The Draft Report and the Forty-Slide Conference Deck
You are reviewing a draft SIU report prepared by a newly promoted investigator before it goes to outside defense counsel in a contested fire claim. The draft reads, in part: 'The insured is clearly lying about his whereabouts. A neighbor said he saw the insured's truck leave at 9 p.m., which proves he set the fire. Attached is a photo from social media showing him at a bar that night. The fire marshal agrees the fire was arson.' No dates, addresses, or source citations appear anywhere in the document. The photo was downloaded from a public profile, renamed, and emailed by an analyst; there is no hash, screenshot record, or metadata capture. The same investigator has been invited to speak at a regional fraud conference and has built 40 slides showing the insured's name, date of birth, a burn injury photograph from the medical file, and a floor plan of the house with the alarm panel code written on it.
1. Identify the defects in the draft and explain how you would restructure the report.
Read the worked answer
The draft commits three separate errors that a defense attorney will use to discredit the whole file.
First, it states conclusions as facts: 'clearly lying,' 'proves he set the fire.' An investigator's report records evidence and analysis; the conclusion on cause belongs to the fire marshal and the liability conclusion belongs to the trier of fact. Second, it attributes a statement to an unnamed neighbor with no date, time, or record of the interview, which is hearsay on its face and unusable. Third, it claims the fire marshal 'agrees' without citing a report number, a determination, or a date, and mischaracterizes the role: the marshal determines cause and origin, not agreement with an investigator's theory.
Restructure the document: matter identification and scope of assignment; a short summary that describes what was investigated and what remains open, not who is guilty; a chronology with dates; a facts section in which every sentence is attributable to a named source or a cited record; a separate analysis section where inferences are labeled as inferences and qualified; an evidence index listing each item with its provenance and custody; and an open-items section. Rewrite the key sentences to something defensible: 'The neighbor stated in a recorded interview on [date] that the insured's truck left the driveway at approximately 9:00 p.m. This is inconsistent with the insured's statement that he was home until 10:30 p.m.'
2. What must change before the conference presentation, and why?
Read the worked answer
Almost everything on those slides has to go. The deck contains the insured's name, date of birth, a medical photograph, and the alarm panel code for a private residence. That combination is personal data, protected health information, security-sensitive detail, and material from an active contested claim, presented to an audience you cannot control and cannot later contain.
Rewrite the deck around methodology and lessons learned. Strip names, dates of birth, addresses, policy numbers, claim numbers, and any medical image. Replace the floor plan and alarm code with a generic diagram or remove it entirely; publishing a residential security layout creates a real-world safety problem regardless of litigation. Generalize facts so the claim is not identifiable to anyone who knows the parties, and check with coverage counsel on whether the matter is in litigation, since public disclosure of case facts can create discovery and waiver exposure.
Get written approval from legal and from your leadership, confirm the conference's confidentiality and recording policy, and keep the case identification out of the title and abstract. If the case cannot be de-identified without losing the teaching point, use a composite hypothetical and say so on the first slide. Present findings and method, not accusations, and remember that a conference talk is a public statement that may be quoted back at you in a deposition.
3. Defense counsel deposes you and asks exactly how the social media photo was obtained and preserved. How do you prepare, and how do you answer?
Read the worked answer
Prepare by reconstructing the chain of events before the deposition, not during it. Find out who accessed the profile, on what device and network, on what date and time, from what URL, whether the content was public, and what happened to the file between download and email. Locate the original file on the analyst's machine or the email server rather than working from the renamed copy. If the original screenshot with metadata exists, produce it; if it does not, say so plainly in your preparation memo to counsel.
In the deposition, answer the question asked, in chronological order, in short factual sentences. If there is a preservation gap, concede it rather than improvising: 'The image was captured as a screenshot, saved to a local drive, and emailed as an attachment; I do not have a hash of the original capture.' Do not characterize the photo as proof of anything beyond what it depicts, and do not speculate about the account owner's intent.
Separate what you did from what the analyst did and from what you were told. If you do not know something, say you do not know and offer to find out. Volunteering conclusions under cross-examination is what converts a documentation gap into a credibility finding, and the earlier report language is going to be read back to you, so review it and be ready to explain any overstatement in it.