Investigative Process and Case Management
The investigative lifecycle
Every investigation follows a recognizable arc: intake and preliminary assessment, planning, information gathering, analysis, action, and closure. Candidates must understand that the plan is a living document, not a one-time formality. It should state the allegation or issue, the elements that must be proven or disproven, the sources of evidence, the resources required, the legal constraints, and the review points.
Case management discipline
Good case management means documented decisions, defined ownership, realistic timelines, and controlled information flow. Understand the difference between an investigative hypothesis and a conclusion; hypotheses drive inquiries, conclusions require evidence. Also know the value of periodic case reviews and the risk of tunnel vision, where early assumptions crowd out contrary evidence.
Traps in questions
Common traps include confusing reasonable suspicion with probable cause, treating an interview as the start of an investigation rather than part of it, and assuming that a case ends when a report is submitted. Another frequent trap is failing to distinguish administrative, civil, and criminal tracks, which carry different standards and remedies.
Rule of thumb
Use the "elements-first" rule: before any investigative step, write down the elements of the alleged conduct and the evidence needed for each. If a proposed action does not advance an element, question why it is being taken.
Worked example
A manager reports suspected expense fraud. Rather than immediately interviewing the employee, the investigator maps elements (false claim, intent, loss), preserves system logs and receipts, reviews approval workflows, and only then plans the interview. This sequencing protects evidence and avoids premature disclosure.