What do you do to collect evidence in an investigation? You just ask for it mostly. So, at the beginning, that’s typically the biggest piece of information gathering when you meet your client contact and they start prepping you up to go off to do your investigation. You’re going to want to ask for things like pertinent policies and personnel records, with those be careful not to collect health information that isn’t relevant. Those should always be separate from disciplinary records anyway, but sometimes in smaller or less sophisticated organizations, they are not. And so you always need to say, “I don’t need anything at the social security number or with confidential health information on it, but I do want things like performance reports, write-ups, really any of the odds and ends that are in there.” I usually don’t need an application unless credentialing has anything to do with the investigation.
And then the next big batch of evidence often comes with the reporting party because they have the documents that are going to corroborate what they’re saying and what they’re complaining about because they’ve been thinking about this longer than anybody else. They knew this was a problem before they outcried. So that’ll be your second big batch of evidence.
Don’t overthink this. Unless you’re conducting an investigation that you think will go to the police, there is no reason to act as if this is a criminal investigation because it is not, it is a civil investigation in the workplace. You don’t usually need to do things like say, “Okay, who approves this policy? What date did they approve it on? Did they have the authority to approve this policy?” Generally, that stuff is way outside the scope of your investigation.
That being said, the big instance where it comes up, that you may know that something is going to have police involvement, is if there is a theft or an assault. Remember also that police investigations need to come first. If you are doing any kind of computer forensics, you do want to have a credentialed forensic investigator working on your IT. But if that forensic investigator happens to come across porn on a computer and particularly child porn, they will stop working on that equipment because that is a federal offense. And once you either intentionally or knowingly, or even accidentally stumble across something like child porn, you need to stop everything you’re doing, stop working on that computer, get out a piece of paper and start tracking a chain of evidence. And the chain of evidence tracking just means recording something like “on Tuesday at 3:15, we stumbled across this. We stopped what we were doing and I handed the hard drive to the police.” The next step will be to take that piece of paper and say, “On Thursday at four o’clock, I gave the hard drive to the FBI.” And that will aid in the investigative case. In more normal situations filing sharing usually occurs over email or some kind of file sharing.
