Guidance on Conducting Investigations Remotely

The COVID-19 pandemic has presented innumerable challenges to all facets of life. This is particularly felt where face-to-face interaction is the expected norm. Consequently, those involved in conducting investigations into corporate or individual misconduct are facing challenges at every step of the process. 

Despite these challenges, internal investigations continue and many regulators and prosecutors are pressing ahead as usual. Everyone is adapting to the "new normal". Here we provide practical tips and tricks on how to conduct internal investigations remotely, drawing on our own experiences in recent months.

Whether to investigate

Proceed or postpone?

At the outset, and assuming you have discretion, it is important to weigh up the benefits and risks of proceeding with an investigation at the current time. This will depend on the issues to be investigated, the urgency and whether the investigation is ongoing or new. Some relevant issues to consider are as follows:

Is the investigation really necessary? It may be part of an ongoing programme which can be postponed to the next quarter or half year. Consider whether the investigation can be deprioritised. 

Regulators have also recognised the need to reprioritise where appropriate. In the UK, for example, the Financial Conduct Authority (FCA) has recognised that operational challenges may arise in relation to financial crime systems and controls in the current situation, and has acknowledged that firms may need to reprioritise or reasonably delay some activities. Examples given include ongoing customer due diligence reviews, or reviews of transaction monitoring alerts.¹

Will postponement increase any risks or compromise the investigation? There will be situations where an investigation should not be postponed: for example, the investigation may relate to a matter of critical importance to the business, or its findings may impact on commercial decision-making; there may have been a public announcement about an investigation or inquiry which must be honoured. Consider also the impact on the preservation and quality of the evidence to be gathered - recollections deteriorate over time, or there may be an issue with the availability of a witness, who may be about to leave the company. A tip here: as businesses make fast-moving decisions on staffing levels, you should undertake more regular checks with HR on the status of witnesses or subjects of your investigation.

Is remote access to materials and individuals possible? Where materials which are essential to the investigation are not accessible, this may be the deciding factor in postponement. Our recent experiences have included issues with access to hard copy filing in archived storage, and tapes of recorded telephone lines. 

Other factors that pose a challenge to remote investigation will also need to be considered, such as access to individuals, difficulties in accessing systems and materials, as well as limited or pressured resources.

In some circumstances the decision whether to investigate will be driven or influenced by a third party, for example an enforcement authority. Some of the factors mentioned above may be used as a basis to seek to persuade that third party to postpone. Gauge the third party's appetite for proceeding, discuss what their priorities are, what should be the focus of efforts (yours and theirs) in the short term, and what can be achieved in a realistic timeframe. Our experience is that, globally, regulators and prosecutors are themselves postponing or closing investigations. You may find they are receptive to your work taking a pause, or proceeding at a different pace

How to investigate

This section considers the scoping and planning of an investigation, guidance on conducting interviews, and our thoughts on technology.

Scoping and planning

It is vital to target the scope of an investigation carefully and accurately to minimise the impact COVID-19 will have on planning and time management. Inevitable delays caused by the current situation will be worsened by a scope which is unnecessarily broad, poorly articulated, or which creeps. Addressing three key points will help to define and confine the scope.

What is the trigger?

If you are investigating in response to action by an enforcement authority, tailor the scope to their request or requirements. It need not be a deep-dive if the regulator has made a set of discrete enquiries. If they have asked you to drill down into a particular event or transaction, consider negotiating the scope with them. Regulators are also struggling to manoeuvre through these difficult times and they may be more accommodating as a result.

It is important to articulate, in your investigation scoping document or terms of reference, the areas you are excluding (with your reasons), as well as those you are including.

What are you trying to achieve from the investigation? 

Define the aims of your investigation as tightly as you can. Consider whether it is really necessary to identify fully the nature and extent of every aspect of the wrongdoing; or whether it is more effective to limit the scope to answering a specific question, which will enable you to reach findings more quickly and efficiently.

Be specific

Take time with key stakeholders to frame the questions the investigation will seek to answer. Good planning is key and will pay dividends once you begin the investigation. Where you can, build in limitations on the time period, business area, and list of individuals under investigation in order to avoid mission creep.

Time frames

If the decision to proceed remotely is made, be realistic about the timeframe for the investigation. Our experience is that remote investigations are taking longer to conduct, and that timeframes need to kept under constant review. The impact of having to schedule calls rather than being able to walk around to someone's desk or office begins to add up. Careful planning will be required to ensure the smooth operation of an investigation within your target timeframe. Considerations we have faced include:

• choosing and gaining familiarity with the chosen technology, both for data extraction and review, and for communication internally and externally (more on this below);
• the importance of facilitating team discussions particularly where the investigation is document heavy, or relies on the analysis of complex data;
• choregraphing group calls to enable investigators to contribute, debate and test emerging theories or findings; and
• regular revisiting of strategy to counteract drift in timelines.

Conducting interviews with witnesses or subjects

This critical element of most internal investigations can still be carried out effectively using a combination of planning and technology.

Set expectations

Explain clearly in advance how the remote interview is to be conducted. Consider sharing a running order (with timings), which includes time for tech-testing at the outset, and scheduled breaks (see more below). This will give an interviewee comfort about expectations and help to reduce concern and anxiety.

Consider carefully how many sessions and of what duration you will need. Our experience is that interviews are taking much longer than they would in person, and are capable of covering a narrower range of topics. Multiple interviews may be preferable to longer ones. Remote interviews are more draining for all involved than in-person sessions. 

Prepare in advance

It is invaluable for all participants to practice using the chosen technology (see more below), for example in a 'dry run', in advance of the interview. This will ensure familiarity and reduce unexpected problems on the day. Other advance preparation includes:

• Confirmation from everyone that they have a working microphone, camera and internet connection.
• Sending detailed instructions to all attendees and providing them with the phone number of a senior individual who will be on the call, in case of technical issues on the day.
• Planning intervals: it is important to take breaks when interviewing remotely. This can be facilitated by all participants turning off video and muting microphones but remaining on the call.

Carefully consider scope and questioning 

Go back to first principles on how to achieve best evidence: simplify questions and avoid compound questions; ensure that questions are focused and references to documents are clear; allow time for an interviewee to find the (part of the) document you want them to look at; allow time for them to consider their answer (and be comfortable with silence on the call while they do that). Appreciate that being interviewed can be stressful, and that a remote interview could exacerbate that.

Etiquette

General conference call etiquette applies to remote interviews. All participants should:

• mute their microphones when they are not speaking;
• appear on video at the beginning of the interview to be introduced and confirm who is present; only those speaking should continue to appear on video (the interviewer and interviewee). This has the additional bandwidth-benefit of minimising connectivity problems, which distort audio and visual quality. If someone else wishes to speak or ask a question, they can switch on their video without speaking, and the leader will become aware of their intention to speak, without any disruption;
• accept that interruptions do happen (including background noise, or interruption by family members), and not draw unnecessary attention to them or let them disrupt the tone or flow of the interview; and
• dress appropriately, and have a neutral/inoffensive background when they appear on video.

Technology

From our experience of testing and debating a range of technology solutions globally, here are our suggestions of the key areas investigators should consider.

What platform should you use?

A range of previously unfamiliar videoconferencing platforms are now being trialled by businesses. But with large technology companies such as Google banning its employees from using Zoom, you will need to consider how the chosen system can work within your company's systems, and ensure that the investigation will not be compromised. Technology will be needed to facilitate meetings both within your investigations team, and with others outside (e.g. interviewees, enforcement agencies) and different considerations may apply. 

• Consider capacity: check that the platform and your account plan can host the required number of attendees. Look for one which is designed to operate with more participants than you need to ensure you are not operating at the limits of a platform's capacity.
• Consider whether you need video or whether audio will suffice.
• Do you need to screenshare? If so, a platform which is designed for this purpose will be key. We have had good experiences with GoToMeeting and Webex, but there are other platforms available with similar features.
• Understand your company's approach to and appetite for new platforms. The process of approval for a new platform may be unworkable in the timeframe of your investigation. So start with what is internally approved and tested.
• Consider the jurisdictions from which meeting participants are joining. Some platforms are inaccessible in certain jurisdictions. Check this in advance.
• Consider whether the platform requires software to be downloaded. Those outside your organisation may be unable to download software to corporate devices. It is easier for participants to use a platform which is accessible through a web browser, although even this may be an obstacle. You may use Skype or Microsoft Teams as your internal method of communication, but inviting external participants to calls on those platforms may not be possible.
• Is the platform secure? Look for technology which only allows access to a meeting via a link which is sent solely to attendees. It is key that the leader has control of who can attend the meeting.

To record or not to record?

An important question is how you will record the contents of the interview. A number of platforms have audio (and/or video) recording facilities, but we have had concerns over the method of storage and privacy. We have also heard from regulators that they have similar concerns – in one instance concerns by regulators over recording of remote interviews has stopped an investigation in its tracks.

If it is not your practice to audio-record interviews (and there are a number of situations in which it would not be advisable), having a note-taker to make a written record of the call is an obvious solution, and replicates what would often happen in a face-to-face interview.

One recommendation is to consider engaging a transcriber to join the call and prepare a written transcript of the call. This accords with the approach being taken by many court services in different jurisdictions. We have used companies who provide transcription services to court to transcribe witness interviews, with success. 

Privacy

Remote meetings and interviews raise privacy concerns. Most platforms show who is dialled in to a call, but there is a much-increased risk of covert recording or the presence of another person off screen, providing assistance, or listening in. Our experience is that is possible to pick up changes in an interviewee's body language and eye contact which would give this away. You should be alert to this. In addition, we suggest that everyone confirm at the beginning of each interview that they are not recording and that they are alone. Scanning the room with the camera may also be appropriate.

It is helpful to advise attendees that a note or transcript of the interview will be taken and circulated for approval (if this accords with your investigation approach), which gives interviewees the opportunity to raise any concerns.

Internal communications

It is helpful if those conducting the interview can communicate with one another privately. Some platforms have this functionality (although caution should be exercised where it is very easy to accidentally turn a private chat into a public one) or you can use emails or WhatsApp during the interviews (note that this should not be done by the participant whose screen is being shared). If this proves problematic, consider taking regular breaks for the investigation team to speak.   

Dealing with documentation

As it will usually be impractical to print and courier large bundles of documents to all interested parties, technology-driven solutions are likely to be useful here. We have worked with our Ashurst Advance legal technologists to enhance our existing extranet to maintain online bundles of documents for investigations and interviews. This enables us to send a secure link to the online bundle for a specific interview, workstream or meeting materials. It also allows for restricted access to specific documents. 

A key issue is whether you disclose certain documents ahead of the interview itself. There may be reasons for presenting documents for the first time on camera, but bear in mind that it will extend the length of the interview. An interviewee will be better prepared if they see the document(s) in advance. 

How to implement your findings

In the current climate it is important to consider critically the capability you and your company have to implement the findings of an investigation. For example, is there resource available to implement a wholesale mitigation plan relating to customer onboarding, when the onboarding team works in a jurisdiction which is in lockdown? Can the compliance team carry out a root and branch review of third-party relationships when they are at full stretch approving short-notice assessments for new suppliers to keep the business going?

Plan for the range of outcomes your investigation may have and think about how they could be implemented with flexibility and pragmatism. At a time when regulators around the world are encouraging the use of a risk-based approach to financial crime, consider employing a similar approach to your investigation outcome. Our experience has been that a staged approach can assist: 

1. Look at what must be implemented immediately: disciplinary action in relation to an employee, which may need to comply with employment law or internal policy requirements; the closing of a customer account to prevent fraud; or the filing of a suspicious activity or transaction report where statutory timelines apply.
2. Test your conclusions; ask what would happen if the implementation were postponed by e.g. 28 or 56 days. Consider reputational impacts and the impact on morale, as well as compliance with legal and regulatory requirements.
3. Consider a staged approach to implementation: plan a timeline which takes account of capacity and resourcing in the relevant business areas, record what will happen when, and explain the reasons for the prioritisation which has been applied. The record will be an important tool in the event of internal or external challenge.

Authors: Ruby Hamid, Duncan Liddell, Rani John and Fraser Collingham

A version of this article was written for publication in Fraud Intelligence (www.counter-fraud.com).

1. See the 6 May FCA update on its financial crime expectations of regulated firms during COVID-19: here.