Written by: James Hart
When the call finally came, Raquel Henderson lunged for the phone on her desk.
Henderson was less than three months into her job as the HR director for a midsize family business in a rural part of the state. The company was the community’s largest employer and a point of pride for the hundreds of people who worked there.
Or it had been a point of pride. A few days earlier, Henderson had received a whistleblower’s report. One of the company’s administrative assistants had accused a VP of particularly cruel workplace bullying, not just once, but in at least a dozen incidents.
The VP — who was also the CEO’s son — swore none of it had happened. Unfortunately, word was starting to leak out into the community.
It was the first time Henderson had ever been responsible for an internal investigation, and she felt overwhelmed by the responsibility. She asked a family friend for advice, and they pointed her to the Investigator.
The company leadership insisted on an investigation that was above reproach, both thorough and thoroughly impartial. The company had in-house counsel, but Raquel noted that — while the company’s attorney knew the organization well — people might argue they were too close to the situation.
(And that was a fair point: The counsel and the VP had known each since the second grade.)
The First Thing You Should Do
“Before we go any further,” the Investigator said, “have you taken action to keep the assistant and the VP away from each other?”
It’s a best practice to keep the two parties away from each other, either by changing locations or work schedules. That way, if someone has been harmed, the company has taken action to prevent further activity. It’s a good idea for those plans to be reviewed by an attorney so they can ensure no one is being punished or retaliated against.
In this case, to prevent the two parties from interacting, the VP was working at the company’s facility across town — a move that was vetted by the company’s internal counsel.
When to Get Outside Help with an Internal Investigation
Raquel knew from her training that internal investigations could be led by any number of people: an HR leader, the company’s internal counsel or even company board members. But, because the company was relatively small, she thought an outside expert might be more likely to be seen as impartial.
Hiring a security firm comes with several advantages:
- They have more practical experience looking into these matters. In a typical year, a firm might conduct several investigations like this.
- Their staffers often come from the law enforcement field and know how to create an organized, detailed process for interviewing witnesses and gathering the necessary evidence.
- Because they’re not a part of the company and shouldn’t have ties with anyone there, it’s more likely their work will be seen as impartial.
- The interviewing process can also become emotionally charged. A trained investigator will have more experience managing the situation.
Raquel said they were still considering bringing in external counsel, too, and the Investigator said that would be fine — their team often worked alongside attorneys while conducting investigations. In fact, depending on the nature of the situation and what’s being alleged, it’s often better if a counsel takes lead.
Anatomy of an Internal Investigation
Each internal investigation is a little different, the Investigator said, though I can give you a rough outline of what most include.
In most cases, the first step is to determine whether there should be an investigation, but in this case, the company had already decided there was enough to justify moving forward.
Next, you need to create a plan for the investigation:
What’s the scope of the investigation?
You’ll want to determine if the issue could be criminal conduct, a regulatory violation, a breach of company policies or something less serious. Was this a one-time violation or an ongoing problem? Does the company have any financial exposure? Depending on your industry, the allegation and the nature of your business, it’s possible the company could be the subject of a federal investigation, too.
Who needs to be interviewed?
In this case, that includes the two people at the heart of the investigation: the administrative assistant and the VP. What about co-workers? Other managers? In the course of the interviews, you may very well find other names that you need to add to the list.
Some investigators ask witnesses to write down what they remember about an incident and then use what they wrote to look for inconsistencies.
In other, more technical cases, it can sometimes be helpful to bring in subject-matter experts, though it wouldn’t be necessary in this case.
What documents or other evidence needs to be gathered?
You’ll want to touch base with the IT department to either preserve any documents, emails, etc., from the parties’ computers. You may also need IT to pause any automated, scheduled deletions they conduct of digital documents. Hiring a dedicated electronic forensics expert could be helpful, too.
Who will conduct the interviews, and where and when will that happen?
The goal of the interviews is to elicit as much information as possible, so you’ll want the interviewees to be comfortable. It may not make sense to hold the interviews in the workplace.
Decide how you’ll schedule the interviews. In most cases, it’s a good idea to block out time over a day or two. Make sure that you leave time between interviews so that your investigators have time to write down and review their notes and impressions from each talk.
Once the interviews are conducted and all the evidence has been gathered, the investigators should produce a report documenting their findings and recommendations. From there, the company can decide what to do and what actions, if any, should be taken.
And it’s important to remember that sometimes it’s not possible to reach a definitive conclusion. Either way, it’s important to communicate the findings to the two parties, so they know they’ve been heard.
Internal Investigations Best Practices
There are a lot of complexities to handling these matters, which is why you’ll want counsel involved in some form. A situation involving potential criminal activity has to be handled much differently from a violation of company policy.
But some general principles apply in almost all situations.
- Timeliness is critical. Obviously, nobody wants to rush things and make unnecessary mistakes, but generally speaking, it’s better to take action sooner. For starters, it’ll make it easier to get accurate recollections for your witnesses. And should the situation end up in court, you’ll be demonstrating that your organization took the matter seriously.
- To the best of your ability, work to protect confidentiality for both the person who came forward and the person who’s being investigated. Limit what information you share with others in the organization. Advise those you interview not to talk with others about what they tell you. But be careful not to promise perfect confidentiality. In the course of interviewing witnesses, you may need to share details, like the nature of the charge, on a need-to-know basis.
- Whether you have an internal or external counsel as part of your investigation, they need to make it clear to any employees that the attorney represents the company, not the employee — what’s called an Upjohn warning. If it’s ever an issue, the attorney-client privilege is between the attorney and the company.
- Impartiality is essential, and you need to work hard not to drive the investigation one way or another. That needs to extend to the words you use, too. It’s not a complaint or accusation — it’s a report, and the person who brings it forward is not an accuser or a victim. They’re a reporter. You’re not investigating the accused or the target — that person is the subject of the investigation.
- Retaliation — or even the appearance or threat of retaliation — can’t be tolerated. The company must do its best to ensure that nobody feels at risk for telling the truth.
“Nobody likes an internal investigation,” the Investigator said. “It’s usually a thankless task, and even if you do everything perfectly, it could just be the beginning of further action, like a court case. But it has to be done and done well. Otherwise, you’re only guaranteeing more and bigger problems down the line.”
- Getting outside expertise — whether that’s in the form of external counsel or a trained investigator — can help businesses ensure that an internal review is conducted correctly and impartially.
- Having a detailed plan will focus the investigation and allow the company to ascertain the facts promptly.
- Confidentiality is key — both for the person who submits a report and for the person who’s the subject of that report. Perfect confidentiality isn’t always possible. Investigators may need to disclose basic information in the course of an interview.
At Chesley Brown, we understand that planning for the unknown can be daunting. That’s why we’ve built a framework that enables businesses to navigate and anticipate risk before it becomes a crisis. We are here to manage risk so you don’t have to. If you or your team have questions about conducting effective corporate investigations, our experts are here for you.
For industry-leading guides and analysis sign up for our blog below.
Reasons to Hire an Outside Security Risk Firm
The security services industry is one of the fastest growing industries in America today. With so many disruptive technologies, emerging threats, and the growing frequency of natural disasters, its easy to understand why — It…Read More
The Ultimate Guide for Small Businesses to Combat Economic Espionage
For decades, the US has been a victim of economic espionage — a foe that is now costing American companies billions of dollars in lost revenue. From hacking government websites to infiltrating research institutions with…Read More
Preventing Civil Unrest
We’ve all recoiled in disbelief and horror as we watched scenes of violence stream across our TVs. The violent insurrection we saw in the U.S. capitol was unprecedented. That is to say nothing of the …Read More
What Achilles can Teach us About Threat Management
By: Dell Spry There are numerous similar, seemingly inconsequential, soft targets scattered across our country unprotected by a single surveillance camera or even a strand of barbed wire. Is this issue getting the attention it…Read More
The SolarWinds Supply Chain Attack: What Businesses Need to Know
What is the SolarWinds Supply Chain Attack? SolarWinds, the Austin-based cybersecurity firm, found itself in the middle of a catastrophe due to internal security lapses. The firm recently earned headlines for making it to the…Read More