Table of Contents
- 50 ) It’s not what you know. It’s what you can prove.
- 51 ) You have flexibility with the investigation, if you can defend it.
- 52 ) Substance beats process every time.
- 53 ) If it does not happen at work, you don’t care.
- 54 ) The office extends farther than the office.
- 55 ) No fishing expeditions asking unrelated people on background in search of an issue.
- 56 ) Unless you have probable cause, leave your employees alone.
- 57 ) Words have meaning.
- 58 ) Keep things confidential while disclosing on a need-to-know basis.
- 59 ) Know your burden of proof.
- 60 ) Corroborate material facts.
- 61 ) The investigation objective is decided up front. It is refined as you go.
- 62 ) We don’t plan to fail. We fail to plan.
- 63 ) What didn’t happen is as important as what did.
- 64 ) If you want to substantiate a crime (or its workplace version) you have to prove each element.
- 65 ) Interim measures are meant to help. Don’t let them hurt.
- 66 ) You’re going to be a guest in someone’s house. Tell the managers.
- 67 ) Good interviews only come from good investigators.
- 68 ) Always ask: Why did he think he could get away with it? What’s missing that would have allowed this? And how did he think he could escape detection?
- 69 ) As with real estate, it’s location, location, location.
- 70 ) You must control the interview, or the witness will.
- 71 ) Make an informed witness list.
- 72 ) You don’t know 98 percent about your witnesses.
- 73 ) No one makes a report out of good corporate citizenship.
- 74 ) Give standard witness instructions.
- 75 ) Never take the reporter’s information at face value.
- 76 ) Ask why the reporter didn’t call the hotline.
- 77 ) Anonymous reporters are neither unethical nor character assassins.
- 78 ) Don’t identify anonymous reporters.
- 79 ) Manage the reporter’s expectations.
- 80 ) You can’t un-ring a bell. Recanting reporters don’t stop investigations.
- 81 ) When in doubt, start with what you know and work outward.
- 82 ) The more specific you are in a case, the more general everything becomes.
- 83 ) Don’t interview everyone.
- 84 ) Never give a witness a questionnaire or anything else before the interview.
- 85 ) Be smart in an interview, but don’t outsmart yourself.
- 86 ) You lie, you’re fired.
- 87 ) The witness can’t speak if you do.
- 88 ) Keep it simple.
- 89 ) Different interview questions yield different answers.
- 90 ) There are no magic questions.
- 91 ) Don’t use an interview script.
- 92 ) Stay flexible. There is no checklist for everything.
- 93 ) Blend multiple witnesses to obscure who told you.
- 94 ) Even if you ask the right questions, you still have to listen for the right answer.
- 95 ) Cover your tracks.
- 96 ) Silence makes people speak.
- 97 ) There can be no quid pro quo for cooperating in an interview.
- 98 ) Employees have to cooperate with your investigations.
- 99 ) Believe in the self-fulfilling prophecy.
- 100 ) Get the witness to admit policy up front.
- 101 ) Did you ever consider. . . . ?
- 102 ) Take all the time you need.
- 103 ) Know the advantages and disadvantages of a telephone interview.
- 104 ) Have the gall to ask uncomfortable questions.
- 105 ) Accept a written statement to supplement the interview, but it shouldn’t be necessary.
- 106 ) Joint interviews don’t work.
- 107 ) It rarely helps to tape an interview.
- 108 ) “Should I get a lawyer?” Don’t answer that.
- 109 ) If asked, allow the witness to impose reasonable conditions.
- 110 ) “Am I in trouble?” You might be.
- 111 ) Practically speaking, employees cannot refuse to talk to you.
- 112 ) Let thy witness go.
- 113 ) Assess the credibility of your witnesses.
- 114 ) Have an “airplane rule.”
- 115 ) It is possible to detect deception.
- 116 ) All lies are not the same.
- 117 ) If the implicated employee resigns, the investigation continues.
- 118 ) There’s always a reason why the implicated person did it. Find the back story.
- 119 ) Always try to get a confession. It makes your job easier.
- 120 ) Speak to the implicated person even if you think it’s a waste of time.
- 121 ) An interrogation is not an interview. Remember the difference.
- 122 ) Empathy is the easiest way to get an accused employee to confess.
- 123 ) Take a second bite at the apple if needed.
- 124 ) End each interview on a positive note.
- 125 ) Don’t sell before the close either.
- 126 ) Destroy your interview notes. Write a memo instead.
- 127 ) Opinions and editorializing don’t belong in the interview notes.
- 128 ) The truth is logical.
- 129 ) A timeline puts everything in perspective because most of what we do is reactive.
- 130 ) It’s rarely a good idea to have more than just you and the witness in the room.
- 131 ) You don’t need every shred of paper. It’s quality, not quantity.
- 132 ) In each investigation, some documents are better than others. Know which ones are best for your investigation.
- 133 ) Documents can do more than just establish new facts. Documents can support the ones you already know.
- 134 ) You can’t always get what you want. But you might get what you need.
- 135 ) Evidence is information that reveals the facts, but all evidence is not the same.
- 136 ) Hearsay evidence is not admissible in court. Good thing you aren’t there.
- 137 ) Know when to start. Know when to stop.
- 138 ) You have to decide what happened.
- 139 ) At the end of the investigation, there are only three outcomes.
- 140 ) The investigation report is your most important document.
- 141 ) The investigation report deals only with the precise allegations.
- 142 ) The most important question to answer in the investigation report is why.
- 143 ) An investigation report is not a data dump. Think before writing.
- 144 ) Show the good and the bad.
- 145 ) Offer no recommendations on discipline, compensation of aggrieved parties, etc.
- 146 ) The reporter deserves a reply when the case is closed, but be careful what you say.
- 147 ) Give read-outs if you don’t trust them.
- 148 ) Call the cops after the investigation is complete.
- 149 ) Litigation is not always the next step after an investigation is completed.
- 150 ) You can’t hide behind the lawyers when you investigate.
The most important part of the process, of course, is the investigation itself. A quality investigation brings value to the company and assists the business managers who must correct the situation you have investigated. A workplace investigation also tangibly affects the people involved, from the implicated employee who may be terminated to the manager who may be blamed for what he did or didn’t do, or should have done.
A good investigator never forgets that real-world consequences are the results of his efforts. This outcome is different from that of other departments in the company. For instance, the accounts-receivable people can assume a certain percentage of bad debts from customers no matter how diligent their efforts, or the sales people can know that a significant amount of time and resources will be spent on potential customers who never wind up buying anything. We are only human, and we are not infallible. But we must remember that our colleagues will pay personally for our sloppiness and mistakes. “Good enough” should never be good enough for us.
50 ) It’s not what you know. It’s what you can prove.
Although investigators tend to—or at least should—have specialized training, don’t underestimate the value of your own common sense. Many times your common sense will spell out for you what likely happened or didn’t happen in the events under investigation.
But common sense can have its limits in your fact finding. For example, you are just so sure that Bob falsified his expense account. You are certain of his motive, his opportunity and his narcissistic view that the company does not appreciate him. But despite your gut feelings, you cannot find enough proof that the expenses he submitted for reimbursement had no business purpose. Bob has also denied everything. So what can you do?
Essentially you are stuck. A fundamental rule of the courtroom is that the burden of proof is on the prosecution to prove the allegations. This rule applies to workplace investigations too. Hunches, even your own moral certainty, don’t count. All that counts is the relevant, valid proof you gathered. Your gut feeling is no substitute for evidence. You either get enough proof, or the implicated person is off the hook, at least until some future time when new information comes to light.
51 ) You have flexibility with the investigation, if you can defend it.
Investigators are generally free to select what seem to be the most effective methods of collecting, analyzing, and recording all relevant information. You may use any lawful method you think is most effective to complete your fact finding.
If your company has an investigation protocol, follow it. But remember that the protocol is not a straightjacket. It is only a default set of investigation standards your company wants you to follow. Deviations are expected when a particular investigation requires.
Be prepared, however, to defend any deviation from the protocol. Any deviation must be an informed decision that will, it is hoped, result in a better investigation result for the company, and a result that remains fundamentally fair to the employees involved. Sooner or later, you’ll have to explain your decisions in a particular investigation and justify them.
52 ) Substance beats process every time.
Compliance-process owners regularly compile data on workplace investigations. Trends are examined, and problematic business processes are identified. The data is often shared with colleagues in other departments, often at quarterly meetings, where everyone reviews the same pie charts, pulls their chins in concentration, and agrees that the company should now do something different because of these insights. Then, typically, nothing happens, and another meeting is held in three months. In other words, people have just acquired the investigator’s work, massaged it, and then presented it as their own insights.
The investigation process is where the facts are learned. The investigation process validates whether your company’s training is effective and whether people trust your hotline. Workplace investigations are an important way to show whether the compliance program adds shareholder value—by increasing revenue or reducing unacceptable business risk—or whether the program is unfortunately just feel-good window-dressing.
The bottom line: there is a time for analysis, and there is a time for the brass-tacks work of an internal investigation. Each is useful, but the two are not interchangeable. Don’t fall into the trap of believing that massaging information learned through the efforts of others is the same as doing the necessary, and sometimes unpleasant, work of gathering that information. Be the one who adds substance and contributes value. Leave the arm-chair analysis to others.
53 ) If it does not happen at work, you don’t care.
Some misconduct allegations involve sensitive issues. For example, the executive who everyone believes is having a romantic relationship with his assistant, or the sexually harassing manager who others tell you has just filed for divorce. As you investigate issues of personal conduct, you might be tempted to consider their alleged actions in the greater context of that person’s life, not just their work. After all, when a witness volunteers that your implicated person is generally known to have a failed marriage, isn’t that relevant to establishing a motive behind his flirting with every woman in the office?
Employees are entitled to their privacy, however. An employer may only invade that privacy to the extent the employer has to make necessary inquiries. So, unless an employee’s conduct occurs either at work or somehow within the context of his employment, you have no right to ask about it. To do so is not only irrelevant—you are investigating workplace misconduct—but you might expose the company to an invasion-of-privacy claim (at the minimum).
You can often preempt this risk. At the beginning of each investigation, inform the witness—both the implicated person and anyone else who may know of the witness’s personal life—that you only seek information on work-related behavior. Explain that you do not wish to know more than that.
When you “inoculate” the witness not to give you more than a limited answer, you protect yourself and the company. If the witness volunteers the information, you may accept it (although you should write in your notes that the witness volunteered it). But even if it’s volunteered, consider if for background information only. The information may give you some insights or point you to areas of relevant permissible information, but non-office topics are usually of limited value when trying to prove workplace misconduct.
54 ) The office extends farther than the office.
You should investigate misconduct wherever it arises in the employment context. This extends beyond company offices and worksites. Conduct which occurs on a company-sponsored outing, training meeting, or other sanctioned off-premises event is subject to the same rules—and the company is subject to the same liability—as if it happened in the company’s office.
Some employees do crazy things when on business trips or at company conventions. Their behavior is subject to the same scrutiny as if it were occurring on their work desk rather than in a hotel room. The company risks liability and harm from this behavior just the same as if it occurred down the hall from the CEO’s office.
55 ) No fishing expeditions asking unrelated people on background in search of an issue.
Sometimes in the search for probable cause and usually before you are brought into the loop, managers many contact some trusted colleagues for their views as to whether the implicated person might be capable of the complained-about conduct. These managers aren’t trying to defame anyone as much as understand the dimensions of the problem they have just encountered. In fact, these managers would probably defend their inquiries as an appropriate way to understand what may have happened.
There are times when appropriate inquiries could be made regarding what the person contacted heard in the past about the conduct under investigation. But these are inquiries you should make, if needed, in the initial phase of your investigation. Whoever asks the question, the views of those colleagues should never be solicited to determine if the reported activity sounds like the kind of thing the implicated person might have done. This communication is potentially defamatory. It is also useless to the investigation.
What matters to you is what the implicated person did and whether you can prove it. It is of little help that uninvolved people who were contacted believe that the implicated person might be the kind of person to do that sort of thing. That is speculation, not probable cause or relevant information.
56 ) Unless you have probable cause, leave your employees alone.
Generally speaking, employees have the right to be left alone to do their jobs. Even though an investigation may be needed from time to time, an investigation should never be a “fishing expedition” in order to locate some elusive misconduct believed to be lurking around your company.
Your company’s leadership has given you limited corporate authority. You cannot open an investigation indiscriminately. Similarly, a reporter does not have the right to insist on an investigation simply because your company has an investigation function or promotes its hotline. An investigation is appropriate—and your authority kicks in—only if the initial report gives you probable cause to believe that misconduct has occurred. Never make any promises or commitments that action will be taken, other than that the information will be looked into.
What is probable cause? Probable cause is a criminal-justice concept. It reflects the value judgment that people are entitled to be free from scrutiny unless some basic factual threshold is satisfied. Probable cause means (1) that you reasonably believe a violation of your code of conduct, law or regulation may have occurred in your workplace, and (2) you reasonably believe that the named employee committed it. If you have probable cause, an investigation is now proper. Otherwise, an investigation is not appropriate at that time. (However, if later facts establish the probable cause, than an investigation should be opened.)
57 ) Words have meaning.
Workplace investigations are similar to their criminal-justice counterparts. And because proven misconduct may sometimes actually be criminal—for example, colluding with an outside vendor to approve phony invoices and then splitting the money—the temptation exists to adopt the law-enforcement nomenclature. Resist the temptation, however.
Ours is a business function, even if it is not always easy to show it. If we adopt words which are imprecise or freighted with meaning from another context, we will obscure our business purpose. We cannot fight all the stereotypes or preconceived notions, but we can set the right example with a careful selection of terms that reinforce our business purpose:
Report. This is the information presented by a colleague or third party, which is intended to identify possible or actual misconduct by a company employee. It is not an “allegation” or similar term because you haven’t yet verified the information to determine whether probable cause exists to warrant an investigation. The information in the report may lack credibility, it may be fabricated, or it may identify conduct that is not improper. At best, the information in the report is just a starting point for your inquiries.
Implicated person. This is the person who may have committed misconduct. The terms “suspect” or “target” are not appropriate. He is not a criminal. The person you are investigating is still your colleague. Even if substantiated, the misconduct will likely be only a violation of your company’s internal rules.
Substantiated. This means only that you assembled sufficient proof to show that the misconduct more likely than not occurred. Using “guilty” or words that indicate conclusively that the misconduct occurred is discouraged. The former is a poor choice because there has not been a trial. The latter is a poor choice because you don’t know for certain that the misconduct occurred. You only know that sufficient information shows that it more likely than not that the misconduct happened.
Unsubstantiated. Conversely, this does not mean that the implicated person is innocent. It only means that you were unable to assemble sufficient proof to show that the misconduct likely occurred. Your colleague may actually have committed the misconduct.
Inconclusive. This means that, despite your efforts, you could not access enough information to determine whether or not the allegation could be substantiated. It is not the same as unsubstantiated because unsubstantiated presumes that you had access to all the documents and witnesses reasonably needed to make a full inquiry. A good example of an “inconclusive” finding is where essential witnesses have since left the company and refuse to be interviewed now, or where needed documents have been lost or destroyed.
Unfounded: This means that there was insufficient information to give you probable cause and warrant an investigation. This is not the same as unsubstantiated, because here you did not begin gathering proof of whether misconduct occurred. An “unfounded” determination is appropriate where the initial report complained about conduct that was not misconduct even if you assumed the reporter’s facts were accurate. A good example is where the complained-about conduct was within the boundaries of a manager’s reasonable discretion.
Resolved. This term means that you handled an inquiry or assisted with the resolution of an issue, but you did not conduct an investigation. Making inquiries to assist the company’s lawyers render legal advice to the company and then completing that effort is a good example.
Besides choosing the right words, don’t sprinkle your writings with corporate-speak or words with unnecessary complexity. So skip the “paradigm shift” and “thinking outside the box.” And if Bob punched Steve in the parking lot, say just that instead of explaining how “the witness observed an assault and battery.” Just say what you mean clearly and simply. Let the results of your efforts shine through.
58 ) Keep things confidential while disclosing on a need-to-know basis.
The importance of keeping all investigation-related information confidential cannot be overemphasized. Maintaining confidentiality is critical to the integrity of your investigation. If you don’t ensure strict confidentiality throughout the investigation, your failure may have serious consequences:
Someone’s reputation may be damaged if others learn of the report, even if the allegation is found to be unfounded.
The success of the investigation can be undermined if others know you are conducting one.
The implicated person might engage in cover-up activities when he learns that he is being investigated.
The company might be vulnerable to negative publicity or liability.
The company’s ability to defend any legal action associated with the matter may be damaged.
The disclosure of information (or misinformation) may cause retaliation or witness intimidation.
All fine and good, but it does create a bit of a dilemma. Investigations are a business process, not a secret search for wrongdoing. They also tend to disrupt operations, despite your efforts to minimize the disruption. Business managers need to know what you are investigating, and how things are proceeding. If interim steps are needed, such as sending the implicated person home on full pay, you will have to tell the managers something. “Just trust me” is not a sufficient, professional response to a manager’s request for a status report or information to justify the interim steps.
You have a qualified privilege to disclose information on a need-to-know basis. This basis comes in two parts: (1) does this person need to know something about the investigation at this moment, and (2) what precisely does this person need to know? If you can sufficiently answer these questions, go ahead. This is a topic where the “you’re damn right I did” standard will serve you well. Just remember to limit the information to what that person needs.
Don’t pretend that even the existence of an allegation won’t affect the implicated person’s reputation. You have an obligation to do all you can reasonably do to protect the reputations of all concerned and the company’s interests as well.
Excessive disclosures of information pose some risks. First, the person you discuss may claim defamation, damage to his career prospects, or some other real or imagined grievance. (What better way to get some insurance against the fallout from a substantiated misconduct finding?) Second, excessive disclosure undermines your investigation either by tipping off witnesses to the specific issues you find important, or the disclosures may chill future testimony by witnesses who—justifiably or not—fear you will blab their personal details too.
The need for confidentiality begins when the initial report is received, but it does not end with the conclusion of the investigation. The fact that an investigation is underway or is being considered, the subject matter of it, the process followed, the materials or information gathered and the results of the investigation must always be treated confidentially. This protection includes being careful before using the details of an investigation at some later point in time.
On a related note, never promise complete or absolute confidentiality to a witness, reporter or anyone else. There is no way to guarantee it in all circumstances. (Once again, never say always, and never say never.)
59 ) Know your burden of proof.
To be fair to the employees implicated in your investigation, you have a burden of proof to satisfy. This means that you have to gather evidence to substantiate each element of the misconduct allegedly committed.
Once the proof is gathered, it has to be measured against a standard of proof. This is whether you have gathered enough proof to consider the allegation to be substantiated.
The applicable standard of proof in a workplace investigation is a “preponderance of the evidence.” An allegation is considered proven if, based on the facts learned and the documents reviewed, it is more likely than not—think 51 percent or more—that the misconduct actually happened. If so, the allegation is considered substantiated. If not, the allegation is considered unsubstantiated.
The preponderance-of-the-evidence standard is not a criminal-justice standard. The criminal-justice standard is “beyond a reasonable doubt.” This means that the proof makes it at least 90 percent certain that the misconduct actually happened. This difference in standards is another reason why the right to remain silent and the right to a lawyer—both constitutional rights in criminal cases—don’t apply to employees in workplace investigations.
This topic underscores why you should avoid criminal-justice concepts and standards in your investigations. For example, if you adopted the beyond-a-reasonable-doubt standard, this would force you, among other things, to spend more resources and time than needed. It would also result in substantiated misconduct going unpunished when you cannot meet a 90 percent standard, although you may have satisfied the 51 percent standard that did apply.
60 ) Corroborate material facts.
Even with different standards of proof, workplace investigations continue to bear some resemblance to their criminal-justice counterparts. In a criminal case, a defendant’s confession is not enough to justify the acceptance of a guilty plea. The police must also produce evidence to corroborate the material facts of the confession to show that it is accurate. (Judges are wary of accepting false confessions.)
This is also true in our world. If you are investigating a theft case, it is not enough to sustain the allegation against Bob simply because he admits taking a laptop from the office that was not assigned to him. However, if in speaking to Mary, she checks the serial number of the laptop and confirms that it was assigned to someone else who did not give Bob permission, then you have corroboration of the material facts to support Bob’s admission.
The point here is that the material facts in your investigation need to be supported by a second source. The second source could be a witness or a document. The important part is that the existence of the fact to your findings does not depend on only one source. It’s better to have the fact bolstered by something else to support its accuracy and reliability.
61 ) The investigation objective is decided up front. It is refined as you go.
Too many investigations begin either as a mad scramble to learn every possible fact or with a lackadaisical approach that usually means the investigator is gathering evidence in search of an allegation. Either way, the investigation becomes inefficient, sloppy, and disruptive and generally wastes limited resources. The investigation result will also be poor and unfocused.
These problems usually indicate that an investigation objective has not been specified. An investigation objective is nothing more than the answer to a simple question: what does the investigation need to prove? You can investigate more efficiently and effectively if you identify from the outset the precise allegation you intend to investigate.
This determination doesn’t sound especially profound, but it’s a simple step that’s frequently overlooked. Grab a cup of coffee, and spend a few moments thinking about the information you have so far. Does it look like employee misconduct or a possible crime? Does it look like a specific company policy was violated, or is it some more generic misconduct like poor management supervision? Does it appear that only a rogue employee is involved, or could it be a perfect storm of unacceptable factors, which conspired to create the problem?
Once you’ve finished your coffee and answered these questions (at least for now), you should then identify the component elements of the alleged wrong. From that point, you determine the information you will need and how you will get it.
An investigation strategy is not engraved in stone. The initial investigation strategy might change as the investigation proceeds. Changing the strategy as the investigation proceeds and additional information is learned is actually a good thing. It shows you are testing your assumptions and proofs against the facts as you are learning them. When needed, you are adjusting your approach. This ensures that your investigation results will be supported by the proof you assembled.
62 ) We don’t plan to fail. We fail to plan.
Every investigation requires you to do some thinking and analysis. You can ensure a good result by doing as much up-front thinking as possible. Once you have identified your investigation objective, the next step is to make an investigation plan.
The detail required, and the time consumed, to plan an investigation depends on the complexity of the allegation. Routine investigations usually require minimal time and detail, and a simple outline or summary may be sufficient. Complex investigations need more time and require finely developed planning.
Your investigative plan is simply the outline of how you intend to conduct the fact-finding process so you can obtain the facts necessary to prove the elements of the allegation. The plan serves as a checklist to ensure all necessary points are covered thoroughly and efficiently. Although created at the start of an investigation, a plan should be updated continually, not only to document the steps you’ve already completed, but also to reflect the changes—in objective, allegations, strategy, lines of inquiry, additional concerns, etc.—that become necessary as the evidence is developed.
There is another benefit of doing your thinking up front. A well-considered investigative plan that is conscientiously updated later becomes the outline for your investigative report. This makes report drafting more efficient. It also ensures a logical consistency and progression from allegations to fact finding to fact presentation. Once the framework is constructed, you only need to fill in the facts.
Part of the planning includes determining the scope of the investigation. The scope is different than the objective, but it is part of the same continuum. The objective is the ultimate purpose of the investigation, such as whether Bob defrauded the company by colluding with an outside consultant to submit fictitious invoices. The scope looks at the fact parameters needed to substantiate the allegation. Continuing with Bob, the scope would include analyses of the invoice-review and accounts-payable procedures. But the scope would not include inquiries into Bob’s marriage or private life.
Defining the scope is fact-intensive. Simply put, what facts are you trying to learn? Is the allegation related to a company policy only? If so, then the investigation would focus on the relevant facts, comparing that to the specified company policy, and then suggesting remedial action. If the investigation concerns criminal conduct or financial irregularities, then the investigation may also assess possible criminal and civil exposure for the company and the individuals involved.
A proper investigation scope reinforces the fairness of the process. If the company must later defend a decision based on the investigation—a wrongful termination claim, for example—it will appear unreasonable for an employer to have reached a conclusion based on no or scattered evidence, or no real investigation at all. Also, it will appear unfair if the company disciplines an employee based on weak evidence when better or stronger evidence was reasonably available but ignored.
Proper definition of the scope also protects the innocent. A properly conducted investigation will identify any wrongdoers, but that does not mean that other individuals might not be injured as a result of the fact-finding. The importance of defining the scope of an investigation is, in some ways, an effort to protect the innocent, to narrowly define the fact-finding area to be investigated, and to assure that those not involved in a particular act of misconduct are neither implicated by their proximity to the event nor exonerated by omission.
There are serious consequences if the investigation scope is too narrow or too broad. You need to get to the root cause of the problem and not just deal with its symptoms. If your investigation is superficial, an underlying business problem will not be addressed, and the workplace will be exposed to further disruption. However, an overly broad investigation can equally harm the workplace culture and disrupt the business.
The scope can change anytime you believe there is actually more or less misconduct than originally thought. If you change the investigation scope (and the plan), simply add a contemporaneous note to the file documenting the new scope and your reasons for changing it. This could help you later on if you are accused of having some improper motive when you adjusted the investigation scope.
Once the scope has been determined, you can move to the next part of the plan: the strategy. A proper strategy, regardless of the investigation’s complexity, makes the investigation process thorough and professional. The strategy is also the next stop on the checklist after objective and scope.
The scope gave you the fact parameters, which only constitutes a broad outline of your fact inquiry. The strategy takes it a step further and looks at the important granular issues, such as which people do you need to interview, and what documents do you need to review. The objective and scope determinations were critical to focusing your inquiry, but they neither give you any proof nor direct you to a promising source of relevant information.
The quality of your fact-finding depends significantly on your strategy. Who can give you the relevant information you need to substantiate each element? What documents should you seek? Do you need expense reports or access to the computer server to review someone’s emails? If you estimate your needs too narrowly, you might miss someone or something. But if you estimate too broadly, you may overlook something important while wading through a morass of marginally relevant information. So, although a strategy should be adjusted as the investigation proceeds and you learn more, try to get it right the first time. This way, any adjustments are merely refinements and fine-tuning rather than wholesale changes that force you to retrace earlier steps.
As the investigation proceeds, stay flexible. Situations change, and you will want to adapt. The true nature of the problem under investigation may turn out to be different from what you first thought. Similarly, the witness list should be a “running” list, because different or additional witnesses may surface during the investigation. Do not let the investigation plan become so rigid that you can’t alter it when necessary.
Keep in mind, however, that although you are an objective fact-finder, you are not neutral. Your role is more like a prosecutor’s, and your investigation plan should reflect that. You are interested in proving that misconduct occurred if you can gather enough proof. You aren’t indifferent to whether or not you can prove it. Like a prosecutor, however, you are interested in justice if the facts show that that implicated person is, in fact, innocent.
63 ) What didn’t happen is as important as what did.
People love to jump to conclusions, especially during investigations. Speculating can be enjoyable water-cooler chitchat, and it tends to be more exciting than the mundane truth. Most misconduct is more often the result of poor and/or irresponsible decisions than intentionally wrongful behavior. Managers often view the allegation in the most-sinister light, and this can lead to a harmful overreaction, both in terms of personnel decisions as well as process changes.
Your investigation findings must tell a story. Of course, this means explaining what happened. But to ensure that management responds appropriately, it is sometimes necessary to explain what didn’t happen. This allows the scrutinized conduct to be placed in context. So make sure you can offer this perspective and plan to write a full narrative when you are done. Tell the whole story.
An overreaction by management to an allegation of misconduct may be worse than an under-reaction. And it doesn’t help the business either way.
64 ) If you want to substantiate a crime (or its workplace version) you have to prove each element.
It is never enough to make an investigation finding of “Bob stole the money.” Your investigation requires a more precise finding if you want to contribute any value to the company. You must satisfy the burden of proof for each element of the offense.
One again, there is a parallel here to criminal justice. For example, to convict a defendant of criminal fraud, a prosecutor must prove—beyond a reasonable doubt—each of the elements: (1) a misrepresentation to the company of a material fact; (2) that was known to be false when said; (3) that was intended to cause the company to rely on it; (4) the company relied on it; and (5) the company suffered damages as a result. The prosecution has to develop sufficient facts to substantiate each element by the requisite standard of proof. Each element must be proven. If even one element cannot be proven—assume there were insufficient evidence of whether the misrepresented fact was “material”—the defendant goes free. In other words, the prosecutor is assembling evidence not to prove “fraud,” but to prove each of five requisite elements.
The same approach applies to workplace investigations. Consider your company policy on sexual harassment. It probably defines sexual harassment as: (1) intentional, unwanted discrimination based on sex, (2) the harassment was severe or pervasive, (3) the harassment negatively affected the work environment, (4) the harassment would detrimentally affect a reasonable person of the same sex, and (5) management knew or should have known of the harassment, and did nothing to stop it.
Focusing on the requisite elements is probably even more important if you believe a crime has occurred, and your company intends to report the matter to the police. The police detectives and others reviewing your findings will be examining the proof with an eye towards a possible prosecution (with a criminal conviction as its goal). Structuring your investigation this way is like giving them a road map to proving the crime, identifying areas for them to supplement with their own fact-finding, and otherwise taking your case.
65 ) Interim measures are meant to help. Don’t let them hurt.
When serious allegations of misconduct are directed toward a specific employee, your company may need to take preliminary action pending the completion of your investigation. If necessary to protect the health and safety of any employee, to protect the integrity of the company’s policies and procedures, or even the need to simply “stop the action” until the investigation is done, management may consider taking any of the following steps:
Suspension of the implicated person, with or without pay.
Sending the employee home without a suspension, but on a paid leave of absence until the matter can be reviewed.
Temporary transfer of an employee pending the completion of the investigation.
Interim measures, however, are not cost-free, even when needed. If the implicated person is alerted to the allegation, which is inevitable if he or she is suspended or terminated before you can interview them, the likelihood of a successful confrontation in an investigation is diminished, especially if the employee retains a lawyer. Proactive measures to obtain damaging evidence against the employee through surveillance or similar measures will, in all likelihood, be lost. The employee may also try to influence other witnesses or third parties who know of the misconduct, or the employee may try to destroy relevant documents or other evidence.
You must recognize that there will be circumstances where the company will have no choice but to suspend or terminate the employee at the same time you are trying to figure out what happened. However, in the absence of a genuine threat to the company’s financial well-being, the better option for your investigation is to wait with the interim steps until the confrontational interview with the subject has taken place. Whatever the choice, interim steps must be coordinated between you, Human Resources, and executive management.
You can be creative with interim measures and tailor them to your specific needs. An employee has no right to continue working unaffected by the investigation. It is only wrong to penalize them if the investigation has not yet been completed. This might seem unfair to some people, but investigations are one of the realities of being a corporate employee.
An investigator must weigh the options to ensure that the investigation is not hampered by interim steps. Suspending or terminating an employee severely limits the investigator’s ability to confront the employee under conditions carefully designed and structured to maximize the likelihood of a confession. As with other factors in the investigations process, decisions made regarding interim measures should be the result of a conscious, informed decision. And be prepared to defend the interim measures both to the implicated person and the department affected by the person’s absence.
66 ) You’re going to be a guest in someone’s house. Tell the managers.
Word of an investigation usually spreads rapidly through the department under investigation. Unless there is a specific need to conceal the existence of the investigation from senior management in the relevant department, courtesy and professionalism dictate that you notify them before the first interview starts. A solid, professional start is particularly important when you anticipate that you’ll need their assistance facilitating interviews and locating documents during the investigation.
If the initial notice is oral, your investigative file should reflect who was contacted. A personal courtesy visit early in the investigation is also helpful to establish good rapport.
During the personal visit, you might advise the department’s leaders of the general nature of the allegations, or you may state the specific allegations if you don’t believe that will compromise the investigation. Department heads should not be told of the reporter’s identity, or allowed to review or make copies of any correspondence from the reporter, unless the case file clearly shows the reporter earlier agreed to it. (Many investigators prefer not to provide this information to management even when the reporter does not object.)
During the courtesy visit, it is appropriate to remind managers not to discuss the investigation with others, especially witnesses, and to be careful to avoid any action that someone could construe, fairly or not, as retaliation for initiating or cooperating with the investigation.