Are You Following These 16 Investigation Best Practices?
Start your investigation with a clear plan, include strong evidence, conduct effective interviews and finish with a thorough report.
You probably know these things (and the other things not to do), but when was the last time you brushed up on investigation best practices?
We've compiled 16 tips from investigation experts across disciplines to ensure your next investigation is timely, fair, organized and effective.
Jump to a section:
To keep your investigation running smoothly, manage it smartly
With so many moving parts, managing investigations can be difficult, especially if you have a large caseload on the go at once. Download this free eBook to learn how to establish a formal management process for more consistent and efficient investigations.
After receiving a report, your first step is to take action that will protect the reporter, the accused and the company (if applicable). Employment attorney Allison West suggests asking: "Is everybody safe that we can just put things on hold until we're ready to start? Or do we need to do something?"
This could mean separating the parties (e.g. moving desks, changing schedules, transferring departments), temporarily suspending one or both parties with pay or changing the chain of reporting during the investigation.
Just be careful that your actions can't be interpreted as retaliation or discrimination. Before taking action, consult a legal expert.
2. Over-Communicate Your Process
Whether they're a reporter or the accused, people want to be treated fairly, seriously and compassionately during an investigation. To make them feel comfortable, the first step of any investigation is explaining the process to all involved parties.
Meet with each party separately, explaining the investigation steps with a proposed timeline. Introduce the investigative team and go over their credentials. Finally, remind them that they can come to you with questions and concerns any time during the investigation.
"Procedural fairness is really about process. If you focus on process, it'll go a long way," says Lorene Schaefer, attorney and CEO of Win-Win Resolve, Inc.
An effective investigation starts by getting your tasks and goals organized. Use our free investigation plan template to outline yours.
3. Set Goals for the Investigation
Setting goals for your investigation gets the whole team on the same page and keeps everyone on track. It's important to ensure that these goals fit the nature and severity of the report and are realistic for your team's size and deadline.
"Talking about the truth is not the avenue you want to go down" when setting these goals, explains West. Each party might hold a different version of "the truth," which will make investigating difficult. Instead, focus on uncovering facts and linking them to a potential policy or regulatory violation.
4. Compose a Multi-Disciplinary Team
"Do you need a team with deeper expertise?" asks West. Then "you need the right people that have that objectivity and the skill sets" that can help you investigate more thoroughly.
Hiring an external expert could help you find more and stronger evidence than your internal investigators could. Depending on the investigation, you might benefit from hiring:
- Forensic accountants
- IT experts
- Employment law experts
- Auditors
Collecting Evidence
5. Use Public Records and Open Source Intelligence
Obtaining external documents or those from other departments can take a long time, if you get them at all. While you wait, tap into open source intelligence (OSINT) and public records. These are publicly available, often free or cheap to use/obtain and can provide information on your subject that you never would have thought to look for.
"Public records are what tie the information that we find online together with what we are going to look for," says Cynthia Hetherington, investigation expert and founder of Hetherington Group. These documents can help you determine an interview subject's credibility, confirm information you already have or send your investigation in a whole new direction.
Strong online research skills can improve your investigations' efficiency and effectiveness. Watch this free webinar to learn tips and tools for gathering information online.
6. Document Evidence
As you're collecting evidence, take note of where, when and how you find it. Make copies of documents and files and store them in one centralized location. "Everything that you have written down is something that you won't have to struggle to remember," says digital forensics expert Andrew Neal.
For digital evidence, "if you're collecting from a device that's not your own, take pictures of the computer. Take pictures of the environment in which the computer was found," Neal says. Take screenshots of social media profiles, websites and blogs in case the accused person deletes evidence.
RELATED: 15 Types of Evidence and How to Use Them in an Investigation
7. Follow a Four-Step Process
According to Neal, there are four key steps to evidence collection. First, "you need to understand what it is you're going to be collecting," so determine a scope. This includes who you are investigating and where you will look for evidence (e.g. devices, platforms or systems, physical locations).
Next, make a plan based on the scope. How long will evidence collection take? How much will it cost? What equipment and programs will you need? Will you need to travel? How will you gain access to the evidence?
Then, prepare for collection. Do background research to determine if you have adequate resources to carry out your plan. For example, Neal says, "collecting data from an iPhone may require a different tool than collecting data from an Android phone." Gather the tools and storage devices you'll need for the investigation.
Finally, "the collection is not just like we show up, plug in and go," says Neal. You need to test your equipment, make sure you have any passwords you need, ensure the environment is what you expected and document each step. Finish by having the subject or other relevant person sign off on your collection to create an audit trail.
8. Know How to Read Social Media Evidence
Many people have at least a small online presence these days, making social media a potential treasure trove of evidence. However, you have to understand each platform to gather the best and most information possible.
For instance, says Neal, a Tweet on Twitter has multiple components:
- The actual Tweet text
- "@" tags another user, whose profile you can then visit for subsequent evidence
- "#" identifies a topic that could clarify or connect the subject to something (e.g. #PlayingHooky for an employee suspected of committing time theft or insurance fraud)
- "RT" means the person is sharing another user's Tweet, connecting the users and/or sentiments
Familiarize yourself with the format of popular sites including Facebook, Instagram, YouTube, Reddit, Twitter, Pinterest and TikTok. Knowing how profiles and posts look and work helps you dive deeper into your investigation.
Conducting Effective Interviews
9. Start by Establishing Rapport
If you barrel into an investigation interview demanding information, your subject probably won't want to cooperate, especially if you're an external investigator.
They might already feel intimidated or unsure, so it's important to start the interview slowly. Explain the process at the start and as you go along. Use small talk to get them to warm up to you. Answer any questions they have for you.
John Hoda, a police-trained interviewer and PEACE trainer, compares the practice to shifting gears on a car. "If you never establish rapport, your 'car' never shifts out of that low gear. In other words, you can waste a lot more energy and time, but you're not going to get any further or faster."
10. Interview the Reporter or Complainant First
According to investigation expert and Principal of Winter Compliance LLC, Meric Bloch, "it's important to debrief the reporter on what he or she knows and how he or she knows it. That way, you can decide on the best resolution strategy."
Was the report made in good faith? Is it based on hearsay? Is the problem recurring? What do you need to do to protect the reporter/victim/your company?
After you've answered these questions using information from the reporter's interview, you can move onto other witnesses and, finally, the accused person. Interviewing the accused person last gives them the opportunity to respond to the allegations and explain their side of the story.
RELATED: How to Overcome 4 Common Challenges of Virtual Investigation Interviews
11. Let the Interviewee's Behavior Guide Your Questioning
During the course of an interview, a subject might go from chatty to tight-lipped, still to fidgety or calm to angry. A behavioral change could indicate deception, but also fatigue, boredom, thirst or hunger, a question that triggers an unrelated past memory or a multitude of other things.
"Rather than right off the bat interpreting that change as being a function of deception, we're going to use that change to guide us with regard to our questioning and then ultimately allow us to articulate what we saw and what we heard," suggests Don Rabon, CFE and investigation expert.
In your notes, record the interviewee's body language and tone along with their responses. Then, let this guide your questioning approach. Are they hesitant to talk? Try building stronger rapport. Do they seem nervous about direct questions? Ask more open-ended questions instead.
12. Make the Interviewee Own Their Story
Summarizing the interview subject's answers in your own words shows you're listening and that you understood them correctly. This practice also forces the interviewee to "own or commit to their narrative," says Rabon.
If they seem hesitant or confused, they could be deceiving you. Try asking some previous questions in another way to see if you get the same answers. Then, move the interview forward with a new open-ended question.
Writing Investigation Reports
13. Make the Report Understandable by Anyone
An investigation report's purpose is to guide stakeholders as they decide how to handle an incident. But it's not very helpful if it's full of errors, buzzwords, abbreviations or jargon.
Instead, make it clear and concise. Xan Raskin, SPHR and founder of Artixan Consulting Group, suggests writing a report that is "organized so that anyone, internally or externally, can understand [it] without having to reference other materials."
Stakeholders might come to you with clarifications sometimes, but shouldn't constantly have to ask what a word means or where you got a piece of information. This back-and-forth wastes time and could easily be remedied with a more thorough report.
14. Open with an Overview
Starting your report with an introduction section helps the reader orient themselves. This is especially helpful if the investigation took a long time or the decision-maker is dealing with a large caseload.
In one or two paragraphs, says Raskin, outline:
- How and when the problem arose and was brought to attention (name/position of reporter and accused)
- The name and title of the investigator(s)
- A brief summary of your investigative process
- Start and end dates of the investigation
- A high-level summary of the allegations/incident
Knowing the major details first gets the reader ready to dive into your more detailed findings.
Your reports should be thorough, compliant and consistent every time. Download our free investigation report template to streamline the writing process.
15. List and Attach Evidence Documents
Emails, performance reviews, time sheets, disciplinary records and relevant policies all provide information that help you draw a conclusion. They're important to the investigation, so include them in both the body of your report and an appendix.
At a minimum, list the documents you consulted as evidence, including their dates. If possible, says Raskin, attach a copy of each document.
"Including all of this may be time-consuming," she says, "but it does ensure that everything's in the same place, and it's easy to access when and if litigation occurs or an agency charge results or there's a reason to revisit the report."
16. Document Your Findings
"Your job is to make a finding of facts, and provide the facts that support the conclusion reached," says Raskin. In other words, it's not enough to say "Manager violated Company's discrimination policy" and leave it at that.
Provide all the evidence you gathered (with references to the source for each fact) first, then tie it to your findings and suggestions. Raskin suggest something like:
"The evidence shows that Manager repeatedly interrupted and raised his voice towards Employee at meetings, criticized her work and removed her from the team on an important project. This conduct started shortly after Employee announced to Manager that she was pregnant. The evidence shows that the quality of Employee's work was no different after she announced her pregnancy than before. Manager was unable to point to legitimate business reasons for removing the project from Employee's responsibilities or provide objective reasons for criticizing her work. These facts support a finding that Manager treated Employee in an adverse manner only after he learned she was pregnant, which is in violation of Company's policy on discrimination and harassment prevention."
Investigation best practices can change with technological developments and the state of the world. But these four general principles are timeless: start with a well-thought-out plan, collect evidence fairly and thoroughly, interview subjects with compassion and a keen eye and wrap it up with a detailed report.