When the Suspect Resigns: Handling Employee Exits During an Investigation

It is common for a person under suspicion to resign before, or shortly after, they realise an investigation has started. For a company under pressure, a resignation can look like a solution: the person leaves, the problem leaves with them, and nobody has to have a difficult conversation.

In our view that is often the most expensive outcome available. A quiet exit tends to cost evidence, recovery and, eventually, credibility with auditors and regulators who later ask why the matter was closed.

What a quiet exit costs

• Evidence. Laptops and phones are returned after a factory reset. Personal email and messaging accounts used for work are beyond reach. Colleagues are briefed on what to say.
• Recovery. Full and final settlement pays out bonuses, encashment and incentives to someone who may owe the company money. A settlement agreement may release claims the company did not yet know about.
• The rest of the scheme. Most significant frauds involve more than one person, inside or outside the company. An exit that closes the matter leaves the others in place.
• Reputation and references. A clean relieving or experience letter can help the person move to another employer, who may later ask why the company said nothing.
• Oversight. An auditor or regulator who later learns the facts will ask why the board accepted an exit instead of finding out what happened.

Our view: manage the exit as part of the investigation

When a person of interest resigns, goes on extended leave or asks to leave, the investigation team, not only HR, should decide what happens next.

Before anything is accepted or announced

1. Secure the evidence. Arrange forensic imaging of company devices and preservation of email, cloud accounts and system logs, with a documented chain of custody. Electronic records relied on later will need a certificate under s. 63 of the Bharatiya Sakshya Adhiniyam 2023.
2. Restrict access. Remove the ability to approve payments, change master data or access sensitive systems, in a way that does not itself announce the investigation if that is still confidential.
3. Check the contract. Notice periods, garden leave, the employer's ability to defer acceptance, malus and clawback clauses, confidentiality and return-of-property obligations all matter. Take employment law advice.

At handover

• Require the return of all company devices, unwiped, and of company data on personal devices, with a signed declaration.
• Ask for passwords to company accounts and for the handover of work held in personal accounts.
• Interview the person if the investigation is ready for it. An exit interview conducted by HR is not a substitute for an investigation interview.

On settlement and documents

• Pay what is legally due. Withholding wages or statutory dues without a clear legal basis creates liability. Discretionary or deferred amounts may be held under malus or clawback terms, on advice.
• Do not sign releases or settlement agreements until the facts are known, and never release claims for fraud the company has not yet discovered.
• Issue factual relieving documents; avoid statements about conduct or performance that may later be contradicted.

Suspension

For people who stay, suspension pending enquiry can protect evidence and witnesses. It is not a punishment, but it must follow the contract and any applicable standing orders or service rules, which may require a subsistence allowance for covered employees. Communicate it only after devices and access are secured; the announcement itself can trigger deletion.

The data dimension

Collecting data from departing employees is still processing personal data. Under the DPDP Act 2023, s. 7(i) treats processing for employment purposes, or to protect the employer from loss or liability, as a legitimate use. Collect what is proportionate to the allegation, record why, and keep investigation data secure. Our article on the DPDP Act and workplace investigations covers the detail.

Decision points

• Accept, defer or require notice? Depends on the contract and on whether the person's presence helps or harms the investigation.
• Interview before exit? If evidence is secured and the investigation is ready, yes. If not, preserve the ability to interview later through the contract or cooperation undertakings.
• Settle? Only after the facts are known, with approval from people independent of the subject.
• Civil or criminal action? Keep the options open; see our view on recovering from fraud.

Common mistakes

• Letting HR run it alone. Standard exit processes are designed for normal departures.
• Accepting devices back without imaging them first.
• Paying everything and releasing everything to make the person go away quietly.
• Glowing references given out of politeness or fear of dispute.
• Assuming the problem has left. The people who helped are usually still there.

Where we can help

We help companies manage exits during investigations: preserving devices and data, conducting investigation interviews, completing the investigation, and, where money has gone, tracing assets before they move further. Speak to us in confidence.