A good investigation can act as a shield, bolstering an organization’s defense and helping to avoid liability or mitigate damages. However, it is far more common that an investigation is a sword to find and cut out wrongdoing in an organization before an outside party or agency comes in.
Complaint intake and investigation are a company’s first (and possibly only) opportunity to hear about an allegation, check it out, and, as necessary, fix it. No compliance program is foolproof—there is always some person who slips through the cracks and behaves badly (often called the “bad apple”) or some system of controls that breaks down. While much of ethics and compliance is about prevention, detection is its twin, and the best tools of detection are often effective complaint intake and investigation. In hindsight, a government agency, judge, or even jury will ask the following of an investigation:
-
What did the organization know?
-
When did the organization know it?
-
How quickly did the organization undertake an investigation?
-
Was the investigation adequate?
-
Did the organization detect and adequately address any wrongdoing in a timely and appropriate manner?
-
Did the organization follow up on the effectiveness of the corrective action?
Having an effective framework for complaint intake and investigations helps an organization cut down risks at an early stage, manage employee and external issues, and message the expectations employees and the public can have about how the organization manages such matters and those involved. The framework and tools for investigations should reflect the values, philosophy, risks, and goals of the organization. To make good decisions, you need information. Complaints and investigations provide access to information and can be valuable tools in analyzing data, correcting problems early, and spotting possible trends.
Creating an Organizational Investigations Program
Regardless of the organization’s size, most organizations have investigations occurring—whether as part of a structured and thought-out formal program by trained personnel or as done on the frontline by managers who hear issues of concern. Therefore, it is important to identify the current personnel who undertake organizational investigations and get their input, buy-in, and alignment as you seek to create a formal organizational investigations program. Further, organizations should consider any change management needed to move from the current state to an implemented investigations program with compliance oversight.
Organizations considering and developing an organizational investigations program should undertake the following basic steps:
-
Identify the organization’s information points and possible sources of information for issues and complaints of all types.
-
Identify the investigations framework currently in place.
-
Conduct a skills assessment of those who have or could potentially be asked to conduct investigations and develop or identify a training program for internal investigators.
-
Design or evaluate the investigations framework, with an eye to the organization’s risk profile.
-
Consider the organizational philosophy and strategic goals regarding investigations and the rights and expectations of witnesses and investigators.
-
Consider with other key risk management functions whether any additional policies or procedures are needed and develop accordingly with any necessary training modules or implementation support.
-
Schedule a timeline for the implementation of the investigation’s framework considering existing investigative activities (and the input and buy-in of those stakeholders) and organizational culture with change management in mind.
-
Implement the designed organization structure, measure and monitor effectiveness, and adapt to changes in organization and environment as needed.
In addition to these steps, there are a few other matters to consider in creating an investigations program: the need for an investigations case management system, the issues of attorney-client privilege, the possibility of the need to report an issue to a government agency, and global issues.
Find the Organization’s Information Points
Employees always have information about where the issues and systems breakdowns are; the real trick is obtaining and effectively harnessing that information. Effective compliance functions tap into the organization’s many information sources and provide employees and others a safe place to share important information about suspected problems and issues. Then the organization must have a mechanism to sort the chaff from the wheat to determine which information and issues merit investigation and manage those investigations accordingly.
Thus, the first task for organizing an investigation framework is to identify the various information points in an organization (those persons and functions likely to be frontline recipients of complaints and reports). Following, the compliance function should create or utilize the various paths to reporting and encourage that reporting. Finally, the organization must determine how and where to handle the different types of investigations.
Organizations need to consider, based on their size and organizational structure, where information points for employee complaints exist. Most organizations have a variety of sources of information and information points that will include some or all of the following:
-
Employee or partner/vendor background checks
-
Personal reporting by an employee, vendor, consultant, or other party to a manager or to human resources, security, compliance, management, or other personnel
-
Compliance helpline reporting (phone/electronic)
-
Workplace rumors
-
Audit reviews
-
Expense report incongruities
-
Calls, emails, or letters from friends/family of employees or vendors, consultants, partners, or competitors
-
Anonymous calls, emails, texts, or letters
-
Websites, blogs, apps, and other social media posts/communications
-
Exit interviews
-
Information from the Employee Assistance Program
-
Contact from law enforcement, government investigators, or news personnel
-
Employee disciplinary actions
-
Litigation trends
-
Liability insurance trends
-
Risk assessment or other employee surveys
Increasingly, because social media channels allow such broad communication by nearly anyone, it is important to consider whether and how to engage in social listening/monitoring about issues that may be published about the organization. The reality is that much information about possible compliance violations or issues is still directly transmitted person-to-person, and the company and compliance function need to take care to ensure that the information makes its way to the appropriate location for issue management, investigation, and resolution. It is important for the compliance function to have insight into these reporting avenues and understand who controls the information flow from them. Based on that assessment, the organization needs a mechanism to make decisions about which matters need to be funneled where and create effective documented processes or procedures to ensure proper handoff.
Once the information sources are determined, and the investigations program is designed, it is important that (at a minimum) those persons in a position to receive information related to complaints or possible compliance issues be trained on the following:
-
Spotting the issues and their significance
-
Responding appropriately to the person raising the complaint, including addressing employee concerns about confidentiality
-
Getting the issues to the right party to manage and possibly investigate in a timely fashion
-
Preparing for ongoing monitoring to ensure that the issues have been effectively resolved and no retaliation is occurring
Conduct an Investigation Skills Assessment
In addition to identifying the key organizational information points, it is important to understand the current skill sets and experiences of those in the organization as to investigations. Those skills may exist within the organization and/or with outside investigators the organization may opt to utilize. Regardless of whether investigations are to be done by internal or external resources, it is important to understand the skills and experience of investigators working on behalf of the organization and develop a training/onboarding program to ensure they are acting in a manner consistent with the organization’s intentions and desires; they are the frontline in contact with persons providing potentially critical information, and how they manage the person reporting and this issue can have significant consequences for the organization and its reputation.
See the Resource: Sample Checklist for Assessing Investigation Capabilities after this article. It covers the subject matter expertise or function of the person, the level of experience and number of investigations in the past year, and the subject areas of those investigations. In addition to these items, you may want to ask about the outcomes of these matters and how they typically document their findings and conclusions and/or track and compare their investigations in each function. This assessment can be helpful in determining the ultimate structure and personnel for the investigations program and how to help develop the necessary skills for the future.
Designing or Evaluating an Investigations Program
The compliance function rarely has sufficient resources to conduct every workplace investigation—nor is that a requirement or necessity for an effective program. What is critical is that the compliance function have insight into the types of investigations being conducted in the organization with some nexus to the compliance function and that it has the opportunity to provide insight and oversight into the management of such investigations to ensure appropriate management and effective and consistent responses to issues, particularly those of a higher risk profile. At the very least, the compliance function should be involved in the creation of any investigations policy, standard operating procedure for report intake, and investigator protocol, in the communication loop as to ongoing investigations, and participate in monitoring resolution of the issues.
Ultimately the structure of an investigations program is a question of oversight, roles, and responsibilities. Once the information points are identified, processes should dictate which matters will be investigated and which teams will be responsible for each type of investigation. For example, some organizations have determined that investigations about claims of discrimination, harassment, and the like should be managed by the human resources and/or employee relations functions, while issues of fraud, abuse, and corruption likely need someone with more general compliance experience or oversight. Regardless of the division, it is important that the compliance function have, at least, visibility, communication, and coordination with those conducting all types of investigations, as issues often are not clear-cut. Nonetheless, each report of actual or suspected misconduct must be resolved appropriately.
Structures to consider for an investigations program include the following: centralized investigations management; semi-centralized investigations management; decentralized investigations management; and outsourced investigations management. The formats might look something like one of (or some variation of) the following:
Investigations Program Structures
Type of Investigations Program |
Who Performs Investigations and Training on Conducting Investigations |
Relationship to Compliance Function |
---|---|---|
Centralized Investigations Program |
All investigations are performed by one central investigations group that trains its investigators on conducting investigations. |
The investigations group is either part of the compliance function or reports its investigations findings to the compliance function. |
Semi-Centralized Investigations Program |
Investigations are performed by more than one group, depending on the nature of the allegation, and training on conducting investigations is done by each group for their own investigators. |
Each investigations group reports in some form to the compliance function about the investigations they complete. |
Decentralized Investigations Program |
Individual groups perform investigations and training (if any) on how to conduct investigations. |
There is little or no reporting to or oversight from the compliance function. |
Outsourced Investigations Program |
Skilled external resources perform investigations. |
There is oversight by organizational functions, which may include subject matter experts such as employee relations and/or compliance. |
In all of these structures, there is also the question as to the role of Legal. It is best practice to have a trained attorney involved and/or responsible for the oversight of investigations to assist in managing the legal considerations and to help ensure the process of an investigation is thorough, programmatic, and defensible. Again, those matters with a higher risk profile, and the possibility of the requirement for public disclosure, should generally involve in-house and/or outside counsel; these would include matters of financial misconduct, as well as allegations of fraud, bribery, and any other potentially illegal activity. The attorney involved should also have his/her own skills and experience conducting investigations so that the oversight and assistance is tailored to the organization’s investigative needs.
Internal Investigations Program Philosophy and Policy
At the very least, organizations should develop a philosophy around how internal investigations are to be accomplished and the methods and means that are considered appropriate or not. The philosophy should address some basic questions: Will a subject always have an opportunity to respond to the accusations? Is one innocent until proven guilty? What techniques are acceptable for investigators?
This philosophy should also include the following:
-
Investigation processes and standards
-
Qualifications, expectations, and authority of investigators
-
Treatment and expectations of witnesses
-
Issues of cooperation and confidentiality
-
Communications related to the investigations and to whom
-
Investigation working papers, draft reports, and final documents
-
Access to investigative information and files
-
Appropriate retention and destruction periods for investigative data
Organizations should also consider implementing a written policy and procedure on internal investigations to address some or all of the following matters:
-
The investigation process and standard.
-
What is an investigation?
-
Who is authorized to conduct investigations? In what areas?
-
What is the investigator’s role (i.e., neutral fact finder, decision-maker)?
-
What rights do witnesses have (including access to information about the allegation)?
-
What is expected of witnesses (e.g., cooperation, confidentiality, and evidence preservation)?
-
Reporting/communicating about investigations to senior management/others.
-
Complaint reporting channels (where and how complaints can be made).
-
The policy against retaliation/retribution.
For reference, see the Resource: Sample Internal Investigations Policy after this article.
Consider the Confidentiality of Investigations
Organizations have long recognized the critical importance of maintaining confidentiality with respect to internal investigations. Confidentiality is important to protecting the integrity of evidence and the investigation itself. It can help minimize the possibility of retaliation against reporters and witnesses and of employees tampering with evidence or speaking to potential witnesses before the company’s investigators have an opportunity to do so. It also respects the privacy rights of the employees involved in the investigation. However, the National Labor Relations Board (NLRB) has called into question company practices of requesting blanket confidentiality for all internal investigations.
In the case of Banner Health, the NLRB found that an organization’s interest in maintaining the confidentiality of all investigations is insufficient to outweigh employees’ Section 7 rights to concerted activities for their mutual aid and protection.[5] To minimize the impact on Section 7 rights, the NLRB held that companies must first establish, with respect to any particular investigation, that confidentiality is appropriate because of the need for witnesses or evidence protection or for some other legitimate business justification.
Organizations should consider the Banner decision in formulating their investigations procedures. It should be noted that the scope of the ruling applies only to nonmanagement witnesses. More specifically, investigations procedures, such as the standard instructions given at the beginning of an investigative interview, should include consideration of the need for confidentiality (and, where there is a need, documentation of that) with respect to all investigations. State and federal laws should also be considered during policy development, as some states permit recordings as long as one person is aware while others do not.
Create a Case Management System
Another important consideration in the creation of an investigations program is whether to implement a case management system for documentation of organization investigations and, if so, what type of system. These systems can range from a simple Excel spreadsheet documenting relevant information about such investigations to homegrown databases or off-the-shelf or customized solutions provided by large vendors for investigation tracking, management, and report generation. While these case management systems can help with tracking metrics and identifying trends, they also are potentially discoverable in the event of litigation. Consider both the value and risk of having such a system and then determine the desired content and access rights.
Attorney-Client Privilege
Because the vast majority of investigations involve claims of harassment, discrimination, retaliation, threats and violence, theft, and the like, generally, an investigator need not be an attorney. However, there may be times when an organization determines that because of the risk profile of the allegation, the use of an attorney (external or in-house) as an investigator or an outside investigator working at the direction of in-house counsel is desired to create the attorney-client privilege for the investigation content. Notably, in many cases, the organization may later determine that it wants or needs to waive any privilege (for example, when the organization discloses a compliance issue to a government agency and seeks leniency).
An important point should be stressed here. It is the purpose of the inquiry and not the job function of the investigator that is dispositive. In other words, a lawyer who conducts the investigation is doing so because of his/her skills and experience, not necessarily his/her job title.
An organization is entitled to the protections of the attorney-client privilege. The privilege belongs solely to the corporation, not to any specific employee. There are several factors relevant to the availability of the attorney-client privilege in the context of a workplace investigation:
-
The communications were made by organization employees under instructions from superiors in order for the organization to secure legal advice from counsel.
-
The information needed by organization counsel in order to formulate legal advice was not otherwise available to executive management.
-
The information communicated concerned matters within the scope of the employee’s corporate duties.
-
The employees were aware that the reason for the communication with counsel was to enable the organization to obtain legal advice.
-
The communications were ordered to be kept confidential, and they remain confidential.
The attorney-client privilege only protects the investigation communications from discovery; the underlying information contained in the communication—witnesses and business documents—is discoverable; the privilege does not extend to the underlying facts.
Communications that merely transmit business-related facts may be discoverable because the privilege most often applies to requests for legal advice. The transfer of nonprivileged documents from the corporation to the attorney similarly do not make the documents privileged. Communications made for purposes other than to obtain counsel’s legal advice, including communications made to third parties, are not privileged. Consequently, simply funneling communications through a lawyer will not shield an investigation from disclosure because communications for business purposes are not privileged.
Attorney involvement in investigations can be tricky. Even if the attorney takes all appropriate precautions to maintain the privilege, a court may later determine that the communications at issue are discoverable (because, for example, the court may determine that the communications relate to business and not legal advice). In addition, government agencies may demand access to privileged reports as a form of cooperation when an organization seeks leniency for a detected ethics and compliance failure.
Attorneys who conduct investigations should be careful to explain their role as attorney for the organization (and not as attorney for the employee) to those employees whom they interview. Attorneys conducting investigations should always consider and determine when and how to provide appropriate warnings to witnesses about their role. While these so-called Upjohn warnings can take many forms, see the Resource: Sample Upjohn Warning after this article.
The work product doctrine may also apply to shield materials generated in the context of internal investigations from disclosure. This doctrine protects documents and other tangible items that were generated in anticipation of litigation by or for the company or its representative. Thus, if there is a reasonable prospect of litigation related to the matter under investigation, the work product protection may apply.
Conducting an investigation subject to the attorney-client privilege is done because the purpose of the inquiry is to allow the organization to receive legal advice and not for risk or personnel management. It is not just because the investigative issues are sensitive. It’s because the investigation purpose is different than the common compliance matters.
Reporting an Investigation to a Government Agency
As discussed previously, in certain cases, an organization (particularly those publicly traded on the US stock exchanges) must disclose organizational ethics and compliance failures in public filings and by contacting government agencies to report the matter. Certainly, publicly traded companies should consult with legal experts on the likely circumstances for such disclosures, including but not limited to financial misconduct, certain conflict-of-interest situations, or bribery and corruption. But they should also ensure that before an investigation occurs in any realm with the potential for such a disclosure, they have appropriate mechanisms in place to investigate and manage such claims and connect with in-house and outside legal experts promptly before undertaking those investigations.
Global Issues
Global issues are concerns in the healthcare industry as organizations outsource services traditionally performed within the organization. One such area of concern is offshore coding. Depending upon where the vendor is headquartered, the following issues should be considered prior to signing a contract with the vendor. Some organizations may feel they are protected by a written contract and a Business Associate Agreement, but they may find they cannot enforce the written documents.
There are several important issues to consider in an investigations program if your organization has a global reach. Knowledge and understanding of the local culture, local laws and regulations, and sensitivities around witness questioning and other behavior in a location is helpful. Likewise, language barriers and possible translation issues must always be considered in global investigations. All of these can be important factors in choosing the right investigator. Further, data collection, privacy concerns, and employer/employee rights can be significantly different around the world and must be considered and understood for any location before an investigation begins. Additionally, not all jurisdictions recognize the attorney-client privilege of in-house attorneys.
Conducting Effective Workplace Investigations
Once the investigations program structure and philosophy have been established, the actual investigation must be conducted. The first step for any investigation is receipt of the complaint and complaint intake. Then a decision must be made as to whether an investigation is required or desired. Finally, once a decision is made to investigate, the appropriate investigator must be selected, and the investigation should be planned and begun.
An investigation is the systematic and thorough examination into something and the recording of that examination in a report. In the workplace, an investigation has four basic components:
-
Thoroughly documenting incidents of actual or suspected misconduct to maintain a permanent record of their occurrence.
-
Identifying the root cause of an incident where the improper conduct occurred.
-
Identifying people involved in misconduct.
-
Compiling information that proves or disproves an allegation or that implicates or exonerates an employee suspected of misconduct. This is especially true if the investigation is used to justify disciplinary or other post-investigation action.
A workplace investigation seeks sufficient credible facts to allow managers to decide what action, if any, should be taken in response to a substantiated allegation. Responsive action may be divided into three broad categories.
Corrective action: Corrective action includes those steps taken to “fix the system” to reduce the likelihood of future wrongdoing or other undesirable events. Examples of corrective action include establishing, changing, or augmenting procedures, training, and implementing internal controls. Inspections or audits may be used to identify effective ways to address problems discovered during investigations. Managers may take corrective action even when the allegations cannot be substantiated but where a deficiency in internal controls is identified.
Remedial action: In some cases, the investigation reveals that the wrongdoing or deficiencies in internal controls adversely affected employees. Although redress of wrongs is not by itself a sufficient reason to initiate a workplace investigation when other remedies are available, basic fairness requires that individuals harmed by improper conduct or unintended consequences of “the system” be restored to their prior circumstances whenever possible. This action is an important element of management’s response to a workplace investigation. Management may decide to take remedial action even when allegations of wrongdoing cannot be substantiated.
Disciplinary action: Disciplinary action is any action short of criminal prosecution taken against a person found to have engaged in wrongdoing. Disciplinary action does not include training, counseling, or performance-based actions. Disciplinary action includes such actions as the following: admonition, reprimand, suspension, demotion, corrective action, written warning, and/or termination of employment. Although some may think disciplinary action by management is the primary purpose of a workplace investigation, corrective and remedial action is actually more relevant to the business goals of the organization. In some cases, other considerations may dictate that no (or limited) disciplinary action should be taken in response to substantiated misconduct. (For example, to protect the integrity of the workplace investigations process, it may be necessary to forgo disciplinary action in an unusual case to protect the identity of a whistleblower or other confidential source.)
Tailoring the Process
There is no one-size-fits-all workplace investigations process. The right process for an organization is one that management believes will best prevent, detect, and explain incidents of noncompliance within the organization. Several factors will determine the contours of the process:
Size of the organization: How formal and elaborate a process is depends on the size, complexity, and culture of the organization. The industry in which the organization competes should also be considered.
Likelihood: This factor considers the likelihood that certain types of misconduct may occur because of the nature of the organization’s business. When there is a substantial risk that certain types of violations may occur, management must develop a process that meaningfully detects and prevents those types of offenses.
The organization’s history: This factor considers the types of offenses the organization—or those of its competitors—should have taken steps to prevent in the past. Preventing the recurrence of known problems should be foremost in the minds of managers trying to make the investigations process effective and relevant to the organization.
Business Goals
The investigations process has its own business objectives. An understanding of these purposes helps establish the workplace investigations process in the organization. Investigators are no different than any other organization employee; the investigator’s job is to serve a business purpose designed to protect the organization.
Business-focused objectives: No investigation of any complexity can be successful unless specific objectives are determined in advance. The objectives of the investigation decide the investigation’s starting point and where it is intended to finish.
Properly articulated objectives actually protect the organization. They lay a defensive foundation against possible claims later on that the investigation was improperly motivated, a “witch hunt,” or a rambling inquisition against imagined wrongdoing with no beginning or end. The organization is protected when it can be demonstrated that from the beginning, the intentions and objectives of the investigation were legitimate, professional, and proper.
Identifying the truth: Many organizations treat the fact-gathering process to investigate a misconduct allegation as just a personnel-management matter. There is often little focus on professional fact gathering in methods, which tend to assure the credibility of the evidence. In the absence of a professional process—one that can be examined to determine the equity of the process and outcomes—the accuracy of the fact gathering, other than as a way to justify terminating employment, remains a shortcoming in many organizations.
The context in which the investigation is conducted must be able to answer two basic questions: what happened (the truth), and why did it happen? The investigative process determines the facts that are sufficient to cause a reasonable person to recognize that the true facts are what they are reported to be.
In a misconduct investigation, the accusations must be credible, relevant, and truthful to bring the level of proof to a standard where management should be expected to conclude whether a business-conduct standard was violated. The investigation also determines whether any other people were involved besides the Subject. By identifying the Subject’s modus operandi if misconduct is proven, the investigator will identify gaps in internal controls.
Establishing accountability: An investigation establishes accountability as to how an event happened and what mitigating circumstances may exist that affected the outcome of the event. The investigation does not critique management style unless specific management actions contributed to the circumstances that permitted the incident being investigated to occur.
Report Intake Versus Investigation
Although it may be clear immediately from some reports whether or not an investigation is warranted, many reports are too vague and more specific information is required before an investigation is launched. The process by which initial live reports get vetted for assessment is referred to as intake.
Report intake can be done contemporaneously with the initial report (e.g., when an employee reports harassment to someone in Human Resources, they can likely undertake intake in that conversation) or as a separate step before a decision to undertake an investigation is made. It is important to distinguish intake mechanisms, goals, and practices from investigations.
The goal of report intake is to determine when the report merits an investigation. Intake should generally consist of asking the reporter/complainant the Five Ws—who, what, when, where, and why. Here are some questions that cover the Five Ws.
Who
-
Who was involved?
-
Who was present?
-
Who have you talked to about the incident?
-
Who else might have experienced something similar?
-
Who else might have information about the incident?
What
-
What exactly occurred? What words were used?
-
What was the physical action (if any)?
-
What was the reaction of witnesses or others present?
-
What did you do in response?
-
What made you report this?
-
What do you want to happen next?
-
What else should an investigator know?
When
-
When did the incident(s) occur (day/time)?
-
When did you talk to anyone else about it?
Where
-
Where did the incident(s) occur?
Why
-
Why do you think this is an issue?
-
Why do you believe this treatment is occurring?
It would be easy to allow report intake to transition immediately to investigation without pause or due consideration. Given the myriad of issues to consider before undertaking an investigation, however, best practice is to separate the report intake and investigation process, pause and understand what the report consists of, and make a thoughtful decision before launching an investigation (including understanding the likely risk profile of the complaint and considering whether attorney-client privilege may be desirable).
Determining When to Investigate
If the organization decides that a formal investigation is needed, there are some key next questions to be resolved: What will be the scope of the investigation? Who will conduct it? How much will it cost? How long will it take? Is there a business justification for the investigation to be confidential? Is there a possible need to have the investigation conducted under privilege? The answers to these questions are not trivial because the responses may likely be viewed with hindsight by executive management, the press, the courts, and possibly the government.
There are some key benefits for organizations in choosing to conduct investigations. These benefits include the following:
-
A workplace investigation helps the organization determine the extent of potential civil or criminal liability.
-
If an organization effectively investigates its own misconduct, the organization may persuade the government to forgo conducting a separate investigation, reduce the scope of its investigation, or allow the corporation to guide the government’s investigation. A credible investigation may prevent a wide-ranging government investigation into the organization’s affairs.
-
An investigation can help satisfy a director’s fiduciary duty to the organization, including the obligation to self-police to establish compliance and detection programs.
-
When there is a duty to investigate, the failure to do so may subject management to civil liability.
-
The best way to avoid indictment is to have full knowledge of all of the relevant facts so that an appropriate preindictment defense may be presented to the government. A thorough investigation, combined with voluntary disclosure, may be the dispositive factor in convincing the government not to bring criminal charges.
-
An organization can use a workplace investigation to minimize the effect of negative publicity that has arisen from allegations of wrongdoing. An investigation enhances the organization’s credibility. The investigation distances the organization from any wrongful acts by its employees, and the very existence of an investigation shows the organization’s good faith.
-
An investigation may encourage investor confidence and protect an organization’s market position. When allegations of misconduct are raised, the investigation may be used to address issues or dispel a cloud of suspicion.
However, consider the consequences of investigating the report. The investigation will require the commitment of time, resources, and corporate energy, perhaps more than was initially expected or budgeted. There will be lost productivity in the business. People helping the investigator will be diverted from their job duties. The internal machinery of the organization will be explored and exposed. Executive management will have to live with the results of the investigation. This might include findings of fault, require public disclosure of the conduct, or involve the taking of internal or external remedial action.
Not every allegation of misconduct must be investigated. If initial inquiries about the report fail to confirm that an incident may have occurred or that there is a reasonable factual basis to believe misconduct may have occurred and that the Subject may have committed it, there may be no basis for an investigation at that time. For example, an investigation is not needed in the following scenarios:
-
The report is a misunderstanding of organization policy.
-
The allegation relates to a lack of communication between the reporter and another person.
-
No other facts are necessary to resolve the issue, or the material facts are undisputed.
-
The substance of the report can be resolved informally, such as a request for assistance rather than an allegation of misconduct.
The person handling intake should document the report and the basis not to proceed with an investigation. The record should show that although no investigation was conducted, the reasons for not proceeding were reasonable under the facts then known. If the investigation process is audited at some later time, the permanent record documents the handling of the matter and the inquiries the investigator made at that time. The ability to account for all inquiries made is part of the ability to build a perception in management that there is a high degree of integrity in the process. The documented decision also allows the organization to reopen the matter if additional facts are obtained in the future that warrant further inquiries or investigation.
Below is a list of considerations to help determine whether, based on the complaint intake, an investigation is warranted (none of these are necessarily determinative, and it will be a case-by-case analysis). These considerations apply regardless of whether there has been a “live” complaint intake or an anonymous call or written complaint report.
Nature of the Allegation
-
Is there an allegation of a policy violation?
-
When terms like “hostile work environment,” “discrimination,” “harassment,” “unfair,” “illegal,” “unethical,” or “fraud” are used, it can be tempting to assume an investigation is mandated, but it is crucial to understand the nature of the specific conduct (words and behavior) alleged and reason such conduct is believed to be hostile, discriminatory, harassing, or fraudulent.
-
If the allegation is founded, would it violate the code of business conduct or some other policy or otherwise be illegal or unethical?
-
Is there really an allegation of workplace conflict or possible wrongdoing that requires an investigation?
-
Does the allegation trigger some legal obligation to conduct an investigation, or would an effective investigation be a possible defense or mitigation of a future claim (e.g., federal discrimination claims and occupational safety and health claims)?
Request for Action
-
What result does the person complaining seek as an outcome?
Possible Scope
-
Are witness interviews necessary to make a determination?
-
How many people are likely going to need to be questioned?
-
How disruptive would an investigation likely be?
-
What is the nature of the work group involved? Are they close-knit? Are they in one location? Is it a cube area or offices? What is the work they do?
-
What other options besides witness statements are available to prove/disprove the claims?
-
Will an investigation likely result in other information about the work group that may help resolve issues?
The Accused
-
Have there been other prior issues/claims/allegations involving the same individual?
-
Is the Subject a supervisor and/or a director or higher level?
-
Is the Subject still a current employee?
-
Is the Subject under the authority of the organization (i.e., a current employee)?
Weighing these factors, the ultimate question is whether there is sufficient information to warrant a concern about a violation of policy and/or law for which more information and additional fact-finding would be necessary. Balancing the rights and interests of employees is also critical. As a general rule, it is better to err on the side of conducting an investigation than failing to conduct one. Particularly in matters where employees may be disciplined or employment terminated, it is generally preferable that employees have a right to be heard on the claims before such action is taken against them, and if they feel as if the process has been fair, they are less likely to raise specious allegations of mistreatment.
Participant Rights and Responsibilities
The participants in a workplace investigation may be divided into the following categories: responsible managers, internal departments, reporters, witnesses, subjects, and investigators. The participants likely have different perceptions of the purpose, scope, or nature of a workplace investigation. Their respective rights and responsibilities also differ. These rights and responsibilities may impact the manner in which the investigation is conducted, its results, or the action that may be taken in response to the investigation.
Responsible Managers
Responsible managers are those who have management authority to take corrective, remedial, or disciplinary action in response to the findings of a workplace investigation. In practical terms, responsible managers are the superiors above the management level of the Subject. Consequently, they are among the people for whom the investigation is to be performed, whether or not they requested the investigation. When a responsible manager did not request the investigation, as, for example, when there is a hotline report, the responsible manager should be notified promptly upon commencement of an investigation unless there is good cause to believe doing so would compromise the investigation. When compromise is a concern, consider whether a more senior person should instead act as the responsible manager.
Because a responsible manager must take appropriate corrective, remedial, or disciplinary action, the investigation should provide them sufficient information to make intelligent decisions about these matters. In longer, more complex investigations, responsible managers may be provided periodic progress briefings. Their participation in decisions about the direction the investigation will take may be encouraged if this will help ensure they obtain information necessary to make their decisions. Such participation may also help them understand the investigation is intended to promote the efficiency of the organization.
Internal Departments
Internal departments are those business units in which the matter under investigation is alleged to have occurred. The Subject’s department should be appropriately notified of the existence and general nature of the workplace investigation. Premature notice that would compromise the investigation should be avoided. However, as a practical matter, the Subject’s department should be notified before the conduct of on-site interviews in most cases.
Notifying the Subject’s department at the earliest practical time is important because the managers have an affirmative responsibility to cooperate with and help facilitate the investigation. The managers’ cooperation is often essential if the investigation is to be successful. Cooperation entails more than simply providing a space for the investigators to work and making witnesses available at reasonable times. It requires the managers to establish the proper atmosphere for the conduct of the investigation and, at times, positive assistance.
Depending on the investigator’s needs and specific requests, this may include the following such actions:
-
Making a general announcement—with appropriate messaging and confidentiality—regarding the existence of the investigation to limit speculation and inform department employees of their duty to cooperate with investigators.
-
Directing uncooperative witnesses to answer questions and disciplining those who continue to refuse to cooperate.
-
Taking effective action to prevent or address concerns about retaliation for cooperating with the investigation.
-
Directing employees within the department to assist the investigation by gathering documents or other materials, conducting analyses of information, and adjusting meeting, vacation, and travel schedules to be available when needed.
Cooperation necessarily requires the Subject’s department not take any action that could be construed as interference with the investigation. Therefore, employees should not do the following:
-
Suggest what witnesses should say when interviewed or attempt to influence potential witnesses in any other manner.
-
Question witnesses as to the nature of the investigator’s questions or their responses.
-
Take any retaliation action against reporters or witnesses.
-
Identify the reporter (whether anonymous or not).
Department personnel should not be assumed to know intuitively it is improper to question witnesses about their statements, even in a casual manner. Therefore, these matters should be discussed when the Subject’s department is notified of the investigation.
Reporters
Reporters have many different reasons for making allegations, but their motives are not directly pertinent to the investigation. Their motive is relevant only to assessing the credibility of their allegations. The allegations of a reporter who is seeking to “get even” may lead to the discovery of substantial misconduct. Some reporters choose to remain anonymous. Others may identify themselves but request confidentiality during the investigation. Other reporters have no objection to disclosure of their identities during the course of an investigation.
When reporters have firsthand knowledge of facts related to the allegation, they should be interviewed as witnesses. Reporters who admit their own wrongful involvement in a matter they present for investigation, or who are implicated during the course of the investigation, may also become subjects. Because bias may color the perception and recollection of any witness, investigators may find it useful to explore the reporter’s motive in order to decide what weight to attach to facts asserted by the reporter, just as they would for any other witness. However, the investigator must exercise caution to avoid leaving reporters with the impression they are being investigated or harassed for making the report.
Because reporters voluntarily present information concerning wrongdoing, there is a heavy burden on the organization in general, and the investigator in particular, to ensure reporters are not subject to retaliation. Accordingly, a reporter’s requests for confidentiality merit special consideration that may impact the conduct of the investigation and the potential for disciplinary action. The investigator may find it necessary to interview reporters more than once because not interviewing them in their office at the same time coworkers are interviewed would appear odd and suggest they were the reporter. In some cases, the investigator should attempt to develop alternate sources of evidence to protect the identity of reporters who have requested confidentiality.
Reporters should be told whether an investigation will be conducted; doing so may reduce the likelihood they will seek a matter be addressed by an outside organization. Reporters may also be told when an investigation has been concluded. However, due to the Subject’s privacy rights, reporters do not generally have the right to know what specific remedial or disciplinary action occurred unless it somehow becomes a matter of public record. If an allegation is not sustained, reporters should be given some explanation for that conclusion.
Reporters have the responsibility to present their concerns in good faith. This means they may not make allegations they know to be untrue even if the allegations turn out to be factually wrong. Similarly, a reporter may not ignore or disregard information they know, or could learn upon reasonable inquiry, would tend to show the allegation is untrue. Reporters should not make frivolous allegations. That is, they should not seek a workplace investigation of matters a reasonable person would know do not constitute violations of law, rule, or regulation or other matters appropriate for workplace investigation. Otherwise, and to protect the integrity of the investigation process, the reporter is subject to disciplinary action.
Witnesses
Witnesses are the people the investigator chooses to interview because they may have information that tends to support or refute an allegation or information that may lead to the discovery of such information. Most people are selected as witnesses because they have knowledge of the facts surrounding an allegation. Witnesses may be able to provide firsthand, indirect, or circumstantial evidence.
Witnesses are divided into two categories for the purpose of selecting appropriate interviewing techniques. Cooperating witnesses are those who are willing to assist the investigator’s attempts to develop pertinent facts. For example, when asked, they usually will tell a narrative story that requires minimal questioning and therefore may be interviewed using standard interviewing techniques. Hostile witnesses are reluctant or unwilling to cooperate with the investigator. Often, the investigator uses interrogation techniques, such as asking questions that require only a yes or no answer.
Witnesses may become subjects during the course of an investigation. The investigator must be alert to ensure their rights (and those of the organization to take action against them in appropriate cases) are protected should that happen. Witnesses may not be subjected to retaliation for cooperating with a workplace investigation.
Subjects
Subjects are employees against whom an allegation of misconduct has been made. Subjects should be given the opportunity to comment on, respond to, or rebut the allegations made against them. The investigation should not be considered complete until the investigator has obtained the Subject’s version of the events in question. (Exceptions, however, include where the Subject has already resigned or refuses to cooperate with the inquiries.) This information may aid the determination of what actually happened. In addition, information provided by the Subject may assist the responsible managers in determining what action, if any, to take against the Subject. For example, when the investigator concludes that the Subject violated an applicable standard, the investigator should try to determine whether the violation was due to ignorance of, inability to comply with, or deliberate disregard for the standard.
Reasonable Basis to Investigate
Generally speaking, employees should be left alone to do their jobs. Even though an investigation may be needed from time to time, an investigation should never be a “fishing expedition” to locate some elusive misconduct believed to be lurking around the organization.
The investigator has limited corporate authority. An investigation may not be opened indiscriminately. Similarly, a reporter does not have the right to insist on an investigation simply because the organization has an investigation function or promotes its hotline. An investigation is appropriate—and the authority kicks in—only if the initial report gives the investigator probable cause to believe that misconduct has occurred. Never make any promises or commitments that action will be taken other than that the information will be looked into.
What is a reasonable basis? The concept reflects the value judgment that people are entitled to be free from scrutiny unless some basic factual threshold is satisfied. A reasonable basis means that the investigator reasonably believes a violation of the code of conduct, law, or regulation may have occurred in the workplace, and the investigator reasonably believes that the facts presented are sufficient to suggest misconduct may have occurred. If the investigator has a reasonable basis, an investigation is proper. Otherwise, an investigation is not appropriate at that time.
Degree of Proof Required
To be fair to the employees implicated in the investigation, the investigator has a burden of proof to satisfy. This means that the investigator has to gather evidence to substantiate each element of the misconduct allegedly committed.
Once the evidence has been gathered, it has to be measured against a standard of proof. This is whether the investigator has gathered enough proof to consider the allegation to be substantiated. The applicable standard of proof in a workplace investigation is a “preponderance of the evidence.” An allegation is considered proven if, based on the facts learned and the documents reviewed, it is more likely than not (think 51% or more) that the misconduct actually happened. If so, the allegation is considered substantiated. If not, the allegation is considered unsubstantiated.
The preponderance-of-the-evidence standard is not a criminal justice standard. The criminal justice standard, as the investigator likely knows, is “beyond a reasonable doubt.” This means that the proof makes it at least 90% certain that the misconduct actually happened. This is another reason why the right to remain silent and the right to a lawyer (both constitutional rights in criminal cases) do not apply to employees in workplace investigations.
This topic underscores why the investigator should avoid criminal justice concepts and standards in the investigations. For example, if the investigator adopted the beyond-a-reasonable-doubt standard, this would force the investigator, among other things, to spend more resources and time than needed. It would also result in substantiated misconduct going unpunished when the investigator cannot meet a 90% standard, although the investigator satisfied the 51% standard that did apply.
Identifying the Right Investigator
Who has the right stuff to conduct a workplace investigation? The candidate pool for investigators is usually as follows:
-
Human resources/employee relations personnel
-
Security personnel
-
Compliance personnel
-
Lawyers (internal or external)
-
Auditors
-
Occupational health/safety personnel
-
An outside consultant/investigator
The following is a list of core competencies to consider and weigh when selecting an investigator:
-
Absence of any conflicts of interest (organizational, relationship, and perception)
-
Ability to understand the business purpose of the investigation and the potential issues that may arise (the big picture)
-
Knowledge of the organization policies, procedures, and practices
-
Interviewing skills, both verbal and nonverbal, including the ability to ask the “tough” questions
-
Experience, training, and credentials
-
Ability to be an impartial and neutral fact finder
-
Ability to spot key issues and problem solve
-
Flexibility and good judgment
-
Is well respected
-
Is an ethics and compliance champion and has a spotless record
-
Ability to establish boundaries and maintain report with witnesses
-
Ability to maintain confidentiality
-
Ability to appropriately document findings/write a good report
-
Ability to influence the decision/outcome in the organization
-
Knowledge of the specific area or subject matter at issue (e.g., discrimination, fraud, or theft)
-
Availability for anticipated time frame of investigation
-
Relevant personal characteristics of investigator (such as race, age, and gender) that could play a factor
-
Ability to perform as a witness if called to testify
Once identified, an investigator should undertake the following steps in preparation for an investigation:
-
Determine the initial scope of the investigation.
-
Assess potential challenges.
-
Identify potential witnesses and determine desired order of interviews.
-
Identify sources of potential evidence.
-
Prepare outline of questions.
-
Consult with counsel on privacy, scope, and other legal matters.
Investigation Preparation and Strategy
Once a decision has been made to conduct an investigation and the investigator has been selected, the investigation should be conducted promptly. That said, the manner of investigation should never be compromised to meet a specific timeline. The speed and thoroughness required depend on the nature and scope of the allegation. For example, a claim of theft of company property by a single employee on a single occasion in an organization of 150 employees should probably be completed with a decision made and implemented within a week (and the report completed within a week after that). By contrast, a claim of bribery of foreign government officials over a two-year period in a foreign country for an organization of 175,000 employees will likely require at least 90 days or more to complete the investigation and additional time to document.
Nonetheless, organizations should have a threshold for anticipated case closure, and generally, investigations open more than 90 days should be seriously scrutinized and tracked until closed. Having open, lingering cases can do more harm than good to an organization, as any defense or mitigation that can flow from an investigation generally necessitates that such an investigation be completed promptly. It is important to document rationale on timing of an investigation and any delays that occur during the process so that it is clear upon later review.
Planning the Investigation
Careful planning is critical to a successful, credible investigation. It begins with issue spotting—the process of reviewing the facts (alone or with other facts) to determine whether they would provide the basis for a management decision to take corrective, remedial, or disciplinary action.
The issue-spotting analysis begins with the initial contact with the reporter when the investigator questions the reporter to develop more information. It continues after the interview is completed, when the investigator determines whether or not to open a workplace investigation. Issue spotting is the first step of the planning phase of an investigation.
When conducting an issue-spotting analysis, consider both the implied and systemic allegations. An implied allegation is one that is not stated directly by the reporter but which could be inferred from the facts. For example, a reporter who claims her manager unfairly favors her coworkers by approving expense reports with nonbusiness expenses is providing you with the implied allegation of expense report fraud.
A systemic allegation is one in which the reporter’s information leads you to believe that others may be similarly affected. Once the issues have been identified, they should be written in the form of allegations to be investigated.
Consider the following:
-
Do not rely on the reporter’s description or characterization of the facts. The investigator should formulate his/her own statement of the allegation.
-
An allegation to be investigated should be expressed in neutral, unemotional terms. It should be formulated in such manner that substantiation (a “yes” answer) of the allegation demonstrates that misconduct has occurred.
-
The allegation should be worded similarly to the following: someone (the Subject) did, or failed to do, something (the act or omission), and such act or omission was improper (the wrongdoing) because it violated some standard (law, rule, regulation, or organization policy).
Choosing Allegations to Investigate
Having written allegations in the proper format, the investigator can then decide whether action is warranted and, if so, what that action should be. At this point, it may be clear that one or more of the allegations must be thoroughly investigated and discussed in a formal investigative report that documents the findings. The investigator would then be ready to start writing the investigative plan and begin the investigation. In other cases, the investigator may want to make discrete inquiries that may develop additional information from other sources before proceeding further.
The way to proceed is a judgment call that comes with experience. On the other hand, at this point, the investigator may realize that some allegations are simply not significant enough to warrant any further form of inquiry. At best, they may warrant maintaining for record purposes. If the investigator cannot write a good allegation after consulting with others in the office, reviewing applicable policies, and perhaps talking with counsel, it may be that there is nothing to investigate.
Sometimes an allegation may be serious but contain insufficient information or detail for the investigator to determine how to gather more information. The organization does not have sufficient resources to engage in fishing expeditions. Reports that fall into this category should be documented and closed. The matter may be reopened if and when additional information is learned.
Developing the Investigation Plan
The investigator must be prepared to conduct a comprehensive, objective, fair, and professional investigation. The planning needs to be flexible to accommodate new information and developments. The investigation may have to be expanded or modified as information is developed.
The detail required and the time needed to plan an investigation depends on the allegations. Routine investigations usually require a minimum amount of time and detail and a simple outline. More complex investigations need more time and require finely developed planning.
The scope of the investigation should also reinforce the fairness of the process. If the organization must later defend a decision based on the investigation—a wrongful termination claim, for example—it will appear unreasonable for an employer to have reached a conclusion based on no or weak evidence. It will also appear unfair if the organization disciplines an employee based on weak evidence when better or stronger evidence was reasonably available but ignored or not reviewed.
Proper definition of the scope of an investigation also protects the innocent. A properly conducted investigation identifies culpable employees, but that does not mean that other individuals might not be injured as a result of the fact-finding. The importance of defining the scope of an investigation is, in some ways, an effort to protect the innocent, to narrowly define the area to be investigated, and to assure that those not involved in a particular act of misconduct are neither implicated by their proximity to the event nor exonerated by omission. A proper investigation determines the relevant facts, provides a basis for fixing accountability, and provides a basis for neutralizing rumors and innuendo.
Once the scope has been determined, make the plan. This is more than just a list of documents and witnesses. It incorporates the proposed strategy. A proper strategy, regardless of the investigation’s complexity, makes the investigation thorough and professional. The strategy of the investigation should move from the general to the specific, gradually zeroing in on the Subject by carefully acquiring and analyzing information. As information is gathered, the theory can be refined to focus the investigation on the most logical source of misconduct and/or business process failure.
An investigation plan also ensures that the organization has met its obligations to the subject, to the proper operations of the business, and to the organization’s shareholders. A good investigation plan addresses each of the following issues and questions:
-
The alleged facts and behavior that led to the investigation. This can be set out in a chronology of events that can then be enlarged as the investigation develops.
-
The organization employees and other parties who are the subject of the investigation.
-
What law, policies, procedures, codes of conduct, or other requirements may have been violated and where documents specifying those requirements can be located.
-
How widespread is the misconduct? Is this an isolated occurrence or a systemic problem?
-
What information will be sought on each issue, and who are the potential sources of that information?
-
What type of report should be prepared to publish the findings?
-
After the investigation is completed, what post-investigation steps are likely to be needed?
-
Which individuals might have personal knowledge about one or more of the factual issues?
-
The order in which witnesses should be interviewed.
-
What specific issues are to be covered with each witness?
-
What documents will be needed to conduct the investigation and complete the investigation file?
-
What documents will be shown to each witness, and which documents will be sought from each witness?
-
Which senior managers will receive the reported findings, and to whom will the investigative team report?
There may be serious consequences if the investigation is too narrow or too broad. The investigation needs to get to the root causes of the problem and not just deal with its symptoms. If the investigation is superficial, the business problem will not be addressed, and the workplace may be exposed to further disruption. However, an overly broad investigation can equally harm the workplace culture and disrupt the business.
Gathering Evidence and Separating Fact from Fiction
A properly conducted workplace investigation follows four steps:
Determine the nature of the allegation: The investigator must gain a quick understanding of the problem. Usually, someone in the organization knows the subject matter at issue and might even have personal knowledge of the incident. That person must be quickly debriefed so that the investigator has some basis from which to proceed and a solid idea of how the matter under investigation evolved.
Develop the facts: There are two basic components to the fact development in a workplace investigation: interviews of employees or third parties and the review of relevant documents. Document review is an important part of any investigation. Documents provide a historical narrative of events. They often tell much of the story by themselves. Also, they can provide a written framework into which information developed through witness interviews will fit.
Document the investigation: To serve as a basis for management decisions, the investigation findings must be documented and supported. The report must give a comprehensive explanation of the information gathered in the course of the investigation. Sometimes a brief memorandum will suffice. In a complex investigation, a detailed written report will be prepared for presentation to executive management. The complexity of the issues and the stakes involved often dictate the way the investigation is documented.
Publish the findings: Once completed, the investigation findings must be disclosed to management, the reporter, and the Subject. Of course, the level of detail will vary as necessary, as will the document the investigator provides, if at all, to each of them.
Conducting Interviews
Interviews are the heart of most investigations. The facts and information that witnesses provide are often the critical source of information. Therefore, having a consistent process for the conduct and content of the interviews is crucial.
It is important to understand, appreciate, and reflect the role and concerns of each different party in a case: the reporter/complainant, the general witnesses, and the subject. Each has different information and motivations, and each will have different questions about what the investigation can mean to or for them and their future with the organization.
In addition, investigators will want to plan the order in which the interviews occur. For example, in most cases, the Subject is interviewed at the same time or after multiple witnesses are interviewed. Most employees the investigator interviews will be nervous and understandably apprehensive. The investigator should briefly explain at the start of the interview what is going on and what is expected of the witness.
The introduction to the interview is the hardest part because the investigator has to create the proper impression, enlist the witnesses’ cooperation, and explain the nature of the inquiry, all at once.
Read the Resource: Sample Instructions to Witnesses aloud to the witness (found after this article). These should be the standard ground rules for the interview. The instructions establish the conventions and assumptions between the parties. Giving clear interview instructions not only lays the ground rules, but also conveys to the witness that the investigator is in control of the interview.
The witness should receive a brief explanation of the matter under investigation. The investigator should make an effort to explain why the witness has been included in the investigation (e.g., because they have submitted a report, have been identified as the subject of a complaint, or have been identified as someone who may have information relevant to the investigation).
The investigator should ask the witness some introductory questions. These items are important to know:
-
The witness’s name
-
Job title, duties, and times worked
-
Start and end dates of employment
-
Supervisor’s name and title
-
The identity of any employees who report directly to the witness
-
Whether the witness has been previously investigated or disciplined
-
What others interviewed or involved in the matter have already told the witness
-
What the witness has been told by supervisors or management
-
Whether the witness has been threatened in any way to provide or withhold testimony
Time limits should not be unnecessarily imposed on interviews—they should take as long as is reasonably needed to determine and obtain the information and must enable the witness to believe that the organization is sufficiently concerned about the matter.
Employees often ask whether they are in trouble or whether they will be disciplined. Be straightforward—it is certainly possible that employees may be disciplined if they committed misconduct, but at this point in the investigation, the investigator is just gathering the facts. Never represent to a witness that their cooperation may be offered as a quid pro quo for avoiding any disciplinary, civil, or criminal action.
What follows is a detailed outline of suggested questions for the reporter/complainant, general witnesses, and the subject.
Interviewing the Reporter/Complainant
As an investigator, take the following steps when interviewing a reporter/complainant:
-
Introduce yourself by name, and (if appropriate) provide your business card or contact information.
-
Describe your role as a neutral fact finder conducting an investigation into a claim of wrongdoing.
-
Identify yourself as a representative of the organization and acting on behalf of the organization in conducting the interview.
-
Confirm that the individual believes that you can be impartial and neutral in the matter.
-
Inform the person that there will be additional witnesses you will need to interview (do not name names).
-
Describe how other records or information might help you determine what happened and why (e.g., emails, voicemail messages, photos, and other items).
-
Ask if they are aware of any documents or records that might assist you.
-
Inform them that they can provide you a list of names of possible witnesses that they think might be helpful (and when they provide this list, ask them what they think each witness can provide—you may need to explain you are looking for people who saw or heard things, not character witnesses to vouch for people).
-
Let them know that you will make the final decisions about who to interview.
-
Set your expectations of them as a witness: that they will be truthful and not misleading, that they will cooperate with you, that they will keep the matter confidential and not discuss it verbally or in writing with other witnesses or employees, and that if they violate these expectations that there may be disciplinary action.
-
Set expectations that you will not share witness names with other witnesses unless there is no way to avoid that and who you will share your investigation findings with (e.g., them, management, or others).
-
Describe the policy against retaliation and what it means to them and what they should do if they have any concerns that they are being subjected to any retaliation and the consequences if they retaliate against others.
-
Ask questions (starting with the Five Ws).
-
State your understanding of the claim/concern they provided.
Interviewing General (Percipient) Witnesses
As an investigator, take the following steps when interviewing a general witness:
-
Introduce yourself by name, and (if appropriate) provide your business card or contact information.
-
Describe your role as a neutral fact finder conducting an investigation into a claim of wrongdoing.
-
State that the organization takes claims seriously and has a process to determine whether wrongdoing has occurred.
-
Share that you are interviewing several people who you believe might have seen, heard, or known something and they are one of them.
-
Describe how other records or information might help you determine what happened and why (e.g., emails, voicemail messages, photos, and other items).
-
Ask if they are aware of any documents or records that might assist you.
-
Inform them that they can provide you a list of names of possible witnesses that they think might be helpful (and when they provide this list, ask them what they think each witness can provide—you may need to explain you are looking for people who saw or heard things, not character witnesses to vouch for people).
-
Let them know that you will make the final decisions about who to interview.
-
Set your expectations of them as a witness: that they will be truthful and not misleading, that they will cooperate with you, that they will keep the matter confidential and not discuss it verbally or in writing with other witnesses or employees, and that if they violate these expectations that there may be disciplinary action.
-
Set expectations that you will not share witness names with other witnesses unless there is no way to avoid that and who you will share your investigation findings with (e.g., them, management, or others).
-
Describe the policy against retaliation and what it means to them and what they should do if they have any concern that they are being subjected to any retaliation and the consequences if they retaliate against others.
-
Ask questions (starting with the Five Ws).
-
State your understanding of the information they provide.
-
Ask if there was anything you did not ask them that you should have.
-
Ask if there is anything else they think you should know.
-
Ask the witness if their account has been complete and accurate.
-
Tell them generally what your next steps are.
-
Make sure they have your contact information.
-
Let them know whether or not you will likely be in contact with them again.
-
Acknowledge their cooperation (if appropriate).
-
Offer the opportunity for them to ask any questions they have (even if you cannot or will not provide the information).
Interviewing the Subject
As an investigator, take the following steps when interviewing a person who has been accused of wrongdoing:
-
Introduce yourself by name, and (if appropriate) provide your business card and contact information.
-
Describe your role as a neutral fact finder conducting an investigation into a claim of wrongdoing.
-
Identify yourself as an agent of the organization and acting on behalf of the organization in conducting the interview.
-
Reiterate that the organization takes claims seriously and has a process to determine whether wrongdoing has occurred.
-
Share that you have interviewed several people who have seen, heard, or know something about the matter but that no decision has been made at this point.
-
Identify that they have been accused of X, and tell them that this is their opportunity to share their side of the story and provide any information they might have to provide mitigating and exculpatory information.
-
Emphasize the importance of cooperation and truthfulness.
-
Describe how other records or information might help you determine what happened and why (e.g., emails, voicemail messages, photos, and other items).
-
Ask if they are aware of any documents or records that might assist you.
-
Inform them that they can provide you a list of names of possible witnesses that they think might be helpful (and when they provide this list, ask them what they think each witness can provide—you may need to explain you are looking for people who saw or heard things, not character witnesses to vouch for people).
-
Let them know that you will make the final decisions about who to interview.
-
Set your expectations of them as a witness: that they will be truthful and not misleading, that they will cooperate with you, that they will keep the matter confidential and not discuss it verbally or in writing with other witnesses or employees, and that if they violate these expectations that there may be disciplinary action.
-
Set expectations that you will not share witness names with other witnesses unless there is no way to avoid that and who you will share your investigation findings with (e.g., them, management, or others).
-
Describe the policy against retaliation and what it means to them and what they should do if they have any concern that they are being subjected to any retaliation and the consequences if they retaliate against others.
-
Ask questions (starting with the Five Ws) but seek admissions.
-
State your understanding of the information they provide.
-
Ask if there was anything you did not ask them that you should have.
-
Ask if there is anything else they think you should know.
-
Ask the witness if their account has been complete and accurate.
-
Tell them generally what your next steps are.
-
Make sure they have your contact information.
-
Let them know whether or not you will likely be in contact with them again.
-
Reiterate that no decision will be made until the investigation is complete.
-
Acknowledge their cooperation (if appropriate).
-
Offer the opportunity for them to ask any questions they have (even if you cannot or will not provide the information).
It is recommended after interviewing each witness that the investigator consider whether they need to go back to the reporter/complainant or any other witness for more information or to ask follow-up questions. An investigator must also consider whether there are additional witnesses who might have relevant information (whether any other witness named them or not). An organizational chart and a floor seating chart may help to identify other potential witnesses who could have overseen or overheard important information.
Investigation Tip: Types of Lies
During an interview, the witness may engage in a variety of different attempts to deceive you. There are five basic types of lies that the witness may use.
1. Simple denial: Its simplicity might lead you to think that this type would be chosen often. But many people don’t deny misconduct directly. Psychologists call this “cognitive dissonance.” To avoid this, a witness will go to great lengths to avoid having to deny it directly.
2. Omission: This is the most common type. It is also the simplest lie because the witness tells the truth but leaves out the information that could be embarrassing or incriminating. Because the remaining part of the witness’s statement is true, it can be repeated consistently. If the witness is presented with the omitted information, he can just respond that he forgot to mention it. A lie of omission can succeed if you are not prepared to force the subject by mentioning the excluded information.
3. Fabrication: This is the most difficult type of lie because it requires the witness to be inventive and have a good memory to keep the lie consistent. This type of lie also creates the most stress for the witness. Ask questions when a lie of fabrication is suspected to show that the explanation does not hold up to specific questioning. If the investigation can disprove the witness’s sequence of events or details, that result may prove as significant as a confession of wrongdoing.
4. Minimization: Here, the witness offers a small admission of fault hoping that you will be satisfied and discontinue any further questioning. When this type of lie is used, it is a strong indication that additional information is being withheld.
5. Exaggeration: A witness may exaggerate the actions of another person or an aspect of a particular conversation. The lie may be used by someone who wants to increase the value of his information or inflate his own importance. If you maintain a healthy skepticism and question each claim, you should be able to identify any exaggerations.
Lies told in an interview can be as powerful as a confession. Lying in a workplace investigation likely exposes the employee to disciplinary action. An investigator must constantly be aware of the possibility that the subject is withholding information or intentionally attempting to deceive.
Subject Interviews: Proper Practices
A proper workplace investigations process provides the Subject with an opportunity to respond to the allegations. When the investigator properly interviews the subject, the investigator fulfills any fundamental-fairness rights that they might enjoy, and if they admit to wrongdoing, that statement can be used as proof of guilt.
The Right to Respond
The Subject should be reasonably provided with an opportunity to respond to the allegation and the information alleged. If the Subject denies the allegation, they should be offered the opportunity to assist in the investigation to establish their innocence. Even if the weight of the information uncovered tends to substantiate the allegation, the investigation is not over until the Subject is allowed the opportunity to respond to information gathered.
Admissions are the strongest proof in an investigation because, of course, the statements come directly from the Subject. It also provides some comfort to the investigator because it frees the investigator from having to draw conclusions about guilt from the available facts. In many investigations, there will be little disagreement about the facts, and the difference between guilt or innocence will depend on the interpretation of what those facts mean—was the boss’s request for a date simple flirting or an attempt for a forbidden quid pro quo for that promotion? The admission, for example, that the Subject knew their actions violated organization policy when they did them can be very helpful.
Interrogating the Subject
There is a fundamental difference between an interview and an interrogation. The dynamics of the two are completely opposite. An interview is a non-accusatory fact-gathering conversation to determine facts, sequences of events, and alibis or to confirm information with a specific witness. The questions are generally open-ended, and the witness does most of the talking. If close-ended questions are asked, the investigator is usually trying to clearly establish certain facts or to confirm important details. The investigator is not looking for a confession but only for the witness to confirm or deny specific pieces of information. Organizational investigations should be conducted as interviews and not interrogations.
Preparing to Interview the Subject
An interview of the Subject must be planned carefully. The purpose of this session is to learn the truth and obtain admissions of material facts. Remember that the investigator is not looking to gather objective information other than explaining their conduct or offering mitigating facts. The Subject is unlikely to give the investigator additional facts that the investigator can reasonably use (unless the Subject leads the investigator to some new avenue of inquiry).
As the investigator prepares for the interview, consider the subject’s possible motives for committing the wrongdoing. Did they do it for the money? To save their job? To impress someone? When the investigator has some idea—even if it is only a working hypothesis—the investigator can then focus the interview in that direction.
The theme of this interview should include some explanation as to why an investigation was conducted and what leads the investigator to believe that the person committed the misconduct. It is not necessary to make accusations—in fact, it will probably chill the conversation—but the investigator needs the Subject to understand that the investigator is there for a reason and the interview is not just a fishing expedition.
The investigator should also clearly state that the investigator is only investigating the allegation and that the investigator has no control over postinvestigative steps. This will avoid any claim later on that the Subject admitted fault only because the investigator said that it would save their job.
Telephone and Virtual Interviews
Telephone interviews should be used as a last resort in the age of technology. With ease of access to technology such as Zoom, GoToMeeting, Google Meet, and Facetime, a face-to-face interview that allows the interviewer to watch the interviewee’s nonverbal cues should be used in place of a telephone interview. Such interviews should be conducted in a controlled environment with as little extraneous distractions as possible. If such software is used, IT security personnel may be asked to assist to ensure the method is secure and provides confidentiality. All laws should be considered in the jurisdiction prior to taping.
If technology cannot be utilized for a face-to-face virtual interview, the telephone interview should be conducted to keep the investigation on track. The obvious difference between face-to-face interviews and telephone interviews is that the investigator cannot see the person the investigator is interviewing. In some cases, the investigator cannot be sure the investigator is talking to the person the investigator is attempting to interview. Therefore, in the absence of other verification, the investigator must be careful to ask questions that would ensure a reasonable belief that the people he or she is talking with are the people they claim to be.
In a telephone interview, people speak to each other but do not truly communicate. Therefore, the investigator needs to be an active listener to obtain all the information that is being passed on the telephone. Although the telephone interview allows the speakers to gather and/or exchange facts, information, and ideas, the inability to read the nonverbal aspect of the message complicates the process and makes thorough evaluation of the witness and the information provided difficult.
Telephone interviews (even those where technology is used so the parties can see each other) should be avoided where possible, especially in the case of subjects and important witnesses. Reporter interviews done in person are also preferred, but this is not always possible because many complaints come via the telephone hotline and provide no means of follow-up. It is also recognized that cost becomes a factor when in-person interviews require travel expenses. Effective time management may also be a factor.
Try to limit telephone interviews to witnesses who only provide background information, to use as a follow-up technique after the primary interview has been conducted in person, and to use as a preliminary inquiry technique to determine the extent of someone’s knowledge or develop leads.
The guidelines for telephone interviews are similar to face-to-face interviews with a few additions and a slightly different emphasis on others. Consider the following:
-
Ask a second interviewer to be present in the room and take notes.
-
Get callback numbers and set up a time for continuation, if necessary, at the start of the phone conversation in case the investigator has to end the call before the interview is completed.
-
Review notes with the witness more frequently during the interview to ensure that if the interview is terminated prematurely, the information obtained to that point is accurate.
Case Study: Challenging Interviews--Angry, Evasive, and Sad People Call for Different Approach
Melissa Edson, Standards and Compliance Specialist
Jackie Stemwedel, Senior Manager of Standards and Compliance
Jacki Waltman, Manager of Health Information Management and Corporate Privacy Officer
Hazelden Betty Ford Foundation
For some reason, an employee at the Hazelden Betty Ford Foundation was evasive in an interview during a compliance investigation, feigning unfamiliarity with healthcare practices despite her long history. That didn’t work for Melissa Edson, standards and compliance specialist at Hazelden Betty Ford, and she called the employee on it. “The person had been in the field 20 years, and we were asking questions about her behavior. She kept telling me, ‘I guess I am naive because I don’t know,’” Edson recalled. “I said, ‘I am not accepting that as an answer,’ and I asked the questions in different ways.”
Evasiveness is one of three types of “challenging” interviews that compliance officers may experience during compliance investigations, along with crying and anger. They make it harder for compliance officers to get answers to the questions they need to further investigations.
“The goal of the interview is to get your questions answered, and sometimes you have to manage some of the responses people have,” said Jacki Waltman, manager of health information management and corporate privacy officer at Hazelden Betty Ford. “If you can’t get people to calm down, you have to hit the pause button and try another strategy because your goal is to gather information.”
Evasiveness may indicate that employees are gauging what the interviewer knows so they can decide how much to reveal. “They don’t want to tell you more than what they need to tell you or they may have decided being dishonest or not cooperating is more advantageous,” Edson said. “Also, sometimes people think if they talk to you they will get themselves or someone else in trouble.” Whatever the reason, she says it helps to overcome evasion with open-ended questions. For example, “How did you respond to the situation? How has this situation impacted you? What other relevant information would you like to share related to the situation? Who else may have witnessed the situation or been impacted by it?”
People who cry in interviews may be expressing the stress of the investigation or something unrelated. “The first thing is to understand yourself and what your comfort level is with someone who is becoming very emotional,” Edson said. “Maybe sit there in silence and let them process through that, and maybe ask them why they are being triggered with emotion.” If they’re unable to compose themselves, consider rescheduling the interview and encouraging them to seek out human resources or the employee assistance plan. However, if things settle down, you may be able to ask the questions or infer the tears “are validating facts,” Edson said.
Then there are angry people. Sometimes they’re angry because they feel they did something wrong and don’t want to talk about it, and sometimes they’re just having a bad day. “Acknowledging it is a great way to begin to defuse that and begin to move forward,” Edson said. “Don’t ignore it and hope it goes away.” Angry people may come across as defensive or passive aggressive, pretending they don’t hear your questions. There are times the person is menacing. “If you don’t feel safe, leave,” Edson advised. “Maybe get someone to escort them out of building.”
Follow the 80/20 Rule
Interviews under less dramatic circumstances typically yield useful information for compliance investigations depending partly on the skills of the compliance officers who conduct them. “Practice makes perfect,” Waltman said. She recommends trial runs with colleagues to refine interview skills. “We do a lot of role playing” and “critique as we watch.”
Listening carefully to the people you interview is essential. “Remember the 80/20 rule,” Waltman said. “They talk 80% of the time, you talk 20%. You are there to gather information, not share information.” Silence is a useful strategy. When interviewers are silent for seven seconds or more, people feel compelled to break the silence. “They will usually give more information than they intended,” she said.
Jackie Stemwedel, senior manager of standards and compliance at Hazelden Betty Ford, said it’s important to evaluate the credibility of people being interviewed. “Assessing credibility is key to an interview,” she noted. Here are some factors for evaluating credibility, Stemwedel said:
-
“Interviewee’s comfort with sitting in the interview and answering questions directly.
-
Forthcoming with information or is it like pulling teeth to get them to share anything?
-
Confidence in responses (pitch and tone, as well as body language).
-
Interviewee’s information corroborates the timeline developed based on evidence available to you.
-
Have they had any complaints about other matters, and have they been deemed credible in those situations?”
She also recommends assessing the credibility of the people who report compliance problems. “No matter how outlandish something sounds, you have to take it seriously,” Stemwedel said. “Just because a [wild] report comes in doesn’t mean it isn’t true.”[6]
Obtaining Other Records/Evidence
Besides interviews, there are a number of other potentially significant sources of information to consider and possibly review. Any source of information reviewed should be retained as part of the investigation file, regardless of whether it supports, refutes, or sheds no light on the allegations. These sources include the following:
-
Company policies
-
Company property (records, information, etc.)—consider review of the records retention policy and whether or not issuance of an investigational hold is required to ensure relevant records are retained and not destroyed
-
Company records (hard copy or electronic, including emails, instant messages, and phone records)
-
Employee expense reports and employee company credit card statements
-
Websites/internet (Google, Yahoo, Myspace, Facebook, Twitter, etc.)—be wary of potential privacy issues and consult with legal counsel
-
Criminal background checks—be wary of potential privacy issues and consult with legal counsel
-
Civil/criminal matter background checks—be wary of potential privacy issues and consult with legal counsel
-
Company or location video surveillance—be wary of potential privacy issues and consult with legal counsel
-
Employee badge records
-
Employee personnel files or other relevant files (I-9, worker’s compensation, manager files, etc.)
-
Pictures/video captured on employee cell phones or other video recordings available
-
Instant messages
-
Public records
At a minimum, investigators should be familiar with the company’s code of conduct, the records management program, and retention schedule and any policies specific to the area at issue. In addition, good investigators are familiar with the hardware, software, tools, and technology of the organization, including but not limited to information about who is responsible for such information and how long it is stored.
Investigators should have the right to request relevant information from any and all potential sources. Among the organization records are likely to be emails and other messages. Consider the forensic tools and skills available and when and whether they can and should be utilized to obtain records in an investigation. In addition, always consider the possibility that there may be videotapes if there is any monitoring or filming in the workplace. With the ever-shrinking size of recording and photography devices, there is often a potential for information that employees have photographed or even recorded on cell phones and other devices. Consider whether the investigation calls for the issuance of an investigation hold to ensure that relevant documents are preserved and not destroyed in the ordinary course of records management.
Any item reviewed as part of the investigation (whether it provides evidence in support of a claim or not) should be retained as part of the investigation file. For example, if badge data is used to establish when an employee entered a building on a given day, regardless of whether the employee in question entered the building on that day, a copy of those badge records reviewed should be retained in the investigation file as an exhibit.
As interviews are completed and evidence is gathered, an investigator must work to effectively analyze the data, draw conclusions, identify potential corrective actions or other remedies, and then document their findings.
Evidence Standards
Evidence consists of information, documents, and objects that are used to prove or disprove facts. The investigator gathers evidence to determine the facts in the case. Although the investigative report will not directly address the evidence behind every fact stated in the report, the quality of that evidence eventually determines the degree to which others will accept the facts. Rules of evidence exist to ensure evidence is reliable, and the investigator should be familiar with and apply the more important rules and the concepts behind them.
Evidence includes information obtained from people, documents, and physical objects. Information from witnesses may be testimonial (oral descriptions of statements, acts, and events) or demonstrative. It may constitute firsthand knowledge of witnesses or recitation of what they have learned from others (hearsay). Documents may be obtained merely to prove their existence (there was a contract) or to establish the substance of their contents (the contract was signed by a specific person, or it included a specific provision). Similarly, physical objects may be used to demonstrate their existence or identity (the serial number on the notebook computer found in a private residence establishes it is the organization-owned property) or to demonstrate a particular characteristic or quality of the object that is implicated in the wrongdoing (when seized, the computer contained data in violation of organizational policy).
Qualities of Evidence
Consider the following qualities of evidence in determining its value to the investigation:
Relevance: In obtaining and evaluating evidence, consider its relevance by asking whether it tends to make a fact that is of consequence to the investigation more probable than it would be without that evidence. If not, then the evidence is not relevant, and its incorporation into the investigative report is not appropriate. (The question of relevancy often arises in the consideration of circumstantial evidence.)
Materiality: Evidence is relevant if it tends to make an important fact more probable. A fact is material if it tends to prove or disprove an allegation. For example, the fact that vendor A’s proposal was given to competing vendor B by Steve, a member of the Procurement Department, is material to proving an allegation that Steve violated organization policy by leaking confidential information. The fact that Joan, another member of the department, also had a copy of the proposal is not likely to be material to the allegation against Steve (unless it can be used to suggest Joan, not Steve, was the source of the leak).
Evidence in the form of a statement by Larry that he saw Steve take the proposal out of the file cabinet and hand it to Nancy, an employee of vendor B, is relevant to establishing the fact that Steve really did give the proposal to vendor B. Larry’s observation that Nancy was wearing a blue dress that day is not evidence that tends to make more likely the fact that Steve gave her the proposal (unless it is used to establish the person really was Nancy), and, therefore, that evidence is not relevant.
Competence: In obtaining and evaluating information, consider whether the circumstances by which it was obtained support a belief in its truthfulness. For example, statements by a witness with a history of lying, or impaired perception, or with a strong bias or prejudice, are likely to be of limited value in establishing facts. Similarly, a confession or statement containing information contrary to one’s interest or benefit obtained under duress or a perception of coercion will not be as reliable as one obtained fairly and freely.
Authenticity: In obtaining and evaluating information, consider its authenticity—is it what it purports to be? Is the signature on the document really that of the person whose name it conveys? Could someone else have used the subject’s computer name and password? Issues of authenticity are generally resolved by the quality (or lack) of chain-of-custody proof. Being given under oath, such as with an affidavit, also bolsters the authenticity of testimony.
Relevant Categories of Evidence
The investigator will deal with several categories of evidence and should understand the distinctions between them. These categories include direct evidence, circumstantial evidence, and opinions.
Direct evidence: Evidence, in whatever form, may tend to prove or disprove a fact either directly or indirectly (circumstantially). A fact is proved by direct evidence when the witness has actual, or direct, knowledge of the fact to be proved and does not need to rely on facts the witness did not actually observe but only inferred from other facts known to the witness. A witness who says, “I know that Mike stole the organization checks because I was there with him, and I saw Mike open the filing cabinet, take the checks, and put them in his pocket,” has presented direct evidence to prove the fact that Mike took the checks.
Circumstantial evidence: When direct evidence cannot be obtained to establish a fact, the existence of that fact may sometimes be established because reasonable persons are willing to draw inferences from other facts. Circumstantial evidence is direct evidence of one or more facts from which other facts may be inferred, or established indirectly, because there is a logical relationship between them. A witness who says, “I know Mike stole the checks because he was the only one in the room at about the time they were stolen,” has presented circumstantial evidence to prove the fact that Mike stole the checks. The evidence is circumstantial because the witness did not actually observe Mike steal the checks but inferred that fact from other facts the witness did observe directly. In the absence of other contrary facts, it is logical to infer that the only person in the room who had access to the checks likely stole them.
It is important to appreciate the difference between direct and circumstantial evidence because circumstantial evidence has the possibility for an alternate explanation of what really happened. In the previous example, there may have been a second person in the office that the witness did not see. Witnesses may think they know something directly, and present it in that manner, when in fact they are really drawing inferences from indirect, or circumstantial, evidence. When a witness says, “I know fact A occurred,” it is important to establish the actual basis for that assertion. Careful examination may show that the witness does not really know fact A occurred, but only that facts B and C did. Test a witness’s statements by probing follow-up questions, such as, “Why does the witness think that?” and, “How does the witness know that?” Don’t reject evidence because it proves to be circumstantial, but remember that such evidence should be more critically evaluated and, when possible, corroborated with additional evidence.
Opinions: Opinions are generally conclusions premised on facts and the interpretation of those facts. For example, to say that Mike was shouting at Jim, was calling him names, and was red in the face constitutes a recitation of facts. To merely state that Mike was angry at Jim constitutes an opinion that is based on the facts observed. The opinion may be accurate, but the investigator cannot be certain without knowing the underlying facts. Indeed, in some cases, observation of physical details may not always be sufficient to form a valid opinion. Jim may have been helping Mike practice a role in a play that required Mike to show anger.
Effectively Analyzing Data
In analyzing data, it is important to go back to the allegations and be clear about the behavior alleged. Then, considering the evidence, determine whether the behavior occurred as described or in some modified form (or whether it is more likely than not that it occurred as alleged). Then consider whether the behavior violates one or more company policies. Finally, consider what other issues you may have discovered and determine whether they are appropriately addressed in this investigation or in some other way.
Here are some major considerations used in data analysis:
-
What are the issues/allegations?
-
Where are there consistencies/discrepancies among witness statements?
-
Can you substantiate/refute the allegations?
-
What facts support the findings/conclusions?
-
Were there credibility issues with any witnesses?
-
Were there documents, recordings, or other evidence that supported/refuted the allegations?
-
If this was a violation of an ethics standard, who will notify the ethics and compliance function, and what will their role be in the decision?
-
For business reasons, does anyone else in the organization need to be informed of the investigation results? If so, whom and why? In addition, who will inform, and what information will be shared?
Included after this article are some tools to help analyze data:
-
Resource: Sample Evidence Collection Worksheet
-
Resource: Sample Key Allegations Worksheet
-
Resource: Sample Key Facts Worksheet
Making Credibility Determinations
Sometimes, despite best efforts to obtain evidence that supports or refutes a claim, it comes down to a situation where the reporter has one version of events and the subject has another, and there are no witnesses or documents to the event. In those cases, an investigator should do the following:
-
Confirm there is no one else who may have seen/heard or overheard the incident.
-
Examine whether either party discussed the event with anyone else immediately after it happened and consider interviewing the people it was discussed with. (By this you can determine whether a person’s story has changed over time or is consistent with their first reaction.)
-
Reflect on whether there is anything in one version of the story versus the other that makes it more believable.
-
Consider that if the incident occurred as it was reported whether it would be a policy violation.
-
Think about the demeanor and general responses of the witnesses. Were they cooperative? Were they forthcoming? Did they volunteer information? Did they withhold information? Do they have some motivation to lie?
-
Decide whether to go back to any witness and ask whether they can think of any reason someone would be dishonest about the incident.
When this is not effective, the case may simply turn on a credibility determination. This is where many investigators become uncomfortable. However, the job of an investigator is to make a finding, and “I cannot determine which version is accurate” is not sufficient. Ultimately, an investigator has to make a decision. Sometimes the decision is simply that based on the sum of the information provided and the witness statements and demeanors, you find it more likely than not that certain behavior occurred. Such a finding is sufficient.
Reaching a Conclusion
When the investigator has finished gathering evidence, management should be notified, and the investigator should generally be available to answer any questions. The investigator should express appreciation for the support received and indicate whether there were any significant problems that hindered the conduct of the investigation. The investigator should also advise management whether the climate suggested a concern over retaliation for cooperating with the investigator. The investigator should not comment on the substance of their findings, noting that the investigation is not considered complete until the investigative report is completed. Management may be advised of the general time frame in which to expect the report to be finalized and who to contact for a status update.
Most investigations collect more information than is necessary to reach a conclusion. Some information is redundant; other information is not pertinent to a decision. Sometimes the information is conflicting. Deciding what information to treat as evidence and how to deal with it in the investigation report is important because in cases where remedial or disciplinary action is a possibility, the decision to accept the conclusions in the investigation report is likely to be made only after an examination of all the evidentiary material in the file. If the report does not appear to fairly address pertinent evidence, its conclusions may be rejected. These are some common issues in deciding what happened:
-
Evidence considered, but not relied upon, should be discussed in the investigation report if it is likely that others would want to consider it or question the completeness of the report were it not mentioned. This is critical when there is conflicting evidence.
-
The failure to discuss and explain why one version of events is relied upon in lieu of competing evidence will cause readers who are aware of the conflicts to question the objectivity of the writer.
-
Evidence that is redundant or repetitive can be summarized when it comes from various sources that present no unique information. For example, stating that five people saw the subject in the office on a particular day is adequate in most cases.
-
Testimony may prove difficult to analyze in some cases. Often, only a few witnesses have the entire story. The investigator must piece together fragments of the story to present the entire picture. Summarizing the testimony of witnesses providing these fragments is one acceptable technique to make the sequence of events clear. In complex cases, or cases with many witnesses, it is helpful to use some system for identifying what each witness said about each allegation, such as an evidence matrix or an outline.
The evidentiary analysis must bring together all documentary, physical, and testimonial facts relating to the allegations to reach a conclusion. The facts relied upon to reach each conclusion should be apparent to the reader. When the applicable standards are themselves vague, or the testimony conflicts, the reasoning that leads to a conclusion is not always apparent. In that case, the analysis in the investigation report must explain to the reader how the investigator reached the conclusion.
Do not forget to consider the root cause of why something happened. The root cause may be that the subject did not know the rule, could not comply with it, and/or would not comply with it.
Considering the stakes involved, the investigator has to make a finding. There are only three possibilities to the investigator’s decision: substantiated, unsubstantiated, and inconclusive.
Substantiated: A substantiated finding results when a preponderance of the evidence supports the allegation of misconduct. The facts, from documentation and testimony, indicate that a violation occurred.
Unsubstantiated: An unsubstantiated finding results when (i) preponderance of the evidence supports the conclusion that the alleged misconduct did not occur; or (ii) the available evidence is insufficient to meet the burden of proof, even if the investigator believes that the misconduct occurred.
Inconclusive: An inconclusive finding results in the rare situation in which the investigator simply cannot complete the investigation, for example, because of the unavailability of witnesses and/or essential documents.
Determine Appropriate Corrective Action or Other Remedies
It may be that following an investigation, a decision is made that nothing further needs to be done. However, in many cases corrective action must be considered. In considering the appropriate corrective action, organizations should consider the following:
-
Were any promises made and/or broken?
-
Are there wrongs that need to be righted?
-
Are there policies that were violated/followed?
-
What individuals are responsible for the violations?
-
Does the Subject have a direct or indirect reporting relationship with the claimant?
-
Do the managers or supervisors of the responsible individuals have any role?
-
How frequent was the behavior in question?
-
How serious was the incident?
-
Are there mitigating circumstances?
-
Were there prior incidents involving the Subject? The claimant? Witnesses?
-
What was the actual or potential impact to the organization (financial or otherwise)?
-
What remedies exist? The range of actions can include doing nothing, providing a policy reminder, giving a written or verbal warning, suspending employment or placing a person on administrative leave with or without pay, demotion, bonus reduction, project removal, responsibility decrease, workplace limitations, allowing voluntary resignation/retirement, restitution, termination of employment, civil/criminal prosecution, etc.
-
What remedies are desired/requested?
-
How have similar issues been handled in the past?
-
What level of discipline is appropriate?
-
What was decided as remedy?
-
Who will implement corrective action and by when?
-
Who is responsible for verifying corrective action was implemented?
In addition to any corrective action, organizations should also consider whether there was any information identified as part of an investigation that suggests other action might be helpful to resolving any root issues or systems breakdowns. Other actions can include providing additional training to some or all employees, communicating differently, revising policies and procedures, offering coaching or other training to certain employees, and conducting periodic checks on the affected group or groups.
Create an Investigation Report
The key to a successful internal investigation is the ability to communicate findings in a meaningful format to the impacted audience. It is important to consider your audience when formulating written or verbal reports.
Communications for internal investigations under client-attorney privilege will be dictated by the entity’s general counsel. Compliance should typically communicate results of routine internal investigations that have not been conducted under privilege. It is imperative that the compliance professional assess the audience when communicating results when concluding an investigation. In other words, the compliance professional should determine the communications needs of C-suite executives versus board members versus physicians and middle management. The compliance professional’s audience will determine the communication method and the amount of information shared.
A compliance professional should consider the audience and adapt any templates to fit the recipient’s needs. For example, the board and C-suite executives may prefer a higher-level executive summary with an emphasis on who, what, when, where, and how in succinct language. Like their board member and C-suite executive counterparts, physicians will typically prefer a high-level summary, with an emphasis on how the investigation impacts the physician personally (what the risks are to the physician and/or the physician’s practice) and how the physician can best mitigate identified risks. This mitigation is referred to as the corrective action plan. Middle management, in contrast, often expects details from the compliance professional. Middle management may demand not only an understanding of how and why the investigation took place, but also metrics, if applicable, and detailed analysis of process flows, control breakdowns, and interviews with appropriate personnel. The details are often demanded by middle management because this segment of the workforce is often tasked with taking corrective action, including future monitoring to ensure ongoing compliance.
Regardless of the audience, the compliance professional should focus on presenting facts that can be supported through analysis of documentation and/or notes captured as part of interviews. Written and verbal communication should refrain from subjective messaging, including the compliance professional’s personal reflections and opinions. All internal reports should be reviewed for accuracy in relation to the facts gathered and documented to support conclusions drawn. Objective reporting should be documented along with dates and times of any verbal communications and all internal investigations material to support an effective compliance program should be retained within the compliance department.
The report should provide a third party with enough information to identify the claim, establish a timeline and course of investigation, and identify the findings and evidence on which the findings were based. See Resource: Sample Investigation Report Form 1 and Resource: Sample Investigation Report Form 2 after this article.
As organizations increasingly view compliance professionals as business counselors, reporting the findings will often both enhance and showcase the value of the workplace investigations process to the organization. The investigator needs good communications abilities, problem-solving skills, knowledge of the business, and client partnership skills.
Common Errors in Final Reports
Problems in final reports often occur because investigators know the case so well that they fail to include information in the final report that readers who are not familiar with the case need to know. Other problems occur because of sloppy writing habits or the failure to organize and place information in the appropriate sections of the report. Some common investigator errors include the following:
Mixing up facts, opinions, and conclusions: There are separate sections of the final report for recording facts, opinions, and conclusions. All too often, writers give their opinions in the middle of a recitation of facts. This is confusing and may cause readers to question whether the investigator understands the difference. Opinions may creep in through the use of adjectives and adverbs in a sentence setting forth facts. This may occur because the investigator fails to reserve the discussion of the implications that may be drawn from the facts for a later section of the report. Another common problem is the inclusion of facts, for the first time in the report, in the sections of the report reserved for conclusions and recommendations. This often happens when the investigator realizes that a fact necessary to support the conclusion does not appear in the findings section.
Unsupported conclusions: Sometimes it is not apparent how the investigator arrived at the conclusions based on the evidence presented in the final report. This usually occurs for one of three reasons. First, because investigators are so familiar with the case, they may think they included a fact when they did not, or they may assume something will be apparent to the reader that is not obvious to one unfamiliar with the investigation. In most cases, the evidence was gathered, but it simply was not reported. A second reason is the inclusion of conflicting statements of fact that were not resolved in the discussion of the findings. When the reader looks at some of the reported facts, the conclusions appear logical, but when others are added, a contrary result would also appear reasonable. This requires the reader to attempt to resolve the conflicts, often without any information in the report that would provide a logical basis for doing so. A third reason is the failure to cite and, where necessary, discuss the standard that should be applied to the facts to reach a conclusion. The most effective way to avoid these problems is to adhere to the outline of proof in the investigative plan when writing, then to ask someone in the office who is unfamiliar with the case to read a draft of the final report.
Conclusions that just cannot be supported: Misinterpreting testimony, misreading documents, and not wording allegations properly may result in erroneous conclusions for which there is simply no support in the investigative record. This discredits recommendations and damages the integrity of the investigation process. This problem may not be obvious from a reading of the final report itself; it is most likely to be discovered when management is reviewing the final report to determine whether or not it will support disciplinary action. To avoid this situation, you first must be able to document the source of every fact in the report. The most effective way to do so is to create an endnote for each statement of fact when writing the draft of the final report.
The endnoted draft should be maintained in the file; the endnotes should not appear in the final report. Using endnotes permits another person in the office to quickly review the document, interview notes, or other sources of evidence relied on to support the facts in order to determine if there is sufficient support in the record.
Recommendations inconsistent with conclusions: Occasionally, conclusions are presented that merit a recommendation, but none appears in the final report. In other cases, the conclusion does not support the recommendation. These errors are likely to be picked up when drafts are reviewed by compliance colleagues not familiar with the case.
Post-Report: Monitoring and Managing for Issues and Retaliation
Once a report is complete, an investigator or some other party must be designated to be responsible for ensuring that appropriate actions as recommended and/or adopted are enacted. Following an investigation, the organization needs to have an appropriate mechanism to monitor the issue and ensure that any remedial or corrective action has been effective and quickly assess any potential retaliation concerns from witnesses or investigation participants.
It is best practice to have a stand-alone organization policy against retaliation. See the Resource: Sample Policy Against Retaliation after this article. The organization also needs to create awareness as to the nature, common circumstances, and risks of behavior that may be perceived as retaliatory. Additionally, the best tool to protect against and prevent possible retaliation is limiting the information about an investigation. If you choose not to shield personnel from the details of investigations, then they will be subject to retaliation claims. The more people who know who was involved in an investigation, the more monitoring must be done to prevent, deter, and/or detect retaliation. Limiting the scope of those in the know about an investigation should mitigate some risk of retaliation claims or at least provide a solid defense.
However, an organization can never really prevent retaliation; it can simply take responsive action to quickly undo some forms of retaliation (namely, those involving the setting of the terms and conditions of employment) and take disciplinary action against those individuals who are found to have acted improperly. At its core, retaliation is all about perception.
Some other options to manage retaliation concerns include shadowing important witnesses over time following an investigation. This can be as direct as having live check-in points with reporters/complainants after an investigation, although some argue that such treatment is, in and of itself, retaliatory. But that should be examined on a case-by-case basis, as some witnesses may see this as comforting while others may see it as being singled out. Other ways to manage for retaliation are to review performance evaluations, promotions, and compensation decisions that involve reporter/complainants or, better yet, ensure that such decisions are never made by a single decision-maker, but have the input, consideration, and calibration of multiple people who have not been involved in the investigation.
An effective workplace investigation process includes a method by which complaints and concerns are funneled and addressed in a credible and defensible manner. Its elements include a defined investigation structure, clear roles and responsibilities, a philosophy on how to address the rights of those involved, a skilled investigator who can properly execute on fact gathering, and assessment to create an outcome to ensure proper communication and documentation and effective resolution of issues and prevention of retaliation.