When things go wrong internally; fraud, harassment, data leaks, ghost workers, it is not what happened that destroys your organization. It is how you respond. Most boards and CEOs hesitate, outsource blame, or overcomplicate the process. That is how rot spreads.
Here is the practical, unfiltered guide from Institute of Forensics & ICT Security experts on how to conduct internal investigations and disciplinary hearings effectively without losing the plot which usually could cost the organization’s reputation and more money.
- a) The trigger: Know when to act
(i) Every investigation begins with a trigger. A whistleblower email. A financial discrepancy. A complaint of harassment. An exceptional report by the Internal Audit or Analytics team. A system flag of an exceptional event. Do not wait for a perfect storm. The best time to investigate is when your gut tells you, “Something is off.”
(ii) In 2010, a young lady in her mid-20s went directly to the CEO’s office. She was a cashier at a microfinance institution in Mbale. Her supervisor was forcing her to process loan top-ups for ghost clients. Her reports to head office were ignored. She risked everything to blow the whistle. That’s the real trigger. The courage of one. That is how we got involved as case investigators.
(iii) Once a trigger is identified, activate your internal risk committee or a trusted triage team. Never the whole HR or audit department. Small, tight, and skilled wins.
- b) Scoping the investigation
(i) Define what you are investigating. Not “Is there fraud,” but “Did person X manipulate loan disbursement records between January and March 2024?” In investigations, clarity of the investigation objectives is key.
(ii) Avoid kitchen sink investigations. Scope creep kills credibility. Focus on facts, not gossip. Hard evidence not hearsay and opinions. You are investigating to identify who did what, where, when, and how. Better have your facts in order. Remember, there is no draft evidence!
(iii) Create a work plan with milestones: document review, interviews, forensic review, draft report.
- c) Evidence gathering: the audit trail is king
(i) Review emails, finance logs, door access records, and CCTV footage if available. In Uganda, where logs are often manual, focus on inconsistencies. Cross-check signatures, approvals, timestamps.
(ii) In one case in Arua, our investigators discovered that fuel vouchers were signed by a staff member who had been on maternity leave. That single signature opened a trail of collusion worth UGX 124 million.
(iii) Interview key suspects last. First, gather all evidence. Interviews are not fishing expeditions. They are confirmations. Better first take their statements. Study their alibi. Collect all supporting evidence. And interview only to connect the dots and determine the consistency of their statements. Investigations is a skill.
- d) Conducting the disciplinary hearing
(i) Once evidence is clear, write a report (see next article on this) and prepare for a hearing. Send a formal letter to the accused with clear allegations, hearing date, right to representation, and relevant documents.
(ii) Form a panel with an HR rep, a legal adviser, and a neutral chair. Avoid panels of friends or enemies.
(iii) Hear both sides. Ask open questions. Let the accused respond freely. Maintain a verbatim record. In many cases, the truth slips out in tone, not words.
- e) Disposition: conclude with integrity
(i) Decide based on facts, not emotions. Was there a breach of policy? Was it gross misconduct? Was it negligent or malicious?
(ii) Document your decision. Clearly outline reasons. Issue a sanction proportional to the breach: warning, suspension, termination, or referral to police.
(iii) In the Mbale case, the supervisor was terminated and reported to police. The cashier was promoted and became head teller. Protect whistleblowers if you want a culture of truth.
- f) Lessons learned: Fix the root
(i) Every investigation must end with a report to management. What control failed? Where was oversight weak? What culture enabled the breach?
(ii) Use findings to fix systems: update procedures, train staff, or even restructure departments. Otherwise, the next investigation will be déjà vu.
An investigation is not about who you punish. It is about what you allow.
Start fast. Stay focused. Finish with courage.
That is how we build institutions that last.
Unlock your investigative skills and become a reporting pro: Sign up today for our Investigation and Report Writing Course and start making an impact!
The IFIS Team
Copyright IFIS 2025. All rights reserved.
