Ethics Essentials: Setting the Scope of an Investigation

Investigation Scoping as Strategic Framework

• Effective investigation scoping establishes a clear purpose statement and action plan that articulates what you’re investigating, who needs involvement, and what successful completion looks like before any interviews or document reviews begin.
• The scope should function as a living thesis that evolves as evidence emerges, serving as a North Star that keeps the investigation anchored while remaining flexible enough to adjust when findings reveal the problem differs from initial suspicions.
• A well-defined scope prevents the two most common investigation failures: pursuing matters too narrowly and missing systemic issues, or investigating too broadly and consuming resources without delivering actionable findings.

The Iterative Nature of Investigation Scope

• Investigations rarely follow a straight line from allegation to conclusion because preliminary information typically represents symptoms rather than complete diagnoses, with reporters often possessing only fragmentary knowledge of broader patterns.
• Building an iterative mindset into your investigation protocol requires explicitly anticipating inflection points where you assess whether allegations can be corroborated and whether scope expansion or contraction is warranted based on emerging evidence.
• Treating scope as a one-time determination at the investigation’s outset sets up dangerous assumptions that the initial allegation fully captures the problem, when in reality you may be looking at something much larger, smaller, or fundamentally different than first reported.

The Triage Inflection Point

• Every investigation reaches a critical decision point after initial fact-gathering where you must determine whether you can corroborate some or all of what was alleged, or whether findings suggest the allegations lack sufficient merit to proceed.
• Approximately half of all allegations prove not credible upon initial examination, making it essential to establish clear criteria for what constitutes adequate preliminary investigation and what documentation standards support defensible closure decisions.
• Failing to recognize and properly document this triage inflection point leaves your organization vulnerable to future accusations that concerning allegations were simply buried rather than appropriately investigated and closed based on evidence.

Stakeholder Engagement and the Large Pizza Test

• Investigation teams should remain small enough that a large pizza could feed everyone involved—typically limiting core team membership to fewer than eight people—to balance diverse perspectives against risks of confidentiality breaches and privilege waiver.
• Additional subject matter experts, legal counsel, or business partners should be consulted on an as-needed basis without sharing unnecessary details about allegations, reporter identity, or specific investigation subjects to maintain confidentiality.
• Widening the circle of trust too broadly creates the significant risk that information inadvertently reaches investigation subjects, compromising the investigation’s effectiveness and potentially enabling evidence destruction or witness coordination.

Protecting Privilege While Gathering Context

• When gathering input from colleagues outside the core investigation team, frame conversations to obtain necessary context about business pressures, organizational structure, or technical matters without revealing allegation details, reporter identity, or subject names.
• Position these consultations as information-gathering exercises rather than seeking opinions about whether allegations have merit, which helps maintain attorney-client privilege and prevents unnecessary disclosure of confidential investigation details.
• This approach allows investigators to build essential background understanding—particularly important for ex-US investigations where cultural factors may influence both the nature of misconduct and appropriate investigation techniques—without compromising investigation integrity.

Cross-Functional Collaboration Models

• Effective investigation programs establish clear communication protocols between compliance, employee relations, legal, and security functions that enable appropriate handoffs when the nature of misconduct becomes clearer and different expertise is required.
• Matters often begin with one team investigating what appears to be interpersonal conflict, theft, or policy violations, but require partnership with other functions as evidence reveals regulatory violations, legal concerns, or systemic issues beyond the originating team’s expertise.
• This collaboration model ensures that investigators with the most relevant experience and appropriate authority address each matter while preventing dangerous gaps where serious issues fall between functional boundaries because each team assumed another was handling it.

Anonymous Reporter Engagement Strategies

• Anonymous reporters often “dump and run” by providing fragmentary information without realizing what additional details would enable effective investigation, making it critical to resist accepting their initial submission as complete and sufficient.
• Implementing systems that allow confidential follow-up dialogue—through anonymous hotline callbacks, secure messaging platforms, or voice-altering technology—enables iterative conversation that protects reporter identity while gathering necessary specificity.
• This engagement strategy frequently transforms vague allegations that would otherwise be closed as too nonspecific to investigate into actionable investigation plans with sufficient detail to examine allegations thoroughly and reach defensible conclusions.

Responding to External Regulator Contact

• When regulators approach your organization with specific allegations or findings, let their deliberately chosen disclosure guide your initial investigation scope rather than either investigating only precisely what they disclosed or launching unfocused searches throughout unrelated business areas.
• If preliminary investigation uncovers related issues beyond what regulators disclosed, immediately consult with legal counsel about disclosure obligations and strategic considerations rather than attempting to limit scope to avoid finding additional problems.
• Good faith investigation that discovers and appropriately discloses additional issues typically receives more favorable regulatory treatment than approaches that appear designed to deliberately constrain scope, as regulators generally know more than they initially reveal and are testing organizational responsiveness.

Avoiding Premature Promises to Witnesses

• Never tell witnesses they are definitely not investigation subjects or that matters are minor unless you are certain those representations will remain accurate as evidence emerges, because witnesses frequently transform into subjects as investigations develop.
• Making premature assurances that you later must retract destroys your credibility with witnesses and severely compromises their willingness to provide forthcoming information in subsequent conversations when their cooperation becomes even more critical.
• Instead, offer preliminary readouts that explicitly disclaim finality and make clear that initial assessments remain subject to change as investigation findings develop, which maintains flexibility while preserving trust and witness cooperation throughout the investigation lifecycle.

Documentation Standards for Negative Findings

• When investigations conclude that allegations lack merit, document your negative findings as thoroughly as you would substantiated misconduct by recording what information you reviewed, whom you interviewed, what corroborating evidence you sought but did not find, and what reasoning supported your closure decision.
• This documentation protects against future accusations that your organization simply buried concerning allegations without adequate investigation, demonstrating that closure decisions were reasonable and based on genuine investigative effort rather than convenience or avoidance.
• Matters can and should be reopened if new information emerges, but your contemporaneous documentation must establish that the decision to close was defensible based on the evidence and investigative steps available at the time of the original investigation.