Essential step needed: the moment an investigation* starts the company's bank account is frozen. When unfrozen (it doesn't need to take long, just enough to tell the bank the conditions) no payments can be made to the shareholders or directors or close relatives of the same without the investigator's express permission and to get that permission there needs to be a very good explanation; an explanation so good that it's unlikely ever to be good enough. Any other payments also need to be run by the investigator to ensure they are essential to the running of the business.
*Investigation means an investigation by any regulator, ICO, OfCom, Trading Standards or whatever.