The Laptop Refresh, the Works Council and the Three Bidders
At Calloway Industrial, an internal audit review of procurement found that a $2.3 million annual maintenance contract had been awarded three times in a row to the same supplier, each time through a competitive tender with three bids. The three losing bidders share a registered office address. On Friday afternoon the IT refresh team schedules the procurement director's laptop for reimaging on Monday morning; HR asks whether it can serve notice 'this afternoon to be safe'; and the director's manager wants to 'just ask him about it' over coffee. The director is based in the company's German subsidiary, where a works council has co-determination rights over monitoring measures. Company policy states that company-issued devices are subject to monitoring and may not be used for personal business.
1. Set out your sequence of actions for the next 72 hours. What do you do first, and what do you refuse to authorise?
Read the worked answer
First action - freeze the reimaging. Everything else is recoverable; a wiped laptop is not. Send IT a written hold notice by email (it creates a timestamp) covering the device, its backups, and the mailboxes of the director and the three bidders. Copy counsel.
Order of operations.
- Written preservation notice to IT and records management; suspend the refresh for that asset.
- Forensic image of the laptop by a competent examiner, hash recorded at acquisition and verified after. Original sealed and stored; analysis on a working copy only.
- Preserve server-side sources that do not depend on the laptop: email including deleted items and journaling or archive, ERP procurement and vendor master audit logs, VPN and badge logs, print server logs, phone records, shared-drive version history.
- Collect the tender file, the three losing bids and the bidders' incorporation records.
- Issue a legal hold to relevant custodians with an instruction not to delete.
- Take counsel's advice on works council engagement - in Germany, monitoring measures affecting employees generally require co-determination, and consultation happens before covert monitoring, not after.
- Draft the investigation plan: scope, interview order, peripheral witnesses first.
Refuse. The coffee chat, the same-afternoon termination, and any access to a personal device or personal account without a lawful basis. Each converts a controllable internal matter into a spoliation or unfair-dismissal problem.
2. HR argues that terminating the director now reduces risk. What are the investigative and legal consequences of doing so before the digital evidence is secured?
Read the worked answer
Effect on the evidence.
- Access is revoked at termination in most IT setups. If the account is disabled before the mailbox is exported, journaling and litigation-hold settings are frequently the first casualty.
- The employee now has both a reason and an opportunity to destroy what remains in his possession: home working files, a personal drive, a personal phone, paper files.
- Co-conspirators are alerted. If the three bidders are connected, correspondence you have not yet collected may be withdrawn or tidied up.
Effect on the case.
- In many jurisdictions an adverse inference can be drawn against an employer who destroys, or permits the destruction of, relevant evidence. It weakens your position in any subsequent civil or regulatory proceeding.
- Dismissal before the facts are established risks a wrongful or unfair dismissal claim, particularly in the German entity where works council consultation and notice requirements apply.
- You lose the interview. A termination letter is not a substitute for an admission, an explanation, or the names of others.
The balanced position. Termination may well be justified on the current facts, and there may be a duty to protect the business - but it should follow rather than precede evidence capture, which is typically a matter of days. Prepare the notice, agree it with counsel, execute it once the forensic image and mailbox export are confirmed. Separate the employment decision (HR) from the investigation decision (investigator); neither should drive the other's timing.
3. The director used personal webmail for some supplier correspondence. How far can you go, and what is the risk of going further?
Read the worked answer
Company laptop and corporate mailbox. Covered by the stated policy - devices are subject to monitoring and may not be used for personal business. That wording is your authority. Note that the policy must still be reasonable and, in the German entity, may require works council involvement before monitoring is applied.
Personal webmail accessed on the company laptop. Weaker ground. Browser history, cached pages and locally stored files on the company device are generally within the employer's remit. Reading the contents of a personal webmail account is a different act from examining a company asset.
Two lawful routes.
- Consent. Ask for written consent during the interview or by letter. This is the cleanest route and often succeeds once the employee understands that refusal will be noted.
- Lawful process. If consent is refused, take counsel's advice on whether local law permits compelled access. In many European jurisdictions the answer is no without a court order or a works council agreement.
Do not log in with credentials found on the laptop or guessed. Evidence obtained that way is frequently excluded, and it can generate a data-protection complaint or a civil claim that outlives the fraud case.
Practical consequence. Build the case on what you can lawfully obtain - corporate mailbox, ERP logs, tender file, vendor records, bank records - and treat the personal webmail as corroboration to be pursued only through a lawful route.