A company structure is not a substitute for accountability
A company can organise ownership, contracts and operations, but the entity label does not decide every person’s criminal responsibility. PECA allegations require examination of the relevant acts, authorisation and mental elements, together with other applicable legal principles. [1]
Management should be able to identify who selects clients, approves scripts, administers systems, authorises payments and handles complaints. Where every decision is attributed vaguely to “the company”, both prevention and a later factual explanation become difficult.
Maintain a responsibility map tied to actual authority. Do not create titles that conceal the real decision-maker or assign a junior employee responsibility for controls they cannot operate.
Make compliance part of campaign approval
Require commercial, operational and relevant legal or technical review before launching a new service. The depth should match the risk. A simple support desk and a campaign handling financial or health information should not necessarily pass through the same abbreviated process.
Record approvals and conditions, and define who can suspend disputed work. The person responsible for compliance must have a usable escalation route rather than only a duty to sign a policy after management has already committed to the client.
Changes also matter. A new script, target market or data source can alter the risk even where the client remains the same. Historical approval is not perpetual permission for every later instruction.
Employment rights require their own legal analysis
Staff contracts, wages, working arrangements, leave, safety and disciplinary processes should be assessed under the applicable employment relationship and provincial law. Do not assume that one provincial rule or a foreign HR template applies uniformly across Pakistan.
This article does not prescribe a universal minimum wage, working-hours limit or statutory benefit threshold. Those details need current location- and workforce-specific verification. Calling an individual an independent contractor also does not necessarily settle the legal classification if the actual relationship differs.
A cybercrime allegation should not become an excuse to ignore earned entitlements or impose arbitrary punishment. Obtain advice on any proposed employment action and separate it from pressure to give a particular statement in an investigation.
Create a safe route for raising questionable instructions
Employees should know where to report false claims, suspicious data use, payment irregularities or requests to delete evidence. The process should allow escalation beyond the supervisor whose conduct is questioned.
Treat reports seriously and preserve the relevant facts. Do not promise absolute anonymity or a universal statutory whistleblower protection that has not been verified for the situation. Explain how information will be handled and the limits of confidentiality.
A reporting route is ineffective if employees are punished for using it or if every complaint is sent back to the person complained against. Governance should reward early correction rather than encourage silence until a customer or agency discovers the problem.
Internal investigations must remain lawful and proportionate
Define the allegation, scope, decision-maker, evidence sources and individuals affected. Preserve authorised business records and access logs. Do not assume that an employer may enter every private account or seize personal devices without an appropriate legal basis.
Give the relevant person a fair opportunity to address matters as required by the applicable process. Separate established facts, disputed accounts and conclusions. Avoid a report that declares criminal guilt when the business has conducted only an internal employment inquiry.
Involving a lawyer does not automatically make every underlying fact or document privileged. Handle legal advice and factual evidence appropriately and obtain specific guidance where privilege is asserted. PECA’s authorisation and confidentiality questions remain relevant to the investigation method. [1]
Preserve individual representation and conflicts
The company, director, manager and employee may not share the same interests. If a disputed instruction came from senior management, the employee’s account may conflict with the company’s preferred position. Counsel should assess those conflicts before accepting a joint role.
Do not make salary, references or resignation terms conditional on a false statement. Nor should staff be encouraged to blame an absent colleague without evidence. Accurate role records and truthful cooperation protect the integrity of the process. [2]
A company may facilitate legal assistance, but it should not treat that assistance as ownership of the employee’s account or defence.
Worked example: a complaint about a high-performing campaign
Imagine a team leader reports that agents are rewarded for claiming an unauthorised brand affiliation. Management should preserve the scripts, messages and incentive records, pause the disputed instruction where appropriate and investigate the actual practice.
The review should consider who approved the representation and whether training contradicted the written policy. Dismissing the reporting employee or rewriting the policy without preserving the earlier record does not resolve the underlying exposure. [1]
Any corrective employment action should follow a lawful process. Client notifications, regulatory questions and potential criminal exposure should be assessed separately rather than compressed into an internal HR conclusion.
Make the board or owner review measurable decisions
Useful reporting identifies unresolved campaign risks, overdue approval updates, significant complaints, access incidents and corrective actions. It should show who owns the problem and what decision is required, not simply display the number of staff who attended training.
After an incident, ask whether the system encouraged the conduct: unrealistic targets, unclear authority, weak access controls or fear of retaliation. Fixing those conditions is more valuable than finding a convenient individual to blame.
Good governance does not guarantee that misconduct will never occur. It makes lawful instructions clearer, problems easier to detect and responsibility more accurately evidenced when a dispute arises.
Legal assistance for this issue
Legal Bridge LLP can review Pakistan-side governance, contracts and individual legal exposure. Detailed employment obligations need a current provincial assessment, and conflicts between management and employees must be addressed separately.
