Public/private relations in the field of security attract considerable academic attention. Usually, the state is central to the analysis, focusing on the diminishing role of a previously dominant state. The role that organisations themselves play in the investigation and settlement of their internal norm violations is, however, much less researched. An emphasis on the role of the state downplays the importance of such actions. This research paper, based on qualitative data from the Netherlands, highlights the role of the organisation as the principal actor in corporate investigations and corporate settlements. The legal constraints upon and day-to-day activities of corporate investigators are considered and the consequences of the distance between public law enforcement actors and corporate security are reflected upon. The paper arrives at the conclusion that the limited insight into the measures taken by organisations in response to internal norm violation can be considered problematic from a democratic, rule-of-law point of view. The freedom of action enjoyed by organisations within the private legal sphere makes oversight and control quite challenging.