How organisations establish facts, preserve evidence and investigate sensitive allegations without starting from a predetermined conclusion.
ORIGINAL PUBLICATION: 23 February 2022 REVISION COMPLETED: 28 September 2026 AEST
By Navid Sobbi, Founder and CEO, NSI Global
A corporate investigation is a structured process used to establish facts about suspected misconduct, fraud, insider activity, conflicts of interest, data misuse, intellectual-property theft, procurement irregularities or other events that may expose an organisation to loss, legal action or reputational damage.
The purpose is not to prove management’s preferred explanation. A sound investigation defines what is alleged, preserves the evidence capable of testing it, follows relevant lines of inquiry, gives affected people an appropriate opportunity to respond where required, and reports what the evidence supports – including when it does not support a definitive finding.
Some matters can be handled internally by legal, HR, compliance or security teams. Others require an independent external investigator, digital forensic examiner, financial specialist or other subject-matter expert. The right approach depends on the allegation, the evidence, the people involved, the organisation’s policies, legal obligations and the consequences of getting the answer wrong.
Corporate Investigations Begin With a Question, Not an Assumption
The original version of this article described corporate investigation primarily as a way to identify and prove unlawful conduct. That is too narrow. A company may need to investigate conduct that is criminal, civil, regulatory, contractual, disciplinary, unethical or simply inconsistent with internal policy. In some cases, the investigation may ultimately show that the allegation was mistaken or cannot be determined from the available evidence.
A useful starting question is therefore not ‘How do we prove this person did it?’ but ‘What happened, what evidence can answer that question, and what alternative explanations must be tested?’ That difference affects the entire investigation – from evidence preservation and interviews to reporting and management decisions.
What Can Trigger a Corporate Investigation?
| Investigation Type | Typical Question | Evidence May Include |
| Employee misconduct | Did an employee breach policy, duty, employment obligations or an instruction? | Email, devices, access logs, documents, interviews, CCTV or business records. |
| Fraud or financial misconduct | Were money, assets, expenses, procurement processes or company authority misused? | Financial records, approvals, communications, supplier data, access records and interviews. |
| Insider threat | Was legitimate access used to steal, disclose, manipulate or destroy sensitive information? | Endpoint artefacts, cloud logs, removable-media activity, file access, email and identity records. |
| Intellectual property or confidential information | Was proprietary information copied, transferred, disclosed or used without authority? | File metadata, cloud activity, messaging, USB artefacts, browser history and document repositories. |
| Procurement or conflict of interest | Was a business decision influenced by an undisclosed relationship, interest or improper benefit? | Corporate records, financial links, communications, due diligence, declarations and transaction history. |
| Whistleblower allegation | Can the reported conduct be tested while protecting confidentiality and procedural fairness? | Protected disclosures, records, witness evidence, electronic data and independent corroboration. |
| Cyber or data misuse | Was information accessed, copied, changed, shared or deleted without authority? | Digital forensics, identity logs, cloud audit trails, endpoint telemetry and account records. |
| Third-party misconduct | Did a contractor, supplier, intermediary or partner act outside its authority or obligations? | Contracts, communications, due diligence, transaction records and field enquiries. |
An Investigation Needs a Defined Scope Before Evidence Is Collected
Poorly scoped investigations expand quickly, collect unnecessary personal information and make findings harder to defend. Before substantive investigative work begins, the organisation should identify the allegation or issue, the period under review, relevant people and systems, decision-making authority, confidentiality requirements, known conflicts and the legal or policy framework that applies.
The scope should be capable of changing when genuinely new evidence emerges, but expansion should be deliberate and documented. A new allegation may belong within the existing matter, require a separate investigation or need referral to another function or authority.
Fair Work Commission guidance for registered organisations provides a useful procedural benchmark: define the allegations and scope, identify investigator authority, avoid actual or perceived conflicts of interest, document lines of inquiry and base decisions on evidence and facts. The legal requirements for a particular company or investigation can differ, so counsel should be involved where employment, whistleblower, privacy, regulatory or litigation issues are material.
Preserve Evidence Before the Investigation Changes It
Corporate investigations increasingly depend on electronic evidence. Email, collaboration platforms, mobile phones, laptops, cloud accounts, access-control systems and business applications can change through normal use, automated retention, synchronisation, account closure or IT remediation.
Where digital evidence is likely to matter, preservation should occur before routine troubleshooting, reimaging, device replacement, account deletion or broad collection changes the original state. This does not mean every workplace matter requires a forensic image. It means the organisation should identify what evidence is material and use a collection method proportionate to the purpose.
NSI Global’s Digital Forensics practice supports authorised internal corporate investigations, employee misconduct matters, insider threat, intellectual-property theft, unauthorised access and evidence preservation.
Digital Evidence Can Reconstruct Conduct That Ordinary Review Misses
A document folder or mailbox rarely tells the whole story. Specialist analysis may be required to determine when a file was created or copied, whether removable media was connected, which account accessed a repository, whether material was deleted, how a communication travelled between devices, or whether an apparently innocent event fits into a larger timeline.
Depending on the matter and lawful authority, relevant sources can include email, cloud audit logs, mobile devices, messaging applications, browser artefacts, document metadata, access records, identity logs, endpoint telemetry, removable-media activity and backups. These sources should be interpreted in context: a technical artefact can establish an event, but it does not automatically establish motive or misconduct.
Interviews Test the Evidence; They Should Not Replace It
Witness and subject interviews remain central to many corporate investigations. They provide context, identify additional evidence and allow competing explanations to be tested. The sequence matters: interviewing too early can alert people before volatile records are preserved, while interviewing too late can leave documentary evidence unexplained.
Questions should be tied to the defined allegation and evidence rather than designed to secure a confession. Investigators should distinguish what a person directly observed from inference, hearsay or assumption, and should document material inconsistencies rather than selectively recording only evidence that supports one theory.
Procedural Fairness Matters When Findings Affect People
Where an investigation may lead to disciplinary or other adverse decisions, procedural fairness can become critical. Fair Work Commission guidance states that people who are the subject of allegations should have an opportunity to respond before a final decision is reached, the decision maker should be impartial and free from actual or apparent bias, and the decision should be based on the issues, evidence and facts.
The Commission’s unfair-dismissal guidance also considers whether an employee was notified of the reason relied upon and given a genuine opportunity to respond before a dismissal decision was made. The exact legal requirements depend on the circumstances, applicable legislation, employment instruments and organisational policy.
This is one reason the investigator and ultimate decision maker are often separated. The investigator establishes findings within the approved scope; management, the board, HR, counsel or another authorised decision maker determines what action follows.
Not Every Allegation Ends With a Finding of Wrongdoing
A credible investigation must be capable of reaching more than one outcome. Fair Work Commission guidance for registered-organisation investigations identifies three common findings: substantiated, not substantiated, and inconclusive or unable to determine.
That distinction protects the integrity of the process. ‘Not substantiated’ does not necessarily mean the allegation was fabricated, and ‘unable to determine’ is not the same as proof that nothing happened. It means the available evidence did not justify a stronger conclusion.
Reports should explain the evidence relied upon, material evidence that points the other way, limitations, unresolved issues and the rationale for each finding. Avoid language that overstates what the evidence can establish.
Whistleblower Investigations Need Additional Controls
A corporate investigation may begin with a whistleblower disclosure. Where the disclosure qualifies for protection under the Corporations Act, confidentiality and anti-detriment obligations can materially affect how the organisation handles the matter.
ASIC states that companies investigating protected concerns must take reasonable steps to avoid disclosing information likely to identify the whistleblower without consent, subject to the circumstances permitted by law. At the same time, an investigation may need to afford procedural fairness to people who are the subject of the allegations. Those obligations need to be managed together rather than treating confidentiality as an absolute promise that can never interact with the investigation.
Whistleblower matters should be scoped with the organisation’s policy and legal obligations in mind. Legal advice may be necessary before information is circulated, identities are disclosed, interviews are planned or investigation records are shared.
Internal or External? Independence Should Match the Risk
The old article suggested corporate investigations should only be conducted by external professionals. That is not a sound general rule. Many organisations appropriately investigate matters internally through HR, legal, compliance, security or audit functions.
The real issue is whether the investigator has the authority, capability, independence and access needed to conduct the matter fairly. Fair Work Commission guidance expressly contemplates both internal investigators and external parties, and says an external party should be considered where the organisation is unable to investigate or where it would be inappropriate to do so.
| Internal Investigation May Be Suitable When | External Investigation May Be Preferable When |
| The allegation is narrow and the organisation has an experienced, conflict-free investigation function. | A senior executive, board member or investigation decision maker is implicated. |
| Evidence is readily available and specialist forensic work is unlikely to be required. | Actual, potential or perceived conflicts could undermine confidence in an internal process. |
| The issue is primarily an internal policy or workplace matter with established procedures. | Litigation, regulatory referral or a significant whistleblower matter is likely. |
| Management can separate the investigator from the person making the final decision. | Specialist digital forensics, financial investigation, field investigation or cross-border enquiries are required. |
| The organisation can preserve confidentiality and provide appropriate oversight. | The independence of the findings is itself important to the board, counsel, insurer, regulator or other stakeholder. |
Corporate Investigation and Due Diligence Are Different Questions
The two disciplines overlap, but they should not be treated as interchangeable. Due diligence is usually forward-looking: should the organisation hire, appoint, invest, contract, lend, acquire or extend trust? A corporate investigation usually begins after a defined concern or event and asks what happened, who was involved and what the evidence can establish.
An investigation may use due-diligence techniques to examine corporate structures, hidden interests, counterparties or relationships. Likewise, due diligence may identify anomalies that later justify an investigation. The purpose and evidentiary question should still be clear.
For pre-transaction and counterparty risk, see Enhanced Due Diligence and Background Checks
Surveillance and TSCM Are Specialist Tools, Not Routine Steps
The original article listed covert surveillance and TSCM as ordinary methods within a corporate investigation. Both can be relevant, but neither belongs automatically in every matter.
Surveillance may be appropriate only where it is lawful, proportionate and genuinely relevant to the defined issue. Licensing, privacy, workplace, insurance and surveillance-device laws can vary by jurisdiction and activity. TSCM belongs where there is a credible technical-surveillance or information-leakage concern – not as a substitute for digital forensics, interviews or documentary analysis.
Where technical surveillance is suspected, see Technical Surveillance Counter Measures
A Defensible Corporate Investigation Follows a Disciplined Sequence
Define the allegation and authority – Clarify the issue, decision maker, applicable policy, legal constraints and purpose of the investigation.
Identify conflicts and appoint the investigator – Confirm independence, expertise, access and oversight before substantive work begins.
Preserve material evidence – Secure relevant documents, devices, accounts, logs and other records before normal business processes alter them.
Plan the scope and lines of inquiry – Identify witnesses, systems, documents and questions capable of testing the allegation and alternative explanations.
Collect and analyse evidence – Use documentary review, interviews, digital forensics, financial analysis, due diligence or other methods according to need.
Put material allegations to affected people – Provide an appropriate opportunity to respond where procedural fairness or policy requires it.
Test competing explanations – Look for evidence that contradicts the leading theory rather than treating inconsistency as an inconvenience.
Make findings within the evidence – Distinguish substantiated, not substantiated and unable-to-determine outcomes where appropriate.
Report facts, limitations and rationale – Explain what was examined, what was not, why findings were reached and where uncertainty remains.
Hand decisions to the authorised decision maker – Discipline, remediation, referral, litigation or control changes should follow through the appropriate governance process.
When Digital Forensics Changes the Investigation
Digital forensics becomes especially important when the dispute turns on what a person did with a device, account, file or communication. A conventional IT review may identify active files and account settings; a forensic examination can preserve evidence, recover relevant artefacts, reconstruct timelines and document methodology for later scrutiny.
NSI Global’s Digital Forensic Incident Response practice uses a structured nine-stage DFIR-EDM methodology covering authority, chain of custody, preservation, collection, processing, analysis, review, production and reporting. The methodology is relevant where the investigation may feed into litigation, regulatory action, employment proceedings or another process in which evidence integrity matters.
Learn more: Digital Forensic Incident Response
How NSI Global Supports Corporate Investigations
NSI Global’s investigations practice handles corporate fraud, internal misconduct, intellectual-property matters, asset tracing, due diligence and other sensitive corporate enquiries. Where a matter requires specialist evidence, NSI can coordinate investigative work with its in-house digital forensics, enhanced due diligence, TSCM, intelligence and litigation-support capabilities.
The objective is to use the method that answers the question. A corporate investigation should not become a collection of every capability available; each method needs a defined evidentiary or risk-management purpose.
NSI Global’s current investigation services are delivered for corporations, law firms, financial institutions, government bodies and other authorised clients. The appropriate scope depends on the allegation, jurisdiction, lawful authority, confidentiality requirements and intended use of the findings.
Related service: Corporate Investigators
Questions to Ask Before Starting a Corporate Investigation
- What exactly is alleged, and what decision will the investigation inform?
- Which evidence could confirm or disprove the allegation?
- What must be preserved immediately before ordinary business activity changes it?
- Is there an actual, potential or perceived conflict for the proposed investigator?
- Does the matter involve whistleblower, privacy, employment, surveillance or regulatory obligations?
- Will specialist digital forensic, financial, intelligence or technical-surveillance expertise be required?
- Who is responsible for procedural fairness and for putting allegations to affected people?
- Who will make the final management, disciplinary, legal or regulatory decision?
- What findings are possible if the evidence is incomplete or contradictory?
- How will the organisation record limitations, preserve the investigation file and control access to sensitive material?
Frequently Asked Questions
What Is a Corporate Investigation?
A corporate investigation is a structured fact-finding process used to examine suspected fraud, misconduct, insider activity, data misuse, conflicts, intellectual-property theft or other business risks. It defines the issue, gathers and tests evidence, and reports findings for an authorised decision maker.
Can a Company Investigate Its Own Employees?
Yes. Internal investigations are common and can be appropriate where the organisation has capable, impartial personnel, clear authority and suitable procedures. An external investigator may be preferable where conflicts, seniority, complexity, specialist evidence or the need for independent findings make an internal process inappropriate.
When Should an External Corporate Investigator Be Appointed?
Common triggers include allegations involving senior management or the board, actual or perceived conflicts, significant whistleblower matters, likely litigation or regulatory scrutiny, serious fraud, cross-border evidence, specialist digital forensics or circumstances where stakeholders require demonstrable independence.
What Evidence Is Used in a Corporate Investigation?
Evidence can include documents, emails, mobile-device data, cloud logs, access records, financial transactions, CCTV, corporate records, interviews, witness material and specialist forensic artefacts. The relevant sources depend on the allegation and lawful authority.
What Is the Difference Between a Corporate Investigation and Due Diligence?
Due diligence usually assesses a person, company or transaction before trust is extended. A corporate investigation usually examines a defined concern or event after a trigger has arisen. The same research tools may sometimes be used, but the purpose is different.
Can Digital Forensics Be Used in Employee Misconduct Investigations?
Yes, where there is lawful authority and electronic evidence is relevant. Digital forensics can preserve and analyse devices, accounts, files, communications and timelines in a manner designed to maintain provenance and evidentiary integrity.
How Should a Whistleblower Investigation Be Handled?
Qualifying whistleblower disclosures can carry statutory confidentiality and anti-detriment protections. The organisation should apply its whistleblower policy, control identifying information, consider legal advice and design the investigation so confidentiality obligations and procedural fairness are both addressed.
Does an Investigation Have to Prove the Allegation?
No. A credible investigation may substantiate an allegation, not substantiate it, or conclude that the available evidence is insufficient to determine what occurred. The report should explain the basis and limitations of the finding.
Is TSCM Part of Every Corporate Investigation?
No. TSCM is appropriate when there is a credible concern about technical surveillance or information leakage from a physical or communications environment. It is a specialist counter-surveillance discipline, not a routine substitute for ordinary investigation or digital forensics.
Sources and Further Reading
- Fair Work Commission – Internal investigation by the registered organisation – Procedural guidance on scope, conflicts, investigator authority, evidence, procedural fairness, findings and reporting. The page is directed to registered organisations and is used here as a procedural reference rather than as universal legal advice for every company.
- Fair Work Commission – Opportunity to respond – Explains the opportunity-to-respond consideration in unfair-dismissal matters under the Fair Work Act.
- Fair Work Commission – Valid reason relating to capacity or conduct – Discusses investigation quality, reasonable opportunity to respond and findings based on reasonable grounds in unfair-dismissal matters.
- ASIC – Whistleblower rights and protections – Current guidance on whistleblower confidentiality, detriment protections and investigation handling under the Corporations Act.
- ASIC – Company officer obligations under the whistleblower protection provisions – Guidance on protected disclosures, identifying information, investigation confidentiality and procedural fairness.
- NSI Global – Corporate Investigators – NSI Global corporate investigation services covering fraud, misconduct, due diligence, asset tracing and intellectual property.
- NSI Global – Digital Forensics – NSI Global digital forensic capability supporting internal corporate investigations, employee misconduct, insider threat and intellectual-property theft.
- NSI Global – Digital Forensic Incident Response – NSI Global’s DFIR-EDM methodology and evidence-preservation capability for high-stakes investigations.
