A Credible Internal Investigation Is Built for the Forum It May End Up In

The first reader of an investigation report is usually the audit committee or the board. It is rarely the last. Depending on what the report finds, it may be read by the statutory auditor, a regulator, the police, a court, an arbitral tribunal, an insurer, a buyer in due diligence, and the person accused and their lawyers.

An investigation designed for the board meeting will often fail those later readers. One designed for the most demanding of them will satisfy the board as well.

Four tests of credibility

1. Independence that can be shown

The commissioning body should be independent of the subject, usually the audit committee or a committee of independent directors. Investigators should have no reporting, personal or commercial link to the people or decisions under review. Record the conflict checks.

Independence also means that the people whose conduct is in question do not shape the scope, choose the investigators or receive drafts.

2. Evidence that traces to its source

Every finding should be traceable to a document, data record or interview note that has been preserved and can be produced. For electronic evidence, that means forensic imaging or documented collection, hash values and a chain of custody from the start.

Electronic records relied on in proceedings will need a certificate under s. 63 of the Bharatiya Sakshya Adhiniyam 2023, signed by the person in charge of the device and an expert. Our guide to electronic evidence under the BSA explains what it requires.

ICAI's Forensic Accounting and Investigation Standards, mandatory for engagements by ICAI members from 1 July 2023, set expectations on independence, scoping, evidence and reporting that are a useful benchmark for any investigator.

3. Fair process for the people involved

People accused should be told the substance of the allegations and the evidence, and given a real opportunity to respond, before conclusions are reached. Witnesses should be interviewed by trained investigators, with a second person taking notes, and told the purpose of the interview and how the information may be used.

Fair process is not only ethical. If the findings lead to dismissal, a domestic enquiry or court will test whether natural justice was observed.

4. Conclusions that go no further than the evidence

A credible report states what happened, who did what and what the evidence for each finding is, and says clearly where the evidence is incomplete. It does not decide whether conduct amounts to an offence under the Bharatiya Nyaya Sanhita 2023 or s. 447 of the Companies Act 2013. That is for counsel and, ultimately, a court.

Privilege: engineer it, do not assume it

Indian law protects professional communications between a client and its legal advisers; the Bharatiya Sakshya Adhiniyam 2023 carried forward the protections previously in ss. 126–129 of the Indian Evidence Act 1872. The protection is narrower than many boards assume, and the position of communications with in-house lawyers is less settled than that of external advocates.

Practical steps that improve the position:

• external counsel engaged at the outset, instructing the investigators in writing, for the purpose of advising the company;
• investigator reports addressed to counsel, marked accordingly, and circulated only to those who need them;
• factual findings and legal advice kept in separate documents;
• care with board minutes, emails and summaries, which may not be protected even if the report is.

Whether privilege attaches in a particular case needs specific legal advice.

Disclosure realities

Credibility also means planning for disclosure. For listed entities, the initiation of a forensic audit aimed at detecting misstatement, misappropriation or siphoning of funds is a deemed-material event under Schedule III of SEBI LODR, and the final report must later be disclosed with management's comments, except where a regulator or enforcement agency initiated the audit. The statutory auditor may also ask to see findings. Write the report on the assumption that people outside the boardroom may read it.

Common mistakes

• Management investigating itself. A report commissioned and scoped by the subject's own line will not persuade anyone.
• Interviewing the subject first. Without documents and data, the interview cannot test the account given.
• Collecting evidence informally. Screenshots and forwarded emails are hard to authenticate later.
• Scope creep without a record. Expanding into new issues is often right, but the decision and its reasons should be recorded.
• Drafts in circulation. Early drafts with untested conclusions are discoverable risks and leak easily.
• Overstating findings. One unsupported conclusion can discredit an otherwise sound report.

Where we can help

Our fraud and whistleblower investigation team runs independent investigations for audit committees and boards, typically working under the direction of the company's external counsel. Our digital forensics and eDiscovery team preserves and reviews electronic evidence to s. 63 standards, and our litigation and arbitration support team carries findings into proceedings. Speak to us in confidence.