The Process of Investigation
E. F. Ferraro
1.6 The Seven Phases of Investigation
not necessary. In order to discipline an offending employee, in most instances the employer needs only to prove the employee in question committed the offense.
The employer does not need to prove or demonstrate things like means, motive, and state of mind or intent. Those elements of the offense are inconsequential and have no bearing on the employer’s decision to impose discipline. Armed with a properly obtained admission, an employer needs nothing more to take disciplinary or corrective action against the offender. The same is not the case for criminal prosecution.
Trap: Employers tend to over-investigate. Many of them believe they must prove their case beyond a reasonable doubt. This extraordinarily high standard (or sometimes referred to as burden) of proof is reserved only for criminal prosecution.
In pursuing it, the employer expends more time and resources than necessary.
Like undercover, interviews are also interactive. They afford the investigator the opportunity to exchange information with the subject. Specifically, interviews afford the investigator the opportunity to determine the who, what, where, when, how, and why from the very person who was there. It also provides the investigator the unique opportunity to peek into the mind of the offender. This benefit, com-bined with the opportunity to obtain an admission, makes the investigative inter-view the most powerful form of investigation for those conducting workplace investigations—and the title of this book.
investigator who imposes process and structure on his investigation obtains bet-ter results and does so with more efficiency. What’s more, it differentiates him as a professional. It affords him and his employer or client the benefit of ease in assessing and analyzing the result. As in the scientific community, process also permits peer review. In the community of employer–employee relations, others may review the fact finder’s efforts and are able to easily and accurately struct that which the fact finder found and how he found it. The ability to recon-struct the process and demonstrate its integrity and propriety lends it credibility.
That credibility is the foundation on which all facts rest. An investigative process without credibility is fatally defective. That defect potentially imposes a bar to the admission and ultimate use of otherwise admissible and actionable evidence. It is the implementation and ultimate integrity of this process that is the hallmark of the professional investigator.
1.6.1 Assessment
The Assessment phase of the investigation involves examination and evaluation of the fundamental facts regarding the allegation and some “preinvestigation investi-gation.” Things generally accomplished in this phase include:
◾ Determining if the parties suspected are, in fact, employees and were work-ing on the date and time in question.
◾ Determining what policies, practices, and precedents exist that may impact the intended investigation and the manner in which it is to be conducted.
◾ Who else in the organization should be notified prior to the initiation of the fact finding or before investigative interviews take place?
◾ Are there any parties external to the organization that should be notified and, if so, who?
Equally useful is the simple mental exercise of determining if the matter is even worthy of an investigation, are the allegations (or suspicions) credible, and what might happen if the matter is simply ignored? Additionally, one also might consider the endgame. For example, what does a successful investigation look like and how might the results be used? Does the result include prosecution, restitu-tion, or discipline? These and other factors will drive one’s process and the level of effort he will invest. In order to facilitate this phase of the investigation, see Appendix 2. This easy-to-use tool (called the Investigation Checklist) can be mod-ified to suit your individual needs. In its current form, it covers all of the up-front considerations and actions discussed thus far and can be used to ensure nothing has been overlooked.
Tip: Fact finders are well served by properly assessing an allegation and fact pat-tern before committing themselves and their organization to an investigation.
Failing to undertake some simple preinvestigation steps often results in wasted time and resources.
1.6.2 Preparation and Planning
The next phase of the process has been discussed already in some detail. It involves all of the front-end activities and preparations that normally take place before fact finding begins. It includes such activities as obtaining management’s commitment, negotiating objectives, establishing a timeline for the project, deciding a standard of proof, and pooling the necessary resources and expertise to do the job properly.
I take the preparation and planning of my investigations very seriously. I have learned from experience that the time and energy invested up front pays big dividends later. For example, by negotiating and detailing objectives early, I am more easily able to lobby for the resources I need to do the job. By establishing a timeline and communicating it with the client before the project begins, allows both the client and me to better plan and budget our time. It also provides a clearer way to communicate expectations and often reduces confusion later. The old adage, “plan your work, then work your plan,” works perfectly here. Without proper preparation and planning, successful workplace investigations are more difficult and less efficient. And sadly, even seasoned investigators overlook this important step. Have you ever intentionally traveled a great distance to a far-off destination without a strategy, itinerary, or map? It’s not possible. You would never reach your destination. Why then would you undertake something as com-plex as an investigation without doing the same preparation and planning? Only a novice would gloss over this important step. Don’t be foolish: plan your work, and then work your plan.
1.6.3 Information Gathering and Fact Finding
I have already described in considerable detail the six methods of investigation. This phase of the investigation necessitates the investigator to combine these methods and deploy them in a precise sequence and measure. Tactically, the investigator mixes and matches the methods she determines appropriate at the appropriate time. This mix is largely predetermined during the planning phase. The investigative team, project manager, and client should together determine the investigative tools to be used and when. If you have ever conducted a workplace investigation, you probably did this and gave it very little thought. By front ending the process with sufficient planning and sequencing the investigative tools to be used, the objectives are usually easier to achieve and the investment necessary to achieve them is diminished.
The information-gathering phase of the process, however, is not an end, but a means. The purpose of this important phase is to gather the information necessary to move to the next phase: verification and analysis. This point is missed all too often by many in the industry. Many of my colleagues fail to appreciate that the successful gathering of information does not mark the end of the investigation. The successful gathering of information provides the foundation from which to move forward. Here’s a good example:
Hypothetically, suppose our client (external or internal to our organization) suspected an employee was violating his organization’s policy regarding the use of the Internet during working hours. Specifically, the organization had credible evi-dence that the employee in question frequently viewed pornography at his worksta-tion during his scheduled work hours. Suppose also that during the preparaworksta-tion and planning phase, it was decided that, should the suspicions be true, the employee would be terminated. You are asked to conduct the investigation and obtain the proof, should it exist.
Given the objective to obtain the proof, the fact finder also must know the standard of proof. The sophisticated fact finder knows the standard of proof will drive his process and significantly determine the resources necessary to obtain the stated objective. Because only an employment action is sought, the standard of proof should be that of good faith investigation/reasonable conclusion.13
After some quick preinvestigation investigation and an assessment relative to the size of investment the client is willing to make, the fact finder then begins the information-gathering phase of the investigation. Using elementary computer forensics, he quickly finds temp files, trash bin items, saved images, and book-marked web pages related to or containing pornography as defined by the orga-nization’s policy, on the subject’s notebook (he uses a docking station while in the office). Is the investigation sufficient and has the fact finder achieved the standard of proof selected? The answer will surprise you … it is a qualified “yes” to both questions.14 However, the investigator should not end his process here. He should move his effort to the next phase of investigation, and interview the subject. The reason he should do this is twofold: (1) there may be extenuating and mitigating circumstances unknown to the fact finder, and (2) if the subject is guilty as sus-pected, an admission should be sought.
In properly interviewing the subject, our investigator fulfills any due process rights the subject might enjoy, and, if he provides an admission, it will be used as proof of his guilt.15 The decision makers can then effectively discount or discard the evidence developed during the forensic analysis and hang their disciplinary deci-sion on the subject’s admisdeci-sion alone. In doing so, the subject is denied the oppor-tunity to attack any aspect of the forensic portion of the process or claim a material defect in the evidence it produced. If he disagrees with the discipline and wishes to fight it, he must first overcome his own admission. In acting upon the admission only, the client has met the good faith investigation/reasonable conclusion standard and has significantly reduced that chance of an evidentiary challenge.
Tip: The information gathering and fact finding phase of the investigation is not an end but a means. It affords the investigator the information he needs to inter-view the subject and successfully obtain an admission.
1.6.4 Verification and Analysis
As discussed above, the next phase involves the systematic interview of those identi-fied during our information gathering and fact finding. These interviews are called investigative interviews and are reserved for those who we have a very convinc-ing reason to believe committed the offense or offenses in question or had direct involvement in it. Many professional investigators and employers overlook this opportunity. They frequently forego investigative interviews and opt for termina-tion or even arrest. Although terminatermina-tion and arrest might remove the offender from the workplace, it is not a complete solution. Properly conducted investigative interviews often yield information not otherwise attainable by any other means.
A cooperative interviewee can provide information and intelligence spanning the term of his employment. Even a lengthy undercover would only produce direct evidence developed during the course of the investigation. A cooperative inter-viewee is likely to provide information regarding others as well. It is not unusual for a culpable offender to “give up” or “roll over” on co-conspirators during an inter-view. This information is corroborative only. However, the accumulation of enough corroboration could justify the interview of an individual not identified during the information-gathering phase of the underlying investigation. In substance abuse investigations, this is very common. The resultant expansion of information and intelligence and ultimate identification of many more additional offenders sig-nificantly enhances the ROI. I have had investigations in which my team began interviewing with information involving two employees and when finished had interviewed over 30. In one particularly memorable case, a female employee identi-fied 110 employees whom she alleged sold cocaine at work. Sobbing as she discussed her transgressions, she said she was sure she had sold to additional employees, but could not remember any more names.
As mentioned earlier in the last section, investigative interviews also yield admis-sions. From an employment law standpoint, properly obtained admissions constitute the best evidence an employer can obtain. Unlike criminal law where admissions and even confessions often only have corroborative value, an employer needs only to proffer an admission to make its case. No other proof is necessary. An admission even trumps other evidence with which it conflicts. From an employer’s perspective, there is no better evidence than an admission. Some of the best attorneys I know have failed to leverage this powerful opportunity. Don’t make the same mistake. Whenever pos-sible follow your information gathering with investigative interviews.
Tip: Successful investigative interviews are largely predicated on the amount of information the interviewer possesses before the interview. Bypassing the informa-tion gathering and fact finding phase and going directly to investigative interviews rarely produces useful results and creates unnecessary liability for both the inter-viewer and the customer.
1.6.5 Decision Making
Following the third and fourth phases of the investigation, the project manager should assemble the results and present it to the decision makers. This typically involves reducing the findings into a concise report and formally presenting it. To analyze, interpret, and detail one’s work is easier than it sounds if the project man-ager has the proper information management processes in place. I will discuss these and other important subprocesses later. What is important now is to appreciate what has been achieved up to this point and its value to the client. Effectively, the process should have yielded:
◾ significant factual information regarding the matter under investigation
◾ information identifying at least some of those involved and some idea of their purpose
◾ corroborative information from investigative interviews regarding those involved from co-conspirators or witnesses
◾ admissions from the wrongdoers regarding their transgressions
Demonstrably the investigative team has leveraged the initial information gathered during the fact finding phase into two additional sources of information:
that which was provided by the subject and that which others said about him.
Armed with this wealth of information, the employer client can then easily and safely determine the equitable disbursement of discipline and/or corrective action if appropriate. Let’s look closer.
In the instances in which admissions exist, decision making is simple. Lacking admissions, the employer client might have corroborative statements from those who made admissions as well as other evidence developed during the fact finding phase. Lacking any admissions, the employer client still has the results from the fact finding phase. Even in the face of a denial by any particular subject, armed with sufficient incriminating information, the employer client is afforded the luxury to safely make a tough call if it applies a good faith investigation/reasonable con-clusion standard. In other words, the process has engineered defensible fallback options even in the worst case scenario—no admissions from anyone. This may all appear a bit esoteric, but I assure you these intricate machinations will not be
missed on a trier-of-fact with any sophistication. At the very least, if challenged, the employer client and its investigators will be able to demonstrate they employed a well-conceived process, one with structure, purpose, and fairness. It is one that epitomizes professionalism and separates it and its principles from the typical bun-gling incompetents that most judges and juries are accustom. Plaintiffs and the attorneys that represent them, love employers (and investigators) that lack process, fly by the seat of their pants, and make mistakes at every turn.
It should be emphasized that this phase of the investigation is the responsi-bility of the organization’s decision makers. It is often best that the fact finder is not involved in either the decision making or discipline disbursement phase of the investigation. To do otherwise may create the appearance of bias or prejudice.
Similarly, those who are not true fact finders should not become part of the fact finding process. Segregating these duties is critical to the protection of the investi-gation’s integrity and those that conducted it.
Tip: The fact finder should never play the role of decision maker, or vice versa.
In fairness to the subject and the process, separate the duties of the fact finder and decision maker.
1.6.6 Disbursement of Disciplinary and/or Corrective Action
This phase of the investigation might appear perfunctory, but it is not. Regardless of the quality and sophistication of the process, the decisions regarding discipline and corrective action must be fair and equitable. Good evidence and an admission don’t make a minor offense a capital crime. Conversely, punishing all offenders equally is not necessarily equitable. The punishment must first fit the crime, then, like crimes must be punished similarly. The failure to do so, invites discrimination and disparate treatment claims. Successfully defending such claims can be embar-rassing and costly.
Once decided, the discipline must be dispensed. How and by whom is the next decision? Here again the fact finder should play no role. These are management (decision maker) decisions and actions. However, some interesting twists exist. As a fact finder, I have often found myself in a consultative role during this phase of the process. Often when confronted by unusual facts or circumstances, my decision makers have turned to me for guidance. While I make it a practice of not recom-mending one form of discipline or corrective action over another, I have advised my employer clients on such things as the strength of my evidence, the appropri-ateness of the discipline contemplated and how others in similar circumstances chose to respond. Other options include allowing those selected for termination of employment the opportunity to resign instead or offering those allowed to resign a hold-harmless agreement to sign in exchange for the employer not opposing their
application for unemployment insurance. We will discuss these and other interest-ing options later in the book.
1.6.7 Prevention and Education
Tying the process together is the last phase of prevention and education. During this phase, the employer client and investigative team join together to critique the effort, benchmark, identify best practices, and analyze their performance. Additionally, this employer client/investigative team assesses the damage and attempts to sort out what went wrong in the first place. What was it that allowed the problem to occur and how can it be prevented in the future? This evaluation can be priceless.
Clearly, if the organization continues the same practices, it is likely to get the same result again in the future. Such behavior is worse than pointless, it may be negligent as well. Under the legal theory of foreseeability, negligence is compounded when a party should have reasonably foreseen an event that could have been prevented had it taken corrective or preventative action. Organizations make the mistake often and in doing so incur unnecessary additional liability.
Finally, the team should reduce its findings into some sort of recommendations.
The recommendations often include altering or modifying policies, changing or imposing new practices, and, finally, training for those who need it. Of all of the phases of investigation, this is the least utilized. In many instances, once the process has reached this phase, no one is interested in doing anything further or expending more resources. However, experience has shown that, if the lessons learned are not leveraged, problems and workplace issues tend to reappear and repeat themselves.
As such, passing up the opportunity to learn from past mistakes and record best practices seems to be a heavy price to pay for simply wanting to close a file and move on to the next project.