Effective investigative strategies involve more than mixing and matching inves-
tigative methods. The successful project manager needs strategy. That strategy must be sufficiently structured such that it provides efficiencies and the opportunity to measure results. However, the strategy must be sufficiently flexible so that it permits the changing of objectives and strategy as new information is learned. The project manager and her investigators must have the ability to change their objectives and modify their strategy as new information is developed. My clients sometimes make the mistake of being inflexible. On numerous occasions, I have had employer clients tell me that they are interested in only catching the thieves or firing the drug dealers. Although I cannot argue with these goals, upon discovery of other offensive workplace behavior, these same clients chose not to address it. Knowing other egregious and actionable behavior is taking place, they will turn a blind eye to it because the investigation of those offenses was not among our original objectives.
The Process of Investigation ◾ 17
How sad and how wasteful. Investigators make the same mistake. Because one
offense or another was not included in their original charter, they ignore them.
Their process is so structured; once the train has left the station, there is no changing its destination.
1.4.4 Properly Pooled Resources
Nothing can derail a well-planned investigation more effectively than an organization’s failure to support it with the proper resources. The failure to dedicate adequate talent results in a lengthier investigation that will assuredly fail to achieve the desired objectives. Following is an example.
Several years ago, the owner of a regional drug distribution operation called
my office seeking my help. The owner claimed that several employees had come
forward and alleged that co-workers were stealing. After discussing the particulars, it appeared to me that the allegations were credible and that a proper investigation would likely expose the perpetrators. I suggested the informants be interviewed so that all of the information possible could be extracted from them. As is often the case, the owner— now client— resisted. He said the employees had been promised
confidentiality; furthermore, they were said to be unlikely to talk if questioned by an outsider. I told him, in that case, the only solution would be undercover. He resisted again. He said he did not have the time or the money for an undercover.
Although he believed his losses were approaching $40,000 a month, he wanted a
faster, less-expensive solution. After more discussion and some debate, I acquiesced and agreed to surveillance. To my surprise, the resultant surveillance produced results and several employees were identified engaging in very questionable activity.
I suggested they be interviewed. Given what we knew at the time, I proposed that investigatory interviews would likely yield admissions and, based on those admissions, the client could take the necessary disciplinary and/or corrective action.
Again anxious to achieve a fast and more convenient result, my client insisted on involving the authorities. Incorrectly, he believed that the police would pick up where we left off and solve his problem. He further professed that “police action”
would produce an unqualified deterrent and discourage similar behavior by others in the future. The police agreed, but they insisted in verifying our result and doing additional surveillance themselves. After several weeks of inactivity on the part of the suspect employees, the police became tired of their surveillance and decided to confront them. They did, and even using intimidation and the veiled threat of prosecution, not a single employee offered an admission. Thoroughly frustrated, my client shut the project down and paid our bill. Months later, as I typically do, I followed up and called him. He said his losses had diminished to a trickle, but reluctantly admitted he had no peace of mind. He knew as I did that those responsible for the many months of theft were still in his employ. It was only a matter of time until they gathered the courage and once again resumed their criminal activities.
18 ◾ Investigative Interviewing
This scenario is common. Businesses and the people who run them, like most
of us, are impatient. Workplace investigations are complex and as I said earlier in this chapter, successful investigations require the investment of time, patience, and resources. If your organization or client isn’t prepared to make the requisite investment in each, your investigation will be difficult and probably fail to produce the desired results. In this case, defaulting to law enforcement was a mistake. Instead of using an external resource with the skill and ability to solve his problem, the customer chose a resource that was ill equipped to fulfill his objectives. The outcome was not only disappointing, it was counterproductive. Like many decision makers, he failed to appreciate that the commitment of resources involves the commitment of the right resources.
Tip: In matters involving complex issues, it is often necessary to bring to bear resources that have special expertise. Failing to use the right resource often produces disappointing, if not useless, results.
1.4.5 Lawful Execution
Corporate investigators and those who conduct workplace investigations for their employers have enormous responsibility. The outcome of their efforts often impact the organizations they serve and the employees who work for them. The Process of Investigation™ has no rule book (except those like the one in your hand), it is not governed by any oversight body and it is not necessarily bound by criminal law or civil code. It and the people who conduct workplace investigations are governed largely by organizational dictate and ethics. Usually, not until someone complains or sues and the fur begins to fly does anyone ever really scrutinize the typical workplace investigation or the people who performed it. Consider for a moment your
own investigations. How many of those were ever really scrutinized and picked
apart? Who critiqued you or your team? Certainly there must be exceptions, but by and large very few workplace investigations are looked at carefully. Unless someone challenges the outcome, is dissatisfied with the punishment, or the effort was so glaringly defective, no one cares and no one looks. The case is closed and never looked at again. Not so for criminal investigations. Every aspect is examined.
Regardless of the venue or the likelihood of critical examination, all workplace investigations should be conducted ethically and lawfully. To do otherwise is a disservice to the subject, the customer, and the investigative profession.
Trap: Rules, policies, laws, and codes provide society and the organizations with structure and order. A fact finder’s failure to obey them is a disservice to all those that his investigation touches, including his own.
The Process of Investigation ◾ 19
1.5 The Eight Methods of Investigation
Fundamentally, there are eight basic methods of investigation:
1. Physical surveillance
2. Electronic surveillance
3. Research and internal audit
4. Forensic analysis
5. Undercover
6. Interviews
7. Grand jury
8. Search warrants and subpoenas10
That’s it. There are no others. Every other form of investigation one can identify is a subcategory of one of these. You might have observed, the use of a grand jury and search warrants and subpoenas are not available to most of those who conduct workplace investigations. Typically, workplace investigations have only the first six methods of investigation available to them.
Every workplace investigation uses one or more of these six methods. The chal-
lenge for the professional investigator is to select the method or methods most suitable for his particular circumstances and deploy them properly and in the correct sequence. In many instances, the investigator will find that he must combine the methods in some fashion or mix and match them. It is only with knowledge and
experience can the investiga
tor know which methods to use and when. It is this
unique ability to combine these methods properly and efficiently that separates exceptional investigators from good investigators. Let’s look at each of them briefly.
1.5.1 Physical Surveillance
In the context of workplace investigations, physical surveillance is nothing more than watching people, places, things, and activities. Physical surveillance has only two requirements: there is something to watch and someone to watch it. As such, physical surveillance is relatively inexpensive and easy to use. Those who have conducted surveillance know that, as simple as it may seem, to be done properly it requires significant skill and patience. Not everyone is capable of surveillance or doing it well. In some instances, it requires sitting patiently in closed quarters, such as an automobile or van. In other instances, it requires following the subject as he/
she drives about. This form of physical surveillance is called moving surveillance and requires even greater skill.
Physical surveillance, however, has its limitations. Because it is not interactive, i.e., the observer has no interaction or communication with whom he is observing, the evidence physical surveillance produces is typically only corroborative. That is, it only supports or corroborates other evidence. Here’s an example.
20 ◾ Investigative Interviewing
If I were to observe an individual remove from the rear door of his workplace a large, sealed corrugated box and suspiciously put it into the trunk of his vehicle under the cover of darkness, what did I actually see? Did I observe a theft? Absent any other evidence, what I observed was likely nothing more than an individual remove from the rear door of his workplace a large, sealed corrugated box and, suspiciously looking over his shoulder, put it into the trunk of his vehicle. You see, absent any other information, I don’t know what the box contained, whether he had permission to remove it, or if the box was even his. For this reason, physical surveillance can rarely be used for anything other than developing corroborative evidence.
1.5.2 Electronic Surveillance
Electronic surveillance is similar to physical surveillance in that it, too, is nothing more than watching people, places, things, and activities. However, unlike physical surveillance, electronic surveillance employs the use of electronic technology in order to improve the results. It, too, is relatively inexpensive and easy to use.
Electronic surveillance also can be used in places and circumstances where simple physical surveillance cannot. Because electronic surveillance uses technology, such as video, covert cameras, and personal computer monitoring software, it can be
used when and where physical surveillance is not possible. For example, if the subject of interest was deep inside a facility, say, inside the employee breakroom, all the possible physical surveillance in the parking lot would never record questionable activity taking place in that breakroom.
However, therein lies the risk. Because electronic surveillance is possible in so many circumstances, users of it must be careful not to deploy it where its use might violate the rights of others. Among them is the right of privacy. The courts have widely held that even in the workplace, employees enjoy a limited right to privacy and the expectation thereof. The limitations of which vary from jurisdiction to jurisdiction. Regardless, a worker’s right to a reasonable expectation of privacy is universal, and to violate it may be both criminally and civilly actionable.
Electronic surveillance is not interactive as well. Like physical surveillance, it has no interaction or communication with that which it is observing or monitoring.
As such, the evidence it produces is typically only corroborative.
1.5.3 Research and Internal Audit
The third method of investigation is the combination of research and audit. This method involves the collection and examination of information from both public and private sources. Many investigators incorrectly use the terms research and audit interchangeably. For the purpose of workplace investigations, the activity called research defines that work involving the collection and examination of public records or public sources. Such sources include the Department of Motor Vehicles, the county clerk’s office where criminal and civil records are stored, and the county
The Process of Investigation ◾ 21
recorder’s office where all manner of records involving real estate transactions are recorded and kept.
Public records often afford the workplace investigator a huge source of information and depending on the type of matter under investigation, possibly the very clues that may make his case. Take, for example, vendor fraud investigations. These frauds typically involve a dishonest purchasing agent who, without the consent or knowledge of his employer, establishes a business with which he does business. In order to legitimize the business as a viable vendor, by formally organizing it and create a legal entity. In most situations, it must be properly registered as a corporation or a limited liability company (LLC). This permits the business to open business banking accounts and perform other functions customary to a legitimate business.
In order to do this, the principal must file certain documents with the Secretary of State in which the business resides. In doing so, public records are created that are available to anyone for the asking. When suspecting vendor fraud, these are precisely the documents the investigator should seek.
On the other hand, audit applies to those records and documents internal to the organization—specifically the examination of documents and information that would not normally be available to someone outside the organization. Such records include attendance records, productivity records, financial record, and even prior investigations. Today, the amount of information organizations generate is stag-gering. Modern enterprises are far beyond merely watching the numbers. Keeping
records on customer wants, needs, buying patterns, and consumption; vendor
capacity, capability, delivery time and reliability; productivity, up-time, down-time, capacity, and even the amount of waste produced are common. No detail,
event, outcome, or result is too small to document. In fact, modern management
tools, such as ISO (International Organization of Standardization) business methods standards and Six Sigma require everything to be measured. Assuredly, no
organization of any size is short on data.
The use of such data is manifold in many workplace investigations. In fact, I tell my students that every workplace investigation employs the investigative method research and audit at some level. Years ago, I conducted an investigation for an aerospace manufacturer that suspected employee theft. The manufacturer produced a complex component used in jet engine fuel flow regulators. For some time,
“per unit” production costs were escalating, yet supply prices and labor costs were stable. The waste stream seemed unchanged and “unit failure” rates were at all-time lows. Buried deep in the mass of information the client kept on its manufacturing process, we discovered that the production of each unit consumed three times the number of screws the unit actually required. Upon inspection of inventories, we found no excesses nor did we discover any undocumented waste or failures.
Purchasing records supported the excessive consumption rates of the screws, but where were they going? We decided to dig even deeper. After taking a close look at each screw vendor, we discovered that two of them oddly operated out of the
same single-family residence. Further investigation revealed the home was that of
22 ◾ Investigative Interviewing
one of my client’s purchasing agents. In short order, he was interviewed and readily admitted he had committed the crime. He further revealed that it was greed
that had motivated him. He explained that after the screws his little firm sold were received and placed into inventory, he would steal them, repackage them, and resell them to his employer again and again. We estimated that some screws had been
repurchased as many as twenty times. Had the client not kept
the detailed records it had, the case may have never been solved.
1.5.4 Forensic Analysis
Forensic analysis is the fourth method of investigation. It includes all manners of investigation that employ science and/or the scientific method. Included in this category are bodily fluid analysis, chemical and substance analysis, fingerprint examination and comparison, computer forensics, various deception detection methods, and forensic document examination. For the purposes of our study, forensic analysis is the catchall category where science and the investigator meet.
Some of the forensic tools available to investigators are rather interesting. One of the least familiar and more fascinating is Benford’s law, a powerful fraud detection tool that predicts the frequency of numbers (digits) in some naturally occurring, unmanipulated groups of numbers. Engineers and mathematicians have long
known of a simple but powerful mathematical model that quickly predicts the
distribution of numbers for “pointing suspicion at frauds, embezzlers, tax evaders, sloppy accountants, and even computer bugs.”11 Frank Benford, rediscoverer of this phenomenon, was a physicist for General Electric, who in 1938 recognized that certain “nonrandomly behaved numbers in nonnormally distributed data sets”
behave in a very predicable fashion. Benford analyzed over 20,000 data sets of various categories and found that all of the seemingly disparate numbers followed the same first-digit probability pattern. Benford’s probability distribution (in percent) of the first digit of any database that meets the criteria described above is shown in Figure 1.2.
Thus, if we examined a data set composed of invoice amounts, Benford’s
law (which is scale invariant) predicts that 30.10 percent of the invoice amounts begin with the digit 1. Those amounts, for example, might be $1.29 or $17,031.81.
Regardless, approximately 30% will begin with the digit 1, roughly 18 percent will begin with the digit 2, and so on. The data set that does not conform, therefore, is suspect. My personal investigative use of this powerful forensic tool has consistently provided insight into corrupt data. Note I said corrupt data, not fraudulent data. Benford’s law only permits us to identify data of interest. It is the job of the fact finder to determine if that data are the result of intentional manipulation and whether that manipulation was the result of a fraud.
Investigative Interviewing: Psychology, Method and Practice Page 6
