Internal investigations get commissioned in a hurry, usually the week something goes wrong. The decisions made in that first week determine whether the result is useful — to the board, to a regulator, or to a court — or whether it is a document the company later wishes did not exist.
What triggers one
A whistleblower complaint, an auditor’s finding, a regulatory inquiry, an anonymous tip, a departing employee’s allegations, or a discrepancy someone could not explain. The trigger shapes the scope, and the scope should be written down before anyone is interviewed.
The threshold decisions
Who directs it. Management, the general counsel, the audit committee, or the board. Where the allegations touch senior management, an investigation directed by that same management is worth very little to anyone reviewing it later.
Whether outside counsel is needed. Independence is not a formality. It is the thing that makes the conclusions credible to a regulator, an auditor, or a sceptical judge. The closer the allegations come to the people who would otherwise run the investigation, the more it matters.
Privilege, and what it covers. An investigation conducted by counsel for the purpose of providing legal advice is generally privileged. That protection is fragile: it can be lost by wide distribution, by describing findings in non-privileged communications, and by disclosure to third parties. It also belongs to the company, which may choose to waive it — a decision with consequences for individuals that should be understood before, not after.
Scope. Narrow enough to finish, broad enough that the answer means something. Scope creep is the most common way investigations become expensive without becoming more useful.
Preservation, first
Before interviews, before anything: a documented litigation hold, suspension of automatic deletion, and preservation of devices and accounts belonging to the people involved. Everything else can be sequenced. This cannot.
Interviews
The order matters — generally peripheral witnesses first, to build the factual picture before speaking to the people at the centre.
Every interview of an employee by company counsel should begin with a clear statement that counsel represents the company and not the individual, that the conversation is privileged and the privilege belongs to the company, and that the company may choose to disclose what is said. It should be given carefully and confirmed. Skipping it, or delivering it so quickly that it does not land, is a recurring source of later problems.
Take careful notes. Whether to prepare formal memoranda, and in what form, is a judgement about the eventual audience.
Documents
Collect defensibly: identify custodians, preserve forensically where warranted, search with terms that are documented, and keep a record of what was searched and what was found. An investigation that cannot describe its own methodology will not persuade anyone.
The report
The most consequential question is whether there should be a written report at all, and if so how detailed. A written report is a durable document that may later be produced, subpoenaed, or required to be shared. Sometimes that is exactly what the company wants — a credible, documented response. Sometimes an oral report to the board is the right answer. This is a decision to make deliberately at the outset, not to arrive at by default at the end.
Then what
Findings usually lead to some combination of remediation, personnel decisions, control changes, and a decision about whether to self-report. Self-reporting is a genuine strategic decision with real consequences either way, and it depends heavily on the regulatory regime involved.
The follow-through matters as much as the finding. An investigation that identifies a control failure and changes nothing is worse than no investigation, because it establishes that the company knew.