We have looked at background investigations and what information is obtained from these during the pre-employment screening process; however, there are other types of investigations that may need to be conducted once an individual has been hired. These investigations are conducted in the event of any suspicions or allegations that an employee may be violating company rules or regulations. If it is determined that an employee investigation be conducted, it is imperative that the results stand up to the necessary scrutiny of the legal system or any union agreements your company is subject to. This makes the employee investigation process a vital part of ensuring that your organization can maintain discipline and provide a safe and secure work environment, although still meeting any requirements to protect the individual.
We will first look at the proper process that should be followed in order to conduct a proper investigation against an employee, since a poorly or illegally conducted investigation can result in severe repercussions for both your company and any employees involved in the allegations. Once we have established the proper methodology to accomplish such an investigation, we will then look at the various employee misconduct incidents that normally occur in businesses and what considerations should be taken into account when investigating any concerns or issues.
8.2.1. The Investigation Process
As stated, it is critical that any investigation meets all necessary requirements—both from a legal basis and from any employee or union agreements your organization must follow. For this reason, it is best to follow specific steps prior to and throughout the conduct of an investigation in order to mitigate the possibility of an inaccurate or unsubstantiated investigation. These steps are not necessarily in order, as many of these tasks are done in conjunction with one another; however, each of these tasks should be accomplished in order to ensure that the investigation is conducted properly.
• Designate qualified investigators within your organization.
• Continually develop investigative resources.
• Follow established methods to collect, handle, and store evidence.
• Train and follow proper interview techniques with any eyewitnesses, supervisors, and suspects.
• Accomplish completed investigation reports in the proper format to ensure full documentation of the results of the incident.
We will cover each of these tasks in detail over the following sections.
8.2.1.1. Designation of Qualified Investigators
Finding and designating one individual within your organization, or a small cadre of individuals, who has the experience and necessary traits to conduct a thorough investigation, is a necessary first step that should be accomplished in order to accomplish employee
investigations. Without this step, it is impossible to conduct a thorough and proper investigation without a trained and qualified individual. Many organizations will wait to designate an individual to conduct an investigation until an incident has occurred—this is normally not a good idea, as the selected employee may not have any training or qualifications to conduct an investigation and, because of the last-minute notice, definitely will not be prepared to accomplish a thorough investigation. By designating specific individuals to accomplish investigations within your organization prior to their occurrence, you will lessen any potential issues that could occur due to an inadequate or improper investigation.
When looking at what individuals within your organization should be identified to work on any investigations, there are several traits that typically ensure successful investigators. A good investigator should ideally have some experience in conducting investigations and should be:
• Unbiased, unprejudiced, and not allow personal likes or disliked to interfere with the investigation.
• Have high ethical values and adhere to the principles of honesty, goodwill, accuracy, discretion, and integrity.
• Exhibit faithfulness, diligence, and be able to conduct themselves in an honorable manner while carrying out assignments.
It will likely be necessary to designate more than one individual within your organization with the responsibility to conduct investigations. Multiple investigators will ensure redundancy in case of any absences of the primary investigator at the time of an incident, or minimize any potential conflicts of interest that could preclude the primary investigator from conducting an investigation. For example, if your organization’s primary investigator is the supervisor of an employee who is alleged of wrongful behavior, it would be inappropriate to have them conduct that particular investigation. For these reasons, it is a good idea to have more than one individual, or a small group of people, who are designated and qualified to conduct an investigation.
Once you have designated your organization’s primary investigators, it is highly recommended that they obtain training on investigatory procedures (if they are not already certified or have experience as an investigator) and coordinate together to keep each other informed of any lessons learned or changes in procedures from recent investigations. There are a variety of resources where you can obtain this training that include many local law enforcement agencies, schools, and training seminars. In addition to training, all investigators should coordinate on any ongoing investigations. This will not only provide for an alternate investigator should the primary become unavailable over the course of the investigation, but it will also ensure that any issues, concerns, and lessons learned from recent investigations strengthen the overall investigative process. Once these individuals are trained, certified, and develop a system to periodically coordinate with each other, your investigative team will be fully prepared and qualified to handle most investigations within your organization.
8.2.1.2. Obtaining Information from Available Resources
There is a variety of information that can be useful to an investigator during the course of any investigation, and investigators must be aware of where to obtain this information. In order to obtain this information, they should constantly develop sources and become aware of available resources so that they can quickly and accurately obtain information on individuals involved in the investigation or the incident in question. These resources can include any reference material that is relevant to your company’s industry and workforce, or sources that provide personal information on individuals. Many of these reference materials can be found in such obvious locations as the public library or local newspapers and magazines, whereas other useful information pursuant to the investigation can be obtained from informants who are known to provide reliable information based upon the investigator’s knowledge and development of these sources.
Table 8.2 provides a list of many different sources that can provide information and material relevant to many different types of investigations—although this list is not complete, it provides a starting point for your organization’s investigative team to begin to develop their own information sources.
Table 8.2
Investigation Resources
Agency | Available Information |
Public library | • Periodicals and newspapers • Who’s Who listings • Professional directories (e.g., medical directories, law directories, banking directories, etc.) • Encyclopedias • Telephone books |
City and county offices | • Business licenses and permits • County clerk office for citizenship, marriage licenses, and divorce decrees • Weapons permits • Felony and misdemeanor charges • Bankruptcy and other civil records • Real-estate transactions and property tax payments |
Local law enforcement | • Incident reports • Accident reports • Criminal reports |
Worker’s compensation bureau | • Job-related injuries • Previous employers • Listing of dependents |
Credit reporting bureaus | • Individual financial history • Social security number • Personal information to include current address, date of birth, employment, and marital status |
8.2.1.3. Evidence Handling
During any investigation, it is normal that evidence pursuant to the incident will need to be collected. In conjunction with obtaining information from the necessary resources throughout the course of an investigation, the investigator must also ensure they know the proper procedures when collecting, handling, and storing any evidence relevant to the issues at hand.
The basic rules for collecting and handling evidence must follow the same chain of custody that is required and used in a court of law, since it is never known at the outset of an investigation if actual criminal action occurred. For this reason, all evidence must be properly collected to ensure there is no break in the accounting and possession of any item of evidence from the time it is collected at the scene until the evidence could be used in court. The purpose of maintaining the proper chain of custody for any evidence collected is to be able to show that the evidence is in the same condition as found at the crime scene and has not been tampered with. When the investigator first identifies an item as evidence, the following steps must be taken:
• Photograph the crime scene and document where each piece of evidence was found. This documentation should include the date, place, and time of discovery.
• Mark the evidence with a distinctive mark, being careful not to damage or alter the item in any way.
• Place the evidence in a proper container that is appropriate for that item (e.g., fibers in a plastic bag, liquids in their original container, medication in pill boxes, etc.). The container should be marked with the date, place, time of discovery, and identification of the individual who collected the item. If at all possible, witnesses should be present when packaging any evidence.
• Maintain a chain of custody log that documents the identity of any individual who takes possession of the evidence during either transport or storage of the item. This information should include the individual’s printed name, signature, date, and time where they took possession.
• Place the evidence in a secured evidence locker until the item is to be presented.
It is best to keep the chain of custody, or the number of individuals who come into contact with each piece of evidence, as short as possible. Ideally, it would be best for the same individual who collected the evidence to be the person who eventually places the item into secured storage.
8.2.1.4. Interviews
It is critical that the investigator obtain as much information from other persons who were eyewitnesses as possible; in order to determine the circumstances and facts surrounding the incident they are investigating and one of the best methods to obtain this information is through interviews. A trained investigator will typically interview all individuals who are believed to have information regarding the incident in question and then obtain additional names of other eyewitnesses or potential suspects over
the course of their initial interviews. It is not unusual for an investigator to conduct multiple interviews with key eyewitnesses based upon subsequent information they may obtain over the course of their investigation. In order to ensure that they can completely explain the incident, a thorough investigator will continue to conduct interviews until they are satisfied they have knowledge of all the facts and can successfully close the case.
The purpose of these investigation interviews is to gain information in order to establish facts surrounding the incident. Some of the basic information an investigator will want to obtain or confirm with the witness during any interview includes:
• Developing background information on the specific incident.
• Identifying additional witnesses for further interviews as necessary.
• Identifying suspects and accomplices.
• Eliminating suspects and discovering details of other offenses.
• Verifying statements and physical evidence obtained from other interviews.
• Obtaining additional evidence.
As discussed earlier, it is sometimes necessary for an investigator to conduct follow-on interviews with the same individual in order to reaffirm and reestablish the facts obtained from the initial interview. These follow-on interviews can provide new perspectives on evidence, jog the witness’s memory, or identify other suspects who were missed due to information the investigator has gained since the original interview.
Documentation of the interview, normally called a written statement, is necessary in order to legally preserve the information provided by the eyewitness. These written statements not only provide a record of the interview, but they are also useful to refresh recollection of a witness and discourage the witness or suspect from changing their story. A written statement can be hand-written or typed and should include the following elements:
• Start and end time of the statement.
• Eyewitness’s personal information (e.g., name, address, telephone number, position, and section, etc.).
• Statement that the information was provided freely, voluntarily, and was not coerced by threats or promises.
• In the conclusion, the statement should contain an affirmation that the contents are true, correct, and voluntarily provided.
• Signatures of both the eyewitness and investigator.
In the majority of investigations conducted in the corporate arena, interviews are the most critical portion of any investigation. In order to ensure that the information obtained during these interviews is admissible and useful, following the steps previously discussed will greatly enhance your organization’s ability to bring these incidents to a successful conclusion as quickly as possible, so that everyone can then concentrate on the real business at hand.
8.2.1.5. Investigation Results and Reports
The objective of any investigation report is to provide a professional, accurate, detailed, and easy-to-understand account of the events that took place based upon information obtained over the course of interviews and the investigator’s personal observations. This account should be compiled into an investigation report that should always include the five W’s and one H: the Who, What, Where, When, Why, and How. The report should concentrate on the facts and report, in chronological order, the correct sequence of events as they occurred, based upon the information obtained during the course of the investigation.
The investigation report should include all information from the investigation, such as a list of evidence, copies of documentation, and the written statements from all interviews. A standard format for the investigation report is as follows:
• Executive Summary. This section includes a brief synopsis of the incident. It should provide a brief overview of the incident as it occurred in chronological order. It is meant to be an overall summary for executive managers to be able to rapidly understand the facts surrounding the incident and to obtain the necessary information in order to make their decisions, without having to read the entire report.
• Detailed Investigator Log. This section is an in-depth list of all actions taken by the investigator over the course of the investigation. It should be accomplished in chronological order and includes notes on all tasks that were accomplished during the investigation of the incident, such as their notification of the incident, investigation of the crime scene, evidence collected, interviews, and conclusions based upon the facts found.
• Complete List of Interview Statements. This section includes all statements obtained from the interviews conducted during the investigation. These interview statements should usually be in a “question and answer” format and they should include the signatures of both the witnesses and interviewer.
• Evidence Log. This section is a complete list of each item of evidence collected. It is normally accomplished on a worksheet and includes a brief description of the evidence, where it was found, the date and time it was collected, and its current status (e.g., stored in a secured evidence locker, turned over to law enforcement, etc.).
8.2.2. Employee Misconduct Investigations
Now that we have covered the necessary steps to conduct an investigation, we will look at the various types of employee misconduct typically found in business. Within all of these incidents, an employee misconduct investigation must be accomplished in order to assist in determining if an individual has violated company rules and policies or state and federal laws. Several different employee misconduct issues are listed below, along with the considerations specific to that particular issue.
8.2.2.1. Sexual Harassment
Sexual harassment, or unwelcome sexual advances, is defined by the United States Equal Employment Opportunity Commission (EEOC) as “any requests for sexual favors, and other verbal or physical harassment of a sexual nature”
[3]. Prior to any incident within this area, every company should establish a zero-tolerance sexual harassment policy and post the policy to ensure that employees are aware that sexual harassment will be promptly investigated. Furthermore, employees should be made aware that assistance in sexual harassment investigations will not be subjected to any form of retaliation and all matters regarding the case will be kept confidential. Along with the definition listed above, the EEOC has two defined conditions of sexual harassment
[4]:
• Quid pro quo harassment describes a claim that arises from a supervisor offering employment opportunities in return for sexual favors.
• Hostile environment harassment is a claim that arises from a supervisor creating or allowing a pattern of conduct pertaining to sex that causes an unpleasant or hostile work environment.
Investigations into any sexual harassment claims should follow the investigative process and include well-written reports and complete records, particularly if the investigation led to termination or the claimant files a sex discrimination suit.
8.2.2.2. Theft Investigations
Employee theft accounts for billions of dollars of loss for businesses every year. Typically, theft is more prevalent at smaller and medium-sized businesses because these organizations have less supervision and rely more on the employees’ trustworthiness, which in turn allows individual employees greater freedom of movement than at large companies with well-established bureaucracies.
Major factors that contribute to employee theft are the lack of proper security measures, the lack of a control and oversight program, and few checks and balances within certain financial processes. Without these controls in place, along with the lack of a strict policy against theft, many employees could be undeterred from stealing since they might not think there is any risk of criminal prosecution or the company’s recoupment of lost money or assets. In order to provide the necessary deterrence against employee theft, developing an effective loss control program policy should provide for and emphasize the following areas:
• Development of checks and balances, safeguards, and preventative aids such as security inspection checklists.
• Conducting physical inventory inspections of goods and merchandise and daily audits with prompt reporting of missing items.
• Employee integrity and honesty testing.
• Employee education and motivation.
• Taking immediate steps toward apprehension and recovery to include prosecution and remedial actions.
8.2.2.3. Embezzlement Investigations
Unlike external theft, which can normally be identified to management and company employees fairly quickly, internal theft, or embezzlement, is stealthy and can go undetected for long periods of time. Embezzlement occurs when someone holds a position of trust and misappropriates money or converts company merchandise for personal use or advantage. Many of the actions that help to deter employee theft can also assist in deterring and detecting embezzlement.
Suspicious activities that are common in embezzlement and can help to identify potential problems include:
• Changes in spending habits or increases in an employee’s standard of living.
• Apparent devotion to work, such as working later hours or refusing vacations. This is done in order to minimize exposure with other coworkers.
• Account discrepancies or questionable transactions such as “padding” to cover up losses or “skimming” before cash entries are made.
• Complaints or allegations of misconduct by coworkers, customers, and contractors.
• Noticeable behavior changes.
• Objection to any procedural changes that will lead to closer supervision and scrutiny.
A disciplined environment with appropriate checks and balances and other safeguards is one of the most effective countermeasures against embezzlement. As covered in
Chapter 2, one of the security fundamentals is redundancy, or separation of duties, which covers many of the areas meant to deter or detect embezzlement. Some of the specific methods to combat this threat include:
• Separation of duties and audit trails.
• Periodic financial and operational audits.
• Gathering information on lifestyles and personal habits of employees.
• Interviewing coworkers.
• Searching e-mail and quality checks on company phones.
• Suspicion—if any employee exhibits traits consistent with possible embezzlement, further investigation may be required.
8.2.2.4. Fraud Investigations
Fraud can be defined as improperly obtaining an asset or item by providing false information. Both theft and embezzlement are considered fraud, so many of the considerations and mitigating actions from these threats can also be used and applied to mitigate the potential for fraud. In addition to simple theft and embezzlement, other types of fraud include: corporate fraud, computer fraud, medical fraud, theft of intellectual property rights or counterfeiting, financial fraud, credit card fraud, economic fraud, personal injury and vehicular accidents, and fraudulent disability claims.
In addition to the guidelines used to deter theft and embezzlement, some additional guidelines that can assist to prevent fraud include managerial controls, employee screening, forensic accounting, and financial controls.
8.2.2.5. Employee Absenteeism
Employee absenteeism is a subtle form of theft that costs businesses millions of dollars each year. Although closer supervision is one of the first responses many organizations will consider when minimizing absenteeism, other more effective methods can include:
• Developing ways that make employees feel important and significant to the company.
• Personalizing management’s relationship with employees.
• Recognition of employee excellence and dedication.
With all these options, however, the best method to reduce employee absenteeism is simply good leadership and supervision by managers with their employees.
8.2.2.6. Drug Abuse Investigations in the Workplace
Improper use of alcohol and drugs in the workplace can create significant costs to businesses due to lost work and inefficiencies sustained by the affected employee. Although it can be difficult to clearly identify employee drug abuse, a supervisor may consider this issue if an employee exhibits absenteeism or attendance problems from work, financial problems, trouble with local law enforcement or arrest, relationship issues with other employees, or unusual circumstances surrounding accidents at work. Physical symptoms of drug abuse may include trembling hands, sallow skin, wan cheeks, runny nose and eyes, and dilation of the pupils.
When conducting drug abuse investigations, the following items should be considered:
• Drug abusers commonly feel that they cannot manage without support of their habit.
• Chronic drug use generally indicates mental or emotional illness.
• Drug abusers commonly have a history of social maladjustment and find it difficult to get along with others.
• Drugs may not be easy to spot, as they can be carried in a number of ways, including within prescription bottles, fountain pens, toothpaste tubes, etc.
8.2.2.7. Gambling Investigations
Gambling addiction can take the employee away from their job because of the lure of dice, cards, horse and dog betting, and other games of chance. In addition, any employees suffering from gambling addiction can become higher risks to attempt theft or embezzlement because of the financial strain they continually place themselves under.
Some considerations for investigation of employee gambling issues include:
• Use of undercover operators.
• Evidence of gambling, such as IOUs, and lists of athletic or payroll pools.
• Cooperation with law enforcement agencies.
• Use of handwriting and fingerprint experts to examine documentary evidence.