After a complaint has been filed that requires further research, the organisation should decide whether an investigation is needed. The investigation should start quickly as the evidence may be jeopardised the longer it takes to start the process. The evidence collected during the investigation should be stored securely after an expert has analysed it carefully. But how can a decision be made on what counts as evidence and what does not? And how can everything be stored safely while still being accessible? These are two important questions every business or investigator should be ready to answer as they affect the success of the investigation.

Evidence necessary for the investigation

The most common complaints that require an investigation are allegations of bullying, discrimination, harassment and fraud. While strategies may need to be implemented to lower cases of misconduct, it is impossible to discourage every single culprit. Employees should be encouraged to gather evidence and come forward with their claim as it will improve the overall environment and their experience at work. While data shows that 10% of Australian workers are bullied, the numbers could be higher due to people not feeling comfortable reporting or not having evidence to make a complaint. They may only be verbally attacked without any way to prove it. 

Employers should educate employees on how to collect evidence if they are the victim of misconduct or they have observed fraud. This will allow the investigator to collect a wider variety and better quality of evidence. As there are many cases, the nature of the evidence may differ. There may be photos, videos, records, contracts, emails and other documents that the investigator will need to protect. 

To ensure that the evidence stored is more accurate, it needs to be collected quickly and, ideally, at the time of the incident. For example, a photograph of the injury at the time of the accident may be more meaningful than a healed wound. Screenshots of online harassment should be taken on the spot before the accused can delete their messages. So it is important that all relevant evidence is collected before the investigation even starts. 

Storing evidence begins before the investigation. It is not only up to the investigator to preserve information but to employees as well. 

Preserve evidence for the investigation

Once the evidence has been collected and the pieces of evidence have been analysed, it should be clear which ones are needed for the investigation. The company must keep both direct and indirect evidence as they have their own advantages and can result in a better outcome. The selected documents should be stored securely during and after the investigation. Some steps to ensure that include:

  • Maintaining confidentiality
  • Abiding by policies and procedures
  • Training employees
  • Choosing a safe place

Maintaining confidentiality

Maintaining confidentiality relies on the investigator, the company and its employees. One person is not able to protect confidentiality on their own. It should be a group effort to make sure that the investigation is carried out successfully and without issues. What the investigator can do is explain to employees the importance of confidentiality and how it could impact the investigation and their work life if the information was leaked to third parties. They should inform them of the repercussions that may follow and how it will not be beneficial in any way to share information outside of the investigation. Employees should also be informed of the steps the investigator is taking to ensure that their identities are protected and that all evidence is stored safely.

Requiring employees to sign a written confirmation of confidentiality increases the likelihood that evidence will be stored securely and they will not be given to third parties. As employees may be the first with access to evidence, it is crucial that they are not tampering with data, trying to delete trails or telling outsiders what is happening within the investigation. The confirmation of confidentiality means that the staff members are aware of the severity of the situation and they are heavily discouraged from making evidence public.

One of the most effective strategies to keep the investigation and its evidence confidential is to conduct interviews in a secure place that is not frequented by other employees. This will prevent gossip from arising, witness statements of being influenced and will protect the identities of the parties involved along with the contents of the investigation.

the investigation

Training employees

It is not required that employees are trained to store evidence securely. However, it is recommended as employees play a big role in the success of the investigation. In many cases, they provide investigators with the majority of information so knowing how to preserve evidence can be essential. When employees are educated on how to handle evidence until the investigation starts, it can lower the probability of information gaps or accidental contradictions. Everyone will have been informed on how to protect themselves and store all relevant information to prevent it from being stolen or accessed by a malicious third party.

Evidence-preservation training is not a program that needs to be undertaken regularly but modules should be offered often enough that a risk-aware culture is created. It will also improve the employees’ experience with the investigation as they are aware of what their rights are and what steps they need to follow. In some instances, this kind of training can encourage employees to speak up and report the issue as they feel confident that they have enough to prove that misconduct is taking place.

Abiding by policies and procedures

One of the main rules when conducting the investigation is to not use the original evidence during the process. The original document, photograph or video should be stored and a copy of it should be used to conduct interviews or establish credibility. Preserving the original evidence and working with copies has many advantages as it will prevent potential damage or loss of file. Having the original document can allow for more copies to be created but copies do not have as much power.

Policies and procedures should make it clear to what extent the company has access over company devices and in the case of deleted information, the IT department should try to find the details that were removed. Establishing clear policies and procedures can minimise the company’s exposure to potential legal consequences as the privacy laws will be taken under consideration.

They should also state who should have access to the devices and evidence once the investigation has commenced, as the more parties involved, the more likely it is that evidence will not be stored effectively. It must be highlighted that employees are not allowed to download evidence on their own devices, only on the devices used for the investigation. Taking relevant documents home should be prohibited and all relevant information should be kept in the investigation space or with the investigator. The parties involved should only be allowed to access the information in the case management system chosen by the company.

It is also wise to develop a record retention policy as it can prevent evidence from being destroyed and will outline what is necessary for them to be retained securely. The retention policy may outline who is responsible for collecting, monitoring and disposing of evidence and for how long the evidence should be kept. It should also include how they will be destroyed once the time period has passed and how the copies will be handled as well. The retention policy must also describe how employee consent will be prioritised to ensure that employees are aware that their records are kept within the company.

Choosing a safe place

To store evidence effectively, they need to be in the right form and place. If possible, all evidence should be transformed into an electronic file so it is easily accessible and easy to store. If documents are stored in a paper form, they will require a lot of storage space, it will impact the efficiency of the investigation and it might be more likely for them to end up in the wrong hands.

 Moving all evidence online has its own risks, as the company may be vulnerable to a cyber attack. The device used to upload them should be clean from viruses or malware and regular scans can increase the probability that the device is safe. However, it is not wise to store evidence solely on that device. It should be used to upload evidence online and create copies of the evidence to use during the investigation process. A smart case management system should then be chosen with strong passwords that will make it difficult for outsiders to access it and easier for investigators to carry out the process.

 This is one of the main reasons our clients choose Polonious. As we are ISO 27001 certified, we take information security very seriously and prioritise secure storage of evidence at all stages of the process. All information can be uploaded to our case management system and can be accessed anywhere and anytime by only those involved in the investigation. Investigators can store a wide variety of evidence, including videos, photos and relevant documents. If you are looking for a safe way to preserve your evidence, contact us! 

Keep in mind

Storing evidence for investigation securely requires many steps and it is a complicated process. What might apply in one investigation may not apply to another. The company and the investigator must strive to work together to ensure the best possible outcome.