Investigations
Investigative fundamentals
Investigations fall into three families, and the standard of proof differs in each. Criminal investigations are run by law enforcement and require proof beyond a reasonable doubt. Civil matters concern liability and are decided on the preponderance of evidence. Administrative or internal investigations enforce company policy and also use a preponderance standard - but the outcome is discipline, not conviction.
Evidence and custody
Evidence is testimonial, documentary, physical, or demonstrative, and may be direct or circumstantial. Circumstantial evidence is admissible and often decisive. The lifeblood of any case is the chain of custody: every transfer of an item logged with date, time, handler, and purpose. Digital evidence degrades fastest - image drives before analysis, hash for integrity, and never work from the original.
Interviews
Interviews gather information; interrogations confront a subject believed to be involved. Interview witnesses separately, before they compare notes, and record contemporaneous notes. Miranda warnings apply to government action, not to private-sector interviewers - a favorite exam trap. Private security only needs Miranda when acting as an agent of the state. Similarly, entrapment is a defense against government inducement, not against a company's integrity test. Public-sector employers must also mind Garrity and union representation rights.
Traps
- Promising leniency or threatening prosecution to extract a statement, which poisons the interview.
- Interviewing the accused first and the witnesses later.
- Writing conclusions rather than observations in the report.
Worked example
A cashier is suspected of voiding sales. Secure and preserve the POS audit logs with a hash and custody log, review video without deleting segments, interview the supervisor and two witnesses separately, then interview the employee with a witness present. The report states facts and times, not "she admitted stealing."
Rule of thumb: if it is not documented and preserved, it did not happen.