1. Establish the Investigative Plan

The important first step is the investigation plan. It will be the living roadmap that evolves as the investigation progresses. Core components include:

• Identifying the investigation’s background
• Defining its scope
• Outlining the objectives and goals
• Determining who will conduct the investigation
• Identifying the stakeholders
• Setting a timeline

2. Initial Background Fact Gathering

After establishing the plan, it is important to gather background information. This process may include informal interviews with staff who know the basic facts and people involved, such as:

• Senior employees in the department in question
• In-house counsel in the initial response team
• But not the key witnesses at this stage

3. Document Collection and Review

Collecting and preserving documentation requires careful consideration of what documents might be relevant and potential sources of data which may be in scope, including:

• Hard copy documents     
• Electronic data e.g. emails and documents stored on servers
• Documents stored on personal devices and in chat systems
• Recorded phone calls
• Chat messages, including on mobile devices
• Transaction data

Locating, preserving and then reviewing this information requires a plan of action:

• Identifying document custodians
• Identifying data sources
• Taking steps to preserve data
• Collecting relevant documents
• Reviewing and categorising documents, and identifying potentially privileged

4. Interviews

Interviewing key individuals is essential to an internal investigation, but some care is needed since some investigating authorities may consider that the company is “trampling the crime scene” if key witnesses or potential targets of the authority’s inquiries are interviewed without the authority being aware. Steps in the process include:

• Determining if the witness has, or needs, individual counsel
• Establishing what the witness knows or doesn’t know
• Having all relevant documents to hand and preparing a memorandum to summarize the information

5. Report Investigation Results

Reporting the findings will depend on whether the audience is company management, external authorities or auditors, and the level of detail and the format require case by case consideration. Some approaches include:

• A written report, which is most detailed but also the most labour-intensive and potentially risky if it unexpectedly falls to be disclosed to an authority or in litigation
• A presentation can be impactful but will sacrifice detail and nuance
• An oral report by counsel, combined with a record of the investigation, which can be an effective way of presenting information but does not create the same type of written record of the findings as other approaches

6. Propose Potential Responses

Having completed an investigation, the company may want to – or may need to – take steps to report and address the misconduct or other issues raised. Considerations include:

• Remedial measures to address the root causes of the issues, such as new procedures or training
• Disciplinary action if appropriate
• Self-reporting to the authorities, which may lead to reduced penalties
• Market disclosure in the case of public companies

Special Considerations

Some investigations may be global in nature or touch on particularly sensitive topics, which will require special treatment. These include:

• Antitrust, where there are different legal standards around the world and simultaneous review by different antitrust regulators is increasingly common
• Corruption, which can require detailed forensic examination and can present substantial reputational risks
• Cybersecurity, where systems may be compromised and a secure communications channel is essential
• Sexual harassment, where a sensitive approach in a potentially emotionally charged situation is critical
• Whistleblowing, where the whistleblower is likely to have legal protections against retaliation