Being told that you are under investigation by an “Internal Audit and Investigations Department” (IAID) can be an unsettling experience. It is important to understand that there is no single UK‑wide IAID body. Instead, many organisations (from government departments to large corporates) operate their own internal audit and investigations functions, sometimes using this label or something similar.

In the public sector, internal audit and counter‑fraud investigation work is often coordinated through bodies such as the Government Internal Audit Agency, which supports departments in identifying risk, investigating irregularities, and safeguarding public money.

So, if you have been contacted by an “IAID”, what you are really dealing with is usually an internal team acting on behalf of your employer or an organisation with which you are connected. However, they will have a clear mandate to investigate serious concerns, so understanding their approach is important when defending allegations arising from the investigation.

What does an IAID function actually do?

An IAID‑type function combines two key roles.

On the audit side, it assesses risk management, governance and financial controls. On the investigations side, it investigates specific allegations — often involving suspected misconduct, fraud, regulatory breaches, or misuse of funds.

Investigations are often triggered by financial irregularities, whistleblowing complaints, or concerns identified during routine unusual financial activity audit work. The IAID’s objective is to establish what happened, how it happened, and whether internal controls have been breached with prejudice to the relevant organisation.

The investigators are typically independent of day‑to‑day operations and report to senior leadership or audit committees. Independence is intended to ensure objectivity — but for those under investigation, it can mean the process feels strategic, rather formal, and adversarial.

What powers does an IAID have?

Unlike the police or statutory regulators, an IAID does not have criminal enforcement powers. It cannot arrest you, obtain search warrants, or compel evidence in the same way as a court or law enforcement agency such as the police. However, within an organisational setting, its powers can still be extensive. IAID functions tend to rely on policy‑based and contractual authority, which may include:

• Requesting access to documents, emails, and internal systems
• Requiring employees to attend investigation meetings or interviews
• Reviewing financial records and communications
• Accessing and preserving digital evidence
• Recommending suspension or restricted access to systems during the investigation

These requirements are usually backed by contractual obligations. An employee’s refusal to cooperate can result in disciplinary action, separate from the underlying allegations.

For third parties such as contractors or other suppliers, the IAID’s powers are more limited, but cooperation may still be required under commercial agreements. A refusal to co-operate may have commercial implications for future contracts.

How does an IAID investigation typically unfold?

Every organisation has its own procedures, but most IAID investigations follow a structured process:

1. Initial assessment

A concern is raised and assessed to determine whether a formal investigation is justified. For example, is sufficient evidence likely to be available? Has harm been caused, in terms of financial loss or prejudice to control measures? How reliable is the complaint?

2. Scoping the investigation

The IAID identifies relevant individuals, defines the issues, and takes steps to secure evidence. This is an important stage because investigations can sometime be disproportionate to the outcome.

3. Evidence gathering

This can involve analysing transactions, reviewing documents and, in more complex cases, using forensic accounting or digital forensics. This may occur without the relevant employee’s or contractor’s knowledge.

4. Interviews

Witnesses are usually (but not always) interviewed first, followed by the individual(s) under investigation. The interviews are usually formal and recorded. If the interview is noted, but the audio is not recorded, the interviewee will normally be given an opportunity to review and agree the investigator’s note of what was said. If the interview has been recorded, a copy or transcript can normally be obtained to help legal representatives understand the nature and substances of the investigation.

5. Reporting

A written report is produced, setting out the findings and recommendations.

From a legal perspective, it is important to recognise that the IAID is building a narrative. The way you engage, what you say, and when — can significantly influence the narrative.

What happens at the end of the investigation?

The outcome of an IAID investigation will depend on the findings. In many cases, the result is internal disciplinary action against employees. This can range from no action to warnings or even dismissal for gross misconduct.

For contractors, the contract terms may refer to specific sanctions, and adverse findings may prejudice or prevent access to future contracts.

In regulated sectors, findings may also be shared with professional regulators, potentially impacting your licence, practicing certificate and career.

If evidence of criminal conduct emerges — such as bribery, fraud, or theft — the organisation may refer the matter to law enforcement agencies or the Crown Prosecution Service (CPS). The IAID itself does not prosecute criminal cases, but its findings can form the basis of a criminal investigation and, ultimately, prosecution. Consequently, defending allegations involves testing whether the IAID’s evidence has sufficient evidential integrity. Is the evidence admissible in the event of criminal proceedings?

It is also common for other proceedings to run in parallel. Employees may face an internal disciplinary process at the same time as a police investigation or regulatory scrutiny. Each brings different risks and requires careful handling because evidence will often be shared between investigations, even though different standards of proof may apply.

Who can be investigated?

The scope of an IAID can be quite broad. It can include:

• Employees at all levels
• Contractors and consultants
• Senior executives and directors
• Suppliers and third‑party partners

In some cases, the investigation may also focus on systemic weaknesses — identifying failures in control or governance that go beyond an individual.

Seniority offers no protection. In fact, cases involving senior figures are often prioritised due to the reputational risk to the organisation. Historically, the CPS found it difficult to prosecute senior management because of the need to demonstrate sufficient control and knowledge by the relevant individual. This has become easier through the establishment of ‘failure to prevent’ offences, so companies are now more exposed to the risk of sanctions.

Why early legal advice matters

A common mistake is to treat an internal investigation as informal or low‑risk. In fact, it can have serious and lasting consequences.

A statement made during interviews, documents you provide, and your level of cooperation can all be relied upon later — not only in disciplinary proceedings but also in a regulatory or criminal context.

Early legal advice can help you to:

• Clarify your rights and obligations
• Understand the scope of the investigation
• Avoid inadvertent admissions or inconsistencies
• Prepare more effectively for interviews
• Manage the risk of parallel investigations and proceedings

Crucially, it allows you to engage constructively while protecting your position.

How JMW Solicitors can support you

If you are being investigated by an IAID‑type function, you are not simply dealing with an internal process — you are navigating a situation that could affect your reputation, career and, in some serious cases, your liberty.

At JMW Solicitors, we specialise in advising individuals and businesses facing internal investigations, criminal allegations and regulatory scrutiny. We understand how these investigations are conducted, how organisations build their cases, and — importantly — how to challenge them effectively.

We can assist you from the earliest stages, including:

• Advising before interaction with investigators
• Supporting and representing you through formal interviews
• Managing engagement with employers or your regulator
• Representing you in disciplinary or criminal proceedings
• The earlier you seek advice, the more options you are likely to have.

Final thoughts

Being investigated by an IAID can feel overwhelming, particularly having regard to the formality of the process. Although it is not a distinct criminal authority, an IAID’s findings can have far‑reaching consequences.

Understanding the nature of the investigation — and taking prompt, informed legal advice — is very important. With specialist support from JMW, it is possible to navigate the process effectively and protect your position at every stage.

Evan Wright is a partner and barrister in JMW’s Professional and Corporate Regulation team.