Internal Investigations: 6 Sources to Establish the Facts

A report is not yet proof. When a company receives an allegation of fraud, harassment, conflict of interest or theft, the first challenge is to move from a claim to verifiable facts.

Investigators rarely rely on one decisive piece of evidence. They look for consistent elements that corroborate one another: a message can clarify a testimony, access data can confirm a presence, and financial records can reveal an anomaly that open-source research helps explain.

This guide explains six key information sources in plain language: what they contain, how they are collected and when they are useful.

Essential principle: collection must be authorized, necessary and proportionate to the investigation. It must comply with employment law, data protection requirements, internal policies and the rights of the people concerned. Legal, HR, compliance, security and data-protection teams should be involved where appropriate.

1. OSINT: using publicly available information

OSINT, or Open Source Intelligence, involves finding and analyzing information that is lawfully available to the public. Sources may include corporate registers, official publications, press articles, professional websites and public social-media content.

Investigators should begin with a precise question, document URLs and consultation dates, and assess the reliability and currency of every source. Public information should be corroborated, as namesakes and outdated profiles can create false connections.

Example — undeclared conflict of interest: public registers and professional profiles reveal a possible relationship between an employee and a supplier involved in a procurement process. The finding does not prove misconduct by itself, but identifies a relationship to verify through internal declarations, communications and purchasing records.

2. E-discovery: finding evidence in business communications

E-discovery is the identification, preservation, search and review of electronic information. It may cover emails, Teams conversations, shared documents, calendars and files held in corporate collaboration systems.

Collection should follow a defined scope: relevant custodians, dates, channels and search criteria. Authorized teams preserve and export the data while retaining useful metadata. Broad, speculative collection should be avoided because it increases privacy risk and the amount of irrelevant material.

Example — workplace harassment: a targeted review identifies repeated degrading messages, establishes their frequency and places them in context. The messages are then compared with interviews and other records rather than interpreted in isolation.

3. Investigative interviews: collecting and testing accounts

An investigative interview is a structured conversation with a complainant, alleged victim, witness, internal specialist or subject of an allegation. It helps establish chronology, identify new sources and give each person an opportunity to provide their account.

Interviewers prepare topics, explain the framework, begin with open questions and then seek precise details. They avoid unnecessarily leading questions and keep an accurate record under the applicable procedure. Confidentiality should be explained without promising absolute secrecy.

Example — sexual harassment allegation: the alleged victim describes incidents and identifies witnesses, messages and locations. Separate interviews are conducted with witnesses and the subject. Conclusions are based on the consistency of the whole body of evidence, not on how confidently someone speaks.

4. Digital forensics: analyzing technical traces

Digital forensics preserves and analyzes technical traces from computers, corporate phones, servers and information systems. Depending on the case, those traces may show logins, file transfers, use of external devices, deletions or actions performed through an account.

Qualified specialists secure the device or create a forensic copy, document each step and use methods designed to preserve data integrity. The scope must respect access rights and the possible presence of private data. An action linked to an account does not always prove who physically performed it.

Example — data exfiltration: shortly before leaving, an employee allegedly takes confidential documents. Analysis identifies unusual downloads and copies to an external device. These traces are compared with access rights, normal activity and the rest of the evidence.

5. ERP data: following transactions and approvals

ERP and management systems record suppliers, invoices, purchases, payments, accounting entries, expenses, inventory and approval workflows. They can reveal anomalies and show which process made a transaction possible.

Investigators define the relevant transactions, accounts, users and dates, then obtain authorized exports with change and approval logs where possible. Analysis may identify duplicates, split transactions, unusual amounts, bank-detail changes and atypical approvals. An anomaly is a lead to explain, not automatic proof of fraud.

Example — manipulated expenses: claims repeatedly fall just below a review threshold. ERP data shows split expenses and recurring approval patterns. Receipts, travel records, payment data and interviews help determine whether the cause is error, policy circumvention or organized fraud.

6. CCTV and badge data: verifying physical presence

Access-control systems record the use of badges at doors and restricted areas. CCTV, where installed and lawfully available for the relevant purpose, may provide information about a presence, movement or physical event.

Investigators should act quickly because retention periods may be short. Requests must identify a specific place, period and event. Authorized security teams export only relevant logs or footage and document access. A badge event usually proves use of a badge, not necessarily the identity of its holder.

Example — equipment theft: badge records identify entries around the estimated time of a disappearance. Relevant footage shows unusual movement, while inventory data and interviews clarify the circumstances. Together, the sources help reconstruct the event.

The right method: corroborate sources instead of seeking a single proof

The strength of an internal investigation lies in corroboration. Independent elements should converge toward the same timeline or explanation. In a conflict-of-interest case, for example, OSINT may reveal a relationship, ERP data may show unusual approvals, emails may explain the selection process and interviews allow those involved to respond.

Each item should remain linked to its source, collection date, collector and any transformations performed. A case-management platform can centralize this information, control access and preserve a clear investigation timeline.

Key takeaways

• OSINT reveals relevant public links and facts.
• E-discovery examines business communications and documents.
• Interviews capture the accounts of the people involved.
• Digital forensics identifies technical actions.
• ERP data traces transactions and approvals.
• Badge and CCTV data help verify physical presence and events.

A proportionate investigation starts with the allegations, defines testable hypotheses and selects only the sources needed. Method, not indiscriminate data collection, is what enables investigators to establish facts fairly and rigorously.

Want to structure evidence collection, coordinate stakeholders and secure the audit trail of your internal investigations? Discover how Evidencia centralizes every step from initial report to final decision.