Searches at a company: internal response protocols for staff and legal departments

By Markiian Vysotskyi, Attorney-at-Law, Counsel at Grain Law Firm

A search conducted at a company is always an extraordinary situation. In most cases, it begins unexpectedly, although sometimes it may be anticipated. In either scenario, it requires a clear and consistent internal response plan and a well-structured algorithm of actions for employees — from the very beginning of the investigative measure through to its completion.

Below are the key aspects that should be considered before the search begins, during its execution, and at the final stage of the investigative action.

The primary task of any company’s legal department is to develop, approve, implement, and communicate step-by-step instructions for employees regarding their conduct during a search. Such a document may take various forms, including an internal order, policy, or regulation. It should contain comprehensive information and contact details of external counsel engaged to provide legal assistance and capable of arriving at the premises as quickly as possible in the event of a search. It should also identify designated responsible persons required to immediately notify company management and legal counsel upon the arrival of law enforcement officers, while clearly defining the means, order, and sequence of such notification.

In addition, the document should include rules governing employee conduct and communication with law enforcement representatives, procedures for verifying their authority and legal grounds for conducting the search, the basic rights and obligations of participants in the investigative action, and procedures for documenting potential procedural violations during the search.

It is essential that all employees are familiarised with these provisions in advance to ensure effective protection of their rights and legitimate interests during the search process.

It is also advisable for companies to conduct staff training sessions in the form of professional briefings or simulated search exercises involving practising criminal defence lawyers. Such preparation helps prevent panic within the team, minimises mistakes during an actual search, and promotes coordinated internal responses among employees. These trainings should ideally be conducted at least once a year and include detailed explanations of employees’ rights and obligations. In particular, employees should understand their right to engage a lawyer to represent either the company or individual staff members, the right to refrain from providing explanations during the search, the importance of avoiding physical obstruction of investigators during the seizure of devices, funds, documents, or other property, and the right to submit motions and written objections to be attached to the search record.

When preparing internal guidelines, companies should specifically address the immediate actions to be taken by staff at the initial stage of the search — after contacting legal counsel but before counsel arrives on site — particularly regarding verification of the legal grounds permitting law enforcement officers to commence the search.

As a general rule, searches are conducted pursuant to an investigating judge’s warrant. However, in recent years, there has been an increasing practice of so-called “urgent searches” in situations allegedly involving the protection of life, property, or the immediate pursuit of persons suspected of committing a criminal offence.

Unfortunately, unfounded urgent searches conducted without a court warrant have effectively become commonplace. As a result, law enforcement authorities frequently abuse their powers when seizing property, particularly computer equipment and financial or business documentation. Such actions often constitute serious violations of property rights, accompanied by the prolonged non-return of seized assets, which can paralyse ordinary business operations and cause substantial financial losses to companies.

Accordingly, when developing an internal search response protocol, companies should provide that the responsible employee or department head present during the search must obtain a copy of the search warrant from the investigator, verify its validity, and confirm the authority of the individuals participating in the investigative action. They should also check whether the company’s name, corporate details, search address, and the specific items or documents authorised for search and seizure are correctly stated in the warrant.

For example, if the address specified in the warrant does not correspond to the actual address confirmed by title documents, technical records, or lease agreements, if office numbers differ from those indicated in the court order, or if the validity period of the warrant has expired, these circumstances may constitute sufficient legal grounds to deny access to the premises and refuse commencement of the search.

The protocol should separately address situations where law enforcement officers attempt to conduct a search despite clear discrepancies between the factual circumstances and the contents of the court decision. In such cases, employees should immediately make an oral objection while ensuring video recording of the events and demand termination of the investigative action, clearly explaining the material inconsistencies.

If law enforcement officers continue attempting unlawful entry into the company’s premises, the responsible person should immediately contact the police to document the relevant violation.

At the same time, employees should avoid physically obstructing access to the premises. Such conduct is unlikely to prevent the search and may instead expose staff members to liability for obstructing law enforcement officers in the performance of their duties. The principal task of employees is to remain calm, avoid provocations, and carefully document all procedural violations for future use in protecting the company’s lawful interests.

The next stage that should be clearly incorporated into internal response procedures is the immediate notification of company management and the urgent request for legal counsel to attend the premises. It should always be remembered that investigators and prosecutors are legally obliged to admit a lawyer to participate in the search at any stage of the investigative action.

Employees should then request that the investigator temporarily suspend active investigative measures to allow reasonable time for counsel to arrive. Once present, the lawyer will ensure protection of the rights of represented persons, monitor compliance with procedural requirements, verify the legality of property seizures, supervise packaging and labelling of seized items, review the preparation of the search protocol and inventory lists, and submit detailed written objections concerning any procedural violations.

Searches frequently result in the seizure of mobile devices, computers, servers, and storage media. Employees should therefore be instructed not to intentionally delete information from such devices before or during the search, as deleted data may often be recovered, while attempts to destroy information could be interpreted by the prosecution as deliberate concealment of evidence.

At the same time, sensitive passwords and access codes to cloud storage systems, electronic devices, or databases should not be stored on mobile phones without additional protection.

Where possible, company representatives should insist on copying relevant information rather than seizing servers, hard drives, system units, or other data carriers. In any event, the responsible person and legal counsel must be present during the seizure of equipment, documents, and other property, supervising the seizure procedure, inventory preparation, and packaging of assets, including accurate recording of identifying features such as names, brands, models, serial numbers, quantities, and document details.

This information is critically important for any subsequent challenges concerning the non-return of temporarily seized property or court proceedings relating to asset freezes and their cancellation.

The final stage of the search involves preparation of the search protocol and related appendices reflecting the results of the investigative action. After review by legal counsel for procedural deficiencies, the documents are signed by all participants, and copies must be provided to the company representative and the lawyer.

Internal instructions should also expressly prohibit employees from signing any documents provided by law enforcement officers before, during, or after the search without prior approval from company management or legal counsel assisting during the investigative action. This rule is especially important with regard to search protocols, appendices, and summonses for questioning.

Accordingly, before signing the search protocol or any appendices, employees should carefully review every paragraph of the document, including the date, the start and end times of the search, the inventory of seized property and documents, and the signatures of all participants, specialists, operational officers, and witnesses. Only after consultation with the responsible person should signatures be provided.

If law enforcement officers attempt to question employees during or immediately after the search by conducting interrogations and preparing corresponding records, employees should remember that, regardless of whether they hold the procedural status of witness or suspect, they are entitled to legal representation and may refuse to provide testimony against themselves pursuant to Article 63 of the Constitution of Ukraine.

Moreover, under Ukrainian law, a person must be summoned for questioning by means of a written notice served at least three days prior to the interrogation. Therefore, investigators and prosecutors are not legally authorised to conduct interrogations simultaneously with a search.

Employees should also remain attentive throughout the search and ensure that law enforcement officers are never left unaccompanied in company premises. Situations frequently arise where one room is being searched under video recording with the participation of investigators, witnesses, company representatives, and legal counsel, while operational officers simultaneously enter and inspect other offices, technical rooms, or storage areas without supervision.

Such conduct creates risks that law enforcement officers may “discover” items or documents previously brought onto the premises themselves and subsequently use them as purported evidence of unlawful activity by the company.

Compliance with these procedures at every stage of the search is critically important and may ultimately prove decisive when challenging unlawful actions or omissions by prosecuting authorities, contesting seizures of property, or opposing asset freezes imposed by the court.

It should therefore be understood that a search is merely the beginning of the process and often the first stage of broader criminal proceedings, which may later include interrogations, court hearings regarding asset seizures, applications for the return of temporarily seized property, and appeals against other actions or omissions of investigative authorities.

For this reason, companies are strongly advised to conduct an internal meeting with legal counsel immediately after the search to analyse the investigative action, determine the next stages of interaction with law enforcement authorities, identify procedural mistakes, assess potential legal and commercial risks, and implement additional measures aimed at minimising negative consequences.

Undoubtedly, a search is always an exceptional event in the life of any company. However, in most cases, advance preparation can effectively prevent many adverse consequences or at least significantly reduce their impact. A clear, consistent, and properly implemented internal response protocol, combined with theoretical and practical staff training, the appointment of responsible persons within the company, and professional legal assistance, can substantially improve crisis management and help prevent disruption of normal business operations.