Define scope and governance
Write the issue, decision-maker, reporting line, independence requirements and boundaries of the investigation. Identify who can change scope and how conflicts will be handled.
Issue targeted preservation steps
Identify custodians, devices, accounts, paper files and third-party systems. Suspend relevant deletion practices without collecting indiscriminately. Record what was preserved, when and by whom.
Protect evidence integrity
Use repeatable collection methods, restrict access, keep originals and document transfers. For technical material, consider specialist imaging and analysis rather than opening or altering the source device.
Sequence interviews intelligently
Review available records before key interviews, prepare topic plans and distinguish facts from assumptions. Record attendance, warnings, notes and follow-up items consistently.
Report with calibrated conclusions
Separate established facts, disputed accounts, corroboration, limitations and recommendations. The report format should reflect its purpose, audience, confidentiality and potential later scrutiny.
Working checklist
- Written mandate and decision-maker
- Conflict and independence review
- Custodian and system list
- Preservation notices and acknowledgements
- Collection and transfer log
- Interview plan and notes protocol
- Issue-based chronology
- Findings, limitations and action tracker