Corporate Investigations

Abstract

In this chapter, the day-to-day activities of corporate investigators are discussed. What are the investigative methods that are used by corporate investigators and how does the investigative process take shape? In this chapter, interview data, case study material and observation data are used to unravel the daily activities of corporate investigators. As becomes apparent, corporate investigators provide a comprehensive service. The investigations may, in this way, stay fully in the private legal sphere, without any criminal justice involvement. Within this private legal sphere, corporate investigators can move with considerable autonomy, providing a specialised and custom-made service to clients. Reasons for the popularity of corporate investigations are discussed in this chapter, as well as the full investigative process and corporate investigators’ relationship with their client.

1 Introduction

This chapter is partly based on a version published in Erasmus Law Review (2016): Meerts, C. A. (2016). A world apart? Private investigations in the corporate sector. Erasmus Law Review, 9(4), 162–176. I thank the reviewers and editors for their useful insights with regard to that paper.

I remember from my time in the police that we were always complaining that private investigators were able to do anything and could just barge in somewhere. And now that I’m on the private end we as private investigators complain that we can’t go in because we don’t have the authority to do so. If someone doesn’t want to cooperate we can’t do much. (Respondent 5—corporate investigator)

Private investigations are often contrasted with criminal investigations done by the police. A recurrent image within law enforcement is that corporate investigators have considerable leeway to perform their investigations the way they see fit. The underlying premise here is that a legal framework for private investigations is lacking.¹ At the same time, corporate investigators feel restricted in their work because they cannot perform the same activities as law enforcement agents can. As we have seen in Chapter 2, corporate investigators are regulated, although the legal framework is quite scattered over different professional groups, and control over compliance to these regulations is rather limited. The most specific regulation available to corporate investigators is laid down in the privacy code of conduct for private investigation firms (NVb, 2015). While this is legally binding only to those investigators who possess a permit, corporate investigators without a permit (in-house investigators, forensic accountants and forensic legal investigators ) seem to largely comply with the rules of the privacy code of conduct as well.

The contrast between the view of law enforcement professionals and the wider public on the one hand, and that of corporate investigators on the other, is interesting. The key point in this controversy has to do with (the absence of) formal powers of investigation . Powers of investigation are, by law, granted exclusively to law enforcement professionals.² As a consequence, there are no private powers of investigation: corporate investigators have the same investigative powers as any citizen.

I think we can do a lot less than the police for example. We don’t have any powers to retain someone. On the other hand, we might not have the threat of prison sentences but we do have the threat of losing your job. Don’t underestimate the power of that either. Keep in mind that mostly we’re not dealing with hardened criminals here, mostly it’s just an employee who has done something wrong. (Excerpt from observation 2—informal conversation)

The sense of limitation, expressed by many corporate investigators formerly working in law enforcement, stems from this lack of official investigative powers. Having no access to formal powers of investigation simultaneously means, however, that corporate investigators can operate with considerable flexibility (Williams, 2005). Crucially in terms of access and speed, there is no need for them to wait for the approval of a prosecutor or judge prior to the use of the methods which are available to them. Approval granted by the client or management suffices. This contrast between the perceived bureaucracy of the state apparatus versus the expected freedom private investigators enjoy is frequently given by corporate investigators with a background in law enforcement as a reason for a career switch.

Although corporate investigators have no formal powers of investigation , their possibilities to investigate are extensive: through the (property) rights of the organisation as an employer, they have extensive access to information related to employees.³ When corporate investigators investigate a case, they might gather a great deal of information by talking to people (interviewing), by looking into internal systems (e.g. personnel logs), firms’ communications (email, phone records), financial systems (accounting, sales and other systems) and open sources (e.g. social networks) and by tracing assets. Much information gathering by corporate investigators relies on the cooperation of the people and organisations involved.

A big difference is that law enforcement has powers we don’t have. That’s an essential difference. But the fact that we aren’t the police also has an effect on people. In some investigations it would be nice to have powers of investigation , for example I’m working on a case now in which we think there has been a kickback somewhere but we can’t prove it. The police could subpoena bank records and create a money trail. But, what I just said – people are different to us. Our big advantage is that they talk more easily to us. They are more relaxed with us in interviews because we’re not the police. So on the one hand it’s a disadvantage not to have powers of investigation, on the other it’s an advantage because people see you as less of a threat. (Respondent 3—corporate investigator)

It is impossible for corporate investigators to for example lay claim to financial records of individuals or organisations other than their client, or to enter premises other than those belonging to their client without consent—these being powers granted exclusively to public law enforcement. This may mean that it proves impossible for corporate investigators to investigate a norm violation fully. In such cases, law enforcement agencies may need to be mobilised by a report to law enforcement authorities. Whether or not the decision is made to do so depends on the client. The greater part of internal norm violations occurring within organisations never reaches the criminal justice system but is investigated by and settled with the help of corporate investigators within the private legal sphere (Dorn & Meerts, 2009; PwC, 2017). One of the reasons for this is that while investigations may concern (alleged) criminal behaviour such as fraud, they may just as well focus on behaviour that is considered undesirable rather than criminal, for example, conflict of interests. In the latter case, there is no possibility to report the norm violation to the police and no criminal investigation will follow (Meerts, 2013).

As do most professional procedures, private investigations have their own language (Falk Moore, 1973). This could also, as Thumala, Goold, and Loader suggest, be ‘“occupational legitimation talk” that seeks to emphasize specialist expertise, competence and [client]-centeredness’ (2011: 296). Being a commercial context, the corporate investigations market as a whole tries to emphasise the niche value of its services by using different terminology. In this way, ‘corporate investigations’ as a semi-autonomous social field sets itself apart from other professional fields. Chapter 2 shows that this process also occurs within the field, between the different professional groups of investigators.

In legal terms, investigative activities which are executed within the context of corporate investigations and those which are executed within the context of the criminal justice system are separated by a different terminology. As pointed out, corporate investigators do not have powers of investigation and someone who is subject to corporate investigations is not protected by the rules of criminal procedure. Words such as ‘suspect’ and ‘interrogation’ are part of the criminal justice system and therefore should not be used for investigations done in a different context. Most respondents from the private sector also refer to their activities with different words than commonly used for public investigations and some make a point of avoiding ‘law enforcement terminology’. In the context of both research observations, the same can be concluded: the investigative processes were defined in different terms in the official documents than those used in criminal justice procedures. The informal conversations within the observation settings also followed these linguistic rules. Interestingly, clients and law enforcement respondents seem less rigid in their use of terminology. However, most respondents for example avoid the word ‘suspect’, using the words ‘subject’ or ‘involved person’ instead.⁴ The same goes for the information source of personal communication: private investigators do not interrogate but they interview (NVb, 2015). This difference in terminology emphasises the difference in investigative powers, as the power to interrogate someone is exclusively granted to law enforcement agencies. The privacy code of conduct for private investigation firms also explicitly avoids the use of law enforcement terminology (NVb, 2015: 26):

This code of conduct abstains from the use of concepts that are present in the Code of Criminal Procedure to avoid confusion with the detection of crimes by law enforcement agencies. Private investigations do not take place under the authority and responsibility of the public prosecution office after all, and furthermore, its goals are different.

The use of different terminology separates private investigators and law enforcement on a symbolic level, something which respondents seem to underwrite. ‘We should really get rid of the image of being private coppers and get the focus on our problem-solving capabilities instead’ (Respondent 40—corporate investigator). In the words of an investigator working for Observation Company 2: ‘I’m no private police’. This difference is not purely symbolic: from an empirical point of view, the differentiation also holds firm. Even though there are many corporate investigators with a law enforcement background, and their work may seem similar to the work of police and prosecution, there are notable differences. It has been remarked before that corporate investigators do not have any powers of investigation and that their investigations are not merely focused on crime. The point of departure—public or private interests—also differs between public and private investigators. Services provided by corporate investigators are thus more encompassing and focused on client interests.

This chapter follows the investigative process from start to finish, describing the investigative process and the investigative methods and sources of information available to corporate investigators. Some corporate investigative methods are broadly similar to those used in public policing. Examples of these are the interview with the involved person (the interrogation of a suspect in criminal law terms) or observation of a place or person (although the degree of duress, rights of the involved person and other legal requirements certainly differ between the corporate investigations and a criminal investigation). Other investigative methods are more private in origin and in ‘ownership’ (e.g. forensic accounting methods or an audit of internal systems ). At the conclusion of the investigative process, findings need to be reported to the client, which is most commonly done in a formal investigations report. The chapter follows a corporate investigation chronologically, starting with the way norm violations reach corporate investigators and the assignment that follows (Sect. 3), through the different sources and information gathering methods (Sects. 4 and 5) to the conclusion of the investigations, culminating in the investigative report. Before discussing the investigative process and methods, Sect. 2 reflects on corporate investigations by looking at the starting point of corporate investigations: the client.

2 The Setting of Corporate Investigations: Client-Centeredness

Private persons are allowed to investigate behaviour that is harmful to them—or to ask other private persons to do so—as long as they do not violate any laws in the process. Legal persons are considered private persons in this sense, and when they act as a client to corporate investigators, corporate investigators may use the investigative possibilities of their client. As an employer, an organisation has the right to control certain behaviours of its employees, and many organisations have made provisions in the labour contract for the use of this information for investigative purposes (Schaap, 2008). Corporate investigators thus often have access to a considerable amount of information provided by the client.

Chapter 2 discussed the different legal frameworks that apply to different investigators. Some investigators’ activities are regulated by law or self-regulation (e.g. private investigation firms and forensic accountants), while others rely on disciplinary rules (in the case of lawyers, these rules are not specifically applicable to investigatory activities) or internal regulation (in-house corporate investigators). It is argued in the previous chapter that this situation leaves room for forum shopping by clients and may lead to situations in which clients acquire the services of the investigator who is least regulated. However, the Dutch law implementing the EU Privacy regulations (GDPR) guides all corporate investigations and general prohibitions such as breaking the (criminal) law, apply to all investigators. Chapter 2 has furthermore shown that corporate investigators indicate that they are guided by general principles of law and that they tend to commit to the guidelines codified in the privacy code of conduct for private investigation firms (NVb, 2015) and the guidelines for person-oriented investigations for accountants (NIVRA/NOvAA, 2010). Because respondents indicate they largely follow the privacy code of conduct, this chapter alludes to these more specific rules when applicable.⁵

The large diversity in professional backgrounds in the field of corporate investigations also creates a wide variety of skills and expertise, going well beyond those used in police investigations (Gill & Hart, 1997). These skills are applied to provide clients with swift results that can be used to prevent future incidents and, possibly, restore at least some of the damage done. The diversity in backgrounds and accompanying expertise make the corporate investigations market of interest to prospective clients. In his work on forensic accounting and corporate investigations, James Williams (2005) has pointed out certain characteristics of corporate investigations which are highly valued by clients. Not restricted by definitions of behaviour given by criminal law or by the (often slow and bureaucratic) structures of criminal procedure, corporate investigators may offer clients a high level of flexibility in investigative methods and solutions. Secondly, the orientation in corporate investigations is on the client and the private troubles the client may have, rather than on criminal acts (which are defined in the Dutch criminal justice system as being against society). This means that any norm violation which is deemed harmful by an organisation may be investigated by corporate investigators. This also leaves room for the client to define the assignment in such a way that it is limited to that specific norm violation. Thirdly, corporate investigations provide an organisation with a high level of discretion and a certain measure of control over the process and information flow. While following chapters show that corporate investigators tend to also pay attention to common good considerations through non-contractual moral agency (Loader & White, 2017), the main focus in corporate investigations is therefore on the client. Investigations are directed towards answering the questions that have been formulated in the assignment by the client. In addition, the internal information and systems that are available partly determine the path the investigations will take. ‘At the start you will consult with the client about indicators, what is it we can do for you and what is it that we need to do to get there, what is the planning and of course what are the costs’ (Respondent 5—corporate investigator). Thus, the services that are provided are tailor-made to meet the needs of the client. For example, when investigating a suspicion of fraud, corporate investigators can be very cautious in their investigations, so as to not create unrest within the organisation. The interests of the client are prioritised in the investigations and this may mean that the investigations need to take a more subtle road than the police would take. Police investigations might be damaging to the operational practices of an organisation, especially since it is difficult for an outsider to understand the workings of internal systems (Gill, 2013). ‘[The police] do not understand our systems. We are the experts of our own systems and we have the necessary access’ (Respondent 16—corporate investigator).

Ok so the police come in, take the administration. Do you have any idea what that does to an organisation? People go home sick, totally lost. And with us, things go more quietly. They don’t even notice. They do when we start interviewing and that will produce unrest of course but that’s at the end of the investigations. What we do is more subtle, we do custom made work. (Respondent 1—corporate investigator)

The client-centeredness of corporate investigations may mean that corporate investigators go about the investigations more cautiously and more efficiently, but also that they focus on different information than law enforcement investigators would. An organisation is often in need of information fast so action can be taken. This information may not be the same as the information produced in the criminal justice process (as it is not the interests of the organisation that are taken as a point of departure, but public interests).

A corporation wants to know what happened. I just finished an investigation for a large Dutch company that suspected it had some issues abroad with one of the directors. That has to be cleared up within three, four weeks otherwise they can’t act. No way that you go to the police first because that’s not going to help you. They have their own responsibilities. They are not going to ask the organisation, what is it you need and I will look into it. It doesn’t work like that. (Respondent 26—corporate investigator)

3 Preparation for the Investigations

Depending on the position of the investigators , an investigation usually starts with an intake of the assignment (in the case of an external investigator) or the report of a norm violation to the security department (in the case of an in-house department) (Williams, 2014). Investigation firms and departments differ in their backgrounds and structure, as reflected by the observations conducted during this research. This means that there are also differences in the way corporate investigators are notified about norm violations. For example, there are large and small investigation bureaus (or forensic departments within accountancy or legal firms), and there are large and small in-house departments within large organisations. These may all have their own way of organising notifications. Observation Company 1 for example—a private investigation firm —had at the time of observation six employees, of whom five were involved in (all kinds of) investigative activities. Observation Company 2—an in-house security department —had at the time fifteen employees, of whom eleven were involved in investigative activities. In Observation Company 2, there was a division of labour, with one team being responsible for the intake and registration of cases, one team focusing primarily on desk research and one team (in the lead of the investigations) focusing on interviewing. Leaving these organisational details aside, in general, notifications are done by management or, in case of an in-house notification system, someone within the organisation.

Respondents suggest that not every assignment is accepted. In in-house departments, this is more or less a decision based on priority: all cases are accepted in principle but during busy periods, it may be decided either to not investigate norm violations with minor importance, or to do so at a later point in time (which may very well be the same since the problem may by then be solved in another way by, for example, the manager).

As a rule, cases are brought to the attention of the helpdesk and registered there. After that, cases are sent to the right place (internal, external, ICT). When it is an internal case, the case is prioritised (in reference to urgency, delicacy and harm) and the manager decides who will handle the matter. Sometimes a case will be reported directly to an investigator and he will start the case and register it on his name. Investigators also need to prioritise what to do and what not to do, sometimes there are just too many cases to do it all. (Excerpt from observation 2)

For those investigators working on contract basis, there is a greater necessity to accept cases, as they are commercially dependent on them.

It’s quite simple actually – basically we take on everything. In principle. Because we really can’t afford to say no. Once you start turning clients down because you’re too busy, chances are that that client will never come again. The nature of the work is such that you can’t say ‘things are too hectic right now, come back in three weeks’. The client has an immediate problem which warrants immediate action. So you need to get to it right away. So one way or the other, in principle it’s a yes. (Respondent 2—corporate investigator)

If the necessary manpower is not available, other investigators may be contracted as an addition to the team (the same goes for in-house departments that are temporarily short-staffed). Both Observation Company 1 and 2 had particular investigators from (other) corporate investigation firms who would be used in such cases. In spite of this commercial necessity to accept all cases, there are still assignments that are rejected by corporate investigators. Respondents are wary of being used by a client for other purposes than the investigation of a legitimate case. For an investigation to be launched, there should be a sound basis, or in accountancy terms a ‘just cause’, for the investigations (NIVRA/NOvAA, 2010; NVb, 2015; see also Chapter 2). The above-cited respondent goes on to say:

So the only question is really, should we take the assignment and do we want to? I mean first of all, is there enough cause for an investigation? You’re dealing with privacy aspects here so there needs to be a valid reason to investigate. Imagine that a CEO comes to you and says, ‘look I have Mr. Jones here and he’s in his late fifties, rather expensive, we would like to get rid of him but firing him would be expensive so could you have a look at his expense account and see whether you can’t find something or other’. Well, no, sorry, we don’t do that. By the way, it’s not always that straightforward because if the same person contacts us, saying ‘we think that Mr. Jones is fiddling with expense accounts for this or that reason…’ The story is the same, it’s just told differently. So it’s not always possible to know exactly but you have to try. That’s why an intake is so important, to get an impression of the context of the case, what kinds of signals are there, how were they discovered, is it specific enough to warrant investigation? When we are convinced of these aspects we may accept the assignment. (Respondent 2—corporate investigator)

Some respondents indicate that they occasionally accept cases which are not commercially interesting, as pro bono work. Observation Company 1 is an example of this. A small portion of the yearly capacity for investigations is reserved for pro bono work. It was explained to me that this usually is work for individuals rather than organisations, although small-scale organisations (which do not have the funds to facilitate investigations) may also be accepted as a pro bono case.

And another thing is – assignments from individuals, how to deal with that. Individuals may also end up in a situation in which you think… Costs are an issue for individuals normally of course but sometimes you come across a case in which a very unjust situation has arisen and the person involved cannot go anywhere else to set it right. In such cases we might decide to do it anyway, even though it is a bad decision from a commercial point of view. Sometimes we already agree on this beforehand with the client, then we make it pro bono. (Respondent 2—corporate investigator)

When a case is indeed accepted, it is customary that the ‘problem owner’—be that the manager of the suspected employee, the board of directors or someone else—and the investigators discuss the reported norm violation in order to form a clear idea of the scope of the problem. The extent to which this is possible at the start of an investigation can differ widely. Respondents indicate that investigations may start with a very clear suspicion towards one person or with a fairly straightforward problem but it is also possible that the question put to the investigators is very broad. It, for example, happens that the client is merely aware that something is not quite right, but cannot put his finger on the actual issue. This means that the assignment of corporate investigators may be very specific or pretty broad. Respondents state that the goal is to define the assignment as strictly as possible before commencing with the investigations. This is especially relevant for investigations conducted by external firms (as distinct from in-house or self-investigations) and in cases in which a certain individual is investigated (person-oriented investigations).⁶ While this predetermined focus is helpful and beneficial to involved persons in the sense of the protection of their privacy, there are also some inherent dangers.

Ok so there are suspicions against someone, we are going to investigate, that’s why we’re here. But it needs to be objective, unbiased. Not ‘we want to get rid of him’. I have done an investigation where a director voiced suspicions against another director, something to do with expenses and overtime. I said, I’m not going to do that. Because, there are three directors here and if I’m going to investigate I need to have the context, so I will have to look at all three. Then you’re investigating the way in which rules XYZ are applied. So that’s what we did and it turned out the one pointing the finger was no angel either. So carefulness and clarity are important in your investigations, making sure you are not being used as the stick to beat the dog with and ensuring the individual is treated fairly. (Respondent 27—corporate investigator)

The way in which an investigation is defined in the assignment agreement may thus influence the proceedings of the investigations heavily. In addition to the possibility of assignments being too narrow in focus, investigators should be aware that clients might want to ask the wrong question, either on purpose or as a result of incompetence.

The thing I have noticed in investigations for governmental organisations is that they purposively – at least I think it is purposively – pose the wrong question. Maybe you have read it, this case about that whistle-blower who committed suicide. And there were articles in the paper about officials who travelled on the expense of the organisations they should have been overseeing. So what happens, they hire an accountancy firm with no track record in investigations whatsoever and they are looking into the declared expenses. But that wasn’t the issue, the issue was with the expenses which were not declared. I think that is purposively asking the wrong question. The answer will be, sure there was something off in the expenses here and there but those were minor things and with the other expenses they found no fault. No of course not. But that never was the issue raised by the whistle-blower or the newspapers. So, in such a way investigations can be used as a lightning rod, to distract people from the actual issue. (Respondent 41—corporate investigator)

This quote lays bare a sensitive subject in the field of corporate investigations, which is related not only to the quality of investigations, but also to their objectivity and independence . As Chapter 2 relates, corporate investigators pride themselves on their reputation of providing high-quality, non-biased and independent services. The problem is, however, that the client might, from the start of the investigations influence the proceedings (and outcomes) by framing the assignment in a certain way. Respondents indicate that they are aware of this threat and try to mitigate it as much as possible. However, in some instances it might prove impossible to be aware of these steering influences. The question may be posed whether investigations such as mentioned by Respondent 41 above, are indeed high-quality, unbiased investigations.

However narrow an investigation may be at the start, during the investigative process the scope of the assignment may, in consultation with the client, be broadened or narrowed down. A broader scope usually means more investigations and thus more expenses, which makes deliberation with the client necessary. Respondents from in-house investigative units indicate that they have more independence in determining the scope of the investigations. This is also apparent from the case studies from observation 2, which was done in an in-house department. In 8 out of 11 cases selected for this research, the investigations commenced with a broad question and the scope of the investigations would be expanded during the investigations. For the case studies from observation 1 (executed within a private investigation firm), the situation was reversed: in 8 out of 10 selected cases, the investigations started with a focused question. However, in these cases the investigations might also be broadened during the investigative process, in consultation with the client.

Respondents indicate that the dialogue with the ‘problem owner’ is especially relevant in the first phase of the investigations.

[The level of contact with the client] depends on the phase your investigations are in and the nature of the issues involved. In the beginning of the investigations you’re going to have much more contact with the client about things like, what kind of information are we going to need, what is available internally, which information will need to be secured right away… That’s contact on the operational level, with the IT-department, the business line, the department that’s responsible for the issue. And the question is for example, will it be necessary to collect your information quietly or do the employees already know there’s going to be an investigation and is it ok for you to contact the department and deliberate? How are we going to secure the information, is it a lot, are we going to gather everything, digitalise the information and put it in a big computer so we can search efficiently later on? Or is it limited in scale and maybe already digitally present? Well, those are the kinds of questions that are relevant at the start of your investigations. (Respondent 13—corporate investigator)

After the assignment is determined and the problem defined, the investigations can commence. An inventory needs to be made of the type of information available and location of the information. The client is an important source of information here.

You need to be introduced to the people you are going to need within an organisation. Because we want to interview them or need insight in the administration and things like that. The decision how to investigate and who to interview is ours, we might discuss with the client but in principle we have autonomy in that regard. (Respondent 5—corporate investigator)

The methods to be used depend on the case. The use of cameras may be very helpful to see who has taken money from a cash register but it might prove useless in case of loss of money through digital channels. In addition, some clients may have their own camera systems, track-and-trace devices or other useful tools for investigations, while others do not. It might happen that an employee suspected of wrongdoing is suspended from active duty at an early stage of the investigations so he or she is not in the position to cause more harm. However, in other cases the employee is kept in place purposively to aid the investigations by trying to catch him or her in the act. This also depends on the severity of the matter.

When it is someone high up, with a sensitive position within an organisation you don’t want to wait until you have the results of the investigations before you act, he will be suspended immediately. That person will therefore know about the investigations in advance. When it’s about the disappearance of items from the work floor or someone taking money from the till, you can wait and see what happens if you for example would mark a certain item [CM: to see who takes it]. There’s much less of a rush there and the critical risk is less prominent. (Respondent 50—client)

In general, corporate investigators prefer a suspension over an immediate dismissal of the involved person as long as the investigations are not yet concluded. ‘Sometimes the circumstances warrant immediate action. We prefer a suspension [CM: over a dismissal]. So they are still held to comply with your investigations because of the labour relation they have with the client’ (Respondent 1—corporate investigator).

The order in which the various methods are used may differ. However, it is common to start with the investigation of administration and the interviewing of witnesses. The interview of the involved person(s) is usually reserved for the end of the investigations, so as to be able to confront the person with the evidence against him or her. During the investigations, corporate investigators generally keep an investigative journal for internal use. This journal records relevant actions taken by the investigators, contacts they may have had with people and other relevant information. Especially when there are multiple investigators involved in a case, this may prove very useful (however, respondents also indicate the thoroughness with which this journal is kept differs among investigators). The journal can be regarded as a log and can be used for the eventual report.

After the investigations have been concluded, a draft report is made. Relevant parts of the report are then usually handed to the involved person to read in accordance with the adversarial principle, which inter alia states that one has the right to be informed and be heard (see Sect. 6.1 of this chapter). Part of the adversarial process is that the involved person has the right to know what has been written down in the report about him and that he may react to this. After all involved persons have had the opportunity to make use of their right of inspection, the draft report is finalised and given to the client. Before that may happen, however, the investigations must first be executed. Below, the principal components of a private corporate investigation are discussed.

4 Gathering Information—Investigative Methods Leading up to Confrontation

4.1 Internal Documentation

A common first step in corporate investigations is to look at ‘the paper work’. ‘It’s difficult to assess whether the person is telling the truth and by starting with the financials, you can get a sense of what might have happened’ (Respondent 5—corporate investigator). When business is conducted, actions are documented. This (digital or) paper trail is a valuable source of information in the reconstruction of where the money went. Since the client usually is the organisation where the irregularities occurred, its records are generally available to the investigators. Because the client can order its employees to cooperate fully with the investigations, relevant parts of the organisation may deliver documented information quickly. ‘We usually start with the records. And that is a very broad concept of course. There are financial records, digital but also hard copy. Digital is for example the books, and hard copy the invoices, source documents, everything that the books are based on’ (Respondent 5—corporate investigator).

It depends on the types of services or products the client delivers how these documents are constructed, but generally there are invoices, contracts, tenders and project reports available. Respondents state that this is a good place to start the investigations, after the initial talks with the client. These source documents may provide an overview of what happened fairly quickly.

And then you directly have a lot of information, transactions are documented. There is someone ordering, there is someone who approves it, there is someone who enters it into the system… Payments are usually cashless, which means there are bank records of them. So you try to gather all relevant information, refine your knowledge and document it. (Respondent 28—forensic legal investigator/client)

Much can be derived from the financial administration of an organisation. In case of a suspicion of fraud, the first step is often to identify the amount of money that went missing and where it went. Sometimes this provides a straightforward story and not much additional investigation is necessary. Outgoing payments from the accounts of the client often provide information on the person who received the money. However, there are situations where ingenious constructions are used to disguise the path the money has taken and to hide the recipient. Information provided by the client might not be enough to trace the money or to find out what happened. The access to documentation is limited to internal information from the client, although involved persons may (and sometimes do) provide access to their personal accounts. Sometimes this means that—because of the lack of investigative powers—corporate investigators will not be able to pinpoint the problem. ‘There are situations in which you need the powers of investigation of the police. Especially in these financial investigations. Sometimes you need a warrant to get bank records. We can’t get to bank records of third parties – that would be highly illegal’ (Respondent 1—corporate investigator). This problem of access makes it more difficult for corporate investigators to investigate the norm violation fully when for example subcontractors are involved. ‘In the big investigation I told you about, there was a subcontractor involved and he had his administration, probably, at home. It wasn’t available at our client company so we figured he kept it at home. We asked him for it but he didn’t give it to us of course’ (Respondent 5—corporate investigator).

4.2 Internal Systems

The situation presented on paper may not provide the full story to investigators and is liable to incorrect interpretation when used as the sole source. Additional information sources are necessary to answer the questions posed in the assignment. A logical next step is to look at other information which is internally available. A multitude of internal systems may provide much information for corporate investigations. Generally speaking, all these internal systems may be put to use for an internal investigation, as long as certain requirements are met (e.g. the employer has to announce in general terms to his employees that their movements may be tracked) (Autoriteit Persoonsgegevens, n.d.-a). Most of these systems are not meant for investigative purposes but can be used nevertheless. What kind of system is available depends largely on the (economic) activities of a client organisation. For example, logistics companies often have track-and-trace systems in their vehicles and security cameras are used more often in a large warehouse than an office floor.

4.2.1 Communications and Data Carriers

Organisations often have their own internal communications systems and they make use of (systems of) hardware and software. Email inboxes, mobile phones, personal computers, laptops and external memory devices may all contain valuable information. Privacy legislation allows for these to be investigated when they are owned by the employer (NVb, 2015). By extension, corporate investigators have access to the information provided as a result of the use of organisational facilities by employees.

There are multiple, more and less intrusive, ways to investigate communications and data carriers . According to the widely used principles of law of proportionality and subsidiarity , investigative methods should be proportional to the goal (and to the interest of the client for reaching this goal) (proportionality) and the least intrusive method should be used when possible (subsidiarity). Respondents therefore indicate that they always attempt to use the least intrusive method of investigation.

We don’t wire-tap telephones. But for example, our stock-traders, they may only use the company phones for their activities. And all these calls are registered, to make sure no confusion may occur later on about amounts etc. People know this, those conversations are recorded. And if necessary we may listen to those tapes. And we can make analyses of the phone records, who are they calling, what are their contacts. But we’re not wire-tapping for investigative purposes, listening in on their conversations. (Respondent 39—corporate investigator)

To stay with the example of recording telecommunications, it is possible to record a telephone conversation, but one could also use mediation to track a phone. Data mediation in general refers to the process in which usage data from networked devices (such as mobile phones) is collected and processed, usually for billing purposes (Balter & Bellissard, 2003). It can, however, also be used in investigations. Mediation is less intrusive because while it shows where the phone has been and who has (been) called, the content of the conversation is not recorded. Often, mediation is a very useful tool. For example, in case study 21 of the case studies used in this research, mediation was used to prove that an employee was near the building where some equipment was stolen on the day of the theft, even though he had called in sick and was no longer working in that specific building.

In some instances, mediation does not provide enough information and it might be helpful to know what has been said in phone conversations or by email. Phone calls cannot be retrieved retrospectively so a recording device has to be present at the time of recording. When it comes to email, older information could be retrieved. Email-boxes may be ‘imaged’ and stored in a database to search. This also goes for ‘the digital environment’ more generally. ‘In the larger investigations, data recovery is a standard ingredient. This means that the digital environment is imaged and put in a database. This may become pretty complex because you have to take privacy regulations into account and when the data crosses the national border, this may be a problem’ (Respondent 28—forensic legal investigator/client). Data carriers such as personal computers, laptops, external memory devices and tablets can also be investigated on content or on activity (e.g. Internet logs) if they are property of the organisation. The growing use of BYODs (bring your own device, usually a laptop) may in this regard prove problematic for corporate investigators, as it is not permitted to investigate these. As mentioned before, corporate investigators lack the powers of investigation of law enforcement authorities and therefore their access is limited (though still quite extensive). Within the boundaries of available information, corporate investigators may however investigate more effectively than law enforcement would, especially when it comes to complex internal systems.

Of course they [law enforcement agencies] may demand information and we will have to provide that. But often they don’t quite know what kind of information they need. For example they ask for the laptop of the involved person. But with that they don’t have access to our system, just the computer. You need authorised log in codes to access the system and they don’t have that. I sometimes try to explain this but unless you’re talking to someone from a specialised high tech team, they don’t know what you’re talking about. They don’t understand how our systems work. Neither do I for some part but we have people here who do. Generally they just look at the laptop and stop there. There’s an entire world of information behind that which they’ll never see in this way. (Respondent 43—corporate investigator)

4.2.2 Other Internal Systems

In addition to the above-mentioned communication systems, there are several other internal systems that may provide information. Many organisations for example use a key card system for employees to gain access to a building. These can be used to find out whether someone has been present at a certain site.⁷ Track-and-trace or GPS systems are also used by some employers, to keep track of their deliveries or vehicles and these may provide information on someone’s whereabouts. In addition, regular personnel files, such as a record of someone’s work history at that employer, can be used as background information. A more controversial internal system is the blacklist. Although a blacklist meant for internal use is allowed by privacy law, the involved interests have to be weighed against each other, using the principles of proportionality and subsidiarity . The organisation planning to use a blacklist needs to have an interest that is both legitimate and substantial and the blacklist must furthermore be necessary. The prevention and repression of fraud are specifically mentioned as a legitimate interest by the Data Protection Authority. Furthermore, it is obligatory to apply for a permit from the Data Protection Authority in cases in which the blacklist is to be shared with third parties (as is the case with sector-wide use of the blacklist) (Autoriteit Persoonsgegevens, n.d.-d). In this case, an official protocol for the management of the blacklist is obligatory (Autoriteit Persoonsgegevens, 2018). Many respondents indicate that they do not know for sure whether their blacklist meets the criteria, but they do keep a database with information on people who have been investigated or fired in the past.⁸ These are often used as reference points in investigations (and in the process of hiring new staff). Finally, the use of (hidden) cameras is not entirely free from controversy. Cameras may provide valuable information, for example, when the footage can be used to ascertain which employee took money from the cash register. Although it is allowed to record employee’s movements, privacy law prohibits the use of cameras in certain places (such as the restroom). Furthermore, employees should be made aware of the possibility of camera surveillance (Autoriteit Persoonsgegevens, n.d.-b). ‘We have many cameras placed in our buildings and people know this, they are made aware of it. When we have for example a missing item at a certain location, we can look at the camera footage and see whether we can find suspicious actions that are not part of the work process’ (Respondent 15—corporate investigator). Under certain circumstances, the use of covert cameras is allowed, one of which is (the investigation of) suspicions of theft or fraud. This type of camera usage may only be of temporary nature (ibid.).⁹ Respondents furthermore indicate that the use of covert cameras is the exception rather than the rule.

4.3 Open Sources

Much information can be derived from open sources . Many people are lax in the protection of their personal data on the Internet. A large proportion of both professional and social life occurs online and for a person who knows where to look, the Internet contains much interesting information. Open source investigations, also known as open source intelligence (OSINT) , are widely used and there are currently many companies offering OSINT specific services and training programmes.¹⁰ In Observation Company 2, the investigations were organised in such a way that some investigators focused on doing ‘desk research’. Desk research consists of the investigation of internal systems as discussed above, but also the investigation of open sources. One investigator, especially, was highly skilled in this type of desk research. He for example had several (fictitious) accounts on social media sites so he had easy access to this information. Social network sites such as Facebook and LinkedIn may provide a broad overview of someone’s life (e.g. posts, photographs, likes, sites followed) and professional network (which may be useful, for example, to see whether a third party that is involved knows the involved employee).

Another open source of information is the database. There are some very valuable openly available or on-subscription databases such as the databases containing information on Chamber of Commerce records, name and address data and domain name registration. Many investigators have a subscription to these databases. Additionally, traditional media and the Internet more generally (and search engines more specifically) could also provide a lot of valuable information for investigators.

4.4 Other Sources

Depending on the type of norm violation and the circumstances surrounding it, there are multiple additional methods of investigation at the disposal of corporate investigators. Observation, to take an example, may be useful, although most of my respondents did very few observations. Observations (and the use of camera footage) may be used when an employee is suspected of sick leave fraud. Site visits may also prove useful to see whether the ‘reality on paper’ matches the ‘reality in reality’. ‘For example, go and take stock for yourself and make sure that that what’s in the administration is in fact what’s in stock. To determine that, ok, there is a possibility that the warehouse keeper or someone else took part of the stock’ (Respondent 13—corporate investigator). Some organisations furthermore do a standard search of employees and their belongings when they leave the workplace.

We also search people before they leave. We use a metal detector for that as well. Sometimes things come to light during that. You know, situations where people take something that isn’t theirs and that the alarm will ring. They’re asked to empty their pockets and well, if something’s in there that doesn’t belong to you, you’re going to have a good conversation with me. (Respondent 15—corporate investigator)

Other activities of corporate investigators include the evaluation (and correction) of previous investigations, the evaluation of internal control systems, the calculation of damages in the light of private action and the tracing of assets. When a report is made to the police (which often happens only after the internal investigations have been concluded), law enforcement information may also be used to investigate further. However, law enforcement agencies are very careful with the sharing of information,¹¹ as is illustrated by this conversation with an in-house investigator from Observation Company 2:

That’s the thing. They think there’s no room but there is. The shutters close on mention of information sharing but that’s not necessary. When I report a crime to the police, I would like to have insight in their interrogations etc. They say, ‘no, that’s impossible because of privacy’. They’re so afraid that they go wrong that the solution is to not share anything. We don’t need operational details; it would be very helpful if they could just give us directive information without them having to have to start an entire investigation. Just to let us know whether we’re on the right track. (Excerpt from observation 2—informal conversation)

5 The Interview: Confronting the Involved Person

A final category of information gathering is that which occurs through personal communications. Usually this takes the shape of an interview with colleagues and managers of the involved person (serving as witnesses and sources of information) and, finally, the subject of the investigations himself or herself. Respondents highly value the interview as an essential information source. An interview with the involved person usually forms the last step of the investigations, in which he/she is confronted with the information that has been collected with the use of the methods and sources described above. Interviews with witnesses often occur at an earlier stage as they are informative rather than confrontational. Many corporate investigators have a law enforcement background and are experienced interviewers. However, there are notable differences between an interview and a police interrogation. For example, there is no formal caution at the start of the interview because the interviewee is not a suspect in the sense of a criminal procedure. Nevertheless, respondents indicate that they do point out at the start of the interview that the interviewee is not obliged to cooperate and that cooperation is only on a voluntary basis. This is also codified in both the privacy code of conduct (NVb, 2015) and the guidelines for person-oriented investigations (NIVRA/NOvAA, 2010).

His statement is made freely, I mean if during our conversation he decides he doesn’t want to talk about it, ok that’s his decision. I’m not sure he’s going to be better off with that but when someone walks out the door, he walks. I’m not going to grab him by the neck and say, ok now you’re going to talk. (Respondent 15—corporate investigator)

The voluntary nature of the cooperation of an employee should not be overstated. There is a definite power imbalance between the employee and the investigators (providing a service to the employer).

The conversation turned to the measure in which people tend to cooperate with investigations done by the in-house department. Investigator [X] stressed that they have no formal powers to make people cooperate and that they are dependent on the voluntary cooperation of people. But, as he continued “you shouldn’t overstate the voluntary nature. We are acting as the employer here so people do feel pressure. If someone refuses to cooperate he does so but we do stress that that’s not in accordance with being a good employee. That’s one of the things that’s challenging in an interview. And a lot of people are just scared, that happens everywhere, also at our organisation, people are afraid of management. Afraid that when they talk about them they’ll lose their job”. (Excerpt from observation 2—informal conversation)

Investigators stress their independence of investigation within the assignment they receive. ‘We have our own set of rules on how we conduct our investigations and we give this to our client at the intake of the assignment. Sometimes they say, can’t you do this and that. No, sorry. These are the rules; this is how we do things’ (Respondent 2—corporate investigator). However, this does not mitigate the power imbalance much. An employee is technically free to refuse to cooperate—in practice he or she can feel forced to cooperate with the investigations by his employer. Investigators are aware of this ‘limited voluntariness’.

We caution people at the start of an interview, so to speak, by saying they are not obliged to cooperate. But they feel obliged of course. Sometimes someone asks, what will happen if I don’t? Well then I will have to talk to your manager about that. An interview is very confrontational. I dare say we give high priority to fair play, we stick to our own procedures. But we’re not treating someone with kid gloves. If someone has done something wrong, it’s ok to let him feel that. We are about finding the truth, that can be in someone’s advantage. If you did nothing wrong and we’re totally off track, here’s your chance to fix that. (Respondent 44—corporate investigator)

As discussed in Chapter 2, the law dictates that private investigation firms with a permit implement a privacy code of conduct similar to the one drafted by the NVb and approved by the Data Protection Authority. Other investigators tend to follow these rules as well, either by taking the privacy code of conduct as guidelines or by drafting their own guidelines according to the privacy code of conduct. The guidelines for investigations presented in the privacy code of conduct include for example the right of representation by a lawyer or union representative and the general obligation for the investigators to treat the interviewee with respect and refrain from applying undue pressure and presenting false information (see, e.g., Grant Thornton, 2010). Regarding the question of undue pressure, the privacy code of conduct (NVb, 2015: 31) states:

The mere questioning of someone by a private investigator produces a certain amount of pressure. As interviews are done on a voluntary basis, as a rule there will be no undue duress. It is hard to draw the line between what is and what is not allowed. Keen interrogation is in itself legitimate. It is thus allowed to confront someone denying involvement with evidence and to point out his weak position. Undue pressure is exerted, however, when physical pressure is used. Making false promises and verbal abuse are also illegitimate.

As an investigator of Observation Company 2 explained, this is not just a matter of due process: especially when there is not enough evidence to take measures against someone, working relations may be affected by corporate investigators’ actions.

And you need to be careful, when we have a case in which we can’t really make it stick, when there’s not really enough evidence and the person does not confess, you can’t be extremely tough on him. If he continues to be a co-worker you need to be able to shake his hand in the future. At least that’s my opinion on the matter. (Excerpt from observation 2—informal conversation)

Moreover, interviewees are given the opportunity to have a break and are offered something to drink and eat. ‘As of late we also include this in the interview report, you know, that someone has been treated correctly, had something to drink and had to opportunity to use the bathroom. That’s also to have proof of this for a possible court case of course’ (Respondent 45—corporate investigator). Because ‘the first thing a lawyer tries to do, also in a police investigation, is to discredit the statement that has been made by the involved person’ (Respondent 44—corporate investigator). These basic principles are (in a more general manner) also present in the guidelines for person-oriented investigation for accountants. Respondents indicate they are aware of the situation in which an involved person finds himself, especially in an interview setting.

The complaints that I get I can count on one hand. It used to be mostly about people feeling pressured in interviews. I get that, if you did something wrong and you know it and you’re faced with two investigators who start asking you questions and who are trying to get you to admit you did something wrong, that is a stressful situation. I take these complaints very seriously. But usually it’s just the context of being investigated, that in itself is intimidating. The conversation in the interview may feel awkward but I haven’t found that rules have been broken as of yet. People are treated with respect, they are not held against their will or any of that. So the percentage of complaints is pretty low, usually all runs smoothly. We’ve started to write down some of the procedural precautions we always took but now it’s recorded in the interview report. Things like that we tell people they are there voluntarily, that they are offered a drink and maybe some lunch, that they were able to go to the restroom. And we ask them now at the end of the interview how they feel about the interview. That prevents many complaints. (Respondent 46—corporate investigator)

The rules and normative considerations guiding investigations more generally and the interview in particular are there to ensure a fair treatment of the interviewee and at the same time guard the quality of the interview, so the information gathered through this method may be used in whatever legal solution chosen in the end (see Chapter 4). The rules and principles of law leave room for interpretation—it is possible to stay within the width of the legal framework but still put a fair amount of pressure on the interviewee. It depends in part on the investigator what the stance towards the interviewee is. Some respondents empathise with the interviewee, saying that they can understand the position he is in during an interview. However, most state for example that

You need to be completely neutral in these things. You didn’t contribute to this misery, you’re just hired to get a clear picture of the mess and fix it. You need to be professional about that. Of course, you need to be friendly. When someone needs a break, you offer him one and you record this in the interview report. ‘At that and that time interviewee was very emotional and we took a break’. So you also report what time you continued, you give the man some water, maybe suggest that he takes a walk in the garden. And sometimes, I join them, have a smoke, then some other kind of conversation unfolds. And when he’s ready, you reopen the interview. (Respondent 1—corporate investigator)

Interviews are generally done by two interviewers (see, e.g., NVb, 2015). There are multiple reasons for this. One of these is to have a witness for what has been said during the interview. Furthermore, having two people present is beneficial to the pace of the interview.

We conduct interviews with two people, one takes care of the conversation, the other takes notes. So, we can write the whole thing up on the spot and print it out and then the interviewee can read it and sign. When there are corrections that need to be made we will adapt the document, print again and sign it. The interviewee signs for having been made aware of the content of the interview report and he gets his own print to take with him. It happens that people don’t want to sign because they do not agree or because they want to talk with a lawyer. In that case, we sign it anyway. And sometimes people don’t even want to talk to us. (Respondent 44—corporate investigator)

As the cooperation is voluntary, people may refuse their assistance in an investigation. This could for example mean that he or she does not want to talk to the investigators or that the interview takes place but the person will not answer relevant questions. Respondents indicate that most people tend to cooperate. In a conversation with an investigator in observation 1, I was told that ‘most people are curious; they don’t have any experience with this kind of stuff so they come and have a look at what we do and what we know’. After the interview has taken place, the interviewee is asked to sign the interview report with the interviewers. However, the interviewee may refuse to do so. In this case, a note is made at the end of the interview report and in the final report (see also below).

5.1 The Interview Process

Respondents explain that although an interview is often done in a comparable manner, this is not according to a rigid standard . Different interviewers have different styles and flexibility is an important asset. In addition, the way in which the interview is executed depends on the position of the person who is interviewed within the investigations. Respondents indicate that an interview with a witness is different from an interview with an involved person. Interviews with witnesses are more informative than confrontational and often happen at an earlier stage. (Self-imposed or legal) rules regarding the interview with a witness are less stringent than when it comes to an interview with an involved person.

It is required by privacy law that an involved person is made aware of the fact that information is being gathered ‘within a reasonable term’ but at the latest within a month (article 14 GDPR). This poses an issue for investigations that take longer than one month. The requirement from article 14 GDPR is more stringent than the requirement posed by the previous Dutch privacy legislation and is also more encompassing: the involved person needs to receive more information about the information gathering than before. There are, however, some exceptions. When the information is already known to the person, when it is impossible or too difficult to provide the information, when the information gathering is obliged by law or when the provision of the information to the involved person makes the purpose of the information gathering impossible, the information does not need to be provided. Although it remains unclear at the moment what the full extent and consequences of the new Privacy legislation are for the investigative process, this last category of exceptions provides the possibility to delay informing the involved person.

The data gathered in this research are based on the old situation, in which the involved person should be made aware of the investigations he is subject to at the very beginning of investigations. However, also under the old privacy legislation, there were some exceptions to the rule. One of these was the protection of the rights of others (including the client).¹² In practice, this meant that involved persons were often notified about the investigations at the moment of their interview, which is often at the end of the investigations. Although there are situations ‘in which you need to talk to the involved person as soon as possible, you often postpone this interview until you know exactly which questions to ask, based on the information you gathered’ (Respondent 2—corporate investigator). Respondents prefer to interview the involved person at the end of the investigations, since they are able to confront him or her with the investigations’ results by that time. In this way, the chance that the involved person might destroy incriminating evidence is also diminished, as he/she will only be aware of the investigations at a later point in time. The following quote depicts the procedure respondents follow with regard to notifying involved persons quite nicely:

In principle, you provide the code of conduct for investigations to the involved person at the earliest occasion you have, unless investigative interests are opposed to this. So in case you have to start your investigations and the involved person is still working there, there’s a chance evidence will be lost. For example because he erases all files from his computer or removes physical documents from the administration and throws them in the shredder. That would be a reason not to inform him just yet. You will first have to secure the evidence and only after that, when you know everything is safe, you will notify him. (Respondent 2—corporate investigator)

The privacy code of conduct and general principles of law leave room for the use of flexibility in when to inform an involved person about the investigations. Flexibility is generally an important part of an interview. During one of my informal conversations with investigators during observation 1, an investigator talked about how interviews may take a very different turn from what was anticipated by investigators and responding to such a situation in a good way is vital. It is therefore important to stay flexible when conducting an interview. Respondent 5 displays the same opinion when stating:

Sometimes you decide on a certain tactic for an interview but it turns out very differently. I remember a case where we were expecting this person to be uncooperative and so we decided to start with a confrontation right off the bat. But we entered and he was very open and he wanted to talk to us. You start with a certain tactic but just like that it’s useless and then you need to converse with someone in a different manner than you expected. And it also depends on the subject matter. Or for example when someone is very emotional. Of course there are parts you can prepare beforehand but when you discover during the conversation that the important stuff is somewhere else you have to let go of your neatly prepared list and move to that subject. So you can come up with a certain grid but in practice it seems that you need to be very flexible with that. (Respondent 5—corporate investigator)

As this quote shows, however, interviewers do apply certain tactics during an interview and they prepare for it (see Coburn, 2006).¹³ The level and depth of preparation depend in part on the information that is already available. When the interview is used as a close to the investigations, usually there already is much information and ‘you can write much down in advance, you can make a draft of the interview report and confront him with it. Then you add his reaction, his declaration’ (Respondent 44—corporate investigator).

5.2 Phases in the Interview Process

The two investigative interviews that I was able to attend during the observations had a certain structure. Since this structure is also put forward by respondents, it seems to be more commonly used.

There’s always a difference between interviewers, I always say, you need to do your own thing. But the standard elements are that you start with a social talk, an explanation of the context of the interview, his rights and sometimes his duties. So basically what’s in our code of investigations. And usually, you move from a general conversation to more specific elements. In this conversation, you need to explain your assignment as well. So, you use a funnel so to speak, as an interview technique. The more specific questions are somewhere in the middle of the conversation. And then you start to show your evidence to the interviewee. There’s a turning point in an interview from informative to confrontational. That structure is always there. And these interviews can take a lot of time. (Respondent 1—corporate investigator)¹⁴

In general, the interviewers seem to build the interview around three phases. The first of these is centred on pleasantries—the interviewers start with light conversation to make the person feel at ease. This includes small talk, for example, about a person’s job. The voluntary nature of the conversation is stressed in this phase.

I want to tell you that you are here voluntarily, which means that you don’t have to cooperate and when you want to leave, you are free to do so. But of course we hope you will cooperate with us. (Excerpt from the interview witnessed during observation 2)

After the interviewee has had the opportunity to talk freely about what he thinks is the reason for the interview, the interviewers start with the second phase, ‘confrontation’. Here, the evidence that has been gathered through other channels is used to confront the interviewee with ‘the holes in his story’. The ambiance changes from being amicable to more stern. Although the interviewee is generally treated with respect, the situation could put pressure on the person even when no boundaries are being crossed.¹⁵ Especially when the employee is alone and without representation, he might feel pressured to talk even though he does not want to. The interviewers are experienced and as mentioned above, respondents indicate that interviews are done in couples, which brings a certain force with it. The situation in which people are placed, and the consequences it may have on their lives, is something investigators tend to take into account in an interview setting as well.

Let’s be honest, we have nothing to hide here. When we have the information to close a case, the adversarial principle dictates that the employee has the right to be heard but they don’t have to talk, they may. And I assume that there are very few people who will actually admit that they did it. But when we have a tight case we can say at that moment, ‘look it doesn’t matter whether you talk or not, we’re done. This is how you did it’, if necessary they can see the camera footage and such. No problem, all cards on the table. [But you should also be aware that that person] is often by himself in that interview situation. Because, as an investigator you’re not always aware of the impact it has on someone, you know. And taking that into account your mind-set is different as well for an interview. Even if someone did something wrong, he’s still a person. And the reasons why people do what they do may be heart-breaking. But the consequences of these actions as well. Because that person will have to go home and explain what happened. Especially with some types of norm violations that can be very painful. So I get it. So we try to interact on a human level, and in the end of the day I need to be able to look myself in the eye about how I acted. And sometimes I think, what a waste that this happened to this person. But that’s the way it is. I have done my job in a fair manner. (Respondent 18—corporate investigator)

The final phase of the interview is the conclusion. At this stage, the important information that has been discussed is summarised and either typed up directly, or the notes that the interviewers have taken are checked to make sure they are complete. Most respondents prefer to finish the interview report on the spot.

When it comes to an involved person, [to type the interview report at a later point in time] may not be the best course of action because then you run the risk he will rethink what he has said. ‘I said that but maybe it wasn’t wise to do so, so I want it deleted’. When you correct the report directly, print it, let him read it and comment and ask him to sign, this risk is much mitigated. (Respondent 2—corporate investigator)

Other respondents feel that this is not really an issue and take a different approach:

We always send the interview to them and tell them to take the time to read it carefully, and tell them, what you send back, that’s what you agree to. Then I will edit it and send it again and if you say this is correct, that’s what we discussed during the interview. They don’t even have to sign it then but we’re trying to get the most objective outcome as possible. And if someone says something in the interview but realises later that he should have put it differently, fine. That’s his story and that’s what’s going to end up in the report. So we’re trying to be as transparent as possible in the whole process. (Respondent 18—corporate investigator)

After the interviewee has been confronted with the information gathered during the investigations, the atmosphere seems to change back to amicable. The interviewers and interviewee might discuss what will happen next and other matters, such as the motivation for the transgression, also tend to be referred to. In case the report is typed up on the spot, the interviewee—in accordance with the adversarial principle—gets the opportunity to read it and comment on factual errors. The involved person is then asked to sign the document, along with the interviewers. This is also on voluntary basis—the interviewee is not obliged to sign. ‘For example, this involved person refused to sign his interview reports. We did sign; these were the statements he made to two witnesses [interviewers]. So if it comes to a trial, we can testify under oath about this’ (Respondent 1—corporate investigator). If the report is typed up at a later point in time, the interview report is sent to the interviewee to comment upon and sign. A refusal by the interviewee to sign the document is not considered to be overly problematic by respondents. When this occurs, a note is made that the document has been offered to the person to read and sign but that he or she has refused to do so. Generally, this is considered to provide enough information to make the interview report useable (van Wijk, Huisman, Feuth, & van de Bunt, 2002).

The interview reports differ in size but they are often a summary of what has been said instead of a verbatim account. The interview reports available to me during my research were mostly limited to a few pages. This is not a good indicator for the duration of the actual interview—only the relevant parts of the conversation are summarised in the interview report. This means that the interviewers have quite some freedom in drawing up the interview report. However, the interviewee has the opportunity to amend the report when he thinks important parts are incorrect or missing.¹⁶ Respondents also state that it is possible that the interviewee wants to exclude certain information from the interview report ‘for example private information that his manager has no business knowing’ (Respondent 45—corporate investigator). In some cases, investigators may honour the request of the interviewee, when the excluded information is not relevant to the case.

And when someone wants to change something we don’t agree with, we make a note of that and sign that too. Openness, transparency, completeness. Pro and contra. Those are important principles. It rarely happens that an interview report is reproduced in full in the final investigative report but such a comment will be mentioned in the report when relevant – either to support or to defy your conclusions. (Respondent 1—corporate investigator)

The fieldwork reveals that using the methods of investigation discussed, corporate investigators are often able to provide a fairly complete reconstruction of the norm violation. Using mediation of phones, combined with open sources such as social media, investigators can map who has been in contact with whom, where a third party lives, works, etc. Investigations into financial records and other relevant documents can furthermore provide insight into fraudulent financial transactions. When it comes to for example theft from a shop, cameras and employee log files can be very useful. Although these are all valuable methods and sources of information, respondents tend to place most importance on the interview as a source of detailed information. Usually, the investigations lead up to the interview with the involved person(s). In these interviews, information can be checked, details can be added and errors can be corrected—that is, when the interviewee decides to cooperate. All this information needs to be made available to the client in a concise and clear way. To achieve this, an investigative report is written.

6 Reporting on the Investigations

Once the investigations have been concluded and the questions that were the basis for the assignment can be answered, the information has to be made available to the client.¹⁷ Reports are often quite short and to the point, as respondents indicate that this format is most appreciated by their clients. A report needs to be clear on the facts and easy to read (van Almelo & Schimmel, 2014). Depending on the nature of the assignment and the complexity of the norm violation, reports may be merely two pages (not including appendices) while others may span one hundred and fifty pages. ‘The size of a report varies between assignments but thirty pages is usually about the length for us. Sometimes they are very factual, and then a lot of appendices might be attached, for example interview reports’ (Respondent 36—corporate investigator). Some investigators prefer to use appendices, while others do not. For example, relevant parts of interview reports or other findings may be integrated in the report without them being attached, or they may be added in an appendix. ‘These interview reports are for internal use, to build our case. They are not an integral part of the subsequent report. But we do use them to quote from, especially crucial parts’ (Respondent 5—corporate investigator). Multiple investigations may turn out to be related.¹⁸ Whether or not these are condensed into one report depends on the client. For example, it was explained to me during observation 1 that if a client wants to take different actions against different involved persons, multiple, separate reports for each individual might suit this purpose best. Also, the same case may involve multiple clients, who all receive their own report. Observation Company 1 had multiple investigations which were concluded by more than one report. Observation Company 2 (an in-house investigations unit), however, usually only produced one report. In-house investigators have an internal client, and when multiple departments are involved, the same report may be circulated.

It is difficult to give a standard format of an investigative report, as there are notable differences in the way the findings are presented. However, most investigative reports contain the following subjects:¹⁹ ‘a report is typically formatted like, what was the assignment, what was the scope, what did we do and what did we find?’ (Respondent 36—corporate investigator). Some investigators also add some legal information, a preface with some kind of disclaimer or other relevant information. Opinions seem to differ about the necessary information for a report; however, there is some consensus that a report should at least be transparent about the presented findings and how these have come to the fore. The client needs to be able to make an assessment of the validity of the report and to interpret its findings (Rense, 2004). The reports of the cases examined during observation 1 (case study 1–10) contain a justification of the investigative efforts which have led to the findings presented in the report. In this sense, the report also serves as a way to show accountability to the client. This ‘disclaimer’ is typically not part of the reports of the cases analysed during observation 2 (case study 11–21). Observation Company 2 being an in-house corporate investigations department, it did not have a commercial relationship with its client, based on an official assignment and contract. As such it is not necessary to provide such a justification in every report.²⁰ In these case reports, the explanation of the kinds of investigative methods which have been used is done in a less all-embracing manner. For example, although an investigator of Observation Company 2 explained that the investigation of open sources such as social media is a standard part of the investigations, the use of this method is not always mentioned in the case studies (it is excluded when it yields no results). The investigative actions may however still be retraced as they are recorded in the investigative journal (if kept properly).

Interestingly, respondents working in an in-house corporate investigations department indicate that not every investigation merits a report. In such a case, the case notes, kept in the investigative journal, are simultaneously the final product of the investigations.

We don’t always write a report, we get a lot of rubbish cases. It’s no use to write an entire report then. The rule is that when they want to fire someone, we do write a report for the involved business unit, with an advice attached, for example about the processes that made the transgression possible. But when they are just going to give the involved person an official warning, there will be no report. Maybe we’ll give some advice but nothing written down. When there is no report, your notes, the journal and our registration system ‘is the report’. (Respondent 43—corporate investigator)

Some commentators suggest that it is necessary to have a predetermined goal for the investigations, for example, a report to law enforcement authorities or a dismissal (Schimmel, 2011). When this has been agreed between client and investigator, this predetermined goal is usually presented in the report. However, in practice the decision what to do with the results often is made only after the results are clear. ‘For example, we hand in the report and the client says, “I didn’t know it was this serious, I want to report to the police after all”. Ok, so then we go and report to the police’ (Respondent 1—corporate investigator). If the decision to report to law enforcement authorities is made at the end of the investigations, this may potentially provide an issue with the value that will be given to the evidence. The standard of evidence in a civil court procedure is lower than that which is used in criminal court. If a civil court ruling or internal solution is sought but a report to law enforcement authorities is deemed necessary as well, this might thus be an issue. ‘Improperly obtained evidence is not as problematic for the procedure in civil court. A civil judge will not easily dismiss evidence, he might reprimand you for it but he has heard it anyway and will use it. Plus, often it is not the only evidence you have, you can build your case with the other evidence as well’ (Respondent 50—client). Cases may also be concluded entirely without the involvement of a judge (Meerts, 2014a), which makes the way evidence is gathered even less of an issue in that sense. It is not necessarily a case of improperly produced evidence though—the information might be gathered through all the right channels and according to all the rules and still not comply with the standard of evidence used in criminal court because it must be considered circumstantial. This might be enough for a civil court solution, termination of the labour contract or internal sanctions but it will not hold up in criminal court.

Taking the above considerations into account, the situation may be less serious than one might expect. Because there always is the possibility that a client decides to report to law enforcement authorities after all, respondents state that they try to aim for the standard of evidence that is used for criminal investigations in all investigations. ‘You have the highest standards for the burden of proof there, beyond reasonable doubt. If it complies with that, it will comply with the others as well. So this way, these other settlement possibilities will all remain an option’ (Respondent 1—corporate investigator). As such, respondents indicate that they feel it is important to ‘go by the book’, both in a moral and professional sense and because in many cases the decision how to handle the matter is made only after the investigations have been concluded and the report is presented to the client.

Whether or not a conclusion of findings is drawn in the report depends on the type of investigator. For example, forensic accountants consider drawing conclusions from the presented facts or providing advice to their client in a report ‘not done’ (see also Chapter 2). ‘Clients always ask for a conclusion, “just write down what you think”. But that would be subjective. The report sticks to the facts. Accountants are not supposed to draw their own conclusions, that’s up to the client or a judge’ (Respondent 36—corporate investigator). Others prefer to give some advice on how to proceed but the extent of this advice also differs among respondents. This respondent for example does include some advice on the possible ways of settlement but provides no opinion on the best solution in the current case:

Every case is different, the interests involved are different. Every time you’re faced with a different web, different tensions. The outcome is different every time. But you know, I don’t really care about that. We have a job to do and do it well. You can provide your client with the options but I’m not going to be the one to say, this is the way to go. Who am I to say they should report to the police? (Respondent 1—corporate investigator)

Corporate investigators with a legal background are more inclined to provide an advice on how to proceed:

And eventually you will come to the point that you write your report and explain your findings but also draw conclusions based on that. That could be that there must be measures taken against certain persons or that the structure of the organisation should be changed. And it could also lead to the question whether or not the incident should be reported to the police. And that’s often a tough one to answer. (Respondent 30—forensic legal investigator/client)

The extent to which corporate investigators may influence decisions about settlement of the norm violation differs; however, respondents indicate that the actual decision is not made by investigators. The client is the one deciding. In in-house security departments , the division between the investigators and the decision makers may get blurry at times. ‘Whether or not it needs to be reported to the police is a decision that does not concern HR. They want to be in charge of that, but I am the one to decide whether or not I find it useful. The policy is [that we] report every time, in practice it hardly ever happens. I am the one who has to go there and file the report so I am the one deciding’ (Respondent 48—corporate investigator).

We do the investigations and that’s it. Two of my colleagues have a different opinion, [they think that] when they say someone’s guilty he should be fired, [but other colleagues] have a more nuanced view. Our job is the investigation, getting the evidence and building a case that would hold up in court if necessary. The decisions lie with the involved manager and HR. (Excerpt from observation 2—informal conversation)

6.1 The Adversarial Principle

Before the report is handed over to the client, the involved person will be given the opportunity to read the relevant parts of the report and comment upon it. This implementation of the adversarial principle is derived from accountancy rules; however, most respondents state they comply with this rule even if they do not have an accountancy background (Rense, 2004). The adversarial principle relates to the more general principle of law of due process, which respondents claim to comply with. For private investigation firms with a Wpbr-permit , the use of the adversarial principle is codified in the privacy code of conduct as well (NVb, 2015: 7).

And especially when it concerns an involved person – because it’s a person-orientated investigation – we use the adversarial principle. The first phase of that is to invite him to answer some questions. And the second is that when you make a final draft of your report which contains parts that concern that person, you give him the opportunity to react to it. So he can read it and comment on it. And those comments are added to the final report. And I think this is a good thing and very reasonable. I think that’s very important, it can’t be the case that you just go about your investigations without ever speaking with this person and still write a report about him. Obviously, that’s not right. (Respondent 5—corporate investigator)

Not every involved person takes the opportunity of reading the relevant parts of the report. Respondents indicate that this is not necessarily problematic; however, it does mean that caution should be applied when presenting findings. An example from observation 1:

Three investigators are having a discussion about the adversarial process in [case X]. When possible, relevant parts of the report are sent to the involved person. In this case however, it is decided to make the draft report available at the office of Observation Company 1 instead of sending it to the people it concerns. The reason for this is that multiple people who are involved in the case have indicated they are worried about consequences to themselves, should the report be circulated. To limit the chances of this happening, the draft report is not distributed but only available for inspection in the controlled surroundings of the office of Observation Company 1. To comply with the adversarial principle, the draft report is still available for inspection to the involved persons, however it will not be sent to them. The lawyer of one of the involved persons demands the (full) report to be sent. It is decided this will not be done. (Excerpt from observation 1)

This solution is not limited to Observation Company 1. Other respondents indicate they make use of the option to present an opportunity for inspection at their own location as well, instead of sending it to the involved person.

That draft report is presented to the involved people. It depends on how sensitive the matter is whether that happens by sending it to them or whether we place it somewhere where they can come and inspect it. If we have the slightest inkling that they will abuse the content of the report or that they will go public with the draft, they can only inspect it at our location. This is usually followed by a discussion with their lawyer who will state that the involved person has the right to inspect the draft report based on the adversarial principle. Yes he does. But he does not have a right to the report itself. He is not our client. So he may take notice of the relevant content of the draft but we do not report to him – we report to our client. That’s the way the game is played. Usually they try to slow down the process by refusing to inspect the draft if it’s not actually sent to them. Then we write to them again, giving them the opportunity to inspect the draft. Usually we give them a reasonable term of 2 to 3 weeks to respond, followed by a reminder and a couple of weeks more. But if they don’t respond we will notify them that we assume that they do not want to take the opportunity to read and comment on the report. The suspense builds and in our experience, people will eventually cooperate and inspect the draft. It also depends on the way you communicate with them. Usually they sense the importance of knowing what we wrote about them. So after all that we edit the draft according to their comments. Which may provide another heated discussion when someone says ‘I don’t want this to be in the report’. Our response to that is: we are deciding about the content, if you don’t agree please write it down and we will make sure to attach your comments to the final report. We will present our view on the matter and yours alongside it. Some people write an entire report in response, ok fine we will attach that too. Let the client figure out what he wants to do with it. And then we finalise the report and present it to the client. (Respondent 40—corporate investigator)

The inspection of the draft report may take a substantial amount of time because involved persons do not respond or try to stall the investigations in a way similar to the one described in the quote above. During observation 1, this issue also occurred for an investigation which was almost finalised by Observation Company 1.

The assignment of [case X] provided Observation Company 1 with multiple additional assignments because other organisations that had dealt with the involved persons in the past want to know whether they are also affected by the norm violations. [Investigator] is now working on the finalisation of one of these additional reports and I am having a conversation with her about it. ‘You know what the difficult part is here – we have concluded investigations already which are basically about the same people but for different clients and different norm violations. In those cases we applied the adversarial principle and this particular person referred us to his lawyer. So, theoretically, it would make more sense for me to contact his lawyer now as well. But I can’t because it’s a different investigation. But the thing is, for this involved person it’s not a separate matter, he’s being investigated, that’s it. He’s refused all the registered letters we have sent and other communications he just sent back to us. But I will have to send him an invitation to make use of the possibility for inspection for this case as well. And if he does not make use of that that’s his problem. We did everything we could to comply with the adversarial principle’. (Excerpt from observation 1—informal conversation)

When the adversarial principle has been applied and the draft is amended, the report can be finalised and signed. The (lead) investigator is the one responsible for the investigations and, in case of a commercial relationship with the client, the signature of this investigator is necessary. In the case of investigations done by a private investigation firm , the report is often (also) signed by the director of the firm.

Respondents working for an external client indicate that they agree on the terms under which the report of the investigations may be used. If the client wants to use the report for other purposes than agreed beforehand, the corporate investigators who executed the investigations will have to agree to that.

In the report we state the purpose for which it may be used. Should the client choose to use it for a different purpose than to which we agreed, he has to get our written consent previous to that usage. We can’t enforce that – but at least the statement is there. To cover our risks, make sure clients do not run off with the report and abuse it. Say a client tells us that the report will be used for procedure X but when he gets the report he thinks, ‘it suits me well to post in on my website or share the contents with the newspapers’. That means he has an issue with us because he’s breaching our contractual agreement. But we can’t really stop it from happening in practice. (Respondent 40—corporate investigator)

The reports which are publicly available through the Internet (mostly investigations done for (semi-)public sector organisations) contain a similar disclaimer. This disclaimer usually explains that the report is made for a certain client and meant for the purposes defined in the report and that if the report is made public, written consent is necessary.²¹ Because of the laws regulating transparency in public office (Wet openbaarheid van bestuur—Wob), this is partly moot though: if for example a municipality receives a request under the Wob-regulations (relevant parts of) the report needs to be made publicly available (unless one of the grounds for refusal applies, articles 10 and 11 Wob). However, such a formal addition in the report does protect the corporate investigators against liability claims from people involved when the report is made public without prior consent.

6.2 Complaints Procedures

Persons and organisations who feel wronged by corporate investigations or by the final report have recourse to civil court proceedings on the basis of wrongful act/tort (article 6:162 Civil Code [BW]). Corporate investigators may be held liable for damages in this way. When the corporate investigator in question is a forensic accountant or forensic legal investigator , disciplinary procedures are also open to people and organisations affected by corporate investigators’ actions (see also Chapter 2). Respondents indicate that they are faced with disciplinary action or civil suits on a regular basis, as it is a way for the legal representation of the involved person to discredit the report and in this way remove the grounds for action against the involved person. This goes more generally for the report as ‘even the slightest detail might be problematic. If they find something that doesn’t fit, this can discredit the whole report’ (Respondent 3—corporate investigator). In this way, control is exerted over corporate investigations and when a transgression has been made, the judge may correct the situation by allowing damages to the aggrieved party.

At first I got nervous and I would think my god, we’re in trouble here. But now I know it’s just part of our business. It’s a standard defence strategy: if you can’t win on content… For example the big investigation we’ve just finalised, we and the [board of directors] are charged for slander by the people involved. This happens all the time. (Excerpt from observation 1—informal conversation)

Before taking recourse to a civil or disciplinary court, persons affected by corporate investigations may turn to the complaints procedures of corporate investigation units. For private investigation firms with a Wpbr-permit, it is obligatory to have a complaints procedure in place (article 18 Regeling Particuliere beveiligingsorganisaties en Recherchebureaus [Rpbr]); however, other corporate investigators tend to have a complaints procedure as well.

When someone has an issue with the investigation or the outcome there are several recourses. For people still employed by the company there is a general complaints arrangement to be used for every decision by the company related to a person. This is not specific for actions by the in-house investigators. These complaints end up with the manager and there is an option to appeal to higher management. There is also an official employee confidant an employee could turn to. When a person has been fired that usually goes through court so the employee in question then has the option to complain to the judge. (Excerpt from observation 2)

As this manager of an in-house security department explains, the complaint is usually initially dealt with by the manager of the corporate investigations department or corporate investigation firm.

I don’t get many complaints of people who have been the subject of investigations. Complaints end up with me first and I decide whether they have merit. If people do not agree with the way I handled the matter they can use the official external complaints procedure. As a matter of fact I have one complaint I am looking into right now. That one is about the use of our protocol for investigations and the privacy code of conduct [CM: respondent is the manager of an in-house security department so the privacy code of conduct is not legally binding to his investigators but is used nonetheless]. It is a question of proportionality here and they have a point. It’s a valid question to ask why we first looked at the emails instead of open sources. If you want to upgrade to more intrusive means of investigation you’re going to have to start with the ones which are least intrusive of course. (Respondent 46—corporate investigator)

7 Discussion

This chapter shows that corporate investigations into norm violations within organisations may be executed with the aid of multiple sources of information and methods of investigation. These are only partly the same as the ones at the disposal of law enforcement agencies, since corporate investigators lack formal powers of investigation . This circumstance is a defining difference between law enforcement and corporate investigators, making the arguments put forward by pluralisation theories as presented in Chapter 1 hard to maintain. Corporate investigators and law enforcement agencies are not interchangeable because of corporate investigators’ lack of formal powers of investigation . This seems to be underlined by the avoidance of ‘criminal justice terminology’ by corporate investigators and by the fact that parts of the corporate investigation follow a civil law logic, rather than the logic of a criminal law investigation. As a result of the lack of formal powers of investigation, corporate investigators are not able to perform some investigative tasks; on the other hand, this circumstance also creates much more flexibility in corporate investigations (Williams, 2005). A high degree of discretion and operational flexibility thus defines the process of corporate investigations.

Corporate investigators’ possibilities of investigation are extensive. The fact that corporate investigators are working directly for a client, being responsive to clients’ needs, creates a greater willingness in clients to volunteer information. The close connection to the client and a contractually created duty of confidentiality make much information readily available. Furthermore, because of this and the absence of the need to wait for formal approval from for example a judge, corporate investigations can be executed and concluded fairly swiftly. The absence of formal investigative powers may have sparked the creativity of investigators to take a broader approach to investigations and use methods of investigation that may be regarded as more private in nature. The use of forensic accounting techniques, IT tools and open sources (for a large part digital social networks), does not fall in the category of ‘traditional police work’ (although the police are also increasingly making use of these techniques and information sources).

The lack of formal powers of investigation leads to more freedom for corporate investigators. Corporate investigations are regulated by law and self-regulation (although the specificity of the legal framework depends on the type of investigator—see Chapter 2). Certain core principles of law are used by all respondents included in this research and by the observation companies as well. Leading normative values are competence and diligence, integrity, objectivity, professional conduct and discretion. Within these values, broad principles of law such as subsidiarity , proportionality , fair play and the adversarial principle are used as central to corporate investigations. However, the fact that the limitations put on corporate investigations present themselves in the shape of (general) principles of law makes that there is quite some room for a flexible application of said principles. In this way, much responsibility is given to the moral code of corporate investigators themselves (see also the following chapters on non-contractual moral agency by investigators).

One example through which this may be elucidated is that of the relationship with the client on the one hand, and with the people subjected to the investigations on the other. Starting with the latter, there is a power imbalance present in corporate investigators’ dealings with subjects. Corporate investigators are professionals and have the backing of an organisation, while subjects are usually individuals (sometimes with the backing of some form of representation) who are not used to the processes of investigation. Respondents seem to be aware of this power imbalance and indicate that they use the guiding principles of law described above (subsidiarity , proportionality , fair play and the adversarial principle) to ensure a fair treatment of the involved person. The procedures codified in the privacy code of conduct and the guidelines for person-oriented investigations, followed by most respondents, are meant to protect subjects. In addition, subjects may use complaints procedures and recourse to civil and disciplinary court is available to them to ensure their rights. This, however, does depend on the resilience and pro-activeness of individual subjects.

Corporate investigators cannot force people to cooperate,²² nor are they allowed to, for example, enter and search private premises. This means that much relies on voluntary cooperation by involved persons and others within or external to the client organisation. Respondents indicate that many people do cooperate, which circumstance some contribute to the fact that corporate investigators appear to be less threatening than law enforcement professionals to people involved in investigations. However, the next chapter discusses the types of corporate settlements which may follow corporate investigations and which may have a serious impact on people’s lives. The voluntary nature of such cooperation should not be overstated. Subjects have a labour relationship with the client and cooperation with the investigations may be demanded through that channel.

Corporate investigators must strike a balance between the interests of the subjects, the wider interests involved and the interests of the client. The latter are leading, this being contractually defined by the assignment. This is one of the main reasons for organisations to hire corporate investigators (Meerts, 2014b). However, corporate investigator respondents stress the importance of independence within the limits of the assignment and are wary of too much involvement in and influence over investigations by the client. Once the investigations are finalised and the report submitted to the client, clients are the owner of the product (the report) and, as such, are responsible for its further use. Corporate investigators may assist in that by providing advice and assistance with a report to law enforcement authorities or corporate settlements. Chapter 4 discusses these various solutions following corporate investigations into internal norm violations.