Analysis and Briefings

10th July 2020

How to Choose a Corporate Investigator: 7 Checks Before You Engage One

By Navid Sobbi, Founder and CEO, NSI Global

Originally published 10 July 2020 | Substantively revised 22 October 2026

A corporate investigation can influence a disciplinary decision, an insurance claim, litigation strategy, a transaction, or the response to suspected fraud or information theft. Choosing the wrong investigator can therefore cost more than the investigation fee. Weak scoping, unlawful methods, poor evidence handling or an imprecise final report can leave an organisation with information it cannot safely rely on.

The right question is not simply whether an investigator can “find out what happened”. It is whether they can define the problem, collect information lawfully, preserve relevant evidence, test competing explanations and report findings in a form that decision-makers, lawyers or insurers can scrutinise.

For organisations considering corporate investigation services, the following seven checks provide a practical way to assess whether an investigator is appropriate for the matter.

What Does a Corporate Investigator Actually Do?

A corporate investigator gathers and tests information on behalf of a business, law firm, insurer, government body or other organisation. The work can involve surveillance and field enquiries, but serious corporate matters often extend well beyond those activities.

Employee misconduct, conflicts of interest and policy breaches.
Fraud, false invoicing, procurement irregularities and employee theft.
Workers compensation and insurance investigations.
Intellectual property theft, misuse of client lists and confidential information.
Asset tracing and ownership enquiries.
Background enquiries and enhanced due diligence on people or entities.
Suspected information leakage, insider activity or other integrity concerns.

The important distinction is that the investigator should be selected for the actual problem, not simply because the firm offers surveillance or describes itself as a private investigation agency.

1. Confirm Licensing, Insurance and Legal Authority

Licensing requirements vary by jurisdiction and by the activity being performed. In New South Wales, a person carrying on private investigation and surveillance activities requires the appropriate Class 2E Private Investigator security licence. Businesses providing security operatives must also hold the appropriate Master security licence where required.

Do not treat a licence as proof of investigative quality, but do treat the absence of an applicable licence as an immediate warning sign. Ask the provider to identify the licence or authority under which the work will be performed, and verify the NSW licence on the public register.

Also ask about professional indemnity insurance, contractual confidentiality, information security and any subcontracting arrangements. A corporate client should know who will actually perform the work and who will have access to the information collected.

2. Match the Investigator’s Experience to the Problem

“Years of experience” is not enough on its own. A surveillance investigator experienced in workers compensation claims may not be the right person to examine suspected client diversion, procurement fraud or the misuse of confidential information. Likewise, a researcher skilled in open-source enquiries may not be qualified to acquire and interpret digital evidence.

Ask for experience relevant to the specific allegation, sector and evidence type. For example:

Employee misconduct: workplace process, digital evidence, interviews and employment-law sensitivities.
Fraud: financial records, transaction chronology, corporate structures and corroborating evidence.
IP or client-list theft: devices, email, cloud storage, file access, data transfer and post-employment activity.
Insurance matters: claim history, surveillance, factual investigation and reporting requirements.
Due diligence: beneficial ownership, litigation, regulatory exposure, reputation and cross-border research.

The more serious the potential consequence, the more important it is that the investigator understands the environment in which the findings will be used.

3. Ask How the Matter Will Be Scoped Before Fieldwork Begins

A professional investigation should not begin with “follow this person” unless surveillance is genuinely the right evidence-gathering step. Good scoping starts with the decision the client needs to make and the facts that remain unproven.

Before work begins, the investigator should be able to define:

The allegation or concern being tested.
The decision the investigation is intended to support.
Alternative explanations that should also be examined.
The people, entities, systems, locations and dates within scope.
Which evidence may be volatile or at risk of deletion or overwrite.
What would justify expanding, narrowing or stopping the investigation.

This is particularly important where a seemingly straightforward investigation may require a multidisciplinary response. NSI Global’s Beyond the Scope of a Private Investigator guide explains when surveillance or field investigation alone may leave critical evidence unexamined.

4. Determine Whether Digital Evidence Is Part of the Matter

Many corporate investigations now have a digital component whether the client recognises it at the outset or not. Relevant evidence may exist on company laptops, mobile phones, email systems, cloud storage, collaboration platforms, access logs, messaging applications or removable media.

If an employee is suspected of diverting clients, copying intellectual property or operating a competing business, physical surveillance may show where the person goes. It may not establish what data was accessed, copied, emailed, uploaded or deleted. Those questions may require digital forensic examination.

Timing matters. Digital evidence can be overwritten, accounts can be closed and devices can be reset. An investigator should recognise when forensic preservation is required and avoid ordinary IT handling that may alter timestamps, metadata or other evidentiary artefacts.

5. Examine Evidence Handling and Chain of Custody

Corporate investigations often begin as internal enquiries and later become employment disputes, insurance matters, regulatory issues or litigation. Evidence should therefore be collected as though someone else may eventually challenge how it was obtained.

Ask how the investigator records:

Who collected or received each item.
When and where it was obtained.
How original material was preserved.
Who subsequently accessed or handled it.
What analytical steps were performed.
Any limitations, gaps or assumptions affecting the findings.

A report that simply states a conclusion is weaker than one that connects the conclusion to the underlying evidence and explains the method used to reach it.

6. Test Their Understanding of Surveillance, Privacy and Legal Boundaries

An investigator who promises to “get the information at any cost” is not offering an advantage; they may be creating a liability. Surveillance, tracking, access to communications, workplace monitoring and personal information are subject to legal constraints that depend on the jurisdiction, the technology, the location, consent, ownership and the purpose for which the activity is undertaken.

For example, the NSW Surveillance Devices Act 2007 regulates the installation and use of tracking and other surveillance devices. Whether a proposed method is lawful can depend on the facts and any applicable authority or exception. Privacy obligations may also apply to the collection, use, disclosure and security of personal information. A reputable investigator should be prepared to explain the legal basis for the methodology and recommend legal advice where the position is uncertain.

Clients should also understand the limits. The fact that information would be useful does not automatically make the method used to obtain it lawful. See Legal Limits of Private Investigators for a broader discussion of these boundaries.

7. Assess the Quality of the Final Reporting Before You Engage

The final report is not an administrative afterthought. It is often the product that management, legal counsel, HR, an insurer or a court will rely upon.

Before engagement, ask what the report will contain. A useful corporate investigation report should distinguish:

Established facts from allegations or assumptions.
Observed conduct from interpretation.
Evidence supporting each material finding.
Information that could not be verified.
Methodological or evidentiary limitations.
Any further steps that may be required.

Also consider how sensitive material will be stored, transmitted and retained. Confidentiality should be supported by practical controls, not merely a promise of discretion.

Questions to Ask Before Hiring a Corporate Investigator

A short pre-engagement conversation can reveal a great deal. Consider asking:

What licence or authority covers the work you are proposing?
Who will actually conduct the investigation?
What experience do you have with this type of matter?
What would you preserve before beginning surveillance or interviews?
Could digital evidence be relevant, and how would you protect it?
How do you document chain of custody and evidence handling?
What legal or privacy constraints could affect the proposed methodology?
What will the final report contain, and how are limitations recorded?

When a Corporate Investigator Alone Is Not Enough

Some matters begin as an investigation problem but quickly cross into technical, forensic or intelligence disciplines. Recognising that early can prevent evidence loss and unnecessary duplication of work.

Suspected employee theft of client information: Corporate investigation may need to be combined with digital forensics to establish access, transfer, deletion or use of company data.

Confidential board information appearing outside the organisation: The enquiry may require personnel investigation, digital forensics and, where technical surveillance is suspected, a professional TSCM assessment of sensitive premises.

Concerns about a proposed partner, acquisition target or beneficial owner: The appropriate response may extend beyond a standard background check to enhanced due diligence and intelligence-led research.

Fraud involving email, cloud services or business systems: Digital evidence preservation and forensic analysis may be as important as witness enquiries or surveillance.

Where the issue involves a counterparty or ownership risk, enhanced due diligence may be more appropriate than a conventional private investigation. Where there is a credible concern that sensitive meetings or premises have been technically compromised, corporate office TSCM may also be required.

Red Flags When Choosing an Investigation Provider

Guaranteeing a particular outcome before evidence has been collected.
Refusing or being unable to explain licensing or legal authority.
Offering unlawful access to private communications, accounts or devices.
Beginning surveillance without clarifying the allegation and decision the work must support.
No process for evidence preservation or chain of custody.
Overreliance on technology without understanding its evidentiary or legal limits.
Vague reporting that does not distinguish fact, inference and unverified information.
Unclear use of subcontractors or third parties.

Choosing an Investigator Is Really About Choosing a Method

The strongest corporate investigator is not necessarily the person with the most surveillance equipment or the longest list of services. The better indicator is whether the provider can select a proportionate, lawful and defensible method for the problem in front of them.

For a simple factual enquiry, a conventional investigation may be entirely appropriate. For higher-risk matters involving fraud, employee misconduct, information theft, digital evidence, cross-border entities or suspected technical surveillance, the investigation may need to draw on several disciplines under one coordinated scope.

NSI Global’s corporate investigations are overseen by founder and CEO Navid Sobbi and supported, where required, by in-house digital forensic, due diligence, intelligence and technical surveillance countermeasures capabilities. Findings are documented with the evidence, methodology and limitations so clients can understand not only what was established, but how it was established.

If your organisation needs to establish facts before making a legal, employment, insurance, commercial or risk decision, contact NSI Global for a confidential discussion about the appropriate scope.

Frequently Asked Questions

What Should I Look for When Hiring a Corporate Investigator?

Look for applicable licensing, experience relevant to the allegation, clear scoping, lawful methodology, disciplined evidence handling, appropriate digital-forensic capability and reporting that distinguishes evidence from inference.

Do Corporate Investigators Need a Licence in NSW?

Yes. In New South Wales, private investigation and surveillance activities are regulated under the security licensing regime, with the Class 2E Private Investigator licence applying to individual private investigators.

Can a Corporate Investigator Examine an Employee’s Computer or Phone?

Not automatically. Access depends on ownership, authority, workplace policies, legal obligations and the circumstances of the matter. Where examination is authorised, forensic methods should be used when evidence integrity matters.

What Is the Difference Between a Corporate Investigator and a Digital Forensic Investigator?

A corporate investigator focuses on establishing facts through enquiries, surveillance, interviews, records and other investigative methods. A digital forensic investigator specialises in preserving and analysing evidence from devices, systems, accounts and digital artefacts. Many serious corporate matters require both.

When Should a Lawyer Be Involved?

Legal advice is particularly important where the investigation may affect employment rights, litigation, privilege, surveillance, privacy, access to devices or accounts, regulatory obligations or cross-border activity.