Recognise when the risk has changed
Not every concern requires an external investigator. The case becomes business-critical when the subject is senior, the allegations are serious, internal independence is doubtful, evidence may disappear, or the outcome could materially affect customers, regulators or workforce confidence.
At that point, speed still matters—but uncontrolled speed can make the position worse. The immediate objective is to preserve options and evidence while avoiding any appearance that the outcome has already been decided.
Stabilise the position before interviewing
Define who owns the response, who needs to know, what evidence must be secured and whether interim measures are genuinely necessary. Suspension should not be automatic; alternatives may protect the process with less disruption.
- Preserve relevant emails, messages, documents and access records
- Record the purpose and reasoning behind interim measures
- Separate the investigator from the final decision-maker where practicable
- Give clear confidentiality instructions without promising absolute secrecy
Set terms of reference that answer the real question
A good investigation is not a search for everything that has ever gone wrong. Its scope should identify the allegations, the questions to be determined, the evidence likely to matter and the standard on which findings will be made.
Scope should be capable of revision if material new issues emerge, but that change should be documented and communicated fairly.
Protect the quality of the decision
A defensible report distinguishes allegation, evidence, inconsistency and finding. It explains why evidence was accepted or rejected and identifies any limitations. The report should help the decision-maker think; it should not quietly make a disciplinary decision for them.