Investigation Practice and Evidence Handling

Once a case involves an employee's conduct, how you conduct the investigation matters as much as what you find. Evidence gathered improperly is excluded, and a conclusion reached without process is overturned.

General practice. Requirements differ by jurisdiction; involve legal at the start of any case, not at the end.

Before you start

Get authorisation. Under the governance you defined, from whoever approves investigations. Do not begin looking at an individual because an alert looked interesting.

Define the scope. Which accounts, which systems, which period. An investigation with unbounded scope becomes a general examination of someone's working life, which is disproportionate and will be characterised that way.

Involve legal early. Particularly on questions of privilege, protected communications, and what may lawfully be examined in your jurisdictions.

Decide who knows. Frequently not the subject's manager, at least initially. Confidentiality protects the subject as much as the investigation.

Handling evidence

Preserve before you examine. Take a copy, work from the copy, leave the original untouched. Investigating on a live system alters it.

Record what you did. Time, action, tool, result. Contemporaneously, not reconstructed afterwards. This is tedious and it is what makes findings credible when challenged.

Maintain custody. Who had the evidence, where it was stored, who accessed it. A gap in the chain is the standard route to exclusion.

Do not alter the subject's environment. No remote access to their machine to "have a look", no test messages, no changes to their permissions that would signal an investigation. All of these contaminate.

Preserve broadly, examine narrowly. Preservation should cover more than you expect to need; examination should stay within authorised scope.

Interpreting what you find

Distinguish observation from inference. "The account transferred 4,200 files to a device with this serial number at these timestamps" is an observation. "The employee stole customer data" is an inference, and it belongs to the people making the determination, not to the analyst.

Look for the innocent explanation actively. Not as a formality — genuinely try to construct one. If you cannot, that is meaningful. If you can and did not look, the person's representative will find it and your credibility is gone.

Check the technical assumptions. Timestamps in what time zone. Whether the account was shared. Whether the device was in the person's possession. Whether an automated process could produce the same trace. Investigations have collapsed on all four.

Beware confirmation. Once a theory forms, subsequent evidence gets read to support it. The counter is having someone outside the investigation review the findings before they go anywhere.

The interview

If the subject is interviewed, HR leads. Security explains technical findings and does not conduct the questioning.

Entitlements apply. Notice, representation, the right to respond. These vary by jurisdiction and by contract, and disregarding them can invalidate the whole process regardless of what was found.

Present findings, not accusations. "These transfers occurred; can you explain them" produces information. An accusation produces a defensive response and, sometimes, a complaint about the process.

Take the explanation seriously. People sometimes have one. Test it rather than dismissing it.

Writing it up

Facts, method, findings, and the limits of what the evidence shows. Explicitly state what you could not determine.

A report that overstates certainty is worse than one that acknowledges gaps, because the overstatement is what gets attacked, and when it falls the sound findings fall with it.

When it turns out to be nothing

It frequently does, and how that is handled determines whether people cooperate with the programme in future.

Close it properly. Delete what the retention policy says to delete. If the person became aware they were investigated, someone should tell them the outcome. Being investigated and never told the result is corrosive, and word of it spreads.