Investigations: From Fact Finding to Evidence

Investigations usually begin with uncertainty and a need for fact.

An allegation has been made. Information has emerged. Conduct has been questioned. Something does not reconcile. A concern has been raised, an incident has occurred or an organisation needs to establish what happened.

At that point, information may be incomplete, conflicting or untested.

The purpose of an investigation is not to confirm what is suspected. It is to establish what can be demonstrated.

For SIS, that means understanding the problem, identifying what needs to be established and developing reliable evidence capable of supporting the decisions that follow.

Start with the decision

Before determining investigative activity, we establish what the client needs to understand and what decisions may ultimately depend upon the findings.

An apparently straightforward workplace concern may develop into litigation. A disciplinary matter may disclose fraud or dishonesty. Missing information may indicate an insider threat. A protected disclosure may expose regulatory or criminal conduct. An allegation involving senior management may create wider governance, legal and reputational consequences.

We therefore look beyond the initial description of the problem where the developing intelligence and evidence indicate wider risk.

From the outset, we consider what is known, what remains unknown, what needs to be established and what may ultimately need to be demonstrated.

An agreed investigative strategy

Once the requirement is understood, we agree an investigative strategy with the client.

Where appropriate, SIS works alongside internal legal, compliance, risk, HR and professional standards functions, and externally with legal advisers, insurers and other professional advisers.

The strategy establishes the objectives, proposed activity, resources, risks and intended outcomes.

It also provides the client with a framework against which the investigation can be measured: what is being done, why it is being done, what it is intended to establish, what resources are being committed and whether the results continue to justify the activity and cost.

As intelligence and evidence develop, the strategy is reassessed. Activity can be stopped, resources redirected, and emerging requirements addressed.

The investigation remains accountable to the client objective rather than simply generating investigative activity.

The requirement determines the method

Investigative, intelligence and specialist operational capabilities are resources.

They are not the investigation.

We select methodology according to what needs to be established, the information already available, proportionality, evidential requirements and risk.

Surveillance, for example, may be entirely appropriate where it addresses a defined requirement. It should not become the strategy simply because the capability exists.

The requirement determines the method.

This principle is reflected in Information Commissioner’s Office guidance on workplace monitoring, which requires organisations to be clear about the purpose of monitoring and to consider whether the objective can be achieved by less intrusive means.

Investigations within organisations

Organisational investigations may involve misconduct, fraud, theft, confidential information, intellectual property, conflicts of interest, whistleblowing, regulatory concerns, safeguarding, insider threats or allegations involving senior management.

These matters rarely exist in isolation.

Commercial interests, employee rights, confidentiality, legal obligations, welfare, reputation and regulatory exposure may all need to be considered while the underlying facts remain uncertain.

The existence of an allegation does not establish misconduct.

ACAS similarly distinguishes investigation from proving guilt, requiring workplace investigators to consider evidence objectively, including material both supporting and contradicting an allegation.

Our role is to establish what the available information and evidence support while protecting client interests throughout the process.

From information to evidence

An allegation is not evidence.

Information may provide a starting point. Intelligence develops understanding and directs investigative activity. Investigation tests what is known, identifies what can be established and develops evidence where required.

SIS considers evidential requirements from the outset.

Where material is obtained, we preserve its integrity and provenance. Original material is retained where appropriate, exhibits are recorded and handled, digital material is controlled, and continuity and chain of custody are maintained where required.

This is not something we attempt to reconstruct when an investigation is complete.

Material obtained during an internal matter may subsequently become relevant to disciplinary proceedings, an employment tribunal, civil litigation, regulatory scrutiny or a criminal investigation.

Home Office investigative guidance similarly identifies the chain of evidence as the audit trail demonstrating how evidence has been handled and recognises its importance in maintaining evidential integrity.

Our approach is therefore to develop and manage evidence so that the client can rely upon it if the matter moves beyond its original context.

Where those disciplines fail, the investigation itself can become a source of organisational risk.

When the evidence does not provide an answer

Not every investigation produces certainty.

Witnesses may disagree. Records may be incomplete. Evidence may no longer exist. Some accounts cannot be independently corroborated.

Sometimes the defensible conclusion is that the available evidence is insufficient to determine what occurred.

That is not necessarily an investigative failure.

A defensible investigation must be capable of reaching an inconclusive finding.

Creating certainty where the evidence does not support it creates greater risk than acknowledging what cannot be established.

The investigation is not the report

Our involvement does not necessarily end when investigative activity concludes or a report is delivered.

Where material obtained by SIS is subsequently relied upon, disclosed or challenged, we remain engaged with the client and their professional advisers.

Where required, that may extend to evidential clarification, disclosure, statements, preparation for subsequent proceedings or giving evidence.

That continuity matters.

The people responsible for obtaining and developing the evidence remain accountable for it when its reliability, provenance or methodology is subsequently scrutinised.

A report records the outcome of an investigation. It is not the investigation itself.

The value lies in the understanding developed, the facts established, the evidence obtained and the defensible basis they provide for the decisions that follow.

Intelligence guides. Evidence supports. Risk determines the response.

Director, Private Prosecution practice, London. 

“We engaged Specialist Investigative Support in the course of a criminal investigation on behalf of our client, where their expertise in evidential surveillance was utilised.

They were immediately responsive to our requirements and those of our client, and provided an exemplary evidential and continuity package which was commended by the legal teams, client and disclosure experts.

They displayed sound knowledge of legislation, best practice and guidelines, ensuring the utmost admissibility, accountability and legality of covert operations.

We are extremely happy with the quality of work provided by SIS and their team, and would not hesitate to use them again for evidential surveillance or in the course of a surveillance-led criminal prosecution.”

Intelligence. Evidence. Risk