Conducting investigations in a post-pandemic world

When we talk about conducting investigations post-pandemic, technology is invariably part of the conversation. Pre-pandemic, momentum was already building to use technology to create new efficiencies in the investigative process. This was driven by broader corporate trends such as the move to cloud hosting solutions for data, which was already growing at a rate of 10-20% per year. However, the exponential growth in data, diversity of data types and new platforms and devices were already forcing investigators to consider how technology could help them grapple with this new, and sometimes overwhelming, data environment.

The pandemic acceleration

With the onset of the COVID-19 pandemic and overnight transition to remote working in March 2020, the case for technology-enabled investigations, ranging from remote interviewing to investigators working on the same data across multiple locations, put technology centre stage. While for many investigative teams this transition was an uncertain one, the new methods and the cost and time efficiencies were valuable new tools. As we emerge from pandemic restrictions, two key factors are driving today’s hybrid investigations environment.

  1. Adapting working practices to suit a remote environment. Remote collection is something that was done before the pandemic, but its adoption and professionalisation have greatly improved in the last two years. Companies have started putting better procedures in place to enable remote collections, and regulators have provided guidance on acceptable practices. Key elements for success include, establishing clear lines of communications and definition of roles; outlining clear responsibilities of all the stakeholders involved, from your legal advisors to your forensic specialists, or in-house teams; and making sure everyone involved knows how data collection should be performed and recorded through Chain of Custody forms and further documentation.
  2. Technological solutions for data review. There are various platforms that enable secure data review from anywhere in the world, while providing innovative ways to analyse content and gain insight from massive amounts of data quickly. One of the ways technology can help investigations is through visualization tools to display complex information and insights in an intuitive way. Whether mapping stakeholder relationships as part of an email review or displaying the results of your financial analysis, this has been a game changer in the field of investigations.

Remote, in-person, hybrid?

But before you decide whether to take a remote approach in investigations, there are a few key questions you should have in mind.

  1. Is your investigation into financial or non-financial misconduct? In the former, a key source of evidence is going to be any financial data you can access within your organization and, assuming that that data is available in a digital format and can be accessed remotely, that is going to cover a big part of your investigation. If it is the latter, the situation becomes more complex and could cover HR-related allegations like sexual harassment or bullying. While there's still value in reviewing electronic data, like emails or other electronic correspondence, your main source of evidence would likely be the interviews you're going to conduct. Given the sensitivities of the subject matter involved and the need to preserve strict confidentiality, there is a strong argument that these interviews should be conducted in person.
  2. Where will your investigation take place? A key consideration not only from a legal standpoint on data protection requirements, but that also has practical implications. It’s important to ascertain if you have the bandwidth and the network connection to transfer large quantities of data and conduct interviews remotely.
  3. What is the expected timeline of the investigation? One of the key lessons from the pandemic is remote investigations take a lot longer than on-site investigations. This is partly due to the difficulties that come with coordinating and organizing the work as an investigation team. There are also communication challenges due to lack of responsiveness and sense of responsibility when you try to deal with people remotely, as opposed to meeting them in person.

Finding this article useful?

Remote vs. In person

Most investigators will agree that interviews are the most challenging thing to do remotely. There are issues around confidentiality; for instance, you cannot be sure there isn’t an undisclosed person present in the room, either recording the interview or influencing the interviewee.

It is not ideal to only interview someone remotely in an investigation. Body language will be more difficult to read when assessing the credibility of an interviewee and speaking in person helps to build rapport.

Striking a balance

When you first start planning your investigation put together your interview schedule and use it as your guide for which parties would suit a remote interview, and which would benefit from face-to-face. It is typical to divide your interviewees into three groups: 

  • Group One – the key players
    Your main suspect, and the key source of the allegation, which would typically be your whistle-blower.
  • Group Two – inner circle 
    Any other person that has not directly communicated about the allegation but might have some important information to share.
  • Group Three – context
    Any employees that provide background and context information without being directly involved in the incident being investigated.


Out of these three groups, the one that’s most suited to remote interviews will be group three. Whereas for the other two groups, and particularly when interviewing the main suspect, or your whistle-blower (group one), you should consider conducting those on-site, if possible.

Remote investigations: Pointers for success

If you do decide to investigate remotely, there are some key measures you should put in place from day one. 

  1. Have a clear understanding of where or with whom the data sets you need are located. When your investigation takes place on-site, this can evolve as you are introduced to key stakeholders. When you work remotely you want to avoid endless email chains with people spread across the globe. Map out your key points of contact early on and establish clear lines of communications and escalation.
  2. Establish clear rules on data integrity. An advantage of working on-site is you can consistently verify any data collection you make. When adapting to a remote environment, make sure all data is safeguarded following the same principles that would be applied on-site, including, but not limited to creating forensically sound images, verifying image integrity, and creating backups of the images.
  3. Have a clear escalation procedure. When after a second or third follow up email you're still not getting a reply, knowing that you can escalate to a line manager or someone from the legal or compliance team can be key. This must be applied consistently to avoid any significant delays.
  4. Make sure there is pre-communication to interviewees. Anyone being invited to an interview or requested to provide documentation should be informed in advance about the investigation. A five-minute prologue should be available to explain exactly the purpose of the conversation and any obligation requirements on behalf of the employee to answer the questions truthfully and respect confidentiality. 
  5. Manage expectations. Have a clear plan B in place in case you discover any challenges that require a change in pace or approach. Before you start work, check if it's possible at all to travel to the country where the investigation is taking place. If it’s not, find out if you have someone trustworthy in the country that can potentially support with the inquiries.