In the first article in this series, we dealt with the best approaches to accessing and analysing ‘internal’ digital evidence, including corporate data such as emails and chat messages. However, information that is ‘external’ to the company, such as public record data and well-informed human sources, must not be overlooked.
It can enable executives to take an informed decision on whether to proceed with an investigation which might be resource intensive, reputationally sensitive, and potentially destabilising to the business. It also allows compliance and legal teams to plan and embark on high-stakes interviews effectively, with the relevant facts already in hand and intelligence about each interviewee.
In this article we explore various factors which an investigating team needs to consider when undertaking an internal investigation. We have taken as our example the response to a whistleblower allegation.
1. What are the important things to consider when starting document and mailbox review?
Often the investigating team’s first reaction to a credible allegation involving an employee is to carry out a review of the mailboxes controlled by the key individual(s). The data sources would usually include emails, instant messages and files saved on company servers belonging to these employees. This can be essential in identifying evidence and building context to guide interviews and further investigative work. But there must have been an unusual degree of carelessness from the suspect for a complete picture to arise from the email review alone.
The initial review uses keyword search terms, usually based on the whistleblower’s allegations and developed with the client. But these are only a starting point. Once we start to analyse the data and understand who the relevant employees are and how they communicate, we usually refine the dataset and keywords multiple times. This can be as fundamental as understanding which language the employees of a multinational corporation use in communications with certain colleagues, suppliers, or clients. We also need to develop a list of industry jargon, common acronyms, and shorthand – which can be impenetrable to the outsider. For example, in a recent investigation into an eastern European subsidiary of a large multinational company, the employees communicated in their own language with local suppliers but in English with regional and global headquarters. S-RM therefore developed keyword searches that captured messages in both languages, as well as the most relevant jargon, slang and acronyms.
2. How are digital communication patterns changing?
It is also increasingly common for employees to communicate over messaging apps rather than email. As discussed in the previous article in this series, investigators’ ability to access and analyse these communications can be constrained, particularly if they take place over messaging tools not intended for corporate use. In addition, keyword searches are often of limited value where individual messages are short and informal, sometimes consisting of no more than emojis to show agreement. Instead, the most effective approach is to refine the scope on the basis of the email review, determining the relevant parties and the time period when important discussions might have taken place, then to review the messaging app exchanges in full.
Taking an iterative approach to document review can identify the times of key meetings or calls where decisions were made, as well as lists of attendees, which can be fed back into the review process.”
Employees planning to commit misconduct are typically aware that their corporate messaging platforms may be subject to review. Therefore it is important to pay attention to any messages suggesting a call or an in-person conversation at a critical juncture.
Taking an iterative approach to document review can identify the times of key meetings or calls where decisions were made, as well as lists of attendees, which can be fed back into the review process. This can also be vital in identifying potential witnesses and structuring interviews in order to gather first-hand accounts of key meetings.
3. Is document review the only approach I should rely on?
By deploying corporate intelligence early and effectively, the investigating team can often avoid a resource-intensive mailbox review or intrusive interviews. This is especially useful where the credibility of a whistleblower’s allegations can be established at an early stage. S-RM has carried out open source investigations proving that certain allegations are demonstrably false, bringing the investigation to a swift conclusion. For instance, S-RM was supporting a corporate client which had received an allegation regarding a serious conflict of interest, namely that a very senior executive had improperly awarded a contract to a consultancy firm in which they themselves were a shareholder. By analysing the consultancy firm’s corporate filings and social media output, S-RM was able to confirm that it was a partnership, owned and managed by a small group of founders. While it was apparent from their social media interactions that these partners shared a long professional history with the senior executive, this individual was not an investor. The investigating team within the corporate felt comfortable ending the investigation there.
Conversely, open source research can be used to corroborate certain elements of an allegation early on and justify proceeding with an investigation. Research methods such as social media analysis, network mapping, and corporate record research can be deployed in parallel with a mailbox review, allowing leads to be properly pursued and limiting the number of unanswered questions. The synergy between the ‘internal’ and ‘external’ investigations can add real value, identifying new lines of enquiry and leading to critical findings.
Open source research can be used to corroborate certain elements of an allegation early on and justify proceeding with an investigation.”
Sometimes, vital information held externally is not available via public record research alone, and other investigative methodologies are needed. For example, beneficial ownership can be concealed by the use of proxy shareholders or through offshore companies whose shareholders are not publicly disclosed. In some situations, before proceeding with highly sensitive interviews with senior employees, S-RM gathers intelligence from individuals outside the business who nonetheless have some insight into the allegations or people involved. These sources are carefully selected and discreetly approached – they might include former employees of a supplier whose activities are under investigation, competitors who may have knowledge of their business practices, or regulatory bodies. Around sensitive internal investigations, S-RM carefully designs its approach to external sources to mitigate the risk of exposure or tipping off. In a recent investigation into a senior executive at an investment firm, S-RM was able to gather intelligence discreetly from individuals connected to the firm’s portfolio companies, exploring the extent to which the executive’s misconduct had been observed by them. This approach allowed our client to identify and remedy the issues without revealing their concerns through a more formal request for cooperation.
4. How should I prepare for interviews?
Employee interviews should ideally be built on a foundation of other investigative steps, so that the interviewing team is well-informed and can corroborate interviewee responses against known facts. Findings from the preliminary investigation can also help the team strategise the objectives of each interview and determine their running order, starting with individuals likely to be cooperative or neutral, and therefore generating useful information to support subsequent, more critical interviews. Initial investigative findings are also useful in preparing questions and document packs covering the key events and identifying information gaps or inconsistencies on which to focus. S-RM can carry out or provide training on interviews based on PEACE interviewing models, which are designed to elicit as much information as possible in an ethical manner, following these five steps: (i) Preparation and Planning, (ii) Engage and Explain, (iii) Account, Clarification, Challenge, (iv) Closure, (v) Evaluation.
Employee interviews should ideally be built on a foundation of other investigative steps, so that the interviewing team is well-informed and can corroborate interviewee responses against known facts.”
Preparation is essential to effective PEACE interviewing, and information gathered through document review, open source investigation and human source intelligence can form an effective basis for this.
Seeking external sources of information can also be highly effective throughout an internal investigation, helping to gather and corroborate essential information and thoroughly prepare for interviews. To explore the best approaches to gathering this intelligence in the context of internal investigations, please reach out to our Disputes & Investigations team.
