How to Conduct an Effective Investigation

Advice for professionals who need to establish what happened in a situation requiring review.

By John Thompson
Wed, June 06, 2007

CSOEditor's note: At many companies, small security staffs mean other departments—commonly human resources or legal—necessarily help conduct investigations. John Thompson’s Corporate Investigations for Nonsecurity Professionals, published by the CSO Executive Council (which is affiliated with CSO), aims to ensure that information is collected in a reliable and legally responsible manner. The following is an abridged excerpt on the planning phase of an investigation.

The objective of an investigation is to get the facts so that a resolution of the complaint and situation can be achieved. At the same time, it is possible that some day a jury or attorneys outside the organization might scrutinize every aspect of any investigation conducted. For example, the organization might have to turn over to outside attorneys every note the investigator has written about the investigation, and the investigator might have to recount every conversation he or she had involving the investigation. Moreover, someone’s job or well-being might depend upon the quality of the investigation. Thus, an investigation is not something that should be done haphazardly or without a clear plan in mind. Many investigators have declared their embarrassment to me when I have reviewed their investigation file two years after the investigation in preparation for a deposition or trial testimony. The investigator’s memory naturally is poor about the investigation because it is years later and numerous investigations have come and gone in the interim.

Worse, the investigator’s notes often are cryptic, undated and virtually useless. What seemed like a perfectly reasonable investigation plan at the time is impossible to decipher later. Because every part of an investigation might later be subject to scrutiny, every part of the investigation should be documented, including the up-front planning process. The following considerations should help the investigator plan an investigation. This, in turn, should lead to more accurate and complete information obtained and greater legal protection for the organization.

Minimize witness intimidation.
As the investigator begins thinking about how to conduct the investigation, he or she must confront the possibility that certain witnesses to the investigation might feel intimidated by the alleged wrongdoer, even by the simple fact that the alleged wrongdoer is in the workplace. Even worse, the alleged wrongdoer (and even the complainant) might intimidate, harass, or retaliate against witnesses in an attempt to influence the outcome of the investigation. It might be necessary to remove the alleged wrongdoer, the complainant or both individuals in order to maximize the information obtainable from other witnesses. On the other hand, removing an employee from the workplace during an investigation is a serious human resources matter. If the investigator believes that removing an employee from the workplace is necessary to remove possible intimidation, he or she should consider consulting with the need-to-know group to obtain a consensus on such an action.

Continue Reading

Custom malware frequently goes undetected. According to Forrester Research, the best way to reduce risk of breach is to deploy file integrity monitoring (FIM) tools that provide immediate alerts. This white paper has been brought to you by NetIQ, the leader in solving complex IT challenges.
This white paper describes the business challenges and opportunities that are driving interest in Identity Governance while discussing considerations your organization should make to help achieve project success.
This paper explores the concept of content-aware IAM, describes the integrated architecture for this new approach, and highlights the benefits that this approach provides.
One of the key strategies that IT teams are pursuing to reduce capital costs while boosting asset utilization and employee productivity is the transition to highly virtualized data centers. However, IDC finds that expectations for further boosts in IT asset use and operational efficiency often surpass the actual results for a variety of reasons. These problems can quickly overwhelm any hoped-for benefits as the scope of virtual server deployment expands.
For your IT organization to keep pace with the business, you need a new, faster approach to infrastructure deployment-an approach that increases agility and accelerates time to application value. That's HP Converged Systems. Built on Converged Infrastructure, these systems deliver the industry's first portfolio of pre-integrated, tested, and optimized infrastructure solutions for applications running in virtual, cloud, dedicated, or hybrid environments.
The nature of the blade platform makes system management, monitoring and provisioning easy and efficient. Access this resource to learn how blade migration will save your data center time and money while increasing performance.
Download this webcast to learn about the design considerations for virtualizing SQL workloads, performance and scalability information and high-availability options, as well as support considerations
Many enterprises have discovered that the use of virtualization to support desktop workloads creates a range of significant benefits. These benefits include price efficiencies, improved IT management and greater agility and choice for end users.

This VMware sponsored webcast with IDC will provide both quantitative measurement of the business value -- defined as the expected ROI -- and qualitative analysis associated with the use of VMware View™. IDC will also provide an analysis of the View Composer and ThinApp™ features of VMware View, including the business value of these solutions and an overview of how they work.

Attend this webcast to learn about:
- Challenges and barriers that might impede the adoption of desktop virtualization
- Navigating roadblocks to facilitate a strategic implementation
- Optimizing qualitative and quantitative benefits to IT and your business
Applications are changing - they're increasingly web-oriented, global in nature and run from multiple device types. Additionally, the volume of data is growing exponentially every year. How do you ensure your applications have fast, accurate, up-to-date information in this new world? Modern applications are data-intensive; delivering data the old way using monolithic databases isn't working. What's needed is a modern approach to data. One that scales-out as needed and delivers predictable high performance, but without sacrificing data consistency or integrity.
VMware View™ 5 simplifies IT management while increasing end user freedom by delivering desktop services from your cloud. Building upon VMware's leadership in desktop virtualization, VMware View 5 delivers a high-performance user experience while giving IT greater policy control.

View this webcast and find out how VMware View 5 can help you:
- Deliver the highest fidelity experience of desktop services across any device and any network
- Simplify and automate IT management, security and control of desktop services
- Reduce the costs associated with your desktop environment
IT professionals are being asked to deliver faster "time-to-value" than ever before. An IDG Research survey found that CIOs are eager to invest in technologies that will enable them to get new applications and services up quickly, achieving faster time-to-value.
Learn how to reduce IT management overhead, ease revision control, guarantee data security, scale systems more quickly and reduce server and software costs.
Newsletter Sign-Up »

Receive the latest news test, reviews and trends on your favorite technology topics

Choose a newsletter
  1. View all Newsletters | Privacy Policy
Resource Center