To conduct an investigation properly, you define a narrow question, learn the legal limits that apply to the methods you plan to use, collect documents and digital records before you talk to people, preserve everything with a documented chain of custody, and write a report that ties every finding to a specific piece of evidence. Skip any of those steps and you risk contaminating evidence, breaking a law you didn’t know applied, or ending up with findings that no court, regulator, or executive will credit.
Start With a Specific Objective
An investigation without a clear objective drifts. Write down the exact question you need answered and the decision that hinges on the answer. “Find out what happened” is not an objective. “Determine whether the $14,000 shortfall in the Q3 operating account resulted from error or theft, and identify who was involved” is.
A tight objective does two things at once. It tells you what’s relevant so you stop chasing tangents, and it tells you when you’re finished. Think about what facts are missing, who might have direct knowledge, and what outcome you expect once those facts are established. Revisit the objective as new information surfaces. Investigations rarely unfold in a straight line, and unexpected facts sometimes mean adjusting scope. Expand deliberately rather than wandering.
Know the Legal Limits Before You Collect Anything
This is where amateur investigations go wrong. Enthusiasm leads people to record conversations illegally, enter property they have no right to enter, or run background checks in ways that violate federal law. Knowing the guardrails before you begin is not optional.
Recording Conversations
Federal law lets you record a conversation if you are a party to it, or if one participant consents, as long as the recording is not made to further a crime. About 11 states go further and require all parties to consent. Violating the federal wiretapping statute can carry up to five years in prison.1Office of the Law Revision Counsel. 18 U.S. Code 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications If your investigation crosses state lines or involves phone calls, check the recording law in every jurisdiction involved before pressing record.
Accessing Property
You cannot enter someone’s home, office, or private property without permission, regardless of how important the evidence might be. Doing so is trespassing and can result in criminal charges. If you need evidence from a location you don’t control, request access, obtain a court order, or work with law enforcement.
Background Checks
If your investigation involves pulling a background check or credit report on someone for employment-related purposes, the Fair Credit Reporting Act requires a clear written disclosure and the person’s written authorization before you obtain the report.2Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports The disclosure has to be a standalone document, not buried in an application. If you later take an adverse action based on what the report shows, you must notify the person and identify the reporting agency.3Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act
When to Hand It to Law Enforcement
If the facts point toward a crime, think carefully about whether you should be conducting this investigation at all. Collecting evidence at a crime scene can contaminate it. Confronting a suspect can tip them off and give them time to destroy records. If your actions interfere with an active investigation, you could face obstruction charges. The general rule: if you believe a crime has occurred, report it and let law enforcement collect the evidence. You can still run a parallel internal inquiry for your own purposes, but coordinate so you don’t step on their work.
Licensed Investigators
More than 40 states require anyone providing investigation services to the public to hold a private investigator license. If you’re hiring someone to conduct surveillance, interview witnesses, or gather evidence on your behalf, verify the license. An unlicensed investigator’s findings can be inadmissible and can expose you to legal risk.
Build a Written Plan
With your objective set and the legal limits understood, put a plan on paper. It doesn’t have to be elaborate. Cover four things: what information you need, where you expect to find it, who handles each task, and your timeline.
Sequence matters. Start with what’s easiest to obtain and least likely to alert the subjects. Documents and digital records usually come first, because they’re objective and don’t change their story. Interviews come later, after you’ve read enough material to ask informed questions. An interviewee who knows you’ve already reviewed the financial records will respond very differently from one who thinks you’re fishing.
Assign one person to manage evidence intake and tracking. If multiple people are handling evidence with no coordination, you’re inviting chain-of-custody problems that will undermine everything later.
Where the Evidence Lives
Most investigations draw from four categories of sources. Overlooking any of them leaves gaps.
- Documents: contracts, financial statements, internal memos, invoices, personnel files, insurance records, and correspondence. Paper trails are harder to fabricate retroactively than verbal accounts.
- Digital records: emails, text messages, database entries, access logs, GPS data, social media posts, cloud storage, and metadata. Timestamps and user identifiers often establish who did what and when.
- Physical locations: offices, warehouses, job sites, or anywhere relevant events occurred. Site visits reveal conditions, access points, and physical evidence that documents don’t capture.
- People: witnesses, involved parties, subject-matter experts, and anyone with direct or indirect knowledge. Their accounts give context documents lack, but they’re subjective and have to be weighed against the record.
Map out every potential source before you start collecting. You’ll find new leads as you go, but a full initial list prevents the most common mistake: building the entire case on one type of evidence and missing what another source would have told you.
Collecting and Preserving Physical Items
When you collect a physical item, the goal is to keep it in exactly the condition you found it. Photograph or video-record items before touching or moving them. Note the date, time, location, and condition of each. Use gloves when handling documents or objects that might later be tested.
Designate one evidence custodian. That person receives, logs, and stores every item. Keep access as narrow as possible. Store items in a secure location with controlled access, and use climate-appropriate conditions. Wet or biological material needs different handling than paper.
Treat every item as if it will end up in court. Courts don’t care about your intentions when you collected something. They care about whether you can prove the item is authentic, unaltered, and untampered since collection.
Handling Digital Evidence
Digital evidence is the most valuable and the most fragile type you’ll encounter. A single keystroke can alter file metadata, and connecting a device to the wrong network can trigger automatic updates that overwrite the data you need.
NIST guidelines recommend isolating devices from all network connections first: unplug ethernet cables, remove wireless adapters, or power off nearby access points.4NIST. Guide to Integrating Forensic Techniques into Incident Response (SP 800-86) Isolation prevents remote access, syncing, and remote-wipe commands from destroying evidence.
Before examining any storage media, create a bit-for-bit forensic image, a complete duplicate of the drive including deleted files and unallocated space. Use a write-blocker to prevent any data from being written back to the original. Work only from the copy.4NIST. Guide to Integrating Forensic Techniques into Incident Response (SP 800-86) Verify the copy by computing and comparing hash values (digital fingerprints) of the original and the image. Matching hashes mean the copy is identical.
Digital forensics standards exist specifically to keep this kind of evidence usable.5Office of Justice Programs. Digital Evidence: Standards and Principles If you don’t have the technical background to image drives and preserve metadata properly, hire a forensic specialist. Botched digital collection is one of the most common ways investigations fail, and you rarely get a second attempt.
Maintaining Chain of Custody
Chain of custody is the documented record of every person who handled a piece of evidence, when, and why. If you can’t show an unbroken chain from collection through presentation, a court can exclude the item entirely.6NCBI Bookshelf. Chain of Custody
Every transfer needs a record: the names and signatures of the person releasing and the person receiving the item, the date and time, the reason, and a unique identifier for the item.6NCBI Bookshelf. Chain of Custody It’s tedious, and a single undocumented handoff can break the entire chain.
Authentication in court requires the person offering the evidence to show it is what they claim it is.7Legal Information Institute. Federal Rules of Evidence Rule 901 – Authenticating or Identifying Evidence A clean chain of custody is the simplest way to meet that standard. Without it, opposing counsel will argue the evidence could have been altered, substituted, or contaminated, and judges take those arguments seriously.
Interviewing People
Interviews are where investigations come alive, and where bias creeps in easiest. The goal is to get each person’s account in their own words, not to confirm what you already believe happened.
Read the documents first. Knowing the record lets you ask better questions and spot inconsistencies in real time. Prepare an outline of topics, but don’t script every question. Rigid scripts stop you from following unexpected but valuable threads.
Use open-ended questions (“Tell me what happened on March 12th”) rather than leading ones (“You saw the defendant leave the building, didn’t you?”). Let the person talk. Silence after an answer is one of the most effective interviewing tools, because people tend to fill it with details they wouldn’t have volunteered.
Take detailed contemporaneous notes with date, time, location, and who was present. If you’re recording (and you should, where legally permitted), state the basics on the recording at the start. Notes and recordings do different jobs: notes capture your observations about demeanor and credibility, recordings preserve the exact words.
Interview witnesses before subjects. Witnesses give you baseline facts. Subjects have a stake in the outcome and may shape their answers. Walking into a subject interview with corroborated facts makes it much harder for them to mislead you.
Extra Rules for Workplace Investigations
Workplace investigations carry legal obligations that don’t apply to other kinds of inquiries. Employers investigating harassment, discrimination, or misconduct have to navigate employee rights, privilege, and regulatory duties at the same time.
Tell Employees Who You Actually Represent
When an attorney or investigator interviews employees during a corporate investigation, a basic ambiguity arises: does the employee think you’re looking out for them? In Upjohn Co. v. United States, the Supreme Court held that attorney-client privilege extends to communications between corporate counsel and lower-level employees when those communications are made at the direction of management to obtain legal advice.8Justia U.S. Supreme Court. Upjohn Co. v. United States, 449 U.S. 383 (1981) That privilege belongs to the company, not the employee.
Best practice is to tell each interviewee, before you start, that counsel represents the company and not the employee, that the conversation is privileged but the company controls the privilege and can waive it, and that the employee should keep the discussion confidential. Without that warning, the employee may believe they have their own attorney-client relationship with the investigator, which creates ethical problems and can jeopardize the privilege.
Public Employees Have Additional Protection
Government employees carry an extra layer of protection. Under Garrity v. New Jersey, the Supreme Court held that statements obtained from public employees under threat of termination are involuntary and cannot be used in a later criminal proceeding against them.9Justia U.S. Supreme Court. Garrity v. New Jersey, 385 U.S. 493 (1967)
Practically, a government employer investigating potential criminal conduct must choose: grant immunity so the employee’s statements can’t be used in a criminal prosecution and compel cooperation, or let the employee remain silent without punishment. You cannot do both. If your workplace investigation might overlap with criminal liability, involve legal counsel before conducting interviews.
Privilege, Litigation Holds, and Preservation Duties
If litigation is even a possibility, think about privilege from day one. Investigation materials prepared in anticipation of litigation can be shielded from discovery under the work-product doctrine, but only if you meet specific conditions.
Federal Rule of Civil Procedure 26(b)(3) protects documents and tangible things prepared in anticipation of litigation by or for a party or their representative.10Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery The key phrase is “in anticipation of litigation.” Documents created in the ordinary course of business don’t qualify, even if they later turn out to be relevant. The question a court asks is whether the document was created because of the prospect of litigation, not simply in a context where litigation was theoretically possible.
An opponent can still obtain work-product materials by showing substantial need and an inability to get the equivalent information elsewhere. Even then, courts must protect against disclosing an attorney’s mental impressions, conclusions, and legal theories.10Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery To improve your chances of protection, bring counsel in early, label privileged documents clearly, limit distribution, and keep a privilege log tracking each document’s author, recipients, and purpose.
The duty to preserve evidence kicks in the moment litigation is reasonably anticipated, not when a lawsuit is filed. Once that threshold is crossed, you have to take active steps to prevent destruction of anything relevant, including suspending automatic deletion on email servers and document management systems.
If electronically stored information that should have been preserved is lost because you failed to take reasonable steps, a court can order measures to cure the prejudice. If the court finds you acted with intent to deprive the other side of the information, the consequences escalate: the court may instruct the jury to presume the lost data was unfavorable to you, or it may dismiss the case entirely.11Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery
Issue a written litigation hold to anyone who might have relevant documents or data. Identify the matter, describe what has to be preserved, and make clear that normal disposal or deletion is suspended for those materials. Follow up to confirm compliance. Courts have imposed severe sanctions on organizations that issued hold notices and never checked whether anyone actually followed them.
Organizing Findings and Writing the Report
Raw evidence is useless until it’s organized. A chronological timeline is the single most valuable tool for most cases. Plot every relevant event using dates from documents, digital records, and interview statements. Patterns, contradictions, and gaps become visible almost immediately when everything sits in sequence.
Add a cast of characters (who is involved and their role), a document index (what you collected and where it came from), and a summary of each interview. Cross-reference them. If a witness says they weren’t in the office on a particular date, check the building access logs. If a financial record shows a payment on March 5th, see who had account access and what they said in interviews about that period.
Flag unresolved contradictions and information gaps openly. Knowing what you don’t know matters as much as knowing what you do. An investigation that papers over gaps looks polished but is unreliable.
The final report is the deliverable that outlasts everything else. Months or years later, when memories have faded and witnesses have moved on, the report is what a decision-maker, judge, or regulator will read. It has to stand alone.
Open with an executive summary covering the allegation, the scope of the investigation, the key findings, and the conclusion. A reader who goes no further should still understand what happened and what you determined. The body should cover the background and allegations, the scope and methodology (what you looked at and what you didn’t), a summary of each interview with credibility assessments where relevant, a catalog of documentary and digital evidence reviewed, factual findings tied to specific evidence, and your conclusions about whether the allegations were substantiated.
Write in plain language. The report may be read by HR executives, board members, regulators, or jurors, most of whom are not lawyers. Avoid jargon, state facts before opinions, and tie every conclusion to evidence in the record. If you can’t point to a document, record, or witness statement that supports a finding, the finding shouldn’t be in the report.
Keep facts and conclusions clearly separate. “Three witnesses stated that the subject left the building at 2:15 PM” is a fact. “The subject’s departure was an attempt to avoid detection” is a conclusion. Both can appear, but the reader should always know which is which. Close with a statement that the allegations were substantiated, unsubstantiated, or inconclusive, and note any areas where additional investigation would be needed to reach a definitive answer.