The First Steps for Conducting Internal Investigations

Written by: James Hart

When the call finally came, Raquel Henderson lunged for the phone on her desk. 

Henderson was less than three months into her job as the HR director for a midsize family business in a rural part of the state. The company was the community’s largest employer and a point of pride for the hundreds of people who worked there. 

Or it had been a point of pride. A few days earlier, Henderson had received a whistleblower’s report. One of the company’s administrative assistants had accused a VP of particularly cruel workplace bullying, not just once, but in at least a dozen incidents. 

The VP — who was also the CEO’s son — swore none of it had happened. Unfortunately, word was starting to leak out into the community.

It was the first time Henderson had ever been responsible for an internal investigation, and she felt overwhelmed by the responsibility. She asked a family friend for advice, and they pointed her to the Investigator. 

“These things are always challenging and frequently stressful,” the voice on the phone said. “But the fact that you’re looking for expert help is a good sign — it shows that you’re taking things seriously.”

The company leadership insisted on an investigation that was above reproach, both thorough and thoroughly impartial. The company had in-house counsel, but Raquel noted that — while the company’s attorney knew the organization well — people might argue they were too close to the situation.

(And that was a fair point: The counsel and the VP had known each since the second grade.) 

The First Thing You Should Do 

“Before we go any further,” the Investigator said, “have you taken action to keep the assistant and the VP away from each other?”

It’s a best practice to keep the two parties away from each other, either by changing locations or work schedules. That way, if someone has been harmed, the company has taken action to prevent further activity. It’s a good idea for those plans to be reviewed by an attorney so they can ensure no one is being punished or retaliated against. 

In this case, to prevent the two parties from interacting, the VP was working at the company’s facility across town — a move that was vetted by the company’s internal counsel. 

When to Get Outside Help with an Internal Investigation

Raquel knew from her training that internal investigations could be led by any number of people: an HR leader, the company’s internal counsel or even company board members. But, because the company was relatively small, she thought an outside expert might be more likely to be seen as impartial.

Hiring a security firm comes with several advantages: 

  • They have more practical experience looking into these matters. In a typical year, a firm might conduct several investigations like this.
  • Their staffers often come from the law enforcement field and know how to create an organized, detailed process for interviewing witnesses and gathering the necessary evidence.
  • Because they’re not a part of the company and shouldn’t have ties with anyone there, it’s more likely their work will be seen as impartial.
  • The interviewing process can also become emotionally charged. A trained investigator will have more experience managing the situation. 

Raquel said they were still considering bringing in external counsel, too, and the Investigator said that would be fine — their team often worked alongside attorneys while conducting investigations. In fact, depending on the nature of the situation and what’s being alleged, it’s often better if a counsel takes lead. 

Anatomy of an Internal Investigation

Each internal investigation is a little different, the Investigator said, though I can give you a rough outline of what most include.

In most cases, the first step is to determine whether there should be an investigation, but in this case, the company had already decided there was enough to justify moving forward.

Next, you need to create a plan for the investigation: 

What’s the scope of the investigation? 

You’ll want to determine if the issue could be criminal conduct, a regulatory violation, a breach of company policies or something less serious. Was this a one-time violation or an ongoing problem? Does the company have any financial exposure? Depending on your industry, the allegation and the nature of your business, it’s possible the company could be the subject of a federal investigation, too. 

Who needs to be interviewed? 

In this case, that includes the two people at the heart of the investigation: the administrative assistant and the VP. What about co-workers? Other managers? In the course of the interviews, you may very well find other names that you need to add to the list. 

Some investigators ask witnesses to write down what they remember about an incident and then use what they wrote to look for inconsistencies. 

In other, more technical cases, it can sometimes be helpful to bring in subject-matter experts, though it wouldn’t be necessary in this case. 

What documents or other evidence needs to be gathered? 

You’ll want to touch base with the IT department to either preserve any documents, emails, etc., from the parties’ computers. You may also need IT to pause any automated, scheduled deletions they conduct of digital documents. Hiring a dedicated electronic forensics expert could be helpful, too. 

Who will conduct the interviews, and where and when will that happen? 

The goal of the interviews is to elicit as much information as possible, so you’ll want the interviewees to be comfortable. It may not make sense to hold the interviews in the workplace.

Decide how you’ll schedule the interviews. In most cases, it’s a good idea to block out time over a day or two. Make sure that you leave time between interviews so that your investigators have time to write down and review their notes and impressions from each talk. 

Once the interviews are conducted and all the evidence has been gathered, the investigators should produce a report documenting their findings and recommendations. From there, the company can decide what to do and what actions, if any, should be taken. 

And it’s important to remember that sometimes it’s not possible to reach a definitive conclusion. Either way, it’s important to communicate the findings to the two parties, so they know they’ve been heard. 

Internal Investigations Best Practices

Internal Investigations best practices: meeting and interviewing employees. An investigator meets with an employee to learn more about an incident.

There are a lot of complexities to handling these matters, which is why you’ll want counsel involved in some form. A situation involving potential criminal activity has to be handled much differently from a violation of company policy.

But some general principles apply in almost all situations.

  • Timeliness is critical. Obviously, nobody wants to rush things and make unnecessary mistakes, but generally speaking, it’s better to take action sooner. For starters, it’ll make it easier to get accurate recollections for your witnesses. And should the situation end up in court, you’ll be demonstrating that your organization took the matter seriously.
  • To the best of your ability, work to protect confidentiality for both the person who came forward and the person who’s being investigated. Limit what information you share with others in the organization. Advise those you interview not to talk with others about what they tell you. But be careful not to promise perfect confidentiality. In the course of interviewing witnesses, you may need to share details, like the nature of the charge, on a need-to-know basis.
  • Whether you have an internal or external counsel as part of your investigation, they need to make it clear to any employees that the attorney represents the company, not the employee — what’s called an Upjohn warning. If it’s ever an issue, the attorney-client privilege is between the attorney and the company.
  • Impartiality is essential, and you need to work hard not to drive the investigation one way or another. That needs to extend to the words you use, too. It’s not a complaint or accusation — it’s a report, and the person who brings it forward is not an accuser or a victim. They’re a reporter. You’re not investigating the accused or the target — that person is the subject of the investigation.
  • Retaliation — or even the appearance or threat of retaliation — can’t be tolerated. The company must do its best to ensure that nobody feels at risk for telling the truth.

“Nobody likes an internal investigation,” the Investigator said. “It’s usually a thankless task, and even if you do everything perfectly, it could just be the beginning of further action, like a court case. But it has to be done and done well. Otherwise, you’re only guaranteeing more and bigger problems down the line.”

The Takeaways

  • Getting outside expertise — whether that’s in the form of external counsel or a trained investigator — can help businesses ensure that an internal review is conducted correctly and impartially. 
  • Having a detailed plan will focus the investigation and allow the company to ascertain the facts promptly.
  • Confidentiality is key — both for the person who submits a report and for the person who’s the subject of that report. Perfect confidentiality isn’t always possible. Investigators may need to disclose basic information in the course of an interview.

At Chesley Brown, we understand that planning for the unknown can be daunting. That’s why we’ve built a framework that enables businesses to navigate and anticipate risk before it becomes a crisis. We are here to manage risk so you don’t have to. If you or your team have questions about conducting effective corporate investigations, our experts are here for you.

Sign up!

For industry-leading guides and analysis sign up for our blog below.

  • This field is for validation purposes and should be left unchanged.

Latest News

Emergency Response Plans - Firemen near their truck on the street having rest after they put out a fire at night. Emergency , danger, service concept. Firemen at work.

Emergency Response Planning for Shopping Centers, CIDs, Entertainment Districts and Other Large Locations

By Chesley Brown | July 17, 2024

It takes hard work and careful thought to create an effective emergency response plan for office towers and other commercial properties.  But what if — instead of a single commercial building — you need to…

Read More
Two ladies looking out window discussing how neighborhood watch programs help redisents feel safe.

Neighborhood Watch Programs: Empowering Residents

By Chesley Brown | July 9, 2024

Written by: James Hart The neighborhood watch, one of the oldest tools for community crime prevention, can still be a useful tactic today for combating crime and nuisance activity at commercial properties, especially when combined…

Read More
Archie Dinwiddie - Corporate Director of Compliance and Risk Management

Archie Dinwiddie Promoted to Vice President Risk Management, Training, & Compliance

By Chesley Brown | July 2, 2024

We are thrilled to announce the promotion of Archie Dinwiddie to Vice President of Risk Management, Training, & Compliance at Chesley Brown. With an impressive tenure of 23 years at the company, Archie has been…

Read More
Image of a stressed business owner with her head in her hands to reresent business continuity and crisis management

Disaster Recovery Strategies: Business Continuity in Crisis

By Chesley Brown | June 20, 2024

Written by: James Hart The best advice on disaster recovery and business continuity might actually come from the movies. As Rocky Balboa said: “It ain’t about how hard you hit. It’s about how hard can…

Read More
A group of people walking outside to represent how Community Policing Strategies can bring communities closer

Community Policing Strategies: Building Trust and Safety

By Chesley Brown | June 11, 2024

Written by: James Hart It’s always important to remember: Private security officers aren’t police, and police aren’t security officers. The two roles are both important, but they have fundamental differences. “Security officers can’t be everywhere,…

Read More
The 7 Step Guide for Building Business Continuity Plans that Work