Internal Investigations: Privilege, Interviews and Evidence Contamination

An investigation changes the evidence it examines

When suspected misconduct emerges, the instinct to investigate is usually right. The assumption that any investigation is better than delay is not.

Every investigative act changes the evidential landscape.

An email asking employees to explain themselves may alert a suspect, trigger deletion or circulate one person’s account to others. A group meeting may replace separate memories with a shared narrative. A lengthy interview conducted before the documents are secured may reveal the allegation without preserving the witness’s first account. A report prepared for several business purposes may contain legal advice, operational findings, disciplinary recommendations and public-relations language in one document, making its privilege status far more difficult to defend.

The danger is not confined to deliberate interference. Evidence can be contaminated by ordinary organisational behaviour:

• managers comparing recollections;
• witnesses reading the same chronology before interview;
• interviewers repeatedly advancing a preferred theory;
• investigators disclosing what others have said;
• draft statements being circulated for comment;
• legal, HR, compliance and communications teams working from different versions;
• AI tools summarising interviews inaccurately or blending speakers;
• witnesses editing machine-generated transcripts into polished accounts; and
• decisions being recorded before the factual basis has been tested.

An internal investigation is therefore not a neutral window through which facts are observed. It is an intervention which can preserve, clarify, alter or destroy evidence.

The central principle is:

Protect the first account, not a rehearsed consensus.

The objective is not to make every witness agree. It is to preserve what each person independently remembers, distinguish memory from reconstruction, test that account fairly and maintain a record which can withstand external scrutiny.

Five questions that must be answered before the first interview

Before substantive interviews begin, the organisation should be able to answer five questions.

1. What is the investigation for?

Possible purposes include:

• obtaining legal advice about criminal or regulatory exposure;
• preparing for litigation or enforcement which is reasonably in contemplation;
• establishing operational facts;
• deciding whether to self-report;
• meeting a regulatory notification obligation;
• making an employment or disciplinary decision;
• recovering assets;
• responding to an auditor, insurer or lender;
• correcting controls; and
• informing the board or a committee.

These purposes can coexist, but they should not be treated as interchangeable. They affect scope, governance, privilege, interview technique, access and the form of any report.

2. Who is the client?

The client is not automatically every employee, director or witness who communicates with the organisation’s lawyers.

For legal advice privilege, English law takes a comparatively narrow approach to identifying the corporate client. Communications with employees who are not authorised to seek and receive legal advice on the organisation’s behalf may not be privileged merely because they provide information to lawyers.

The organisation should therefore identify:

• the legal entity receiving advice;
• the individuals authorised to instruct lawyers;
• the body responsible for decisions, such as the board, audit committee or a specially constituted committee;
• whether any director or executive has a personal conflict;
• who may receive the legal advice; and
• how communications from other employees will be gathered.

The answer should be documented. It should also be revisited if the investigation reveals that a member of the original client group may be implicated.

3. Is adversarial litigation reasonably in contemplation?

Litigation privilege is distinct from legal advice privilege. Broadly, it may protect confidential communications between a client or lawyer and third parties, and documents created, for the dominant purpose of conducting litigation which is reasonably in contemplation.

The test is not satisfied simply because litigation is possible in a general sense. Nor is it enough to begin an investigation and retrospectively describe every document as litigation preparation.

The organisation should record:

• what proceedings are realistically contemplated;
• the facts which make that prospect more than speculative;
• when that assessment was reached;
• who reached it;
• the purpose for which particular work is commissioned; and
• whether that purpose changes over time.

In SFO v Eurasian Natural Resources Corporation Ltd, the Court of Appeal recognised that criminal prosecution may be reasonably contemplated before a prosecutor has decided to bring proceedings and that documents created to obtain advice or evidence for avoiding or resisting contemplated proceedings can fall within litigation privilege. The decision does not make every internal investigation privileged. The purpose, circumstances and particular document still matter.

4. Who is independent enough to control the inquiry?

The investigation sponsor must have authority, access and freedom from material conflict.

Depending upon the allegation, control may sit with:

• the board;
• an audit or risk committee;
• a committee of independent directors;
• the general counsel;
• external solicitors;
• a regulated function; or
• another clearly authorised decision-maker.

A senior executive should not control an investigation into conduct which may expose that executive, their reporting line or a decision they approved. Apparent independence is not a substitute for actual authority and separation.

5. What must be preserved before anyone is alerted?

Interview planning should follow preservation planning.

Before a potentially implicated person is notified, consider:

• volatile messaging and AI records;
• email, documents and version history;
• finance and approval systems;
• access and authentication logs;
• call recordings;
• mobile devices and personal accounts used for business;
• CCTV and physical-access data;
• external platform records;
• routine deletion schedules;
• documents held by third parties; and
• the risk of asset dissipation or continuing harm.

The detailed preservation framework is addressed in Preserving Evidence in an AI-Enabled Fraud Investigation. The immediate point is simple: an interview should not become the event which causes the evidence to disappear.

Privilege is a legal status, not a document label

Marking a document “privileged and confidential” can record an intention. It cannot create privilege where the legal requirements are absent.

The analysis is document-specific. A properly structured investigation may contain:

• privileged legal advice;
• privileged requests for information;
• privileged lawyer work product;
• non-privileged source documents;
• non-privileged factual records;
• interview notes whose status requires careful analysis;
• mixed-purpose reports;
• communications which have lost confidentiality; and
• material over which privilege may later be waived.

Treating the whole matter as one privileged container creates two risks. The organisation may disclose material it wrongly assumed was protected, or it may make unsustainable claims which damage credibility with a court, prosecutor or regulator.

Legal advice privilege

Legal advice privilege protects confidential communications between lawyer and client made for the purpose of giving or receiving legal advice.

The advice is not confined to stating the law. It can include advice about what should prudently and sensibly be done in the relevant legal context. But there must still be a qualifying lawyer-client communication, confidentiality and the necessary legal-advice purpose.

The corporate difficulty is identifying the client. Under the approach associated with Three Rivers (No 5), an employee who possesses relevant facts is not necessarily part of the client for privilege purposes. A communication from that employee to the company’s lawyer may therefore fall outside legal advice privilege unless another basis applies.

This is why the engagement structure matters. Lawyers should know who is authorised to instruct and receive advice. Information-gathering from witnesses should not be casually described as legal advice merely because a lawyer conducts it.

Litigation privilege

Litigation privilege may extend to communications with third parties and documents created for the dominant purpose of obtaining information or advice in connection with the conduct of adversarial litigation which is reasonably in prospect.

Three elements require discipline:

1. adversarial litigation must be in progress or reasonably contemplated;
2. the communication or document must be created for the dominant purpose of conducting that litigation; and
3. confidentiality must be maintained.

A document created for a general compliance review, commercial decision or public-relations response does not automatically become privileged because litigation is also somewhere in view.

The investigation mandate, contemporaneous risk assessment and actual use of the work will all matter. Boilerplate wording cannot cure a purpose contradicted by the evidence.

Dominant purpose and mixed communications

Investigations often generate mixed communications. A single email may request legal advice, seek operational input and direct a commercial decision.

The Court of Appeal’s analysis in The Civil Aviation Authority v R (on the application of Jet2.com Ltd) confirms the importance of dominant purpose in legal advice privilege and the need to analyse multi-addressee communications carefully. Copying a lawyer into an ordinary business exchange does not cloak the exchange in privilege.

Practical safeguards include:

• separate requests for legal advice from routine operational discussion;
• avoid copying legal advisers into every email;
• state the legal purpose accurately;
• limit recipients to those who need the communication;
• keep factual source material distinct from legal analysis;
• use separate workstreams where purposes materially differ; and
• record changes in purpose rather than relying on the original engagement wording.

Lawyers do not make pre-existing facts privileged

A contract, invoice, message, accounting entry or AI conversation does not become privileged because it is sent to a solicitor.

The communication seeking advice may be privileged. The underlying document usually retains its original character.

This distinction is essential when responding to compulsory powers, disclosure obligations or a regulator. Moving all relevant documents into a “legal” folder does not remove them from production.

In-house lawyers

Communications with appropriately qualified in-house lawyers can attract privilege, but the lawyer must be acting in a legal capacity. In-house roles often combine legal, commercial, governance and managerial functions. The document should make the legal purpose clear where that is genuinely its purpose.

Privilege is also subject to important context-specific limits, including in some competition investigations. Specialist advice is required where different statutory regimes or jurisdictions may apply.

The iniquity exception

Privilege does not protect communications made in furtherance of crime, fraud or equivalent wrongdoing.

The exception is not triggered simply because the organisation seeks advice about suspected wrongdoing. Obtaining legal advice to understand or respond lawfully to an allegation is fundamentally different from using a lawyer or legal communication to facilitate or conceal misconduct.

Where a person within the instruction chain may be using the investigation itself to obstruct, mislead or continue the conduct, the client definition, authority and reporting route require immediate review.

Design privilege before collecting accounts

A defensible privilege structure starts with an honest mandate.

The written investigation protocol should address:

• the identity of the client;
• the investigation sponsor;
• the legal questions on which advice is sought;
• whether litigation is contemplated and why;
• the factual scope and relevant period;
• the investigators and their roles;
• the relationship between legal, HR, compliance, audit and forensic teams;
• information barriers and conflicts;
• document creation and storage;
• interview methodology;
• reporting lines;
• privilege review;
• external reporting decisions; and
• who may authorise waiver.

The protocol should not assert certainty which does not exist. If litigation privilege is not yet available, say so internally and structure communications on the correct basis. If the purpose later changes, record the change.

Separate the workstreams

One investigation may need to serve several functions. It is often safer to separate:

1. legal advice and defence preparation;
2. neutral fact collection;
3. employment and disciplinary decisions;
4. control remediation;
5. regulatory notifications;
6. insurer and auditor communications; and
7. internal and external communications.

Separation does not mean creating artificial silos or duplicating evidence. It means controlling purpose, responsibility, access and output.

For example, an HR decision-maker may need verified facts without receiving every privileged legal analysis. A communications team may need an approved factual position without access to interview notes. A board may require legal advice and a separate operational action plan.

Keep a privilege decision log

A contemporaneous log can record:

• the document or category;
• date and author;
• sender and recipients;
• asserted basis of privilege;
• relevant client group;
• purpose;
• litigation contemplated, if relied upon;
• confidentiality controls;
• any disclosure or waiver decision; and
• the person authorising that decision.

This is not a substitute for legal analysis. It makes the analysis auditable and reduces inconsistent treatment.

Interviewing is evidence collection, not narrative production

The purpose of an investigative interview is to capture and test a person’s own account.

It is not to:

• obtain agreement with the investigation team’s theory;
• rehearse the witness for a future process;
• secure a polished corporate narrative;
• conceal inconsistencies;
• combine several witnesses’ recollections;
• pressure an employee into speculation; or
• convert uncertainty into apparent certainty.

The strongest interview record may contain disagreement, gaps, qualifications and unresolved contradictions. Those features can demonstrate that the process preserved evidence rather than manufactured an answer.

The interview sequence

Sequence should be deliberate. There is no universal rule that the most senior or most implicated person must be interviewed first.

Start with the evidence map

Before fixing interviews, identify:

• what is already objectively recorded;
• which material is still volatile;
• who created or controlled it;
• who appears to be a witness;
• who may be implicated;
• whose recollection may be influenced by others;
• which accounts are needed urgently;
• whether an external agency may wish to interview first; and
• what facts must remain undisclosed to test knowledge.

Preserve uncontaminated witnesses

Where practical, obtain early accounts from witnesses whose independent memory may otherwise be affected by workplace discussion or exposure to documents.

This does not necessarily mean a full formal interview immediately. A carefully controlled first-account process may record:

• what the person observed;
• what they did;
• what they understood at the time;
• who they spoke to;
• what records exist; and
• whether they have discussed the matter with anyone.

The first account should be preserved in its original form. Later correction or supplementation should be recorded as such, not silently merged into the original.

Do not interview over unpreserved evidence

If a suspect has access to deletable data, continuing systems or dissipatable assets, the organisation may need to secure those risks before alerting them through interview.

The order should be coordinated with legal, forensic and security teams. Containment measures must themselves be documented and proportionate.

Engage with enforcement agencies where appropriate

If an SFO or other criminal investigation exists or is realistically imminent, an internal interview may prejudice the external investigation.

The SFO’s 2025 cooperation guidance expects early engagement about the parameters of an internal investigation, advance notice of steps which may affect the SFO’s work, particular care over internal interviews and, where requested, restraint from interviewing employees.

The SFO also indicates that it will scrutinise privilege claims over relevant interview accounts. Maintaining a valid claim to privilege is not itself treated as non-cooperation, although voluntary waiver may be given significant weight.

This creates a strategic decision, not an automatic answer. The organisation must balance:

• immediate need to understand and control the conduct;
• preservation of first accounts;
• employment and regulatory duties;
• the risk of tipping off or prejudice;
• privilege;
• individual rights;
• cooperation credit; and
• the organisation’s own defence.

Before the interview

Each interview should have a written plan which identifies:

• the interview’s purpose;
• the witness’s apparent status;
• the topics to be covered;
• documents which may be shown;
• facts deliberately withheld for testing;
• the interviewers and note-taker;
• conflicts and separate representation;
• the form of record;
• confidentiality instructions;
• privilege wording;
• data-protection and employment considerations;
• whether participation is voluntary or required;
• any health, language, disability or vulnerability needs; and
• the escalation route if new risk emerges.

Clarify whom the lawyer represents

An employee interviewed by the organisation’s lawyers may wrongly assume those lawyers also represent them.

At the outset, the interviewer should explain in clear, accurate terms:

• whom the lawyer represents;
• the purpose of the interview;
• that the lawyer does not act for the interviewee personally, unless separately agreed;
• whether the communication is intended to be confidential;
• who controls any privilege belonging to the organisation;
• that the organisation may decide to disclose the account;
• the expectation of truthfulness and document preservation;
• any employment obligation to cooperate; and
• the interviewee’s ability to seek independent legal advice.

The wording should be tailored to English law and the actual circumstances. Importing a US-style corporate warning without understanding its legal effect can create false reassurance.

Consider separate representation

Separate advice may be appropriate where:

• the person may face criminal, regulatory or disciplinary exposure;
• their interests may diverge from the organisation’s;
• the organisation may attribute responsibility to them;
• waiver or disclosure of their account is under consideration;
• they are a director with personal duties;
• they request advice; or
• fairness and effective cooperation require it.

The organisation should not present its own solicitor as neutral personal counsel.

During the interview

Obtain free recall before reconstruction

Begin with open questions:

• What happened?
• What did you understand at the time?
• What did you do next?
• Who else was involved?
• What records did you create or receive?

Allow the witness to give an uninterrupted account before documents, other accounts or the interviewer’s theory are introduced.

This protects the distinction between:

• independent recollection;
• recollection refreshed by a contemporaneous document;
• inference from ordinary practice;
• information learned later; and
• speculation.

Test, but do not feed

Effective testing requires challenge. It does not require telling the witness the answer sought.

Questions should:

• progress from open to specific;
• identify the source of asserted knowledge;
• separate what was seen, heard, inferred and later learned;
• test chronology and decision points;
• confront material inconsistencies fairly;
• explore evidence pointing away from wrongdoing;
• identify records and other witnesses;
• avoid repeated propositions which encourage acquiescence; and
• record genuine uncertainty.

Where a document is shown, record when it was introduced and whether it changed or refreshed the account.

Avoid disclosing other accounts unnecessarily

Telling a witness what a colleague said may assist a targeted challenge, but it also contaminates the witness’s future account.

Before disclosure, ask:

• Is the detail necessary?
• Can the point be tested without identifying the source?
• Is the witness’s independent recollection already recorded?
• Will disclosure prejudice another interview or an external investigation?
• Is the information privileged, confidential or sensitive?

If disclosure is necessary, record precisely what was revealed and why.

Keep allegations provisional

Interviewers should distinguish:

• an allegation;
• an evidential inconsistency;
• an inference;
• an established fact; and
• a legal conclusion.

Premature certainty can narrow the investigation and invite confirmation bias. It can also be unfair to the interviewee and misleading in any later report.

Recording the interview

The form of record should be decided before the interview, not improvised afterwards.

Options may include:

• an audio or audiovisual recording;
• a substantially verbatim transcript;
• a detailed contemporaneous note;
• a witness’s own written account; and
• a signed or adopted statement where appropriate.

No method is perfect. The important requirements are accuracy, transparency and preservation of the original.

Audio and video

A recording can reduce disputes about wording, tone, pauses and what information the interviewer supplied. It also creates sensitive material requiring secure storage, access control and a clear lawful basis.

If recording, explain it and obtain any agreement required. Preserve the original file, metadata and handling history. Do not retain only an edited clip.

Notes and transcripts

The note should distinguish:

• the witness’s words;
• the interviewer’s questions;
• documents shown;
• breaks and interruptions;
• significant non-verbal matters, if relevant;
• corrections;
• investigator observations; and
• later analysis.

Investigator impressions should not be silently inserted into a purported factual transcript.

If the witness is invited to review the record:

• preserve the original;
• provide a controlled copy;
• require amendments to be identifiable;
• distinguish correction of transcription from alteration of substance;
• ask for the reason for material changes; and
• retain every version.

AI transcription and summarisation

AI can assist with transcription, chronology and issue spotting. It should not become the unrecorded author of the witness’s evidence.

Risks include:

• speaker misidentification;
• omitted words or qualifiers;
• invented or normalised phrasing;
• loss of tone and hesitation;
• inaccurate technical names and figures;
• summary which merges evidence with inference;
• confidential data leaving approved systems;
• uncertain retention or provider access;
• silent model updates; and
• later inability to reproduce the output.

Where AI is used:

1. retain the original recording;
2. preserve the raw machine transcript;
3. record the tool, account, model or version information available;
4. record prompts and settings used for any summary;
5. verify the transcript against the recording;
6. identify human corrections;
7. keep summaries separate from evidence;
8. restrict access and use an approved environment;
9. assess privilege and data protection before upload; and
10. never represent an AI summary as the witness’s adopted account unless the witness has genuinely reviewed and adopted it.

AI can organise evidence. It cannot decide what the witness remembers.

Evidence contamination

Contamination is any process which makes it harder to distinguish a person’s original knowledge from information acquired through the investigation.

Common contamination routes

They include:

• team meetings about “what happened”;
• shared witness chronologies;
• circulated interview notes;
• managers coaching staff before interview;
• witnesses attending each other’s interviews;
• group messaging after an allegation;
• repeated exposure to the same theory;
• media coverage or public statements;
• showing documents before free recall;
• collaborative drafting of statements;
• suggested answers embedded in questions; and
• AI summaries which present disputed facts as settled.

Issue a communication protocol

Where proportionate, witnesses should be instructed:

• not to discuss substantive evidence with other witnesses;
• not to delete or alter relevant material;
• not to conduct their own searches in a way which changes data;
• to preserve messages about the allegation;
• to identify any discussion already held;
• to report attempts to influence their account; and
• to direct external enquiries through the authorised channel.

The instruction should not unlawfully inhibit protected disclosures, access to legal advice, regulatory reporting, trade-union support or legitimate welfare support.

Maintain a contamination log

For each witness, record:

• documents reviewed before interview;
• people with whom the matter was discussed;
• internal briefings attended;
• media or public information seen;
• other accounts disclosed;
• documents shown during interview;
• post-interview communications;
• later amendments; and
• any suspected pressure or coordination.

Contamination does not automatically make an account worthless. It affects how the account should be assessed and described.

Fairness to employees and individuals

An investigation designed to protect the organisation must still be fair.

Fairness may require:

• clear notice of the subject matter;
• a meaningful opportunity to respond;
• disclosure of the substance of serious allegations at the appropriate stage;
• sufficient time and support;
• reasonable adjustments;
• an interpreter;
• independent representation;
• separation between investigator and disciplinary decision-maker;
• care with confidential personal information; and
• an accurate record of disagreement.

The precise requirements depend upon the investigation, contract, policies, regulatory context and potential consequences. A criminal exposure assessment is not the same exercise as an employment disciplinary process. Combining them without a plan can compromise both.

Whistleblowers and confidential sources

The organisation should protect whistleblowers from retaliation and limit disclosure of identity. It should not promise absolute anonymity which cannot be maintained.

The investigation should:

• record what confidentiality was explained;
• separate identity information where practical;
• control access;
• test the allegation independently;
• avoid treating the source as either inherently reliable or suspect;
• consider protected-disclosure rights; and
• plan how fairness to an accused person will be achieved.

Anonymous or confidential information may initiate an inquiry. It should not eliminate the need to establish evidence.

Reporting without converting uncertainty into fact

The final report should reflect the quality and limits of the investigation.

It should distinguish:

• scope and mandate;
• evidence obtained;
• evidence unavailable;
• facts established;
• disputed accounts;
• inferences;
• legal advice;
• control weaknesses;
• remedial recommendations; and
• decisions reserved to the board or another body.

Use calibrated findings

Avoid language which overstates the evidence. The report should explain:

• the standard applied;
• the evidence supporting each material finding;
• significant contrary evidence;
• credibility factors;
• contamination or memory limitations;
• assumptions;
• unresolved gaps; and
• whether a conclusion is factual, legal or evaluative.

A report is more defensible when it identifies what cannot be determined.

Consider more than one output

A single document distributed to every audience is rarely ideal.

The organisation may require:

• a privileged legal advice report;
• a factual chronology;
• a board decision paper;
• a remediation plan;
• an employment report;
• a regulator-facing presentation of facts; and
• a carefully controlled external statement.

Each output should have a defined author, purpose, audience and disclosure analysis. Factual consistency matters, but identical documents are not required for different legal functions.

Control drafts and circulation

Drafts may be disclosable and can reveal evolving theories or unsupported language.

Use:

• clear document ownership;
• restricted recipients;
• version control;
• disciplined comments;
• separate legal advice;
• an approved factual source;
• a distribution record; and
• a retention decision consistent with legal obligations.

Do not delete inconvenient drafts after litigation or an investigation is contemplated. Preservation duties apply to material which may bear upon the issues, not merely the final approved account.

Waiver and cooperation

Privilege belongs to the client. Waiver should be an informed strategic decision by an authorised decision-maker.

Before disclosing privileged material, consider:

• the precise material proposed for disclosure;
• the legal basis of privilege;
• the purpose of disclosure;
• whether limited waiver is recognised and effective in the context;
• the risk of collateral waiver over related material;
• consequences in parallel proceedings or jurisdictions;
• effects on individuals;
• confidentiality and onward use;
• cooperation credit; and
• whether the underlying facts can be provided without waiving legal advice.

The SFO states that a corporate maintaining a valid claim of legal professional privilege will not be penalised for doing so. It also regards voluntary waiver as a significant cooperative act. That is a powerful consideration, not a command.

Cooperation can include early engagement, preservation, identification of custodians, provision of facts, non-privileged interview records and avoiding steps which prejudice the external investigation. An organisation should not assume that waiver is the only way to demonstrate responsible conduct.

Guide 7 will address self-reporting, SFO cooperation and deferred prosecution agreements in full.

Board and senior-leader framework

Boards, general counsel and investigation sponsors should ask:

• What is the precise purpose of the investigation?
• Which legal entity is the client?
• Who is authorised to instruct and receive advice?
• Are any members of the client or sponsor group potentially implicated?
• Is adversarial litigation reasonably contemplated, and what evidence supports that view?
• Are legal advice, fact-finding, HR, remediation and communications properly separated?
• Has relevant evidence been preserved before interviews begin?
• Is the investigation independent in fact?
• Have regulators or investigators asked to be consulted before interviews?
• Which witnesses require urgent first accounts?
• How will witnesses be prevented from aligning accounts?
• What information will be withheld initially to test knowledge?
• Is each interviewee’s status and representation position clear?
• Will the interview be recorded, and how will the original be preserved?
• Is any AI transcription or analysis controlled and verifiable?
• Can every amendment to an interview record be reconstructed?
• Are investigators pursuing material pointing towards and away from wrongdoing?
• Does the report distinguish fact, inference and legal advice?
• Who may authorise disclosure or waiver?
• Can the organisation explain the process to a prosecutor, regulator, court and the individuals affected?

Senior oversight is not achieved by receiving a final report. It is demonstrated by establishing a process capable of producing reliable evidence and defensible decisions.

A defensible investigation protocol

Phase 1: Stabilise

1. contain continuing harm without destroying evidence;
2. establish legal and executive authority;
3. identify the client and conflicts;
4. preserve volatile and relevant material;
5. restrict unnecessary discussion;
6. protect whistleblowers and confidential sources; and
7. document the initial allegations without treating them as facts.

Phase 2: Design

1. define purpose, scope and legal questions;
2. assess contemplated litigation and privilege;
3. appoint independent investigators;
4. separate legal, factual, HR and communications workstreams;
5. map witnesses, documents and decision points;
6. decide whether external agencies should be engaged before interviews;
7. set interview and recording protocols; and
8. create privilege, decision and contamination logs.

Phase 3: Collect

1. secure objective records;
2. capture urgent independent first accounts;
3. sequence interviews by evidential risk;
4. use free recall before documents or allegations;
5. test accounts fairly;
6. preserve originals and all material amendments;
7. pursue exculpatory and qualifying evidence; and
8. reassess scope when new facts emerge.

Phase 4: Evaluate

1. distinguish fact, inference, recollection and reconstruction;
2. test competing explanations;
3. identify evidential gaps and contamination;
4. obtain legal advice through the defined client structure;
5. assess individual and corporate exposure separately;
6. consider reporting, cooperation, employment and remediation duties; and
7. record decisions and their evidential basis.

Phase 5: Report and protect

1. prepare audience-specific outputs;
2. preserve uncertainty and contrary evidence;
3. control drafts and circulation;
4. decide privilege and waiver document by document;
5. implement remediation without rewriting the historical record;
6. maintain preservation while proceedings remain possible; and
7. review the inquiry’s independence, fairness and limitations.

Relationship with the wider Financial Crime series

This guide sits between evidence preservation and the organisation’s later decisions about attribution, reporting and resolution.

The First 24 Hours After Suspected Corporate Fraud addresses immediate strategic control.

Failure to Prevent Fraud: A Strategic Guide for Organisations and Senior Leaders explains the section 199 ECCTA offence and reasonable procedures defence.

Deepfake and Voice-Clone Fraud: Legal and Investigative Response addresses synthetic-media deception and the four-layer investigative model.

Preserving Evidence in an AI-Enabled Fraud Investigation provides the nine-layer evidence map and preservation protocol.

The later guides will address:

• corporate criminal liability and the distinction between senior managers, associated persons and failure to prevent fraud;
• self-reporting, SFO cooperation and deferred prosecution agreements; and
• AI failures which may create regulatory exposure without amounting to fraud.

The investigation must support each later decision without predetermining it.

Frequently asked questions

Conclusion

A strong internal investigation does not produce the neatest story. It produces the most reliable basis for decision.

That requires the organisation to preserve evidence before alerting those involved, define the client before seeking advice, distinguish legal and operational purposes, record first accounts before reconstruction, test rather than feed witnesses, preserve every material version and report uncertainty honestly.

Privilege must be designed and maintained. Independence must be real. Fairness must survive urgency. AI must assist the record rather than silently rewrite it.

The quality of the investigation will later be judged not only by what it concluded, but by whether anyone can still tell what each witness knew before the organisation began asking questions.

Protect the first account, not a rehearsed consensus.