Conducting Whistleblower Investigations – Part 1: Preparation

Scott Moritz, Managing Director Protiviti Forensic
James Gibson, Director Protiviti Forensic

In conjunction with International Fraud Awareness Week, we will be running a series of blog posts by our Investigations & Fraud Risk Management practice leaders. For more on the topic, and to listen to our recorded webinars, visit




Legendary football coach Vince Lombardi once said: “When you go into the end zone, act like you’ve been there before.”

Wait, you might say, what does football have to do with internal investigations? The answer is, they both rely on skill and preparation. In football, part of game preparation is viewing game film, understanding what type of plays your opposition runs, and then structuring your game plan in such a way as to effectively counter whatever the opposing team may do on game day. And even though your efforts may not always be as effective as you would have liked – your opponent may run plays that you didn’t see on any game film – preparation, in football, is indispensable. It is just as vital with investigations.

Preparation, of course, is best done in advance, and not in the heat of battle. It’s a good idea to have in an investigative plan and investigative protocols in place before they are needed. These plans and protocols should be sufficiently broad to cover the full spectrum of situations that could give rise to the need for an internal investigation. Some of the more common occurrences that trigger the need for an internal investigation include:

  • Law enforcement or regulatory actions
  • Hotline tips or an anonymous letter
  • An employee, customer or supplier complaint
  • Missing assets or other anomalies discovered through an internal audit
  • A network intrusion evidencing data loss
  • Exfiltration of proprietary data
  • Civil litigation or threatened litigation
  • Adverse media reporting or adverse social media

Below, we focus on some broad ways in which a company should be prepared, so that when the need for an investigation arises, it can act like “it has been there before.”

Assess the Company’s Investigative Capabilities and Fill the Gaps

Even before the need for an investigation arises, in establishing their investigative protocols, companies should evaluate their ability to conduct an internal investigation, identify the individuals within the company that should take part or assist in the process, and determine whether there are any skillsets that may be necessary but don’t exist within the company. The typical investigation requires some or all of the following skills: forensic accounting, employment law, human resources expertise, computer forensics, network security, electronic discovery, background investigations, interviewing and interrogation. If any of these skills don’t exist within the company (and, with most organizations, there’s a good chance that will be the case), determine whether it’s feasible to enter into contracts with service providers in advance of needing them so that you are not pressed to negotiate a contract last minute, placing additional time pressure on an already time-sensitive situation.

Determine Whether the Work Should Be Performed Under the Attorney-Client Privilege

One of the very first steps in the planning process is determining whether an investigation should be performed pursuant to the attorney-client privilege. Again, an investigative protocol that sets certain guidelines for all investigations can be very helpful in making these determinations. Seek the advice of your company’s general counsel (who may in turn seek the advice of an outside law firm) to determine the right approach. The attorney-client privilege protects communications between an attorney and his or her client. It also enables service providers working at the direction of counsel to perform work and generate work product that is also privileged under the attorney work product doctrine. If the decision is made to perform the work under privilege, an attorney – either an in-house or an outside counsel – oversees and directs the investigation, and the information collected as part of the investigation is protected by that privilege. As part of directing the investigation, the attorney defines the investigative team, including any subject-matter experts on subjects such as computer forensics, forensic accounting, interviewing and interrogation etc.

Agree Upon the Scope of the Investigation

Typically, very little is known at the beginning of an investigation, and team members should always go into it with the understanding that the scope may need to change as new information comes to light. Nevertheless, team members should review the allegations and develop an initial scope of work that is likely to provide the information needed to determine if the allegations have merit. Cost is an important consideration when setting the scope – sometimes, a triage or limited investigation can yield information that either corroborates or refutes the allegation early on, before a full-blown investigation is launched. This triage phase can save unnecessary costs in the case of baseless allegations, or provide the investigative team with enough information to make a business case for a full investigation. Not all investigations lend themselves to a triage phase, however; sometimes, the initial information provides a sufficient basis to progress to a full investigation immediately.

In tomorrow’s post, we will delve into the details of a triage with specific examples, and the actions that may follow if the allegations are found to have merit.