An internal investigation is a defined fact-finding process. It should not become an unrestricted search or an exercise designed to confirm a predetermined conclusion.
Mandate and independence
The mandate identifies the concern, questions, period, relevant systems, reporting line and decision-maker. Conflicts must be addressed where the concern touches senior management.
Evidence preservation
Identify email, documents, devices, system logs and paper records. Preserve originals, document collection and use controlled working copies. Under the Personal Data Protection Law, the Controller and any Processor must consider purpose, proportionality, access controls and the rights applicable to Personal Data Processing.
Chronology and interviews
A chronology connects approvals, transactions, messages and system access. Interviews should have a stated purpose, begin with neutral witnesses where appropriate, and give each person a fair opportunity to explain inconsistencies.
Findings and decision
The report should distinguish established facts, unresolved issues and legal assessment. Management then considers employment measures, reporting, a private-right claim, remediation and communications. The first-response sequence is in the first 24 hours guide; characterisation is examined in employee fraud; allocation of responsibility is addressed in corporate crime liability.