Years of experience and discussions with colleagues in the corporate investigative field agree that internal and employee investigations can be disruptive to the work environment. Many workplace investigations are conducted are incredibly unsettling due to an extensive list of challenges, circles, and processes to follow. Security investigations are time consuming, expensive, embarrassing for interviewees, cause loss of productivity, and damage morale as they drag on.
Having conducted thousands of these investigations over the years has taught me a few lessons. Most importantly that each must be handled confidentially and involve as few people as possible of which are only those that need to be involved. Using an investigative team made up of security, human resources, compliance/legal and the subject matter experts who may be needed to assist with forensic accounting and cyber forensics. With the right group in place collaborating on each step of the investigation makes it is easier to keep the investigation on track.
The 4 Stages of Internal and Security Investigations
I like the concept of breaking down an Investigation into four distinct sections. The acronym for this is P.L.A.N. The letter “P” stands for preparation. As part of the preparation, the incident or investigation starts a report or information received about a particular crime or event. The letter “L” stands for learning.
In this stage, the investigator learns as much as possible about the case. Next is the letter “A” for analysis. Once you compile all the information from the learning phase you then analyze it to try to determine what has happened and how it was perpetrated along with the when, why, where, and who might be involved. The letter “N” in the acronym stands for notification. This is when the investigator notifies the superior or the manager of the investigation. In this phase, the investigator also provides the proposed path that the investigation will take, and the resources needed to support it.
The PLAN process works well when dealing with any type of internal or criminal investigation, however, when it comes to scaling security investigations involving scores of witnesses, victims and suspects, resources can become scarce including investigators available to conduct the interviews along with operating expenses to financially support all the necessary steps to assure the investigation is conducted thoroughly, and in compliance with laws, regulations, and organizational policies.
The Time Factor in Security Investigations
All this this must be considered as well as time. According to NAVEX Global, it takes 45 days to conduct an average internal investigation. Impacting the timeline are vacations, call outs, and geographic differences and time zone issues. Decisions will need to be made whether to interview in person or via video conferencing. Having taught interviewing and interrogation courses in college and to professional investigators, I strongly suggest in person interviews.
The longer an investigation takes the more likely information will leak thus contaminating evidence and witnesses can occur jeopardizing the investigation. Time is of the essence in any investigation. While having each member of the investigative team sign non-disclosure and confidentiality statements, once the interviewing of witnesses and suspects begins, it is anyone’s guess on how long it will take for the information to leak out.
Choosing the Right Investigator
Selecting the appropriate investigator to conduct the interview is also critical. Someone that has the right amount experience handling the type of investigation at hand is vitally important. In law enforcement, you would not want a homicide detective to interview a white-collar offender not having a forensic accounting background. Conversely in a corporate investigation, someone with a deep understanding of the company processes, terminology and appropriate interviewing approach should conduct the interview with the suspect.
Another obstacle to consider is that investigative interviews are often particularly embarrassing and uncomfortable to the interviewee. The anxiety starts when they get a call or an email from HR, Security, or the Legal department that goes something like this, “We need to schedule a conversation with you about an ongoing investigation.” Once in your presence, you start by asking for confidentially and possibly have the employee sign the NDA and remind the employee not to talk to their colleagues about the investigation.
Issues of Scale and Technology
This brings me back to scaling an investigation that has of upward of 50-100 potential witnesses and potential suspects. In a recent example, a distribution center with extensive merchandise inventory losses that employs over hundreds of workers including truck drivers, product handlers, shippers, receivers, and laborers all working in and around the facility 24/7 suffered from typical investigative methods due to the size of the warehouse, volume of product, and interconnected processes that occur in the facility.
CCTV systems, access control, and the other traditionally physical security technology proved ineffective in solving the loss problem. Sending a team of inventory specialists with investigators to conduct system audits, surveillance and conduct interviews among employees did not yield substantial results on a time-efficient schedule, while reducing operational efficiency, causing disruption to production and distribution, and potentially negatively impacted departmental relationships.
Case study: Verensics
Fortunately, and coincidently, I met the founders of Verensics’ that created an electronic narrowing interview process reduces the scope of suspects. In collaboration with researchers and professors from notable institutions like Georgia Tech and Kennesaw State University both located in Georgia, the software came to rescue in the case of the distribution center investigation. Once introduced to the company officials, the software was used in the investigation with all one hundred plus employees nearly simultaneously. Simply, the software leads each person down a path asking questions on a computer.
The person taking the assessment is being monitored on how long they take to answer a question, what answer is selected and if an answer has been changed. The questions will be automatically tailored to the performance of the person taking the assessment. The wording of the questions encourages truthfulness which also elicits admissions and knowledge of criminal activity and or policy violations in the workplace. At the end of the assessment the results are immediately available to the investigator for follow-up as needed.
Final Remarks
In the above case, the software program narrowed the suspect pool from over one hundred to just a handful, allowing the investigators to work and focus their efforts on interviewing just those few suspects resulting in the closure of the case with successful results, minimal costs and with removing the human errors caused by traditional methods described earlier.
What is more, the technology can substitute the need for traveling to a region of the country by using the software in other locations in advance of any travel. Travel might only be necessary when suspects are identified by the software.
The software works will in other investigations too. Security investigations of bribery, dishonesty, workplace violence, information theft, sexual harassment, sabotage & vandalism, unethical supplier and vendor relationships to employees, fraud, illegal drug and alcohol violations, and bullying/harassment. This technology has been successfully applied in government and law enforcement internal employee investigations, as well as many public and private organizations. Moreover, the software has pre-employment/routine employee screenings, insider threat programs, and internal workplace investigations applications as well.
Today, investigators have innovative solutions to complex and large-scale investigations involving scores of suspects, witnesses, and victims. Like CCTV cameras and drones using analytics to detect criminal activity, investigators now have opportunities to close more internal and security investigations faster with less disruption to the workplace by using the available technology available to them today.
