Integrity investigations form a substantial part of compliance-related inquiries. They do not focus solely on financial fraud but cover a broad range of issues: conflicts of interest, abuse of position, ancillary activities (side business or job), and violations of codes of conduct. While a fraud investigation often revolves around hard numbers and financial trails, integrity issues are usually more subtle. They concern human relationships, motives, and grey areas where rules and ethics intersect. 

Integrity is the foundation of trust within organizations. Yet integrity risks often go unnoticed, with far-reaching consequences for reputation, compliance, and business continuity. In this third article in our series, the focus is not on investigative techniques, but on what integrity investigations mean in practice: which themes recur, and which patterns emerge from recent cases. We discuss not only well-known integrity risks, but also the less obvious threats. 

We begin with a brief overview of the trends that shaped integrity investigations in 2025. We also briefly highlight the differences between integrity investigations and fraud investigations, discussed in the previous article. We then turn to practice: which cases recur, and how can signals be recognized? By doing so, we also shed light on several underexposed indicators. 

Trends in Integrity Investigations 

Integrity issues are shifting from a narrow focus on corruption and fraud toward broader domains such as conflicts of interest, reputational risk, and moral dilemmas. Recent developments show that: 

• Conflicts of interest and their appearance are increasingly being reported, often in relation to ancillary activities, procurement processes, or decision-making where personal relationships play a role. 
• Codes of conduct for board members, supervisory board members, and political officeholders are being tightened, with a strong emphasis on transparency regarding secondary interests and cooling-off periods. 
• Supervisory authorities such as the AFM and DNB require reliability assessments for board members and supervisory board members, with explicit attention to integrity-related antecedents. 

These trends make integrity investigations more relevant than ever. They are not only reactive but also play a preventive role in promoting sound governance and an ethical organizational culture. Later in this article, we will see one of these trends reflected in a case example. 

What Makes Integrity Investigations Different from Fraud Investigations 

Compared to the forensic fraud investigation discussed in our second article, integrity investigations differ in several important ways: 

• Greater normative discussion: While fraud investigations often focus on the question “Is there financial damage, and who is responsible?”, integrity investigations more frequently revolve around norm-setting: what could reasonably be expected of someone, which behavioral standards apply, and how heavily the appearance of impropriety and reputational risk should be weighed? 
• Fewer hard figures, more context: Relationships, organizational culture, and power dynamics play a much larger role in integrity cases. A single email or expense claim rarely tells the whole story; only when combined with statements, behavioral patterns, and internal policies, a coherent picture emerges. 
• Greater sensitivity regarding privacy and reputation: Investigations often involve individuals in visible or senior positions. This makes careful handling of personal data, communication, and the principle of hearing both sides particularly important. 

It is precisely this mix that makes integrity investigations both challenging and valuable for boards, HR, and compliance: they force organizations to articulate their values in concrete terms. 

Integrity Investigations: When Behavior Is Under the Microscope 

Where fraud investigations often focus on falsified documents, financial loss, and potential criminal elements, integrity investigations mostly operate in grey areas. They address questions such as which interests are at play, which norms apply, and what can reasonably be expected of a professional or manager? 

In practice, reports of potential conflicts of interest, ancillary activities, inappropriate conduct, and breaches of codes of conduct have been increasing for years, in both public and private organizations. To make this more tangible, we present a case example below. 

“You Don’t Want to Create an Uncomfortable Work Atmosphere, Do You?” 

A large family-owned logistics company is known for its reliability and customer focus. This sense of stability is disrupted when an anonymous report is submitted to the compliance officer. An employee in the procurement department is suspected to regularly accept expensive gifts from a supplier, ranging from lavish dinners to tickets for exclusive events. In isolation, this might seem harmless, except for the fact that this employee is responsible for awarding transport contracts. 

Further investigation reveals that the employee also holds a secondary position at a start-up operating in the same market. This start-up appears to be using competitively sensitive data, possibly obtained through informal conversations with the employee. 

But that is not all. Deeper investigation shows that the employee not only accepted gifts, but also subtly pressured colleagues to be “realistic” when reporting performance figures. Minor adjustments to reports, just enough to meet bonus targets. Colleagues had noticed signals but remained silent: “it wasn’t their department” and “you don’t want to create an uncomfortable work atmosphere.” 

What began as a simple report about gifts quickly unfolds into a web of conflicts of interest, a culture of looking the other way, and subtle data manipulation to justify performance bonuses. 

This case is not an exception. It illustrates precisely the trends mentioned earlier and shows how integrity risks often do not present themselves as such but grow gradually within the daily routines of organizations. It also demonstrates how different risks, such as conflicts of interest, ancillary activities, group pressure, and data manipulation, can become intertwined. 

In investigations of such situations, decision-making processes around procurement, documentation of bids and award decisions, email or calendar records, and publicly available information on ancillary activities are examined. These sources are analyzed collectively to answer three core questions: 

1. Were there personal or business interests that could have influenced decisions? 
2. Were these interests disclosed or made transparent, for example through a gift, activity register or integrity declaration? 
3. Were decisions demonstrably different from what could reasonably have been expected, given price, quality, and internal policy? 

Outcomes are rarely black and white. Sometimes investigations show that no formal rules were violated, yet an appearance of a conflict of interest emerged, calling for clearer agreements to roles. In other cases, policies were deliberately circumvented or information withheld, making the violation of norms more explicit. 

Practical Indicators from Integrity Investigations 

Beyond the above case, other recurring types of integrity issues frequently arise in investigations. Some of the usual suspects include: 

• A Culture of “Don’t Ask, Don’t Tell”: Perhaps the most damaging risk is a culture in which employees prefer to look away rather than ask questions. Many employees still hesitate to speak up for fear of repercussions or because they do not want to be seen as “complaining”. A typical example: an employee notices signals of misconduct but remains silent because “it’s not my department”. 
• Data Manipulation: The Silent Saboteur: In the pursuit of targets and bonuses, there can be a strong temptation to present figures slightly more favorably than they are. At a financial institution in Rotterdam, a team leader was found to have adjusted customer satisfaction scores for months. “Everyone does it,” was his defense. The consequences, however, were significant: customer and supervisory trust eroded, and the organization was forced into a costly remediation process. With the rise of AI tools performing data analyses, this risk is only increasing. Who controls the controller? 
• Conduct and Power Dynamics: Reports of inappropriate behavior, offensive remarks, or pressure from managers also fall under the scope of integrity, even if there is no financial component. These cases concern social safety, use of power, and whether behavior aligns with codes of conduct and professional standards. Investigations focus primarily on patterns: is the behavior incidental, or has it been known for years? 
• Handling Confidential Information: A former employee is accused of taking confidential documents to a new employer. Key questions include whether confidentiality agreements were breached, whether files were copied without authorization, and whether sensitive information has surfaced where it should not be. Legal, technical, and behavioral issues intersect in such cases. 

These examples show that integrity investigations are not merely about “rules”. They are about trust, role modelling, and the credibility of commitments to integrity. Next to these more generally known integrity issues, we would like to address some underestimated issues. 

Underestimated Risks: What You Don’t See, but May Still Encounter 

Some less obvious, yet in our view highly relevant, risks deserve attention: 

• Loyalty Conflicts: A growing phenomenon involves employees who run side businesses, perform consultancy work, or even hold secondary jobs with competitors. This is not inherently wrong, but it becomes risky when confidential information or conflicting interests are involved. Consider the IT employee who develops an app in their spare time using data from their primary job, or the procurement officer who also “coincidentally” works for a competitor. Organizations often fail to adequately monitor this, despite potentially severe consequences ranging from data breaches to legal claims. 
• Group Pressure and Groupthink: Decisions are (often) made collectively, but what happens when critical voices are ignored? At a tech start-up in Amsterdam, pressure to scale rapidly led to ethical objections against a new data sales strategy being dismissed. The result was a breach of the GDPR, and a fine imposed by the Dutch Data Protection Authority. Group pressure can lead to tunnel vision, where alternatives and risks are no longer considered. A simple but effective solution? Explicitly appoint a “devil’s advocate” during meetings to challenge assumptions. 
• Greenwashing: The Pitfall of Social Claims: Sustainability and corporate responsibility are high on the agenda. But what if reality falls short of promises? A clothing brand claiming to be “100% circular,” while in reality using only 10% recycled materials, risks not only reputational damage but also legal action. External verification of sustainability reporting is no longer a luxury, but a necessity. 

These examples show that integrity risks are not always visible, yet they have real impact. They often arise in grey areas where rules and ethics intersect. The danger is that organizations focus on well-known risks, while the true threats play out in everyday practice, informal agreements, unspoken expectations, and well-intentioned but poorly considered decisions.  

The good news? By consciously addressing these underestimated risks, and by fostering a culture in which employees feel safe to ask questions, many problems can be prevented. Open dialogue, regular risk assessments, and clear agreements regarding ancillary activities, decision-making, and communication are essential. Integrity is not a matter of luck, but of awareness and action. The earlier risks are recognized, the better they can be managed before they escalate. 

Growing Attention to Integrity 

Recent reports and governance codes encountered in our work show that integrity is increasingly linked to concrete standards, assessments, and practical guidance. Examples include: 

• Tightened codes of conduct for board members and supervisory board members, with emphasis on transparent disclosure of secondary positions and interests; 
• Local and sector-specific codes of conduct (for example in municipalities, education, and housing corporations) that explicitly define how to deal with gifts, ancillary activities, and decision-making in situations of doubt; 
• Clear guidelines for safe reporting procedures (whistleblowing) and independent handling, ensuring that reporters feel protected and that investigations are conducted independently of operational management. 

Integrity investigations directly support these frameworks: they are the instruments used to assess whether these standards are genuinely upheld in practice. 

Invitation to Consultation 

We can imagine that, after reading this article, you may have questions or wish to exchange views on certain topics. Or perhaps you are dealing with a concrete case and would like to discuss it. We invite you to contact us without obligation for an introductory conversation about you and/or your case. Our contact details can be found at the end of this article or on our website.  

Looking Ahead to the Fourth Article 

The risks discussed, ranging from loyalty conflicts to group pressure, often remain hidden until someone has the courage to report them. In the fourth article of our series, we therefore take a deeper dive into whistleblowing investigations: how should organizations handle internal (or external) reports? How can employees be encouraged to speak up? And how can a report and the investigation results be translated into genuine, lasting change? 

Get in touch

Dennis van der Meer | +31618948848 | dennis.van.der.meer@compliancechamps.com

Boy Custers | +31649935735 | boy.custers@compliancechamps.com

 

Read more articles here.

What do we mean by forensic fraud investigations?

When we talk about fraud investigations, we often refer to forensic investigations. In the private sector, forensic investigations focus on the independent and in-depth analysis of financial, administrative, and digital data. The aim is to identify potential fraud, misconduct, or irregularities within organizations. This type of investigation combines accounting and financial expertise with investigative skills. In this way, investigators can reconstruct facts, recognize patterns, and gain insight into causes and consequences. The outcomes are not only used to prove or rule out fraud, but also to support organizations in decision-making, internal control, and potential civil proceedings.

A new reality and growing risks for organizations

Fraud remains a real and growing risk for organizations in the private sector. Digitalization, hybrid working, and international corporate structures create opportunities for efficiency, but at the same time increase vulnerability to financial and other forms of fraud. Where fraud was once often limited to simple embezzlement or false expense claims, we now see more complex constructions. These increasingly involve a combination of digital traces, internal processes, and human factors (online).

Studies show that online fraud and scams have increased significantly since 2014, particularly in the areas of purchase fraud, misuse of online payment methods, and identity fraud. At the same time, trend reports indicate that more than three-quarters of companies in the Benelux have faced fraud attempts in the past two years. The financial impact of these incidents continues to grow.

Fraud remains one of the most persistent risks within organizations. Remarkably, the way fraud is detected has hardly changed over the years. Various international studies, including the annual ACFE Report to the Nations, show that approximately 40% of fraud cases are still uncovered through tips and whistleblower reports. Employees, customers, and suppliers therefore play a crucial role in identifying misconduct, often earlier than internal controls or audits.

Although the way fraud is detected has barely changed, the execution of forensic investigations has evolved significantly. The work has become almost entirely digital. eDiscovery (the legal review of digital data) and AI play a central role in this process. At the same time, requirements relating to privacy and evidentiary standards have become stricter than ever. Below, we first outline these trends. We then provide a detailed description of what a forensic investigation looks like in today’s practice, from engagement letter to reporting.

New trends in forensic investigations

Fraud can increasingly no longer be captured in simple accounting errors or isolated transactions. Due to digital traces, complex organizational structures, and rapidly growing volumes of data, forensic investigations in the private sector are also changing. Investigators must work faster, smarter, and with greater technological expertise to identify hidden patterns and subtle signals. These developments are driving significant changes in how organizations detect, investigate, and attempt to prevent fraud.

Three clear trends stand out:

• Online and hybrid forms of fraud are increasing. Examples include phishing and fake payment requests, misuse of online trading platforms, concealing fraud through corporate structures, and improper declarations within healthcare and subsidy schemes. These forms of fraud increase complexity and require an integrated approach. Investigators therefore combine financial investigation with digital analysis and open-source intelligence (OSINT) to make relationships, money flows, and involved parties visible.
• eDiscovery is developing into a key discipline for reducing and analyzing enormous volumes of electronic data. AI and language models help investigators quickly identify relevant documents, conversations, and patterns.
• Forensic readiness is gaining a more prominent place on the agenda. Studies and practical cases show that organizations without proper logging, appropriate retention periods, clear access rights, and solid agreements with external IT service providers struggle to reconstruct a complete and reliable picture after an incident.

Against this background, it is relevant to examine step by step how a forensic fraud investigation unfolds in practice. At the same time, we provide insight into how we approach such investigations.

From engagement to investigation plan

An investigation usually starts with a signal. This may be an internal finding from controls, a report via a whistleblower channel, a remarkable transaction, or a request from an external party, such as a regulator or subsidy provider. The first (or second) contact with the forensic investigator takes place during an intake meeting. In this meeting, the facts, context, and legal framework are clarified. This includes what exactly has been identified, which period and systems may be affected, and whether there is a risk of criminal implications or regulatory enforcement.

Based on this intake, the parties prepare an engagement letter and an investigation plan. These documents define the objective, scope, roles, planning, and deliverables. They also address conditions related to data processing and privacy. This includes the categories of personal data likely to be processed, the applicable legal basis under the GDPR, any restrictions on access to mailboxes and private devices, and whether a DPIA is required. In practice, this aspect often proves to be a weak point. Organizations want investigations to be carried out, but do not always have a clear process in place to act quickly and lawfully when an incident occurs, especially when IT is partly outsourced.

Financial forensic investigation

Financial forensic investigation often forms the backbone of the factual analysis. Investigators analyze, among other things, general ledger entries, project administration, payment flows, procurement and sales files, expense claims, and contracts. The aim is to identify unusual patterns. In cases involving misuse of subsidy schemes or healthcare budgets, investigators may, for example, compare declared hours with services actually delivered. Illogical money flows through intermediary entities also receive attention.

Using data analytics, investigators identify anomalies such as unusual journal entries, round amounts just below authorization limits, fictitious or duplicate suppliers, abnormal margins, and circular transactions between related parties. Visualizations of money flows and network analyses of relationships between legal entities and natural persons help make complex constructions understandable. This is particularly relevant when companies are used as a front for money laundering or VAT carousel fraud.

It is essential that investigators properly document the analytical methods they use and ensure that these methods are reproducible. Only then can findings withstand scrutiny by auditors, regulators, or courts. When deploying new AI techniques, it is therefore crucial to understand the underlying models to meet reproducibility requirements.

Digital forensic investigation and eDiscovery

Digital traces play a role in almost every investigation. Examples include email traffic, chat messages, access logs, document versions, CRM or ERP data, cloud storage, and sometimes mobile phones. Digital forensic investigation focuses on securing, analyzing, and interpreting this data, with strict attention to chain of custody, data integrity, and privacy.

For large datasets, investigators use eDiscovery to search through vast amounts of user-generated data, particularly email traffic. This process reduces data volumes and brings the most relevant subset to the surface. eDiscovery is the process of systematically identifying, preserving, searching, and analyzing electronically stored information for use in investigations, disputes, or legal proceedings. Platforms such as Relativity and Reveal support deduplication, metadata filtering, keyword searches, concept and topic clustering, and increasingly AI-driven prioritization of documents and conversations.

In practice, a lack of proper forensic or litigation readiness often becomes apparent at this stage. When mailboxes are fully managed by an external IT service provider without clear agreements on incident access, when logging is disabled to save storage costs, or when retention periods are set too short, crucial evidence may simply be lost. At the same time, investigators must handle privacy with care. They collect only data that may be relevant, limit access to a small authorized team, apply encryption and logging, and remove or anonymize irrelevant personal data where possible.

Interviews and conversations

In addition to analyzing financial data and digital evidence, interviews remain an essential part of forensic investigations. Conversations with involved employees, managers, key process owners, and, where relevant, external parties help explain the story behind the data. In investigations into, for example, subsidy misuse or complex expense fraud, interviews may reveal that certain practices “had always been done this way,” that there was implicit pressure to meet targets, or that individuals relied on instructions from others without independently verifying them.

Beforehand, investigators determine the order in which individuals are interviewed, what information they receive about the reason and scope of the investigation, and how their rights and obligations are explained. Notes or recordings are carefully documented and stored, with clear agreements on confidentiality and use. Statements are continuously tested against the “hard” data from financial, digital, and open-source investigations. Inconsistencies between narratives and factual evidence often provide valuable leads, but they also require careful interpretation. Experience plays a major role here.

Open-source intelligence (OSINT)

Open-source intelligence is often a standard component of forensic investigations into fraud. Investigators consult trade registers, sanctions lists, case law, news archives, sector publications, and publicly available online information to identify relationships, corporate structures, and reputational indicators.

OSINT activities are always carefully documented. Investigators record which sources were consulted, which filters were used, and what limitations apply to the reliability of the information found. Tools can support this process, for example by recording visited websites and indexing collected information.

Privacy considerations also apply here. Not all personal information found online is relevant or may be processed indiscriminately in an investigation.

Analysis of all collected information

An investigation is an iterative process. Based on new information from earlier investigative steps, analysts reassess the data and determine whether it can be further enriched. It is common to take a step back during an investigation before moving forward again. For example, open-source research may reveal new individuals or entities that play a role as problematic suppliers. This can trigger further analysis of specific transactions in the financial records. These names may also serve as additional search terms in the eDiscovery process.

Reporting: bringing all lines together

At the end of the investigation, investigators present all relevant facts in a report. The report starts with a clear description of the engagement, scope, methodology, and any limitations. Investigators then present the factual findings per investigation stream in a structured way, covering financial investigation, digital investigation, interviews, and open-source research. This is followed by an analysis that connects the different lines of inquiry.

For example, financial data may show unusual money flows, while digital logs indicate that certain changes were made from specific accounts or locations. eDiscovery may reveal relevant communications between involved parties, and OSINT may confirm that certain entities or individuals have previously been linked to similar schemes. Together, this forms a coherent picture supported by data and clear source references.

A modern investigation report always includes an explicit explanation of how personal data and confidential information were handled. Investigators describe which data was collected, on what legal basis, and which limitations applied. They also explain how security measures were implemented and which forms of data minimization were applied. This is not only important for regulators and courts, but also for maintaining trust among employees and other stakeholders.

Not always forensic ready

A key theme from our recent practical experience is that many organizations are willing to cooperate substantively with investigations, but are not always technically, contractually, or practically prepared for a forensic approach.

This can lead not only to unnecessary delays and higher costs, but sometimes also to irreparable gaps in the reconstruction of events. Against this background, one lesson is already clear—even before discussing improvement programs: a solid forensic investigation starts long before the first signal, with how data, IT, contracts, and privacy are organized today.

Invitation to consult

We can imagine that after reading this article, you may have questions or wish to exchange thoughts on certain topics. You may also be dealing with a concrete case that you would like to discuss. We invite you to contact us without obligation to get acquainted with us and/or discuss your case. Our contact details can be found on our website.

Looking ahead: from fraud to broader integrity investigations

In the next article in this series, the focus shifts from strictly forensic fraud investigations to broader integrity investigations. The attention will not only be on financial damage or clear fraud indicators, but on a wider spectrum of integrity issues. These include conflicts of interest, abuse of position, secondary activities, and inappropriate behavior.

In this third part, we show what fact-finding investigations into integrity reports look like. We also discuss the central research questions and explain how organizations can find the right balance between due care, confidentiality, and transparency.

Get in touch

Dennis van der Meer | +31618948848 | dennis.van.der.meer@compliancechamps.com

Boy Custers | +31649935735 | boy.custers@compliancechamps.com

 

Read more articles here.

Blockchain technology offers transparency and security through immutability. Once data is recorded on the blockchain, no one can alter or delete it. This feature builds trust in the system, yet it also creates major legal challenges. The General Data Protection Regulation (GDPR) is one example of legislation that clashes with this technology.

The immutability of blockchain technology directly conflicts with Article 17 of the GDPR, which gives individuals the right to be forgotten. Even technical measures like encryption or hashing cannot combat this problem, since data can still be considered personal if re-identifiable.

Because blockchains are decentralised and global, determining who is responsible for compliance is complex. Which actor in the system is to be qualified as a data controller and/or data processor? This raises questions about liability and enforcement, as no single entity holds authority over the system. Aside from this, national legislation on data retention and auditability further complicate dispute resolution. The result is a regulatory grey zone where legal accountability becomes fragmented.

Is it then impossible to reconcile blockchain technology with the GDPR? Efforts have led to partial technical solutions, such as off-chain storage, data minimization, and cryptographic deletion. Yet, these approaches rarely achieve full compliance as they challenge the fundamental assumption that data can always be modified or erased. The issue is therefore not only technical but conceptual: blockchain’s decentralised logic clashes with the GDPR’s human-centred model that presupposes a controllable data ecosystem. Without modifying these legal principles, compliance remains legally aspirational.

 

Conclusion

At Compliance Champs, we follow these developments with a critical lens. We support organizations in aligning their processes and controls with MiCAR, the Wwft, and international standards. Through knowledge sharing, training, and tailored advice, we help professionals identify risks in time, implement mitigating measures, and embed sustainable compliance. Only through joint efforts by operators, supervisors, financial institutions, and technology partners can the balance between innovation and integrity truly be restored.

Do you seek support and assistance in enhancing your Crypto Compliance Framework?

Please reach out to us on: info@compliancechamps.com

Read more articles here.