The Next Level of Investigations

Authored by:  Jonathan T. Marks, CPA, CFF, CITP, CGMA, CFE, and NACD Board Fellow


Many investigations are currently being performed remotely, in concert with the general counsel, the chief compliance officer, the chief audit executive, and depending on how the allegation was triaged, with outside counsel, a forensic accounting firm, and the board.  Even government prosecutors are interviewing witnesses remotely.

The primary goal of the interview is to elicit information in a non-coercive manner. My personal preference is always to conduct interviews face to face because I can control the subject and the environment and evaluate the nonverbal behavior of the interviewee.  But, if performing a face-to-face interview is not possible, I suggest using video over the telephone.

Due to ‘social distancing” and travel restrictions placed on us during the COVID-19 crisis, we must improvise, adapt, and overcome these obstacles.  Although some investigative activities are taking more time, the requirement to promptly respond and resolve allegations of fraud and misconduct remains intact. Additionally, it is in the company’s and employee’s best interests to resolve these matters effectively and efficiently to reach the proper conclusion and take remedial actions when appropriate.

This writing provides some suggestions for techniques to consider when conducting internal investigations remotely.



Managing the jurisdictional laws and regulations impacting an investigation is often complicated, especially when considering the virtual environment we find ourselves in today.  When dealing with cross-border investigations (be it States or Countries), it is essential to attain legal advice in the jurisdiction(s) relevant to the engagement, so the legal issues such as employment law and data privacy risks are vetted and managed.  Operating in a virtual environment may impact the way evidence is gathered and maintained, witnesses and suspects are interviewed, and cases or charges are brought forth civilly and/or criminally.  These legal issues must be harmonized with counsel at the beginning of an investigation to prevent any unintended consequences that could negatively impact the outcome of the investigation.

Further, cultural differences must be considered when managing the inherent issues of international investigations.  For interviewing, if English is not a language spoken and understood by subjects or witnesses, the investigations team should include a member who can accurately translate the discussion—accurately translating means to capture not just the spoken word, but also any nuances of the language that extend beyond the verbatim conversation.  Ideally, the translator is a member (a co-worker) of the investigations team.  Investigations professionals are trained to detect potential signs of deception in an interview.

Job interview. Businessman having a job interview.


The rise of web-based video conferencing services such as Zoom, Teams, Google Meet, WebEx, and Skype have helped to maintain the face-to-face component of the interviewing process; however, other parts remain mostly unchanged.  As is the case with an in-person interview, advanced preparations should be made.  Because if you fail to plan, plan to fail.

For example, the interviewer should ensure their approach and appearance are as professional as if the meeting was taking place in person.  The interviewer should also ensure that the tone of the interview must is appropriate.  Setting the tone is a process that begins the moment the interviewer is visible to the interviewee.  Distractions of the home-office should also be considered and minimized to the extent possible.  By thoughtfully setting the tone and creating a professional environment at the onset, the interviewer can reduce disruptions and/or distractions such as a landline telephone ringing or a dog barking.  The interviewer should also seek to determine if the interviewee has any parties present in the room.  If the conditions are not appropriate to conduct the interview, be prepared to reschedule.  To maintain the comfort and cooperation of the interviewee, afford breaks in the process to allow time to use the restroom, hydrate, etc.  One of the most critical elements of a successful interview is the ability to establish rapport with the interviewee.  The interviewer must do their best to make the interviewee comfortable with the virtual environment and build this rapport early in the discussion.

Documentation and procedures must remain atop the list of priorities in a virtual setting to preserve the integrity of the interview.  Think about and plan for sharing documents with the interviewee using your video conferencing platform. Consider the fact that you may not be able to see the interviewee’s facial expression when documents or evidence is presented and that you may have to ask them how they feel when a document or evidence is presented. The interviewer should have full control of what is presented and avoid sharing information not intended for the discussion.  I suggest organizing the documents in a separate location with a relevant naming convention will be useful to ensure the flow of the discussion.  Just as in a traditional interview, allow the interviewee to read and react to the evidence presented to them.  The platform utilized to host the interview should also be secured to the fullest extent offered by the platform to prevent potential security breaches, divulgence of sensitive or confidential information, and embarrassing distractions.  This may require meeting passwords and assuring the use of well-secured video conferencing services.

Additional acknowledgments appropriately made at the onset of the interview may include the reason for the interview or the Upjohn Warning.  While these can be memorialized in the interview notes, it may make sense to use e-mail and DocuSign to evidence the interviewee’s acknowledgment. Virtual meetings also allow for the interview to be recorded or screenshots of documents or evidence captured.  To the extent this cannot be controlled with a physical measure, the interviewer should consider including acknowledgments by the interviewee that this activity will not take place.

The investigator should not leave the skills to detect deception via nonverbal cues at the proverbial door merely because an interview is conducted over video instead of an in-person meeting.  The following captures the memento all investigatory professionals should inscribe in their memories, regardless of the circumstances and venue of the interview:

When evaluating a suspect’s behavior for deception purposes, it is essential to remember that there are no unique behaviors associated with truthfulness or deception. The behavioral observations an investigator makes of a suspect do not precisely correlate to truth or deception. First, they reflect the subject’s internal emotional state, cognitive processes, and internal physiological arousal experienced during a response. The emotional states most often associated with deception are fear, anger, embarrassment, resentment, or hope (duping). For the truthful individual, the cognitive processes may reveal concern, helpfulness, and confidence versus (for the deceptive) offering an unrealistic explanation for the alleged misconduct, being defensive, or being overly polite.

Following the interview, notes should be immediately memorialized.  This should be done no later than a day after the interview, while the information is still recent and recallable.  While the interview’s ground rules should be generally unchanged, in a virtual world, the digital medium certainly requires some added thoughtfulness and strategy to ensure everything goes as planned.


Data Preservation and Collection

Although most electronic documents can now be collected remotely, it may be more challenging to collect and review relevant hard-copy documents. At the same time, travel restrictions and quarantines remain in place but keep in mind remote working environments present a variety of challenges for data preservation, particularly the preservation of devices, physical media, and hard copy documents stored in various locations.

When dealing with network data, where data collection cannot take place on-site, data will need to be collected by granting access to systems or remote supervision (e.g., screen sharing). Extra time and care are required to ensure that preservation and collection are “forensically sound.”  Also, additional time is often needed to educate the organization’s IT staff.

Don’t get burned by not understanding the data source and how and by whom it was collected. Ensure the completeness and accuracy of data collected through appropriate testing. Bad actors will often delete/redact, change, or hide data and information before passing it on.

Securing physical-digital devices and hard copy documents is likely to be more difficult. Cooperation from the custodian is expected to be necessary unless device images are taken periodically or can be extracted remotely.

Bring Your Own Device (BYOD) arrangements in organizations will likely make it more complicated. Employers should revisit policies and the authority provided to them, which may require employees to co-operate and provide requested data, including data residing on personal digital devices and messaging applications such as Messenger, WhatsApp, WeChat, Signal, Teams, and Telegram – particularly where these are prohibited from being used for work purposes.

Employees will likely raise privacy concerns (mainly if they use the digital device for personal purposes) after receiving these requests. They may need reassurance that measures were taken to protect their privacy and the company’s interests. Privacy concerns may lead to employees refusing access to their digital devices. Therefore, subject to data privacy advice in the relevant jurisdiction(s), companies need to adopt robust policies that provide enough leverage to obtain access to data residing on these digital devices, including business data on personal devices. Companies are advised to educate employees on these policies and minimize any expectations of privacy for employees who use personal devices to access company networks and data. Companies should properly document steps and attempts to gain access to such digital devices to demonstrate to regulators that all available legal measures have been exhausted should an employee refuse to grant access to devices.

Where devices/documents cannot currently be collected and processed but remain in the workplace, it may be possible to arrange to secure these (e.g., lock them away). Still, there may be employment law and practical issues in obtaining documents and devices in employees’ homes. Hard copy documents will present less of a problem as many organizations have moved to paperless operations.

Business meeting and communication network concept.


Communication with the board, audit, or special committee is always essential during an investigation, but sometimes we forget that communicating with the investigations team is equally important.  Do not hesitate to use the video conference platform to maintain a personal connection with the team.  A remote environment requires processes and procedures to be modified to operate seamlessly.  Create outlets to share findings and ideas, both for particular projects as well as for general communications.  The new cadence for the investigations team should be thoughtfully designed, formally introduced, and monitored in real-time with all data made continuously and ongoing feedback provided by and to the team.  Effective communication will help ensure that issues are promptly addressed, and ideas for improvement are evaluated and implemented when appropriate.

Solid communication that includes a feedback mechanism creates the opportunity for a thorough and efficient investigation. Real-time deliberations may facilitate bringing the “pieces of the puzzle” together in an efficient manner.  Team meetings are also helpful at the beginning of an investigation to design the work plan and assign team members’ responsibilities.  This communication process helps prevent confusion and the duplication of efforts by team members.

The preparation of external communications also requires a modernized approach in the digital world.  When working with a team remotely, a system for version control of a document or report can prevent confusion, frustration, and embarrassment.  Manual processes like standard naming conventions may be helpful but must be designed, communicated, and continuously applied across the investigations team to be effective.  Alternatively, software such as GoFileRoom or OneDrive may help manage the team’s version control and workstreams.



As a practical matter, always consider the standards outlined in the AICPA’s Statement of Standards for Forensic Services No. 1 (“SSFS No. 1”).  Certified Public Accountants who are members of the AICPA and who engage in investigatory matters are subject to these standards, which outline the general standards of the profession.  They include:

  • Engaging only in matters in which the professional can complete with professional competence;
  • Exercise due professional care in the performance of the engagement;
  • Adequately plan and supervise the performance of the engagement; and,
  • Obtain sufficient relevant data to afford a reasonable basis for conclusions or recommendations in the engagement.

These standards apply to our profession regardless of the environment we find ourselves in today.  Investigations must be handled with the same level of care and diligence as they were when we could be on-site with our clients.  Shortcuts will diminish the quality of our work and are risky when the stakes are high, as they always are in this line of work.  Adapting to this environment can certainly be daunting, but the disruption can be embraced as an opportunity to develop and improve-take your investigation to the next level.  With the right attitude, thoughtful and strategic efforts, and continuous, ongoing communications, your investigation process can emerge from this crisis period stronger and more efficient than they were in the “this is how things were always done” era.

I welcome your comments and suggestions. Remember to ensure the source of all data collected is pure!


Jonathan Pic

Jonathan T. Marks

On 5/29/2020, this article appeared on the AICPA website.

John E. Reid and Associates Inc. 800-255-5747 /

Upjohn v. United States, 449 U.S. 383 (1981)

Statement on Standards for Forensic Services (SSFS) No. 1, July 2019

Please follow and like us:
%d bloggers like this:
Skip to toolbar