Companies commissioning an internal investigation tend to assume the file is confidential in a strong, legal sense: that the report, the interview notes and the emails around them cannot be forced out of their hands. In Switzerland, that assumption deserves scrutiny. Protection exists, but it is narrower than most executives expect, it depends on choices made at the start, and it erodes through everyday behaviour — a forwarded email here, a board summary there.

The Swiss starting point: external counsel is the protected channel

At framework level, the strong protection attaches to the classic attorney relationship. Communications with external counsel admitted to the bar are covered by professional secrecy, and work product in the lawyer's typical professional activity — legal advice and representation — enjoys corresponding protection against compelled disclosure.

In-house counsel have historically not had an equivalent shield. The revised Swiss Civil Procedure Code has improved their position: in civil proceedings, a company can now refuse to produce the work of its in-house legal team under certain conditions, broadly where the activity is one that would count as typical attorney work and the legal function is professionally led. That is a real improvement — and a limited one. It is tied to particular kinds of proceedings, it comes with conditions, and it does not turn the in-house function into an external law firm. Outside Switzerland, foreign courts and authorities apply their own rules, and several major jurisdictions treat in-house communications less generously still.

One more limit matters: privilege protects the lawyer's professional activity, not everything a lawyer touches. A pre-existing business record does not become protected because it was emailed to counsel. And fact-finding that looks like a management or HR exercise with legal wallpaper may be treated as exactly that.

Who commissions the investigation decides a lot

The protective analysis starts with the mandate. An investigation commissioned by the board or general counsel, entrusted to external counsel, with a written mandate framing it as legal advice on the company's legal exposure, sits on the strongest available footing. An investigation that grows organically — HR starts looking, compliance joins, a law firm is copied in week three — sits on the weakest. Documents created before counsel was engaged do not become protected retroactively.

This is why the question "should we involve external counsel, and when?" belongs in the first 48 hours. Whether the answer is yes depends on the facts — severity, potential proceedings, who is implicated — but the question must be asked while the file is still small.

How findings circulate is where privilege actually dies

In practice, investigation files lose protection less through legal argument than through distribution. Confidentiality is a load-bearing element: material that has been shared widely is hard to defend as secret. The common failure modes are mundane.

  • The report is emailed to a broad management list "for transparency".
  • Detailed findings are pasted into board minutes, which follow their own disclosure logic.
  • The file is shared with auditors, insurers or advisers without considering what that sharing means for confidentiality elsewhere.
  • Extracts circulate onwards, stripped of context and of any indication that they were legal advice.

Disclosure to an authority deserves its own decision. Cooperation can be the right strategy, and in some settings it effectively requires opening the file. But that should be a deliberate choice made with counsel, weighing what the disclosure does in every other forum — not the accidental consequence of someone being helpful.

Practical rules that hold up

None of this requires exotic machinery — it requires discipline from day one.

  • Commission in writing, with a legal purpose stated, from the board or general counsel to counsel.
  • Route the investigation's communications through counsel, and keep the working group small and listed.
  • Separate facts from advice. Underlying business documents are what they are; the analysis is where protection can attach.
  • Have interview notes taken by or for counsel as part of the legal mandate, not as HR minutes.
  • Label documents accurately — knowing that labels support a claim to protection but never create one.
  • Decide the distribution of the final report before it exists: who receives it, in what form, and what the board gets instead of a forwarded PDF.

Plan for the least protective forum

If a matter has any cross-border dimension — a foreign parent, a foreign regulator, discovery-friendly courts — the safe planning assumption is that the file will be judged under the least protective applicable regime. What that means for your structure depends entirely on the facts, and it is one of the questions a lawyer should answer before the first document is reviewed, not after the report is written. If you are setting up an investigation and want the confidentiality architecture right from the start, we are happy to discuss it.