Investigations: Get it Right the First Time


Understanding Investigations

There is an old saying you only have one chance to make a first impression. The same can be said when conducting internal investigations. Get it right the first time using a sound and well thought out process, one that is effective and ethical. Establish this process before you are faced with a stressful and high profile allegation. Before we proceed, lets define an investigation as “a comprehensive gathering of facts from witness testimony, physical evidence,  document reviews, or other means that attempt to prove or disprove an allegation of wrongdoing.” This information is not intended to substitute for legal advice, nor is it a full and comprehensive investigative plan. But it does provide helpful hints on ways to begin, or improve upon, a process for internal investigations within your organization.

Sources and Motivation

Allegations of illegal or unethical conduct may come from one or multiple sources and often with fragmented pieces of information. The initial information may be reported through management’s chain-of-command, a HR reporting process, a code of conduct hotline, an internal audit, an anonymous whistleblower, or from outside sources. Regardless of how the information is received, the first step is to assess the credibility of the information. This is often referred to as “testing the complaint.” The decision to open an internal investigation should factor in:

  • The severity of the alleged offense.
  • The threat or risk to employees or the organization.
  • The credibility of the allegation.

Persons coming forward with an allegation may be motivated by a variety of legitimate reasons. Some of these reasons may also be less than honorable and therefore those motivations must be carefully vetted. However, persons with ulterior motives may still be reporting truthful information and the allegation should not be discounted simply because of their motives.

Investigative Strategy

An investigative strategy or plan should be developed once a decision is made to move forward with an internal investigation. Begin with determining what law, regulation, or company policy the allegation violates and what, if any, additional reporting requirements and timelines must be met. Consider what type of information needs to be gathered to prove or disprove the allegation. The composition of the investigative team depends on the type and severity of the allegation. In larger organizations this team may include a  representative from management, HR, Legal, Corporate Security or Investigations, IT Security, Compliance, Privacy, and if fraud is alleged Internal Audit. In smaller companies it may only be the owner, a legal advisor, and the investigator. Regardless of the size of the team one of the first decisions is whether to allow the person(s) being investigated to continue in their normal job duties. No two situations are alike, so careful consideration needs to be given at this point. If employee safety is a concern the decision should be quite simple. However, if the matter does not affect the safety of other employees the company may decide to move forward without removing the subject from the workplace.

Talk to the Lawyers

Legal counsel should assess whether the investigation should be structured in a way to maintain attorney-client privilege. The investigative plan should articulate what steps need to be taken to prove or disprove the allegation as well as who will have responsibility for each of those steps. Be flexible enough to adapt to unanticipated information you uncover and be careful of the “iceberg” effect, or only seeing what is apparent or on the surface. Dig a little deeper to ensure there is not a larger or more systemic problem. Developing tunnel vision may lead to missing more critical information.

Since the objective of an internal investigation is to identify, gather, analyze, and document the facts to make a reasonable and thoughtful decision, properly assigned roles and responsibilities are crucial. Understand the skill sets of those involved in the investigation to maximize the value they bring to the team. The use of a third party to conduct an internal investigation may be considered depending on the complexity of the allegation. One person or department should have the lead in conducting the investigation, and all information should flow through this person or department. This lessens the chance of duplication and ensures prioritization of investigative activity. It also helps keep the investigation on track and moving forward.

Step by Step

Begin with the least intrusive actions when developing an investigative strategy. This generally includes gathering and reviewing documents and records which are relevant to the investigation but can be obtained without bringing unnecessary attention. Because investigations may result in litigation or referral for prosecution, the authenticity of  information collected must be unquestioned. Take careful notes to document the origin of the information. Most information is stored electronically so it is important to have an electronic communication policy in-place.  This ensures employees understand their emails and other electronic communication in the workplace are not private and may be viewed by management. If it is necessary to retrieve information from a laptop, desktop, or other company device be sure this is done by qualified experts to ensure chain of custody is maintained.

Begin interviews with those on the periphery and work your way in; eventually interviewing those with direct knowledge of the allegation. Be cognizant of any new information or leads learned from each interview. The type of questions asked may vary as new information is learned. Remember that the confidentiality of the investigation is important to maintain its integrity. Stress to those interviewed and involved in the investigation of the need for confidentiality. Whenever possible the interviews should be conducted by persons trained in interviewing techniques with a basic understanding of deceptive behavior. Interviewers should be good listeners and be able to develop rapport with the interviewee. This enhances the quality of the interview and can help in eliciting additional information. A good interview is more than asking a question and documenting the response. A good interview requires a real time assessment of the information provided and enables the interviewer to follow-up with detailed questions. Keep questions short, concise, open ended and not leading. If the interviewee is confused by the question just imagine how confusing their response will be.

Subject Interviews

Interviewing the subject of an investigation is normally the last step in the investigative process. It is important to have collected and analyzed all the information gathered before the subject interview. Two persons should always be present for the interview with one taking the lead in asking questions and the other taking notes. You usually have only one chance at this interview so you need to be prepared and construct your questions accordingly. Have a plan on what to do with the subject of the investigation after the interview is completed. Consider all likely scenarios and plan accordingly.

Taking written statements from witnesses and subjects is always preferred especially if the matter may end up in litigation or referred to law enforcement. Good note taking is always important and is critical in lieu of written statements.

Closing Out an Investigation

An investigation should be closed once all investigative steps have been completed and all relevant information captured. In some cases this may happen sooner rather than later, especially if the evidence points to disproving the allegation. Some companies prefer the results of internal investigation to be memorialized in a written report while others companies only want an oral report to company executives. This decision should be made early on with the advice of legal counsel. If a written report is necessary, it should be composed by whoever has the lead in the investigation. Lastly, always consult your legal counsel before making referrals to outside agencies.

No two investigations are the same and each brings its own dynamics and challenges. Having clearly defined policies and procedures for conducting internal investigations is essential; as well as having buy-in from senior executives. Avoiding the following can also go a long way to ensuring a successful and ethical investigation:

  • Don’t hide or destroy relevant information.
  • Avoid the “head in the sand” mentality. Go where the evidence takes you.
  • Maintain the integrity of the investigative process and ensure confidentiality; the reputation of people and the organization are at-stake.
  • Don’t develop tunnel vision. Follow the evidence and not hastily drawn conclusions.

About the Author

Jim Dale is the owner and principal of Seven Citadels Consulting. Jim brings to clients more than 30 years of security and risk experience in both the private and public sectors. Formerly the Chief Security Officer (CSO) for three Fortune 500 companies, Jim is a graduate of the University of Nebraska at Omaha and was a career officer, commander, and special agent with the Air Force Office of Special Investigations.  He is a certified threat manager (CTM) and board certified in security management as a Certified Protection Professional (CPP). Jim is a member of the Association of Threat Assessment Professionals (ATAP), the International Association of Professional Security Consultants (IAPSC) and ASIS International.