel review | Findings + remediation list |
Documents
What to gather before the next call
These items help clarify the file; they are not a legal requirement list.
| Item | Why needed | Who holds it | Risk if missing |
|---|---|---|---|
| Allegation intake | Scope and retaliation risk | Hotline / HR / compliance | Lost original wording |
| Custodian and device list | Hold targets | IT / HR | Imaging the wrong people |
| Accounting and approval records | Follow the money | Finance | Narrative without numbers |
| WeChat / email export protocol | Authenticity and PIPL | IT + privacy | Unusable or unlawful collection |
| Interview notes policy | What will later be disclosable | Investigation lead | Casual chats that become the file |
Common failure points
Where files usually break
Starting with interviews because they feel faster than a hold.
Letting Legal, HR and the business write one blended ‘investigation report’.
Using a US e-discovery vendor to pull China WeChat without a transfer analysis.
Informing the whole office ‘we are investigating fraud’.
Promising the reporter confidentiality you cannot keep.
Deleting CCTV because the retention window is ‘about to roll’ without a hold.
Asking IT to image laptops overnight with no chain-of-custody log.
Illustrative forks · not case advice
Moments where sequence matters
Need a WeChat group from a leaver
Open the WeChat Quick Answer. Collection is not automatic because the phone is a ‘work phone’.
Findings may go to a US parent
Separate facts that must stay in China from the brief the parent actually needs. Data Privacy owns the transfer question.
FAQ
Narrow follow-ups owned by this page
Can we run two overlapping investigations?
Usually no. One sponsor, one evidence file, multiple legal tracks tagged inside it.
Do we need outside counsel immediately?
When crime, dawn raid, cross-border transfer or senior-management conflict is plausible — yes. This page is not a privilege manual.
Where is the evidence L4?
There isn’t one. Email, WeChat, devices, CCTV and accounting are this page’s evidence map.
What is the first-hour Quick Answer for?
A bounded ‘how do we start’ question. It links here for the full process.
Decision map
Keep the question bounded.
- Open a controlled intakeRecord the allegation, source, urgency, implicated people, potential retaliation risk and immediate evidence. Limit distribution to the people who need to make the first decisions.
- Set governance and scopeChoose an independent sponsor, identify conflicts, define questions and decision rights, and document when counsel, HR, privacy, security or criminal specialists take ownership.
- Preserve before collectingIssue targeted holds for relevant accounts, devices and records. Map custody, access rights, employee notice and cross-border transfer issues before copying WeChat, mailbox or device data.
- Sequence interviews and findingsBuild a chronology and evidence matrix before key interviews. Separate facts, credibility observations, legal assessment, remediation and employment decisions in the final record.
Quick answers
Need the short version? Start with one narrow question.
These explainers answer one question. They do not replace this topic route or a deep guide.
Quick AnswerEvidence Preservation During an InvestigationInvestigation holds are operational (don’t delete) plus, if needed, a court evidence-preservation order. They are not asset freezes. Reviewed 6 Sep 2026.Quick AnswerHow should an internal investigation start in China?How should an internal investigation start in China?Quick AnswerCan employee WeChat messages be reviewed in an investigation?Can employee WeChat messages be reviewed in an investigation?Quick AnswerWorkplace Investigations in ChinaA workplace investigation is labour-process plus evidence: handbook, interviews, PIPL. It is not the same as a full compliance probe. Reviewed 6 Sep 2026.Quick AnswerEmployee Interviews in Internal InvestigationsPRC investigation interviews are not US Upjohn theatre. Explain who you are, do not promise privilege, and do not coerce a confession. Reviewed 6 Sep 2026.Quick AnswerEmail Review in China InvestigationsCompany email on company servers is the usual review set. Personal mail and PIPL still constrain scope, export of mailboxes, and vendors. Reviewed 6 Sep 2026.
Curated resources
Open the asset that matches this job.
01
Supporting guide
02Pharma & Device Anti-Corruption Dawn Raid Response Playbook
A sector-specific reference for responding to anti-corruption dawn raids in life sciences.
Related practice
03Data Privacy & Cybersecurity national guide
Use this guide for China data privacy, cybersecurity and cross-border data-transfer questions.
Related practice
Employment & Labor national guide
Use this guide for employee discipline, termination and labor-procedure questions.
Helpful to prepare
Facts that make the next conversation clearer.
These items are orientation aids, not a legal requirement list.
investigation planevidence preservationemployee interviewsWeChat and devicesconfidentialityremediation
Related legal file
Stay in this practice; send neighbouring questions to their owner.
Counsel hand-off
What to bring when you instruct
Instruct investigations counsel (privacy and employment as needed). Bring: allegation text, org chart, systems list, what has already been said to staff, and whether any authority has been contacted. Do not start a parallel ‘HR chat’ that is not logged.
Local context
Add the city only when it changes implementation.
National routing first. Local notary, court or bureau practice second.
Open city and province guidesCounsel hand-off
Need qualified counsel?
Investigations counsel can define scope, preserve evidence, manage interviews and privilege, and coordinate internal findings with reporting or enforcement risk.
Find investigations counselLegal review
Who reviewed this guide
Need qualified counsel?
Move carefully. Move with a record.
Use the portal to identify counsel for this practice and related China-side issues.