Summary: This blog has mentioned how to conduct a workplace investigation successfully. Some of the aspects of the internal investigation have also been highlighted. Steps for an effective internal investigation, ranging from the scope of Internal Investigation, preserving evidence and records to documentation and follow-up, are explained clearly. We have also discussed the scope of using third-party email forensics software for a smooth and error-free internal investigation.
Companies that keep up with emerging challenges in the business environment, such as data thefts, frauds, phishing attacks, etc., have started to realize that they need detailed guidelines for internal investigations. This is because only a few organization employees are trained in workplace investigations. When misconduct like accounting fraud, data theft, or action leading to non-compliance is reported in a company, internal investigation helps uncover the truth and identify the culprit. However, you have to ensure that the outcome is generated without disrupting business processes or hurting employee relationships. For this, you need careful planning and execution of the entire investigation process.
Who should conduct Internal Investigation?
Ideally, an investigation is supervised by an investigating officer with a team of professionals from human resources, internal audit, information security, etc. Some companies also use external resources like accountants, digital forensic experts, etc.
If you are going to initiate an internal investigation, then the following are a few questions you should ask first:
- How did the incident take place, and who brought it to light?
- How much will internal investigation cost, and what steps can be taken to minimize expenses?
- Are enough resources and tools available for a successful internal investigation?
These questions can help you get a better idea of the situation.
Once you are ready, you can work on the following:
1. Establishing Clear and Well-Thought-Out Policies
Without a plan of action, a proper investigation can be complicated. So, it would be best to put a comprehensive policy covering all investigation scenarios. There is a protocol that employees and investigators must follow. Some points that should be covered in the policy include:
- Temporary measures that may prevent business hampering during the investigation process.
- Disciplinary actions for different degrees of misconduct and crimes.
- Initial fact-finding assessment methods.
2. Defining the Scope of Investigation
There are two sides to every workplace investigation. On the one hand, the company wants to investigate credible allegations of wrongdoing to prevent financial or reputational damage. But, on the other hand, it doesn’t want to put its precious staffing on the investigation for long as this may affect productivity. So, a balance should be struck that defines the scope and extent of the investigation.
The scope can also be defined based on how fast the company needs information. If time is short, the investigation may be limited to selected interviews and a few handpicked documents analysis. However, if time is available, a comprehensive investigation can be undertaken to cover all witnesses, departments, or entities.
3. Preserving Evidence and Records
In case of misconduct, you need to identify and preserve all the relevant documents immediately so the investigation can be conducted without hiccups. Then, you can issue a notice to all the employees concerned, informing them about the investigation and directing them to preserve the documents associated with it. You also must be extra careful while examining and extracting data from employees’ hard drives, laptops, computers, and even personal digital assistants (PDAs).
4. Documentation and Follow-Up
You must create a detailed report documenting all the investigation activities. You should document details such as the problem in question and how it caught the company’s attention, conduct interviews, and draw conclusions based on the evidence collected.
To prevent repeat occurrences, appropriate preventive measures should be taken. These can include more stringent data protection measures, device security policies, tighter hiring protocols, etc.
5. Who should be involved?
As you might be dealing with confidential information during the investigation, it is better to involve only the concerned employees and departments in the company. You would need to inform the forensic investigations, email forensics experts, personnel from the HR department, top-level/middle-level management, and other key decision makers about the investigation and the plan of action.
6. About the Interviews
Interviewing suspects and witnesses is a vital part of internal investigations. The following are some of the things that you need to remember:
- It is a good idea to start an interview on an informal note. It would be best to make the interviewee comfortable before asking questions.
- A list of important questions must be prepared in advance, and the answers should be documented.
- Video recording of each interview is also recommended for analysis later.
An internal investigation is far more complex and meticulous than the picture this article paints. Hence, creating a comprehensive protocol for the same can take time.
Tools for Digital Forensics Investigation
To identify and collect digital evidence from computers and other electronic devices, you can take the help of an enterprise-grade eDiscovery and digital evidence collection tools. An advanced and easy-to-use email forensics software alone can be helpful if you need to analyze the employees’ emails to collect evidence, forensically. You can use such a tool to scan the mailboxes of all the appropriate employees quickly and accurately. Such tools can help you filter emails to find relevant information quickly, tag critical emails, and export data in convenient formats, like PST, PDF, HTML, etc. These tools also have advanced case management features that allow you to document every detail.
| Download a free trial of Stellar Email Forensic software to start your email investigation now.. |
