Investigations Training

This is an Insight article, written by a selected partner as part of GIR's co-published content. Read more on Insight

Introduction

Employees, no matter how long their tenure in a company or organisation, need continuous training to be up to date with the latest skill sets. It is inevitable that company or organisation policies, technology and investigation tools will keep evolving; employees need to be kept up to date with these changes. Alternatively, employees who are not invested in or who are not constantly learning, or when they are not familiar with the tools, apps, software or machinery used by their company, will become disengaged and ineffective in their roles.

Internal training also allows a company or organisation to know their investigation community better, especially when the company or organisation has a global footprint. It gives peace of mind that everyone is providing a consistency of approach. Everyone, regardless of their previous job roles, experience in the investigation sector, qualifications and training, will know what their employer expects of them, using the company’s approved tools and technologies against the company-accepted policies and guidelines.

Current requirements for training

In order to understand the role of the corporate investigator, it is helpful to consider the current landscape and those external factors influencing the need for companies to have trained investigators.

Current landscape

Within the corporate investigations community there are currently no universally recognised international professional qualifications that are a prerequisite for roles in the same way as other professions like accounting or auditing etc. However, across many industry sectors there is a mixture of practical, legal and regulatory requirements that require companies and organisations to demonstrate that the investigations that they carry out are undertaken by competent and suitably experienced investigators.

Corporate governance and accountability

Following the well-publicised fraud scandals at large multinational companies in the late 1990s and early 2000s, such as BCCI and Polly Peck in the UK, and Enron and WorldCom in the US, a raft of corporate governance guidelines and legislation were enacted. This includes the US Sarbanes-Oxley Act[1] and UK Corporate Governance Codes,[2] both designed to give confidence to investors and hold listed companies accountable for mismanagement at best and criminality at worst.

This resulted in the need for companies to be able, as part of their improved governance control frameworks, to carry out internal investigations to investigate concerns. In many cases significant, extra territorial and complex enquiries will have been, and are, referred to external law firms for reasons of legal privilege and independence. However, with the increasingly complex regulatory and legal environment that has now developed globally, companies are more routinely carrying out a variety of more mainstream ‘business as usual’ investigations to help them maintain and demonstrate a robust compliance culture as well as achieve legal and regulatory compliance. It is not now practical, or commercially viable, to outsource the majority of internal investigations. This has led to an increase in the number of in-house roles for investigators to deal with this workload.

Legislation and regulatory requirements

Certain sectors are more highly regulated than others and investigation requirements may vary significantly between jurisdictions. Whether the investigation supports internal disciplinary, regulatory requirements, civil or criminal actions, the same fundamental requirements exist. Currently in the regulated sector regulators have not specified qualification or educational requirements for those undertaking investigations. However, regulators, investigative bodies and prosecuting authorities may take into consideration ‘skilled person’ criteria when reviewing internal corporate investigations. The current US Department of Justice guidance to prosecutors when evaluating corporate compliance programmes[3] in respect of investigations looks for investigations scoped by suitability qualified personnel, but currently the guidance does not define what they consider suitability qualified personnel to mean in terms of the qualifications. Those undertaking the investigation should have the skills and experience commensurate with the investigation being undertaken. Those responsible for overseeing, managing or carrying out investigations should be ‘fit for purpose’. Organisations, if held to account for their actions, need to be able to demonstrate they have been robust and the investigation is defensible and will stand up to external review. Those that do not will risk being subject to significant sanctions and reputational damage.

Certain investigations may require additional knowledge and skills such as whistle blowing investigations where the legislation and regulations varies across jurisdictions and have significant liabilities attached if the investigation is not carried out in the correct manner. The EU Whistleblowing Directive on whistle blowing,[4] for example, increases protections for reporters and the obligations on employers on how they deal with them. This requires investigators to understand the limitations and the liabilities for not following the guidelines.

As previously indicated certain investigations will need to be undertaken or directed by external legal counsel because of the legal risks and sanctions that the company is facing. Anti-Bribery and Corruption legislation such as the UK Bribery Act and the U.S. Foreign and Corrupt Practice Act are complex, extra territorial and undertaking investigations without the appropriate legal advice and protection could result in poor outcomes for the company and its investors. This also applies to Non-Governmental Organisations (NGO’s) and third sector organisations, i.e. Charities. Investigators also need to have the ability to recognise ‘when not to pursue’ and investigations.

Experience versus qualifications

This raises the question what is competency? Competency is typically defined as the ability to do something consistently, successfully and efficiently. In many organisations the human resources that are utilised to conduct investigations may have received training and achieved recognised qualifications; however, does this mean they are competent to carryout investigations? In many cases yes, but equally in many cases no. Good training and associated qualifications may provide the basis to be successful in investigating less complex or process driven investigations. However, experience is the compelling factor in being able to investigate more complex matters effectively. Ideally, therefore, the business should have a mix of qualified and experienced investigators across its investigations team to be able to combine skills and also provide guidance and mentoring to those investigators with less relevant experience.

Previous professional experience and qualifications

When recruiting for investigation roles, or when selecting current resources to take on additional responsibility for investigations, transferable skills from previous or current roles should be considered. Professionally qualified auditors and accountants will have a number of transferable skills that include, but are not limited to, evidential fact findings and financial analysis. Former trained law and enforcement resources will also clearly bring investigation skills. However, the transition to a corporate investigator’s role will require adjustment and appropriate training in order to understand processes and procedures, and potentially the limitations in powers and access to information.

Risks of using unqualified or incompetent resources

As detailed in the previous points the consequences of failing to use qualified or competent resources to carry out investigations could have significant consequences for the organisation. This could include sanctions from regulators, reputational damage, criminal, or civil litigation that could be undermined. It could also lead to employment law-based actions, including tribunals. If any investigation is scrutinised by a third party the organisation would need to be able to demonstrate the skills and experience of the investigators assigned to the case and evidence that their skills and experience were commensurate with the complexity of the matter under investigation. This assessment of requirements and basis of allocation of resources should be documented in the records retained in relation to the investigation. It is not uncommon for investigations or elements of investigations to be undertaken by HR, compliance or other relevant functions. In these circumstances it is equally important that the resources have the requisite skills and experience for the tasks they are undertaking. Providing training for these functions should be incorporated in the investigations framework. Organisations may find it helpful to maintain a current register of accredited or authorised investigators, across their business, which includes details of the skills and experience of those investigators. A matrix of skills and experience for investigators can be maintained to map to role requirements and identify development needs.

Assurance

In order to demonstrate governance over the investigations framework and ensure that investigations are carried out in line with policy, guidelines and good practice, planned compliance assurance review activities should be carried out. This will require resources with the correct skills to carry out this activity and will also influence the development of training requirements where any weaknesses or breaches of policy and guidelines are identified. Resources within the 2nd line of defence, where the three lines of defence (LOD) model is used, should have the skills to undertake this activity. Internal audit may have resources with the requisite experience and knowledge to carryout reviews, but this is not always the case.

What should be included in training?

Mapping skills to investigations role, one size does not fit all. The variety and complexity of investigation requirements across the corporate sector; from multi-jurisdictional technology enabled financial crime, sensitive internal enquiries, to basic theft or fraud and minor policy breaches, means that investigators require a variety of skills. It is, therefore, unlikely that one investigator will have the requisite skills for all investigation requirements and this should be understood and recognised by the organisation.

A process of mapping skills to investigations requirements and roles will enable corporate to identify what investigative resources are competent to investigate different issues and ensure that they can demonstrate appropriately trained and experienced investigators are allocated to tasks on that basis.

This approach also enables training and development needs to be identified and managed across the in-house investigative community.

It is also possible where the organisation has sufficient resources to combine skills and experience from different investigators to meet the objectives of the investigation. In most investigations, except for the simplest, it is likely that a team of resources will need to be used to carry out all aspects of the enquiries.

In many cases, where appropriate resources are not available internally, aspects of the investigation may be outsourced. This is not uncommon, particularly where aspects of the investigation require legal privileged advice or significant data analysis. However, the organisation will still require investigation managers, who have the requisite skills and experience, to oversee, manage and direct outsourced enquiries.

Key skills for corporate in house investigators

The following provides a summary, but not exhaustive list, of the main skills and knowledge typically required to carry out a range of corporate investigations.

Investigation principles and theory

Those involved in investigations should have a baseline understanding of how to approach an investigation. Generally, internal investigations will concentrate on fact finding and establishing the facts and circumstances, and avoid reaching conclusions on the firm’s or individual’s culpability or legal liability.

Policy and framework

The majority of corporates will have principles based policies dealing with the need to be able to investigate, supported by standards or guidelines that include more detail on processes and procedures. This will form the basis of the governance and controls framework for investigative activity. Investigators will need to understand this framework to ensure they are compliant with the relevant policies and are using their powers to investigate appropriately. The investigation control framework will also allow for planned assurance activity that will help ensure compliance by and drive standards within the investigative community.

Managing investigations

Those managing an investigations’ team, or teams, need to have the skills and knowledge to exercise critical oversight in order to adequately direct and challenge investigations.

Digital forensics awareness

The majority of investigations will require consideration of some form of data review, or at least the identification of data sources that may be of evidential interest. It is critical that those involved in investigative activity are aware of the basic ‘do and do nots’ of dealing with digital evidence in order to maintain the integrity of that evidence.

Forensics and eDiscovery

The ability to identify, recover, secure and analyse data from a wide range of data sources to a forensically defensible standard, this will include relevant certifications for forensic recovery and processing tools.

Securing and recording evidence

Evidence may be gathered from a broad variety of internal sources that draw upon the systems and records of the business. This could include, subject to local laws, but not be limited to:

  • fact finding interviews;
  • collection and examination of paper and computer records;
  • physical searching of company property;
  • examination of access control records;
  • forensic handwriting or document analysis;
  • monitoring of telephone conversations or other communication; and
  • CCTV or other technical surveillance

The sources of evidence and the techniques available to recover will depend upon policy, local laws, regulations and cultural restrictions. Investigators must therefore have the skills and knowledge to assess the necessity, legality and proportionality when securing evidence. This will vary across jurisdictions and can be a complicating factor in more complex multi-jurisdictional enquiries.

The provenance of any material[5] identified as evidence needs to be maintained in order to ensure that such evidence can be considered reliable. A record should be maintained from the time of acquisition to the time it is presented as evidence to ensure that no allegations of tampering can be substantiated. Being able to understand and manage the chain of evidence is essential if evidence is to be admissible in whatever proceedings it is used in. The use of Case Management Systems (CMS) can be an effective method of maintaining defensible records, drive processes in line with policy, generate management information (MI) and provide business continuity.

  • Open source investigation – obtaining evidence from Open-Source Intelligence (OSINT) refers to a broad array of information and sources that are generally available, including information obtained from:
  • the media, e.g. newspapers, radio and television;
  • professional and academic records, e.g. papers, conferences and professional associations; and
  • public data, e.g. government reports, demographics, hearings and speeches;[6]

This is recognised as a highly effective tool for investigators and investigators need to understand how to access currently available information.

Investigative interviewing

Being able to obtain evidence and information through effective interviewing is a key skill. The role of investigative interviewing is to obtain accurate and reliable information from suspects, witnesses or victims, in order to discover the truth about the matters under investigation. There are a number of recognised best practice approaches to interviewing and those who carry out investigative interviews should have a good understanding of the principles. Interviewing is a skill that requires practice and experience. Investigators engaged in complex enquiries that involve interviews should have significant experience and a high level of skill in interview techniques to be effective.

Report writing

At the conclusion of investigatory activity, an investigation report should be written for all cases, in some instances a fully detailed report may not be necessary, but instead a summary including outcomes will still be required. Investigation reports should be factual, accurate and address all the points raised in or identified from the issue or allegation under investigation. Completed reports should include as a minimum:

  • the use of plain language, neutral and objective, and fully detail and reference evidence that supports the findings and conclusions so that an independent reader without prior subject matter knowledge;
  • clearly state the issue investigated, outcomes and recommendations as appropriate;
  • align to the approved Terms of Reference or agreed approach;
  • are protectively marked with appropriate security classification; and
  • include a clear outcome

The writing of investigation reports is a key skill, the investigation can be relied upon by businesses to make critical decisions and could lead to disciplinary or civil or criminal actions. As such investigation reports must be fully considered and defensible, as copies may potentially be obtained by the subjects of the report, by regulators or prosecutors. Investigations teams should also possess both the competency to write reports but also to critically review the content before submission.

When?

It is advisable that investigation training is contemplated under the following circumstances:

New starts

Regardless of investigation experience in previous roles, any new start would need to be trained in the company policies, the kinds of technologies available to aid investigations, the software applications or subscriptions used and the investigative process as dictated by the company.

Changes to existing tools and policies

Any internal changes which may impact the investigation process should be relayed to the investigation community.

New tools and technologies

Training should be delivered when introducing new investigation solutions.

Refresher training

Once an employee has completed the full suite of training available, whether that be from an internal training programme, or an external provider, the organisation should ideally set a time frame as to when refresher training should take place. Considerations include:

  • How long should this time frame be 2 years, 3 years, 5 years etc?
  • What criteria will be used to dictate when refresher training is required, do employees regularly submit examples of their work, e.g. final written reports?
  • What topics will be covered in the refresher training, the whole initial course or just some key aspects of the initial course?

Changing requirements

The ever-evolving advances in technology as well as changes in legal and regulatory requirements means that a corporate investigator, and those that support investigators, need to keep their knowledge and skills up to date. Monitoring any changes and continually assessing if the current skills and experience available address the organisational requirements to carry out investigations.

In order to identify changes in requirements a planned horizon scanning activity should be part of the risk management approach to ensuring the business has access to suitably skilled investigative resources. Changes in organisational structure and operating locations should be part of this process. Controls should be put in place to ensure that the development of new locations, acquisitions or business lines feed into the investigations functions so the investigatory requirements can be assessed and planned for in advance.

On-going professional development

Even the most experienced investigators will need to consider the need to update and refresh existing skills and seek out training and knowledge to learn and understand current good practice, reflecting new investigation techniques, changes in law and regulation etc.

Investigators can keep records of continuous professional and personal development (CPD) activity, and this activity can be incorporated into personal development plans and potentially linked to the assessment of personal performance. This may require investment in terms of budget and time by employers, but we would argue is easy to justify if managed correctly.

Having records of such ongoing professional development will also provide evidence to regulators or similar bodies, that the organisation is addressing the requirements for using suitably experienced, qualified and competent investigative resources.

Who and where for delivering training?

A key element when answering this question depends largely on the size of your organisation, the costs associated with training and who is available to deliver the training. Although it is generally recognised that 70% of learning occurs from job-related experience, 20% from interactions with others and 10% from formal educational events, the importance of the latter cannot be ignored[7].

Methods of training delivery

Internal training

It is advisable that internal trainers are competent and capable of delivering training, have undertaken training skills delivery courses or programmes, and are therefore able to recognise and apply different learning styles, visual, auditory, reading, writing and kinaesthetic. This way, they can incorporate a variety of learning scenarios to cover all learning styles, such as reading, listening, acting in role plays and participation in group discussions, and most importantly, deliver accurate and relevant feedback to delegates.

Pros of Internal training

  • Often cheaper, quicker and easier to organise. There may be no travel expenses or course payments and training covers organisational learning and development needs.
  • Can help build team dynamics. Training is often delivered by employees who are already known to each other and are comfortable sharing experiences and asking questions. Barriers of hesitancy are often removed
  • Can easily identify knowledge gaps. An internal trainer will know, and identify with, the company culture and will be familiar with the investigative function. They will know what is expected from the company and can cover areas where they know the attendees may have specific learning needs, challenges and key areas of individual development.

Cons of internal training

The training may not be formally presented and the trainers may not be considered credible by the attendees.

It can take up a considerable amount of staff time, daily tasks and productivity may suffer.

Pros of external training

  • Draws from expert knowledge and information on the latest trends and products through subject matter experts. There are opportunities to learn of different tools and technologies by people who are out there every day delivering training.
  • Can offer a fresh and impartial perspective with experts in training as well as the subject at hand.
  • Less of an impact on staff, as not required to deliver training.

Cons of external training

  • Can be more expensive and take longer to organise. There will inevitably be travel expenses for the trainers and course costs.
  • There can be a sense of loss of control when training is passed over to an external company. Do they know the organisational culture, are they able to adapt to organisational, design, needs and therefore effectively train employees?

Online training and self-study

  • Often limited to a certain number of slots or sign-ups per year.
  • Time limited; will the employees get it finished by the closure date?
  • It is easy to give employees an online course to complete and leave them to it. However, depending on the workload of the employee, they may struggle to balance their business as usual work with their personal development time. One way around this is to use the training as a performance goal and to allow a specific time to spend on their personal development.
  • There are a handful of professional associations who offer external qualifications, and which use an online training model. These include ACFE, ICA and PCI (ASIS) to name a few. However, online investigator training is not widespread.
  • Quite often, the aforementioned professional associations will require ongoing membership and are often based on a points system, whereby attendance at conferences and completion of regular examinations are required, e.g. CPD. This can be costly in both time and money.

On the job training

  • Mentoring or a ‘buddy’ system is a great way to train a new employee to the same standard as the already existing team members. This fits neatly into the 70-20-10 learning principle, e.g. 70% on the job, 20% formal or structured learning, and 10% self-development.
  • Caution should be given to matching that person with the correct employee to ensure enhancement of the learning experience. Additionally, trust in the mentor is required to ensure that bad habits or short cuts have not been passed on.
  • There is also no recognisable training output with this system and no formal training achieved. It is best to incorporate the mentor or ‘buddy’ system with an established internal investigator training course.

How can training be delivered?

At the time of writing this chapter, we are in the midst of restrictions on face-to-face meetings due to the covid-19 pandemic. As such, many employees are working from home. When it comes to training, offering online video-conferencing training may be more cost-effective, but it brings its own problems and considerations when trying to plan and deliver training:

  • Household distractions such as noise from children, pets, deliveries, other family members. Can the trainee concentrate on the training? Can they commit 100% into any interactive sessions?
  • Connectivity issues, can the trainee join with their video enabled? Do they have the correct bandwidth to support the training? If they can not put their video on, how can you be sure they are actively listening and learning? Could they be doing something else in the background e.g. responding to emails? How many other trainees are on the call and does that have an impact on the delivery quality? It is also more difficult to run practical exercises online.
  • Privacy issues such as who else can hear the call? Are the trainees using headphones? Are other people in the same room as them?
  • Comfort issues such as where is the trainee sitting? How long will the training take? Are there ample breaks away from the screen so they can stretch their legs and rest their eyes?
  • Language, is English the trainees’ first language? Do you need an interpreter? It is often the case that people with accents cannot be understood very well over audio and video platforms.

Ideally, face to face training is the preferable and optimum scenario. You can actively engage and collaborate with people, have eye to eye contact, be more open to questions, classroom discussions, sharing experiences and you can control the environment when it comes to distractions such as phone calls, emails, laptops etc. However, with face-to-face training come additional costs:

  • Costs in relation to travel and accommodation. If you have a global footprint, where do you hold your training? Do you invite other investigators from different countries to join? Do you need to hire a conference centre or rooms at a hotel?
  • Costs in relation to external trainers. Should you opt to hire an external company to deliver your training, how much do they charge per day? How long will your training take? Do they need to travel and be accommodated?
  • Costs in relation to lost working hours. How long will your investigator be out of the office and unable to do business-as-usual work? What contingency plans are there to cover an urgent or high profile request?
  • Language, as above, do you need to hire an interpreter to assist in delivering the training?

Internal accreditation programmes

Some businesses have created an internal accreditation system for their investigation community. This is usually done in conjunction with the learning and development department of the HR function and is based on a learning pathway model.

Training can incorporate all the above methods and test each employee at the end of the training with a test or exam. A certificate or professional internal ‘label’ can be offered on successful completion.

A company’s internal investigation policy can be updated to include that internal investigators should be formally trained and only those investigators who have successfully completed the course are permitted to undertake or manage investigations. Alternatively, an objective assessment of the skills and experience can be made and evidenced and investigators given an approved status to carryout investigations.

ACi education and training pathway

The ACi are currently developing an education and training pathway, intended to deliver an accreditation and certification programme for its members. Recognising that formal certification or accreditation is valued by many individuals, the ACi’s aspiration is to have an internationally recognised qualification and be accepted as an industry standard to attest competency.

The current ACi pathway includes a number of current training offerings which consist of a blended learning approach including webinars, podcasts, individual and group learning activities, knowledge information and sharing through industry forums and bespoke training courses. In due course, the ACi seek to deliver:

  • ACi Foundation Level Investigations course, via live webinar delivery;
  • ACi Foundation Level Interviewing course, via live webinar delivery;
  • ACi One day immersive investigations training workshop, via face-to-face delivery; and
  • ACi Webinars include a variety of topics of interest to the corporate investigation’s community, designed to educate and inform and invariably are free of charge to members.

The ACi also offers investigators a number of articles posted on the ACi website members only resources section, which accessible only to members, on current and relevant topics.

Details of ACi training courses and other education resources can be found by visiting the ACi website at www.my-aci.com.


Footnotes

[5] The official record of origin of a document or work of art where the document was created or received initially or it is the place where the document is now stored - https://thelawdictionary.org/provenance/ 30/11/2020.

[6] Open source Investigations Building your tool kit – Dr Stephen Hill - https://academy.cityoflondon.police.uk/blog/introduction_open_source_investigations_stephen_hill-.

[7] The 70-20-10 model is considered to be of greatest value as a general guideline for organizations seeking to maximize the effectiveness of their learning, and development programs through other activities and inputs. https://trainingindustry.com/.

Unlock unlimited access to all Global Investigations Review content