How to Plan an Investigation

Return to Program Best Practices
Created by John D. Thompson, Security Executive Council Subject Matter Expert Faculty

At many companies, small security staffs mean other departments— commonly human resources or legal—necessarily help conduct investigations. John Thompson’s Corporate Investigations for Non-security Professionals, published by the Security Executive Council, aims to ensure that information is collected in a reliable and legally responsible manner. The following is an abridged excerpt on the planning phase of an investigation for non-security professionals.

The objective of a security investigation is to get the facts so that a resolution of the complaint and situation can be achieved. At the same time, it is possible that some day a jury or attorneys outside the organization might scrutinize every aspect of any investigation conducted. For example, the organization might have to turn over to outside attorneys every note the investigator has written about the investigation, and the investigator might have to recount every conversation he or she had involving the investigation. Moreover, someone’s job or well-being might depend upon the quality of the investigation. Thus, an investigation is not something that should be done haphazardly or without a clear plan in mind. Many investigators have declared their embarrassment to me when I have reviewed their investigation file two years after the investigation in preparation for a deposition or trial testimony. The investigator’s memory naturally is poor about the investigation because it is years later and numerous investigations have come and gone in the interim.

Worse, the investigator’s notes often are cryptic, undated and virtually useless. What seemed like a perfectly reasonable investigation plan at the time is impossible to decipher later. Because every part of an investigation might later be subject to scrutiny, every part of the investigation should be documented, including the up-front planning process. The following considerations should help the investigator plan an investigation. This, in turn, should lead to more accurate and complete information obtained and greater legal protection for the organization.

Minimize witness intimidation. As the investigator begins thinking about how to conduct the investigation, he or she must confront the possibility that certain witnesses to the investigation might feel intimidated by the alleged wrongdoer, even by the simple fact that the alleged wrongdoer is in the workplace. Even worse, the alleged wrongdoer (and even the complainant) might intimidate, harass, or retaliate against witnesses in an attempt to influence the outcome of the investigation. It might be necessary to remove the alleged wrongdoer, the complainant or both individuals in order to maximize the information obtainable from other witnesses. On the other hand, removing an employee from the workplace during an investigation is a serious human resources matter. If the investigator believes that removing an employee from the workplace is necessary to remove possible intimidation, he or she should consider consulting with the need-to-know group to obtain a consensus on such an action.

Form investigative team and divide duties. Interviews often will constitute a major part of the investigation, and it could be a serious mistake to conduct significant interviews one-on-one. If the investigation is legally challenged, the plaintiff inevitably will contest the accuracy of the interviewer’s recollection of the interview. If the organization has two witnesses to interview who have similar recollections, it will be more difficult for the plaintiff to attack the credibility of the investigation. Moreover, it is extremely difficult to ask intelligent questions, listen closely to the answers, formulate follow-up questions and take accurate notes all at the same time. A solution would be to have two interviewers, where one interviewer is responsible for the questioning and the other interviewer is responsible for note-taking. The note-taker also can ask follow-up questions that the primary questioner might miss. This division of responsibility should remain consistent throughout the interview process. Two interviewers will give you two different perspectives on the situation. Many difficult investigations require tough credibility judgments, and it would be valuable to know, for example, that two interviewers have different perspectives on the credibility of a key witness.

Establish the time frame for the investigation. Many times, the organization can avoid liability for wrongs committed by its employees, even supervisory employees, if management takes quick and appropriate action to remedy the situation. Thus, it is always desirable to conduct the investigation promptly after becoming aware of the issue. Impress upon others the need to investigate and resolve the issue quickly and obtain the cooperation necessary to have interviewees available. Of course, if the investigation becomes more complicated than anticipated or unanticipated delays occur, extend the deadline if necessary to do a complete investigation.

Confirmatory memorandum. The investigator must determine whether to provide the complainant with a confirmatory memorandum. This frequently is desirable when the complainant raises a verbal complaint. The memorandum serves a variety of purposes. Most important, it provides the complainant with a clear understanding of the expectations that the organization has for him or her during the investigation.

A letter to the complainant should include the following items:
  1. A statement confirming the issues that the complainant has raised.
  2. A list of all facts provided by the complainant.
  3. A request that the complainant add, delete or correct the facts summarized and a confidential means to provide this information.
  4. A statement identifying the investigator(s) and confirming that the complainant has agreed the investigator(s) will be fair and objective. If the identity of the investigator(s) was not previously known to the complainant, the letter should include a statement that the complainant finds the investigator(s) to be fair and objective unless the complainant indicates otherwise.
  5. The anticipated time frame of the investigation and the method and timing of feedback from the investigator(s).
  6. A statement that the complainant’s cooperation and participation in the investigation is required.
  7. A statement that the complainant should not discuss this matter further—other than with the investigator(s)—while the investigation is being conducted, particularly within the organization.
  8. A statement of the consequences of the complainant’s failure to follow these instructions. The consequences will depend upon whether the complainant is an employee or third party, of course.

Obtain relevant documents. In many investigations, there is a paper trail that provides important information for the investigation. The documents the investigator reviews will answer many questions, raise many other important questions that the investigator will want to ask, identify individuals that the investigator will want to interview, and so on. Documents that the investigator should consider obtaining include: personnel files, telephone records, expense account records, computerized personnel information, appointment calendars, time cards, building entrance/exit records, computer/word processing disks and hard drive, e-mail records and voice mail records.

Special investigative techniques. With respect to many investigations, gathering relevant documents and interviewing relevant individuals will be the extent of the investigation conducted. Sequentially, the investigator should review the relevant documents obtained from the organization and then plan for the interview process. Therefore, the remainder of this section discusses planning for the interview process. However, there are certain times when special investigative techniques beyond mere interviews are appropriate. These are almost always investigative techniques that have a high legal risk and never should be discussed or implemented without legal counsel. In fact, many of these techniques should require high-level approval before they may be utilized, including the following: internal audit, physical investigation (fingerprint, handwriting, voice analysis), physical surveillance, polygraphs, searches of organization or private property, and electronic monitoring or surveillance.

Prepare opening and closing comments. For each interview, the investigator will want to have a set of opening comments and instructions. Similarly, the investigator will want to have a set of closing comments and instructions. This is the part of the interview that is “canned” and not really dependent upon what any particular individual says. Therefore, there is no excuse for being unprepared or “missing” a particular point. For example, I once had a witness claim that she was being retaliated against after an interview. When asked why she did not immediately report this, her answer was that she did not know that she should and did not know to whom to report it. If true, the investigator was at fault for not providing this information to her as part of the “canned” opening and closing comments.

Prepare a set of written questions. This has several advantages. First, it will require the investigator to think carefully in advance about what information is needed, how best to elicit information from each individual and how to protect the confidentiality of parties. Second, it will permit the investigator to organize the interview and develop a logical sequence for questions. Third, it enables the investigator to ask precisely the same questions of multiple individuals and ensures that the investigator will not forget to ask certain questions. The investigator must be careful, however, not to be so tied to an outline that he or she fails to ask necessary follow-up questions or explore something identified by a witness that was not in the outline.

Multiple interviews. It is a rare investigation that resolves all questions after interviewing witnesses only once. First, the investigator will frequently learn new information later in the investigation process that he or she will need to discuss with previously interviewed individuals. Second, multiple interviews are an excellent way to assess credibility. Challenging an individual with contrary information, asking the same question in a slightly different way or asking about information learned since your first interview of the individual can give a better assessment of the credibility of that individual. Occasionally, the investigator might want to involve different interviewers to conduct a second round of interviews. This is appropriate if the first set of interviewers might have missed or been unable to obtain some critical information, or if it provides a valuable new perspective on the situation or if they possess different investigative skills, and so on. This approach also has drawbacks, such as creating more potential organization witnesses in any subsequent litigation. Do not adopt this approach without consulting with legal counsel. There may be situations that call for simultaneous interviews of individuals, ensuring that the individuals do not have the opportunity to contact each other prior to the interview. This situation can be addressed either by having the first interviewee remain in a room with a witness until the second interview starts, or by having simultaneous interviews by qualified investigators.

Written statements. Written statements minimize the opportunity for interviewees to dispute the investigator’s recollection of the interview or change their story. Statements also are a highly persuasive form of evidence. Many plaintiff lawyers have backed off when shown statements of several individuals refuting their client’s story. Consult with legal counsel about this decision.

Taking notes. If the investigation is later challenged legally, the organization will be asked to defend the fairness and quality of the investigative process. The plaintiff will argue that the organization came to the wrong result because the investigator did a poor investigation. The investigation will be more legally defensible if the organization can demonstrate that the investigator planned the investigation process, that the investigator considered each of the issues discussed in this section and that the investigator had rational reasons for following or not following the suggestions contained in this section. As always, contemporaneous notes about how the investigation was planned will be more accurate and credible to a jury or judge than oral testimony at a later point.

Return to Program Best Practices