SECURITY INVESTIGATION

SECURITY INVESTIGATION
Disgruntled employees raise issues every
day, and every day employers respond
by conducting some type of internal
investigation. To warrant an immediate
and thorough security investigation,
employee complaints should be in writing
or "formally" made. The key ingredient in
any investigation is the formal complaint.
 SECURITY INVESTIGATION
Security investigation is a planned
and organized determination of facts
concerning specific loss or damage of
assets due to threats, hazards or
unsecured conditions.
SECURITY COMPLAINT
 SECURITY COMPLAINT
Be mindful that a complaint is not
always the event that triggers a
company's duty to investigate. The
duty arises when an employer
observes acts or statements that
suggest prohibited activity. Prudent
employers often investigate even
without a clear legal mandate.
 SECURITY COMPLAINT
An employee complaint can be
about virtually any aspect of the
employment relationship, but the
most frequently raised concerns
deal with harassment,
discrimination, ethical violations
and retaliation.
 SECURITY COMPLAINT
Whatever the complaint, recent
legal decisions have made certain
that employers have an
unequivocal duty to investigate
promptly and thoroughly as soon
as the employee is put on notice
of possible wrongdoing.
 SECURITY COMPLAINT

When a complaint is received, the

security department should set goals
for the investigation. The goals of a
particular security investigation must
be accomplished with integrity,
fairness, impartiality and respect.
Goals should include:
 SECURITY COMPLAINT
• gathering the facts, • preserving the
• determining the reputations of
merits of the individuals and the
complaint, management,
• complying with • taking proper
legal obligations, remedial action,
• maintaining • avoiding liability,
confidentiality to and
the greatest extent • preventing future
possible, claims.
WHO SHOULD INVESTIGATE?
 WHO SHOULD INVESTIGATE?

Once it is clear that an investigation is

warranted, give careful thought to who
should conduct the investigation. The
same individual is not going to be right for
every security investigation. In fact,
multiple investigators could be useful in
highly complex cases, or where timing is a
critical factor.
 WHO SHOULD INVESTIGATE?

Give consideration to the

• positions and authority of the
complainant and accused;
• any perception of bias a proposed
investigator might evoke among
witnesses; and
• potential impacts on business
operations.
 WHO SHOULD INVESTIGATE?

Generally, a good investigator must

• actively listen,
• be able to process and rapidly respond
to new information,
• possess critical thinking skills, and
• have a solid knowledge of company
policies and practices.
 WHO SHOULD INVESTIGATE?

Other technical qualifications will

depend on the type or complaint at
issue. For example, an accounting
background might be necessary for
charges of financial
mismanagement
 WHO SHOULD INVESTIGATE?

After an investigator is assigned and

goals set, the first order of business
is to conduct a thorough document
review. The management must
preserve all available information or
data;
 WHO SHOULD INVESTIGATE?

everyone participating in the

investigation should be instructed
not to delete any electronic
communications and the IT
department should preserve all
archived and taped materials.
 WHO SHOULD INVESTIGATE?

Relevant physical evidence usually

includes the complaint, witness
statements, personnel files, written
policies and computer records. This will
assist in developing relevant background
information and placing the complaint in
the proper context as related to the
business.
 WHO SHOULD INVESTIGATE?

Reviewing personnel history of the

potential interviewees will help clarify
relationships and potential biases. These
documents provide a foundation to build
an investigation, but the investigator
should continually seek additional
documents throughout the course of the
investigation.
 WHO SHOULD INVESTIGATE?

At this stage, the investigator is

prepared to identify key witnesses.
The investigator should generally
interview the complainant first,
accused next, key witnesses and then
other possibly related witnesses.
 WHO SHOULD INVESTIGATE?

Once the order has been established,

the investigator should prepare a
chronology of events and an outline
for each witness. Outline topics may
include:
 OUTLINE TOPICS

1/8
Review of applicable company
policies, including how they are
communicated to employees,
whether followed, etc.;
 OUTLINE TOPICS

2/8
Summary of the complaint, including
how the management/employee
received notice, as well as a
chronology of important events;
 OUTLINE TOPICS

3/8
The names and identities of all
relevant witnesses with notes on
relevant background and relationships
to complainant and accused;
 OUTLINE TOPICS

4/8
Relevant employment information of
the complainant, the accused and the
key witnesses;
 OUTLINE TOPICS

5/8
Specific information for each
identified incident
(who,what,when,where,why);
 OUTLINE TOPICS

6/8
Identity of other possible witnesses,
new leads and new documents;
 OUTLINE TOPICS

7/8
A conflict check procedure to resolve
conflicting witness accounts without
identifying the witness; and
 OUTLINE TOPICS

8/8
Potentially related claims and relevant
information.
To summarize, an investigator should always consider the
following before investigating an employee complaint:
>Identify the goals of the investigation;
>Identify legal and factual issues to be resolved before
reaching a decision;
>Identify the time frame to conduct the investigation;
>Identify and review all relevant physical evidence and
communicate a clear directive to preserve all electronic data;
>Identify potential witnesses and the order in which they
should be interviewed
>Identify general interview topics.
 ELEMENTS OF INVESTIGATION

>Investigator
>Purpose
>Subject of the Investigation
TOOLS OF THE INVESTIGATION (3 I's)

INFORMATION

INTERROGATION

INSTRUMENTATION
 TOOLS OF THE INVESTIGATION (3 I's)
• INFORMATION
• Knowledge which the investigator gathers
from other persons.
*Acquired from regular sources.
*Acquired from cultivated sources
 TOOLS OF THE INVESTIGATION (3 I's)
• INTERROGATION
• Skillful questioning of witnesses as well as
suspects.
 TOOLS OF THE INVESTIGATION (3 I's)
• INSTRUMENTATION
• The application of instruments and
methods of physical sciences to the
detection of crimes.
 GUESS THE ORDER

THREE-FOLD AIM OF INVESTIGATION

>To locate the offender

>To provide evidence
>To identify the offender
 THREE-FOLD AIM OF INVESTIGATION

>To identify the offender

>To locate the offender
>To provide evidence
GETTING STARTED
 The way an investigation is conducted
will depend very much on the issue that
has come to the attention of the
management. If information has been
received that indicates that some of the
essential qualifications have not been
assessed, the investigation might consist
of a quick telephone call to the manager or
a file review to confirm what was assessed.
 Confirmation that assessment of
certain essential qualifications was not
carried out could lead to a brief report
to the management, confirming these
facts. If requested to do so by the
management the investigator might
recommend as corrective action, that
the essential qualifications be assessed.
 In this case, the investigation will be
quite informal. In deciding on the
corrective action, the management will
need to inform those affected of the
proposed corrective action and how it
will be carried out. A more structured
approach may be needed depending on
the complexity of the situation.
 Two matters need to be kept in mind
during the investigation. The first is that
the investigation must be conducted in
the official language preferences of the
persons consulted. Attention should
also be paid to any requirements for
accommodation by anyone who
requests it.
CHOOSE AN INVESTIGATOR
Persons chosen to investigate the
incident or complaint may come from
within or from outside the organization.
The choice of investigator may vary
depending on the nature of the
investigation. For example, if the issue
is straightforward, the management
might assign a human resources advisor
(one not involved in the process).
If, on the other hand, the
investigation concerns complex
or sensitive claims, the
management might wish to hire
an outside investigator with no
previous connection with the
organization.
In either case, the role of the
investigator is to find facts and
to allow the management to
make an informed decision.
The following is a list of some
attributes which may help the
management to consider in
deciding who will conduct the
investigation:
°thoroughness
°tact
°discretion
°judgment
°respect for others
°ability to handle sensitive
°experience in conducting
investigations
°knowledge of the principles of
procedural fairness
°knowledge of investigation
techniques
°ability to identify key issues and
°ability to analyze facts
°effective oral communication
°ability to write clearly and
concisely
°official language proficiency
The investigator chosen must be
able to carry out the investigation
in a fair and objective manner.
This means that the investigator
must have no personal interest in
the matter and must be able to
find facts without taking sides in
the dispute.
For example, it is recommended
that the investigator chosen not
be someone involved in the
specific appointment process in
question, nor have any family,
personal or social ties with any of
the persons involved.
The investigator should not have
offered any public opinions about
the case, nor have exhibited any
favoritism or hostility towards any
of the persons involved.
 Establish the investigator's
mandate or terms of reference
The management should set
out a mandate for the
investigator to ensure that
both of them have the same
understanding of the purpose
of the investigation.
For example, if the management has
reason to believe that not all the
essential qualifications were
assessed in the appointment
process, the mandate given to the
investigator might be to "examine
whether all essential qualifications
were assessed".
1. What is the purpose of establishing a
mandate for an investigator?
A) To ensure the investigator has a
clear understanding of the
investigation's purpose
B) To give the investigator complete
freedom to investigate any aspect of
the process
2. If management suspects qualifications
were not fully assessed, what could the
investigator's mandate be?
A) To examine whether all essential
qualifications were assessed
B) To investigate any potential
misconduct in the appointment process
1. Answer: A) To ensure the investigator
has a clear understanding of the
investigation's purpose

2. Answer: A) To examine whether all

essential qualifications were assessed
Establish the terms of reference
of the investigation
Some considerations for the terms of
reference are:
• Documents to be examined
• Method of investigation
• Authorization
• Review of information provided
• Requirement for a report
• Review of report
• Requirement for a file
• Timelines for the investigation
Some considerations for the terms of
reference are:
• Documents to be examined:
for example, the CSC (Civil
Service Commission) relevant
CSC policies, organizational
policies, qualification
standards.
Some considerations for the terms of
reference are:
• Method of investigation: the
management might wish to
specify that the investigation is
to be carried out through
interviews, in writing or by
some other method.
Some considerations for the terms of
reference are:
• Authorization: the management
might require that the investigator
ask for authorization to conduct
interviews or meetings, to gather
documents, or to use
organizational premises.
Some considerations for the terms of
reference are:
• Review of information provided: it
could be specified that each
person who has provided
information is to be afforded an
opportunity to review the reporting
of that information and comment
on its accuracy.
Some considerations for the terms of
reference are:
• Requirement for a report: the
management may wish to receive
a report of the findings.
Some considerations for the terms of
reference are:
• Review of report: the management
may wish to review a copy of the
report before it is finalized.
Some considerations for the terms of
reference are:
• Requirement for a file: depending on
the complexity of the case, the
management may wish to have any
notes taken and other relevant
documents kept on a file, to be
forwarded to the deputy head upon
completion of the investigation.
3. What documents might the
investigator need to examine in the
investigation?
A) Only the investigation report
B) Relevant CSC policies,
organizational policies, qualification
standards
4. How might the management specify
the method of conducting the
investigation?
A) By requiring a written report only
B) By specifying that the
investigation be carried out through
interviews, in writing, or another
method
5. What might the management require
regarding the report of the
investigation?
A) The report must be sent directly to
the public
B) The management may wish to
review the report before it is finalized
3. Answer: B) Relevant CSC policies,
organizational policies, qualification
standards
4. Answer: B) By specifying that the
investigation be carried out through
interviews, in writing, or another
method
5. Answer: B) The management may
wish to review the report before it is
Open an Investigation File
In many cases it is good practice to
keep a file with all documents and
records of conversations relevant to
the investigation. This information
will be useful in preparing an
investigation report (if required).
There may be some very straightforward
cases where the investigator can review
the appointment process file or talk to the
manager and immediately complete the
investigation, but in many cases, the facts
will not be so easy to determine and will
involve several interviews or meetings. For
this reason, it is advisable to have an
investigation file.
This file is a management record and will
be subject to both the Company policy
and procedures. A person about whom the
investigator gathers information has the
right to have access to the information
about him or her. This file will also be
subject to any organizational
requirements for retention.
6. Why is it advisable to keep an
investigation file?

A) It helps in preparing the

investigation report if required
B) It serves as a personal record for the
investigator
7. What is a requirement regarding the
investigation file in relation to the
individual being investigated?

A) The individual has no rights to

access the information
B) The individual has the right to access
the information about him or her
6. Answer: A) It helps in preparing the
investigation report if required
7. Answer: B) The individual has the right
to access the information about him or
her
2
Review available information
Prior to commencing the investigation, the
investigator should review any information
available. This may be contained in a letter
from an interested party, who has requested
that the management conduct an
investigation, an audit report, information
from senior management, or information
gathered by the person who has decided that
an investigation will be conducted.
It is imperative that the investigator understand the
issue or issues in question in order that he or she
knows what to investigate. If the issues are unclear,
the investigator may have to go back to the source
(e.g., the person who carried out the audit, the
person who requested the investigation) for further
clarification. There may be additional information
already available, such as the assessment
documents, statement of merit criteria or
advertisement of the appointment process.
8. What should the investigator do
before starting the investigation?

A) Begin interviews immediately

without reviewing documents
B) Review any available information
such as letters, audit reports, or
statements of merit
9. If the issues in question are unclear,
what should the investigator do?

A) Proceed with the investigation

without clarification
B) Go back to the source of the
information for further clarification
8. Answer: B) Review any available
information such as letters, audit
reports, or statements of merit
9. Answer: B) Go back to the source of
the information for further clarification
Prepare investigation plan
The following features are part of a
good investigation plan:
1· Identification of the issue(s):
o What is the error, omission or
improper conduct contended?
o What are the points disputed?
2· Application of the Act, regulations,
policy,organizational policy:
o What sections of the Act and
company regulations are relevant to
the issue?
o What policies apply?
3· Determination of what information
is needed:
o What documents or records need
to be examined?
o Which persons need to be
interviewed?
o Are there other relevant
documents, directives?
4· Developing the questions needed to
obtain the information:
o What questions must be answered
in order to find the facts?
5· Determining the order in which the
information should be obtained:
o Should certain documents be
examined before persons are
questioned?
6· Determine the method of
investigation:
o What method would be best to
obtain the information, given the
circumstances of the case?
10. What should be identified first
when preparing an investigation plan?

A) The methods of investigation

B) The issue(s) to be investigated,
such as the error or improper conduct
11. What is the purpose of determining
what information is needed in the
investigation plan?
A) To decide which individuals
should be punished
B) To identify the documents,
records, and people that need to be
involved in gathering the facts
12. What should the investigator
decide when determining the method
of investigation?
A) The best method to obtain the
information based on the case’s
circumstances
B) The method that is most
convenient for the investigator
10. Answer: B) The issue(s) to be
investigated, such as the error or
improper conduct
11. Answer: B) To identify the documents,
records, and people that need to be
involved in gathering the facts
12. Answer: A) The best method to obtain
the information based on the case’s
circumstances
Methods of investigation
Methods of investigation

• Interviews
• Meeting
• Written Submissions
Interviews
An interview is a method of
investigation where the
investigator conducts an
individual meeting with each
person who can provide
information relevant to the
issues.
Persons to be interviewed might
include members of the assessment
board, the manager, affected persons,
human resources manager, the person
who brought the matter to the
attention of the management or the
complainant and other persons who
have direct knowledge concerning the
issues.
If the case is complex, a written
statement of issues might be sent to
all those persons to be
interviewed,setting out the context
and the questions to be answered
through the investigation. The
interviews are usually conducted at
the workplace or in a mutually
acceptable location.
Meeting
A meeting is a method of
investigation in which those persons
affected by the matter meet in order to
present information and positions on the
issues under investigation. The meeting
could be in person, by teleconference or
video conference, or a combination.
It provides the persons with the
opportunity to be heard and allows them
to explain their actions concerning the
matter. Persons who might be invited to
attend the meeting are the assessment
board members, the manager, persons
affected, the human resources advisor,
and other persons who have direct
knowledge concerning the issues.
Written submissions
The investigation may be
conducted through written
submissions. This may be a useful
method if those involved are in
different geographic locations, where
there is only one issue to be
determined, or where the persons
involved agree on most of the facts.
The investigator would write to those persons
involved outlining the nature of the
investigation and the issues to be resolved.
The investigator would invite comments from
affected persons, or might pose specific
questions to them. One drawback of this
method is that the information presented in
writing may not be clear. In that event, the
investigator may find it necessary to conduct a
follow-up to clarify matters.
The investigation report
In most cases, the investigator will likely
be required to provide a report to the
management. The investigation report is a
written report on the issue(s) raised, the
investigator's findings, analysis and
conclusions. The report should be clearly
written with a logical description of the
information obtained, and with well
reasoned conclusions.
Other important aspects of a good report are:
· It achieves its purpose by answering the
questions that were set out in the mandate for
te investigator;
· It is designed to meet the needs of the
decision-maker;
· It is rigorous - the decision-maker must be
able to rely on the facts presented in the report
and those facts must be based on the evidence
in the file;
 °The report is clear and written in neutral language
that the decision-maker and other readers will
understand;
°The report is concise and conveys all necessary
information, but no more than is necessary; the
investigator deals only with issues set out in his or
her mandate;
· The report is structured in such a way so that
information can be located easily. For example,
creating mandate, background, issues, findings,
analysis and conclusions sections.
The following are some suggested best
practices for investigators:
°Before submitting the report, set it aside
for a day or two and then read it afresh
this may give you a clearer view of where
changes need to be made;
°Ask yourself if someone unfamiliar with
the situation could readily understand the
report;
°When re-reading the report, ensure
that it is coherent, not repetitive and
presents the information in the right
place;
°Ensure that the report corresponds to
the mandate given.
If the final result is likely to be a
revocation,the investigator will need to
comply with the rules of procedural
fairness. The investigator will ensure
that relevant information gathered
during the investigation is disclosed to
the appointee and the department's
representative.
The investigator may do this by preparing a
preliminary case report, which consists of the
issues, facts and information gathered during
the investigation, and inviting written
comment. Any changes to the information as a
result of the comments will be shared with
those involved. The investigator will then
analyze the information and comments
received and reach conclusions. The
investigator then issues the investigation
report.
Conclusion
In summary, investigations must be
conducted within the framework of
the legislation and applicable
policies, and with consideration
given to the procedural fairness
requirements determined by the
specific circumstances of the case.
Important practices include choosing a
competent investigator, establishing a
clear mandate for the investigator,
keeping an accurate file, preparing an
investigation plan and completing a
clear, well-reasoned investigation report
which will allow the management to
make a fair and informed decision.
Prepare an Investigation Plan
Prepare the Investigation Plan
(referred to hereinafter as the Plan)
once you complete your preliminary
analysis. The Plan is the written
outline of how you intend to carry
out the investigation. Use the Plan as
a checklist to ensure you cover all
necessary points.
Although you will draft your Plan at
the start of your investigation, you
must update it continually to
·Document completed steps
·Reflect changes as the investigation
progresses
The Plan does not need to be
elaborate or formal. At a minimum,
include a written statement of the
allegations and a list of witnesses you
plan to interview. A written Plan is
important in the event you suddenly
become ill or you are otherwise unable
to complete the investigation.
You may include all of the elements
listed below in your Plan or combine
some of the elements.
Before initiating the interviews,
discuss the Plan with your tasking
authority to ensure you have
addressed all of the issues.
Prepare an Investigation Plan:
Elements of an Investigation Plan
> Interview Sequence Plan
>Interview List (Witness List)
>Contact List
>Notification List
>Document List
…
Prepare an Investigation Plan:
Elements of an Investigation Plan
…
>Allegations List
>Chronology of Events
>Logistical Plan
>Background Information
>Outline of Proof
Interview Sequence Plan
The Interview Sequence Plan
(referred to here as an Interview Plan
when combined with other lists) lists
the witnesses you plan to interview,
the order of the interviews, the
allegations you intend to discuss,
and the questions you intend to ask.
The Interview Plan should include:
>Comments about the witnesses,
e.g., friendly, neutral, adverse.
>Tentative questions for each
witness, generally, start with open-
ended, general questions leading to
more specific.
 A list of documents you intend to
obtain from each witness and a copy.
As a general rule, interview the
complainant first and the subject
last. You should delay notifying the
subject that you are conducting an
investigation until you arrange an
interview.
You will eliminate the possibility that
the subject may try to intimidate or,
in some cases, reprise against the
complainant and other witnesses. In
some instances, the subject may be
interviewed first.
The Privacy requires you to “collect
information to the greatest extent
practicable directly from the subject
when the information may result in
adverse determinations about an
individual's rights, benefits, and
privileges under the law."
When possible, obtain documents or
physical evidence before
interviewing the subject if you
believe the information will provide
all the evidence necessary to prove
or disprove an allegation.
The subject(s) may also give you
documents to prove his/her
innocence or admit to the alleged
misconduct prior to an interview,
allowing you to conclude the
investigation without interviewing
others.
Interview List

The Interview List identifies the

persons you will interview. You may
also include information from the
Notification and Contact List if it is
easier to maintain all of this
information in one document.
Contact List
The Contact List facilitates the preparation
of the Interview List. You can use the list
to keep track of the persons you notified
about the investigation. Your list may
include:
The witness name, title, rank or grade,
address, phone number and other
pertinent information, to include his/her
role in the investigation.
Notification List

The Notification List identifies

everyone you should inform that you
are conducting an investigation and
the dates you notified them. The
Notification List is often a part of the
Contact List.