Investigations need firm foundations: don't build yours on sand

More and more companies are conducting complex investigations – often prompted by insider tip-offs. But are they looking at the right things in the right way?

This article was first featured in the May edition of The Lawyer.

In the course of our work, we see just how many organisations now have to undertake complex investigations, often resulting from reports made by whistleblowers. It is certainly an increasing theme for companies with significant compliance obligations.

It isn’t hard to see why. Since the UK Bribery Act was introduced in 2010, the practice of opening up reporting channels has become much more common. It follows that companies now discover bad behaviour that was previously hidden from view. Our recent biannual Global Economy Crime Survey found that 16 per cent of frauds in UK organisations were detected through whistleblowing, second only to fraud risk management (19 per cent).

We’re often asked to review and critique investigative work undertaken by others, especially when the stakes are high and a second opinion is needed. If a review fails to find any issues, can you be sure there was simply nothing to find, or did the investigation just not look hard enough or at the right things or in the right places?

The obvious questions to ask are: whether the scope of work was adequate; whether those undertaking the work had enough experience or training to conduct investigations; and whether they had sufficient knowledge of the subject matter being investigated. In other words, did they know what they were looking for?

In our experience, one of the best ways to test the reliability of the findings is to challenge the things people often say about an investigation after completing it.

Here are a few common ones:

‘We looked at all the relevant information’

Most modern investigations are based on the available data sources. And, more often than not, these are now in electronic form, such as email or computerised records of transactions.

The risk here of making fundamental mistakes or missing vital clues – especially in the transactional data – is considerable, so it’s important to make the best possible use of technology. While traditional word search or e-disclosure can yield impressive results for some investigations, it’s vital to consider newer, concept-driven search tools, particularly where the subject matter is vague or broad.

‘We didn’t find anything wrong’

I’ve seen occasions where a review has been criticised or lost credibility simply because it relied on the wrong information. Planning data capture properly ensures the right foundations are in place. All too often, investigators don’t ask themselves whether the data given to them by IT has been captured forensically, or whether it is complete. Proper data profiling is of the greatest importance in understanding what data you have and what may be missing.

‘We did a thorough review’

Ensuring the robustness of the investigation methodology applied to the evidence relies on judgement, but that judgement can be wrong. An excessively narrow approach that misses deleted data, excludes key individuals, limits time periods too aggressively or applies overly simplistic search criteria can fatally undermine any investigation.

‘I’m an investigations expert – that’s what you need’

It’s absolutely right that important concerns should be reviewed by people with a detailed knowledge of how to design and deliver an investigation that stands up to scrutiny. However, if the subject matter is complex, as it often is, it’s just as important to ask other experts to help out.

Niche industry business practices, reporting formats or terminology can all mean key documents data is overlooked, simply because the reviewer didn’t grasp the complexity of what they were reading.

So, what’s the moral of all this? If the stakes are high, make sure you’re comfortable that your investigation is being built on firm foundations. Afterwards, when the hard questions are being asked, you’ll be glad you did.

For more information, please speak with Umang Paw or I, details are below.

umang.paw@pwc.com

fran.marwood@pwc.com