It is difficult today to avoid news about allegations and subsequent investigations.
First, it was a slew of high profile allegations about sexual misconduct—which continues. More recently, it’s about abuse of power in the government. And rarely a day goes by without some news of a financial fraud, bribery, or other scandal at companies around the globe.
In my time, I have conducted many investigations, had my team perform others, and been a target in an allegation that was investigated by outside counsel hired by the audit committee. So I think I have some relevant experience!
What we should all note from the news is that a failure to perform an appropriate investigation is a serious source of risk to any organization.
Here are five points to consider when an allegation of misconduct surface and an investigation is necessary to get to the bottom of it:
1. It is critical for any individual within the organization to be able to report suspected inappropriate behavior without fear of retaliation.
The apparent effort by members of the U.S. government to identify a whistleblower and then paint him or her as a political operative is unforgiveable and probably illegal (these federal employees are protected by law).
Unfortunately, many people do not come forward because there is a credible fear—justified by several real life examples—of retaliation.
Here’s an example of just one: I advised (through her attorney) one woman who reported suspected wrongdoing by her manager to her company’s ombudsman, as required by company policy. However, her manager had started a disciplinary process against the whistleblower, triggered by that person’s refusal to perform what she believed to be corrupt acts demanded by the manager. The ombudsman was a senior member of the legal department who was advising the manager on the disciplinary process; he refused to open, let alone act on, the whistleblower’s complaint. Unfortunately, the whistleblower was fired, her allegations were never investigated, and her personal attorney failed to advise her properly on how to sue for damages. (Sadly, the only protection under federal law is when the whistleblower reports the suspected activity to the SEC. No protection against retaliation is provided when allegations are reported to the company’s ombudsman or hotline, following company policy.)
At another company, an individual told one of my team members that she had been subject to inappropriate sexual harassment. He came to me and I advised that the woman should report the allegation to human resources or the whistleblower hotline. Our team did not investigate personnel-related incidents. Later, I asked the vice president of HR whether the allegation had been received, without naming the person. He said that it had been received, but he had decided it had no merit and would not investigate. He had recognized the name of the complainant and that was enough for him. He said the woman had had disciplinary problems and was complaining to protect her job, not because anything had happened. I tried to persuade him that the allegation needed to be investigated, but to no avail. I reported the facts to the general counsel and let him handle the issue, which he did.
Failing to investigate an allegation by an employee who is being disciplined exposes the company to a claim that the company’s actions against the employee are retaliation.
I also think about the women who have alleged inappropriate sexual activities by Supreme Court judges during the confirmation proceedings. They were not only identified by name but were publicly ridiculed.
These allegations, if there was to be a fair process, should have been conducted quietly by professional investigators with an open mind. They should not have been conducted in public. Frankly, as I look at the current impeachment inquiry involving the President, I have to wonder whether the process is appropriate. It should be much quieter and performed by objective professionals.
2. It is also critical that individuals outside the organization are able to report suspected wrongdoing by another organization’s employees.
I can recall a number of cases where vendors and customers gave us information that we investigated and determined there had been fraudulent acts. (The assessment of fraud is a legal determination, based on facts that we provide counsel.)
Few organizations, in my experience, have processes where vendors, customers, and others can report suspected inappropriate behavior by an employee of the company. When complaints are made, they generally end up in the wrong hands because the third party doesn’t know whom to tell.
3. Every allegation of wrongdoing should be considered and evaluated for a potential investigation.
Before launching a formal investigation by my team, we look to see if there is predication. That is typically based on two questions, explored below.
One: If the allegation is true, would the actions represent a violation of law, company policy, or desired behaviors?
If not, we still consider whether it would be appropriate to conduct further inquiries; sometimes, the whistleblower did not explain the situation adequately and we have our suspicions.
If yes, then we determine who is responsible for the preliminary investigation, which is a process to see if a formal investigation should be opened. Sometimes it is internal audit, sometimes HR, and sometimes it could be another function like physical security or legal.
Two: Is there sufficient information and evidence that the allegation might be true?
Sometimes, we can fairly quickly determine that it is without foundation, in which case we document that and close the case. (We will consider contacting the complainant if we know the identity of the individual to make sure a mistake has not been made in the details they provided. On rare occasions, we might consider investigating whether this was a deliberate smear that represents a violation itself.)
There have been times where the allegation was too vague to investigate. If we can contact the complainant, we will try to elicit more information. If not, we flag the complainant, keeping it open and waiting to see if we receive more information at a later date.
If there is predication, we will open a formal investigation. But we try very hard to keep it quiet. The fewer people who know about it the better, even (and especially) management. I am proud to have completed investigations of suspected inappropriate employee behavior and closed them as without foundation without the ‘targets’ even knowing there had ever been either allegations or an investigation.
4. All investigations should be conducted by trained (and certified, when possible) objective professionals.
My investigators (including myself) were either certified fraud examiners or had received appropriate formal training in investigations, interviewing, and interrogations.
The investigation is to uncover related facts. Interpretation of those facts is a management function with advice from legal counsel. It is very easy, too easy, for investigators to form opinions that bias and taint the investigation.
Every target of an investigation must be treated with respect and dignity throughout the investigation.
I know all too well what it is like to be involved in a poorly executed investigation. I suffered through an investigation by HR of a personnel-related complaint against some of my employees. The investigator did not know what she was doing and alienated everybody—and then failed to uncover the truth.
When a complaint was lodged against me (together with the CFO), the audit committee engaged outside counsel. The lead investigator was professional and handled herself well. It was an awful experience but turned out well—although the individual who invented the complaint was paid to leave the company, which upsets me even today.
5. Internal audit should consider a periodic review to ensure all of the above and provide assurance to top management and the board that the allegation and investigation processes are appropriate.
Where internal audit itself is responsible for the whistleblower hotline or related processes, or investigating allegations, they should consider engaging a third party to perform a review and report the results to the board.
Following these five key points wont ensure that every investigation goes smoothly, but it will go a long way to ensuring that they are carried out professionally, fairly, and with the best intentions at getting to the source of the problem and uncovering the truth. 
Norman Marks is an internal audit and risk management expert and author of the blog, “Norman Marks on Governance, Risk Management, and Audit.” He is also the author of several books, including World Class Risk Management, Risk Management in Plain English: A Guide for Executives, and Auditing that Matters.