When indicators of embezzlement, financial fraud or manipulation of accounting records arise within a company, the purpose of an internal investigation is not merely to determine “who did what,” but to build a factual and legal record that can support administrative, disciplinary, criminal or civil decisions. The matter becomes more sensitive where senior management, electronic data, bank transfers, related parties or a foreign company operating in Egypt are involved. The investigation should therefore combine neutrality, evidence preservation, compliance with labour and privacy rules, and avoidance of turning the internal process into an informal trial that precedes the competent investigative authorities.

I. What Is an Internal Investigation into Embezzlement or Financial Fraud?

An internal investigation is a structured process led by the company or its advisers to examine a specific incident or suspicion, collect relevant documents and data, interview persons concerned, analyse movement of funds, accounting entries or authorisations, and prepare findings that assist management in taking the appropriate action.

It differs from a Public Prosecution investigation. A company has no criminal search or seizure powers and may not use coercion, detention or forced confessions.

II. Criminal Characterisation Should Not Be Fixed at the Outset

The facts may reveal breach of trust, fraud, forgery, use of a forged document, unlawful appropriation or another offence, but the final legal characterisation depends on the evidence and the suspect’s legal relationship to the money or document.

It is therefore preferable to begin with neutral descriptions such as “unexplained account discrepancy” or “unauthorised transfer” rather than conclusively stating at the outset that an employee committed embezzlement.

III. The Labour Law in Force in 2026

Current investigations should not rely on Labour Law No. 12 of 2003 as the law in force. Labour Law No. 14 of 2025 has been enacted and is now the principal framework governing private-sector employment relationships, together with executive decisions and approved internal workplace regulations.

In August and September 2026, the Ministry of Labour issued the general rules for private-sector workplace regulations as important executive measures under the new law, including rules governing sanctions and discipline within establishments.

IV. Internal Fact-Finding and Disciplinary Investigation Are Not the Same

An internal review may reveal a suspicion requiring a disciplinary investigation under the Labour Law and the company’s internal regulations, or may conclude that evidence is insufficient or that the issue is purely financial or accounting in nature.

The fact-finding stage should therefore be separated from the decision to impose a disciplinary sanction, and the investigation committee should not be used to issue a predetermined outcome.

V. Forming the Investigation Team

The investigation team should be proportionate to the scale of the matter and the seniority of the persons involved. It may include legal counsel, a forensic accountant and a compliance or internal-audit representative.

Where the suspicion concerns senior management, the CFO or the compliance officer, it is preferable to assign the investigation to an independent team outside the ordinary management chain.

VI. Define the Scope Before Starting

The investigation should have a clearly defined time and subject-matter scope: what transaction is under suspicion, which accounts, locations or subsidiaries are involved, what period should be reviewed, and what questions must be answered.

An excessively broad scope increases cost and the risk of accessing data unrelated to the matter.

Practical Example of an Appropriate Scope

Were payments made to a particular supplier without corresponding services between January and June? Who created the supplier in the system? Who approved the purchase order and payment? Is there a relationship between the supplier and any employee?

VII. Issue a Legal Hold and Preserve Evidence

Before confronting a suspected person, relevant documents should be protected from loss. This may include suspending automatic deletion policies where possible and preserving emails, accounting files, approval logs, ERP records, login logs and bank transfers.

Preservation does not give the company an unrestricted right to search every device or personal account. Access should be based on system ownership, company policies and applicable law.

VIII. Chain of Custody Is Not a Mere Formality

When a digital file is copied or an original document is received, the company should record who received it, when, where it was stored, whether a copy was made, and who had access.

This does not make the evidence conclusive by itself, but it reduces the risk of challenges to integrity or allegations that the evidence was altered.

IX. Do Not Alter the Digital Original During Examination

Files or devices should not be opened or handled in a way that alters metadata or system logs where doing so may affect evidential value.

In sensitive matters, it is preferable to use a forensic image or documented preservation copy prepared by specialists rather than conducting ad hoc examination on the original device.

X. Electronic Evidence Under Egyptian Law

Electronic Signature Law No. 15 of 2004 gives electronic writing, signatures and records evidential value comparable to traditional documents where the technical and legal requirements prescribed by the Law and its Executive Regulations are satisfied.

This does not mean that every email or WhatsApp message is automatically treated as conclusive electronic evidence. Attribution to the alleged sender, integrity of the content, the circumstances in which it was obtained and the court’s assessment remain separate questions.

XI. Information Technology Crimes Law

Law No. 175 of 2018 and its Executive Regulations govern important aspects of data, evidence and information systems and should be considered where the matter involves hacking, unlawful alteration of data, or misuse of accounts and electronic systems.

Unauthorised access to personal accounts or systems over which the company has no lawful authority should be avoided.

XII. Personal Data Protection During the Investigation

An investigation may require processing personal data relating to employees, customers or suppliers. Personal Data Protection Law No. 151 of 2020 and the requirements applicable to the company should therefore be considered.

The principles of necessity and proportionality should be respected: only data connected to the legitimate purpose of the investigation should be collected, with access restricted and confidentiality maintained.

XIII. Access to Corporate Email

Where an email account is owned by the company, used for work and covered by clear use policies, the company is generally in a stronger position to review it for legitimate purposes such as investigating suspected fraud.

Unnecessary access to personal communications or unrelated data should nevertheless be avoided.

XIV. Analysing Financial Flows

Forensic Accounting typically begins with the question: where did the money go, based on what document, with whose approval, and to which ultimate beneficiary?

The review may include purchase orders, supplier invoices, bank statements, general ledgers, supplier master data, change logs and approval records.

XV. Test the Transaction, Not Just the Document

The existence of an invoice or purchase order does not prove that the service or supply was actually performed. Documents should be matched against delivery, outputs, inventory or the persons who performed the work.

For consulting services, for example, reports, correspondence, timesheets and the individuals who actually performed the work should be reviewed.

XVI. Red Flags Worth Examining

Important indicators include a newly created supplier linked to an employee, one bank account shared by multiple suppliers, changes to supplier data immediately before payment, split payments designed to avoid approval thresholds, or transfers made at unusual times.

These are indicators rather than conclusive evidence. Their purpose is to guide the investigation, not determine guilt.

XVII. Interviews with Witnesses and Suspected Persons

Where appropriate, interviews should progress from less involved persons to the more sensitive or central individuals so that the investigation team understands the facts before confronting the principal subject.

It is preferable to have one lead interviewer and another person taking notes, while explaining the subject of the interview and avoiding threats or unlawful pressure.

XVIII. The Employee’s Right to Defend

Where the review develops into a disciplinary investigation, the employee’s safeguards under Labour Law No. 14 of 2025 and the applicable internal workplace regulations should be respected, including the opportunity to present a defence and respond to allegations to the extent required by the disciplinary framework.

Failure to follow required procedures may weaken the company’s position if the matter later becomes an employment dispute.

XIX. Refusal to Attend or Sign

If an employee refuses to attend the investigation, give a statement or sign the record, the refusal should be documented in a controlled manner under company procedures and labour rules without coercion.

Refusal does not automatically prove the allegation; it is simply an additional fact to be assessed with the remaining evidence.

XX. Can an Employee Be Suspended During the Investigation?

Suspension should not be treated as an unlimited management power. Labour Law No. 14 of 2025, executive rules, the company’s internal regulations and the nature of the accusation should be reviewed to determine whether suspension is permitted and what conditions, duration and financial consequences apply.

In some cases, less restrictive measures may be sufficient, such as temporarily withdrawing system access or changing approval limits.

XXI. Do Not Seek a Confession at Any Cost

A written confession obtained through pressure or threats may create legal problems rather than solve them. The objective is to collect verifiable facts, not obtain a confession by any means.

The company should avoid detaining an employee, preventing departure or confiscating a personal phone without legal authority.

XXII. Preparing the Final Report

A professional report distinguishes among facts established by the evidence, facts considered more likely than not, and matters that could not be proven. It should avoid categorical language of criminal guilt unless there are strong grounds for doing so.

The report should preferably include the investigation scope, methodology, key documents, findings, financial impact, control weaknesses and recommendations.

XXIII. Is the Internal Investigation Report Evidence Before the Public Prosecution?

The company may submit the report and supporting documents with a criminal complaint or during an investigation, and the report may help organise the facts and direct the authorities to relevant evidence.

However, the report is not a judgment and does not bind the Public Prosecution or the court as to legal characterisation or findings. The authorities may request original documents, appoint an expert or hear individuals independently.

XXIV. When Should a Criminal Complaint Be Filed?

There is no sound practical rule requiring an immediate criminal complaint upon the first suspicion in every case. Evidence should first be secured and the basis of the allegation understood unless an urgent situation requires immediate intervention by the authorities.

The complaint should identify specific facts and supporting documents and should avoid allegations unsupported by evidence.

XXV. False Reporting and Defamation

Publicly accusing an employee before the investigation is complete may expose the company or its officers to unnecessary legal and reputational risk.

Allegations should therefore be circulated strictly on a Need-to-Know basis, using neutral expressions such as “suspected conduct” or “matter under investigation” until the facts are clarified.

XXVI. Recovery of Funds

Where loss is established, civil, criminal and contractual routes for recovery may be considered, including demands, formal notices, proceedings and precautionary measures permitted by law.

The company may not impose self-help attachment over a person’s property or accounts without legal authority.

XXVII. Settlement with the Employee or Responsible Party

Settlement may be possible in some civil or financial matters, but its effect on any potential criminal offence should be assessed independently.

Repayment of funds does not automatically extinguish criminal liability for offences that cannot be terminated merely by private agreement. Settlement wording should also avoid unconsidered admissions or waivers.

XXVIII. Regulatory Reporting

Not every company is subject to one uniform duty to report internal fraud. Specific obligations may apply to banks, financial institutions, regulated companies, or incidents involving customer data or funds.

The relevant sector and regulator should therefore be identified before deciding whether disclosure is required.

XXIX. Role of the Board and Audit Committee

Where the matter is material or involves senior management or the financial statements, escalation to the Board, Audit Committee or external auditor may be necessary depending on the company’s structure and applicable regulatory rules.

Conflicts of interest should be managed carefully; a person who may be a subject of the investigation should not supervise it.

XXX. Companies Regulated by the Financial Regulatory Authority

Listed companies and companies carrying on non-banking financial activities may be subject to additional governance, disclosure and supervisory requirements issued by the Financial Regulatory Authority.

Those requirements should be analysed by reference to the relevant activity and licence, and it should not be assumed that FRA rules apply to every joint-stock company in Egypt.

XXXI. Liability of Board Members

Companies Law No. 159 of 1981 contains rules concerning liability of persons responsible for management for violations of law, the articles of association or management faults depending on the company form and the circumstances.

Discovery of embezzlement by an employee does not automatically make board members liable. Management fault, causation and any specific duties breached must be identified.

XXXII. Multinational Companies

An Egyptian subsidiary may need to coordinate with regional management or the group Audit/Compliance Committee, particularly where the matter concerns cross-border payments, government officials or a party subject to foreign law.

However, foreign laws such as the FCPA or UK Bribery Act do not automatically apply to every instance of internal financial fraud. Their scope and elements must be assessed independently.

XXXIII. Cross-Border Transfer of Data

Where evidence review requires sending employee or customer data to group headquarters or advisers outside Egypt, cross-border transfer requirements under the Personal Data Protection Law and any applicable regulations should be examined.

Ownership of the system by the parent company should not be assumed to create an unrestricted right to transfer all data.

Practical Checklist for the First 48 Hours After Discovering the Suspicion

• Appoint a limited and neutral team to manage the matter.
• Preserve relevant emails, records and files before confronting any person.
• Suspend deletion of data connected with the matter where possible.
• Restrict sensitive access rights where continued access creates a risk.
• Identify the accounts, suppliers and payments under suspicion.
• Avoid making public accusations before the preliminary review is complete.
• Determine whether urgent regulatory or disclosure obligations exist.
• Assess the need for a forensic accountant or digital-forensics expert.
• Create a log of actions taken, their timing and the persons responsible.

Common Errors

Common errors include confronting the suspected person before preserving evidence, assigning the direct manager to investigate despite possible involvement, or allowing the matter to circulate too widely within the company.

Other errors include relying on screenshots rather than original files, collecting unnecessary personal data, or assuming that the internal investigation report proves the criminal offence by itself before a court.

Practical Best Practices

Companies should maintain a written internal-investigations policy linking Legal, Compliance, Internal Audit, HR and IT Security, with clear rules on evidence preservation, interviews, confidentiality and escalation.

It is also advisable to maintain an effective Whistleblowing Channel and mechanisms protecting good-faith reporters from retaliation, while separating receipt of the report from any person who may be the subject of it.

When Is Specialist Legal Counsel or Local Counsel in Egypt Necessary?

Legal involvement becomes particularly important where the loss is significant, senior management is implicated, the evidence is digital or cross-border, or the company is considering termination of employment, a criminal complaint or precautionary relief.

Local Counsel can define the limits of a private investigation, align the process with employment rules, review evidence and data collection, draft complaints or settlements, and coordinate with experts and competent authorities.

How Can Specialist Legal Support Help?

El Rouby Law Firm supports companies in defining investigation scope, preserving evidence, conducting interviews, coordinating with auditors and experts, and assessing criminal, civil, employment and regulatory liability.

The firm also supports risk management and governance, drafting investigation and Whistleblowing policies, dispute prevention, negotiation and settlement, asset recovery, litigation, and representation before the Public Prosecution, Economic Courts and Egyptian regulators depending on the matter.

Conclusion

A successful internal investigation begins not with accusation but with evidence preservation, a clearly defined scope and an independent team. It also does not end with identifying the responsible employee; it should explain why the misconduct occurred, where controls failed, and what legal response is appropriate without exceeding the company’s powers or compromising evidential integrity.

Where your company faces suspected embezzlement or financial fraud, El Rouby Law Firm can review the initial response, lead the legal investigation, coordinate with accountants and experts, and identify the appropriate route for fund recovery, criminal action or employment measures.

Legal and Official References

• Egyptian Ministry of Labour: Labour Law No. 14 of 2025 and related executive legislation and decisions.
• Ministry of Labour: general rules for private-sector workplace regulations – 2026.
• Electronic Signature Law No. 15 of 2004: Articles 14 to 17 concerning evidential value of electronic signatures, writing and records.
• Information Technology Crimes Law No. 175 of 2018 and its Executive Regulations.
• General Authority for Investment and Free Zones: Companies Law No. 159 of 1981, as amended.