Litigation Support: When Investigations Become Liabilities.

Investigative material relied upon in litigation, regulatory proceedings or organisational decision making must be capable of withstanding scrutiny. 

An Investigation may be legitimate, its findings substantially correct and its original purpose entirely justified. Yet weaknesses in investigative governance, evidential continuity, disclosure or the handling of material can undermine the decisions it was intended to support. 

The consequences of investigative failures can extend beyond the investigation itself, creating legal, regulatory, financial and reputational exposure.

Specialist Investigative Support (SIS) provides independent review of investigative work undertaken by others, assessing the reliability and evidential integrity of material that may subsequently be challenged or disclosed.

“Can we see the original, please?”

In our experience this can be the point at which an apparently straightforward investigation encounters substantial difficulties and become a source of risk.

The Investigation Is Not the Report.

Investigations frequently begin because an organisation needs to understand something, has concerns or doubt, or is required to establish fact.

The immediate requirement is often for information.

As initial information is considered there becomes a natural transition to intelligence (understand the issue) and evidence (establish fact).

Circumstances can change.

Information may become intelligence. 

Intelligence may direct investigation. 

Investigation may produce evidence. 

Evidence may ultimately have to withstand a level of scrutiny that was never anticipated when the first enquiry was made.

That is why the way an investigation is conducted from the outset matters.

What We Find When Investigations Are Reviewed.

A recurring problem is not that the investigation was dishonest, incompetent or that its conclusions were wrong.

It is that the organisation can no longer demonstrate evidential integrity and provenance in the processes used to determine subsequent actions or outcomes.

A surprisingly common example is the use of WhatsApp or similar messaging platforms as an informal operational record.

Surveillance is often utilised as a necessary, legitimate and proportionate tactic to progress an investigation. 

Surveillance operatives may post observations into a group as an operation develops. 

Images are uploaded. 

Locations are shared. 

Instructions are discussed. 

Client updates may be mixed with operational conversation. 

Information received second-hand may appear alongside observations made directly by an operative.

This group chat is the de facto surveillance log, decision log, surveillance management record, client update record and deployment record.  

A formal report is subsequently produced from it.

The report looks professional until somebody asks: “Can we see the originals, please?”

And the difficulties begin.

Does the WhatsApp group still exist?

Another practice we encounter is the deletion of these chat groups, messages or original imagery once an assignment is considered complete on, at best, the basis of confidentiality.

The group chat is deleted as a form of operational housekeeping.

That may feel tidy, but that is not managing evidence. It is deleting the very material upon which decisions, now subject to cross-examination and scrutiny, may rely.

The Illusion of Proof

Technology can make weak provenance look surprisingly convincing.

Images can display dates and times. 

Their presence does not establish when an image was actually created.

We routinely see third party apps used to place timestamps onto photographs. 

These can be easily manipulated to display any date or time.

Reports can incorporate screenshots, maps and imagery into highly professional looking documents, yet none of those things necessarily establish provenance or evidential integrity.

This distinction is becoming more relevant and important, not less.

As digital material becomes easier to produce, alter, recreate and generate, the ability to demonstrate provenance becomes vital.

Deletion Is Not Evidence Management.

There is an equally important qualification.

Good evidential practice does not mean retaining everything indefinitely.

Investigations frequently involve personal information, sensitive material and information concerning people unconnected or eliminated from initial inquiries. Data protection obligations matter.

Information must be collected for legitimate purposes, protected appropriately, retained for justified periods and securely deleted when it is no longer required.

Controlled retention and deletion under an appropriate governance framework is fundamentally different from operational material disappearing simply because somebody considers the job finished.

An organisation cannot rely on tomorrow what its investigators casually delete today.

A Clear Requirement.

The standards expected of investigations do not exist in isolation.

The Solicitors Regulation Authority’s guidance on internal investigations⁠ specifically identifies the importance of preserving available evidence from the outset, ensuring underlying documents and data are not lost or destroyed.

In the employment context, ACAS guidance on workplace investigations⁠ similarly emphasises the identification and collection of relevant evidence and the maintenance of an appropriate investigative record.

Civil proceedings bring these issues into even sharper focus. Practice Direction 31B of the Civil Procedure Rules⁠ expressly recognises electronic communications, deleted documents and metadata as electronic documents and addresses the preservation of electronic material in its native form.

Evidential preservation cannot be separated from information governance. ICO guidance on monitoring workers⁠ makes clear that collection and retention of personal information must remain necessary, proportionate and justified.

That is very different from simply deleting the operational record because the assignment has finished.

These issues extend beyond investigators, compliance and legal teams.

The UK Corporate Governance Code 2024⁠ requires boards within its scope to monitor and review their risk-management and internal-control framework. Provision 29 now requires a declaration concerning the effectiveness of material controls, including operational, reporting and compliance controls.

That assessment depends upon evidence.

An organisation cannot separate the quality of an investigation from the quality of the decisions subsequently based upon it.

If investigative material informs disciplinary action, litigation strategy, regulatory reporting, safeguarding measures, organisational controls or an assessment of corporate risk, its provenance and integrity can become part of the organisation’s wider governance environment.

The question “Can we see the original, please?” can travel considerably further than the investigation team.

Much of this article has considered circumstances in which an organisation is trying to establish what has happened.

Protective intelligence increasingly requires organisations to apply many of the same disciplines to understanding what is happening and what may happen next. 

We discuss these implications in depth in our Protective Intelligence articles.

Circumstances may vary.

Employee misconduct, fraud, corporate disputes, K&R operational support, insider threat.

Very different circumstances, but the same underlying SIS framework, adapted from specialist government intelligence, investigative and protective practice for commercial application supporting defensible decision-making and protection of client interests.

For law firms, professional services organisations, intelligence and investigation companies relying on investigative material, SIS provides independent review of existing investigations, evidential integrity and provenance, and further investigative work where necessary to establish facts capable of withstanding scrutiny. 

Intelligence. Understand the problem, consider risk.

Evidence. Establish fact, consider risk.

Risk. Manage and mitigate risk throughout the process supporting defensible client decision-making.

SIS | Intelligence. Evidence. Risk.

Related service: Litigation & Professional Services Evidential Support