Get "The Ultimate Guide to eDiscovery"

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Technology for Employee and Internal Investigations

The fundamental goal of any internal investigation or employer investigation is simple: to confirm or refute suspected wrongdoing within the company. Additionally, internal investigations can play an important role in swaying third parties when necessary, such as judges, jurors, regulators, or the press.

To accomplish either of these goals, however, requires careful planning, a defensible approach to fact finding, and, increasingly, the use of technology that can reduce the cost of investigations and help being them to a speedy resolution.

Logikcull Hero image

What Is Internal Investigation Software?

Internal investigations software helps legal and HR teams quickly upload, process, and review data that could be relevant to their investigation. This process is similar to document review and production in litigation, leading many organizations to embrace eDiscovery software for their own investigations.
When an investigation is triggered, investigators can quickly collect data and simply drag and drop it into their review platform. From there, ingestion is automated. Documents undergo a series of processing steps, including OCR’ing, text extraction, deduplication, virus scanning, and metadata preservation, to prepare the data for review.

Once loaded, review can begin quickly. Bulk culling and auto-tagging reduce the need for eyes-on review.The more sophisticated the review platform’s search capabilities are, the better, allowing investigators to create intelligent, customized searches to quickly identify the “troubled children.”

Timeline of an internal investigation, from trigger to determination

Internal and Employee Investigations 101: The Basics

Internal investigations can cover a wide range of potential topics, from employment disputes to the theft of company intellectual property to regulatory compliance, or the lack thereof.

For companies large and small, the need to conduct internal investigations or employee investigations can be significant.

In 2018, the number of internal ethics and compliance reports reached a record high, with a median of 1.4 reports per 100 employees. This means that the average 500-person company now faces around seven compliance events per year, each of which requires an investigation.

Luckily for investigators, however, there is often a single-prong method to wrongdoing. That is, employees tend to use similar avenues to facilitate bad behavior. So, with the right tools and processes, companies can handle a wide range of workplace investigations with ease, predictability, and defensibility.


  • Fraud
  • Theft
  • Embezzlement
  • Harassment
  • Discrimination
  • Misconduct
  • Workplace policy
  • Employment disputes
  • Unfair competition
  • Intellectual property theft
  • Legal and regulatory violations
  • Abuse of leave
Cover of The Ultimate Guide to eDiscovery, downloaded by 10,000-plus legal professionals
arrow down
Download Now

How to Conduct Employee and Internal Investigations: Best Practices

Employee and internal investigations can span a wide range of potential issues, from employee disputes, to potential theft of company IP, to regulatory compliance—or the lack thereof.Such investigations occur frequently. In 2018, the number of internal ethics and compliance reports reached a record high, with a median of 1.4 reports per 100 employees. This means that the average 500-person company now faces around seven compliance events per year, each of which requires an investigation.

Planning at the Onset of an Investigation

Internal and employee investigations aren’t the place to “shoot from the hip and tidy up later.” Applying repeatability and defensibility to your process is key. Those implementing a new compliance system need to study, analyze, and establish their process and workflow before executing it.Ensuring that investigations are carried out thoroughly and defensibly takes proactive planning. Thinking ahead will not only help your investigation run more smoothly, but it will help demonstrate your commitment to a rigorous, objective and fair investigation to regulators, judges and juries when necessary.At the beginning of an investigation, you should seek to establish:

Advanced planning helps create the repeatable, defensible approaches that reduce cost and mitigate risk. This includes having the right technology ready to go when needed. Now that so much employee misconduct occurs online, investigators need to fight fire with fire. In-sourcing email tracking and document review allows companies to allocate resources effectively, reduce external spend, and take control of their compliance procedures, so they can get back to actual business.

Who Should Conduct an Internal or Employee Investigation?

Putting together the proper investigatory team requires balancing considerations of speed, cost, expertise and impartiality. Typically, internal investigations and workplace inquiries are conducted by one of three groups. Internal human resources teams; internal compliance investigations, or security teams; or third-party experts such as law firms, professional investigators, and security consultants. Each choice has its unique benefit.

Internal HR teams: Having an existing human resources team handle internal investigations can be both efficient and cost-effective. Because HR teams are already familiar with company personnel, policies and investigation procedures, they can get started on an investigation quickly, and shifting work from third-party experts or vendors can result in significant cost savings. However, internal teams also have their day-to-day workload to maintain, which can make the additional work of an investigation burdensome. Thankfully, new technology can empower in-house teams to handle investigations more quickly than ever before.

Internal compliance and security teams: Companies with dedicated compliance and security teams can often handle many of their investigatory needs effectively, affordably, and entirely in house. They process an understanding of corporate policies and procedures, plus the specialized skills and independence that make for an effective internal investigation. Armed with the right technology, internal compliance and security professionals can move quickly to respond to incidents and identify the key facts that decision makers need.

Third-party experts: Third-party experts, such as law firms, security consultants and professional investigators, can play an important role in internal investigations. However, utilizing outside experts can slow the launch of an investigation and lead to extreme expense. Thus, some organizations may bring in outside experts only for particularly risky or complex investigations. Others will conduct the initial stages of the investigation themselves, inviting outside experts in later in the process. In-house professionals, for example, can collect and upload data, even conducting initial culling and review, before inviting in third parties. Doing so in a closed-loop, cloud-based system has the added benefit of allowing companies to keep their information under their direct control while empowering their outside experts to operate more quickly and efficiently.

Factors to consider when selecting your investigations team:

How to Respond Promptly to Potential Misconduct

A speedy response to potential misconduct is essential to neutralizing potential risk—and is often required by law. In the case of alleged sexual harassment, for example, the federal courts have required companies to engage in prompt remedial action in order to shield themselves from liability, and the failure to engage in prompt investigations has led to significant awards against employers.Once an investigation is triggered, technology can play an important role in speeding up a company’s response. Once the appropriate sources of information are identified, such as employee email accounts, company communications, and relevant files, they can be quickly loaded into a document review platform to allow investigators to begin establishing the facts at play.

Speeding up Your Review With Technology

Instead of searching through documents manually—an incredibly slow process—or waiting for third-party vendors to collect and process files, investigation teams can harness modern document review technology to reduce the time from project initiation to document review to a matter of minutes.Here’s how review technology can help speed up your internal investigations. When your information is loaded into a review platform like Logikcull, it goes through thousands of automated processing steps, such as OCRing to make files searchable, metadata extraction to collect valuable information, virus scanning, embedded file extraction, and more. That information can then be used to quickly filter your documents for review.


Using metadata filters, investigators can hone in on the most relevant documents quickly. For example, investigators can use filters to narrow documents by file type, sender, recipient, date range, and more. If the subject of an investigation has been exfiltrating company information by emailing it to a personal account, for example, filters can help identify those actions in a matter of minutes.

Your software should also allow you to “cull”, or exclude, unimportant information. Duplicate documents can be instantly removed, while irrelevant files, spam, and the like can be set aside to avoid unnecessary review.

Add smart searching into the mix, and you can radically reduce the time needed to review documents. Today’s internal investigation tools allow you to engineer powerful searches, whether you are looking for simple keywords or complex relationships between terms. And, since intuitive design is one of the hallmarks of this technology, you don’t need a degree in information sciences to construct powerful searches—the software makes complexity incredibly simple. In many cases, effective search and culling can eliminate the need to review up to 95 percent of a subject’s documents.

The Importance of a Thorough Investigation

To reliably resolve questions of potential wrongdoing and provide decision makers with the information they need to proceed, an investigation must be thorough. To be trusted as reliable by jurors and regulators, rigorous fact finding is necessary. Taking shortcuts, omitting information, or not following best practices can raise suspicions of evasiveness or coverups, undermining the whole purpose of the investigation. Investigators must avoid prejudgement and be willing to follow evidence where it leads them. In some cases, a thorough investigation can require the review of a wide variety of data, much of which may not seem easy to review.

More than 40 percent of the 100 largest American companies use Slack, and the platform often appears as “shadow IT” in organizations where it has not been officially embraced. Employees are scheduling meetings and strategizing, even signing NDAs over chat—and Slack data is becoming an increasingly valuable source of evidence to investigators. If you’re not looking for that data, or don’t have the tools to process and review it, your investigations could suffer as a result.

Professionals don’t communicate solely by memos and email anymore. New forms of communication, like Slack messaging are growing incredibly popular. So, unlike 10 years ago, an investigation that limits document review to discrete document and emails may be missing half the story.

Keeping Investigations Confidential

Internal and employee investigations can involve incredibly sensitive information, information about the company itself as well as those involved in the investigation. In order to protect against the loss of potentially damaging information, investigators need to make sure that their data is secured throughout the investigation process. In order to protect the privacy interests of those involved, they should also seek out the least intrusive method of investigating.

What Are the Least Intrusive Methods of Conducting Internal Investigations and Employee Investigations?

To protect privacy, encourage confidentiality, and conduct a speedy investigation, workplace investigation teams should seek out the least intrusive way to obtain the facts needed. Typically, this means starting with company documents and files to establish the facts before moving on to potentially more invasive investigatory methods, such as interviews with potential witnesses.

To reduce the intrusiveness of an investigation, teams should also focus on collecting and reviewing information that is likely to yield valuable insights. The right investigations software can help preserve confidentiality and reduce intrusiveness in two ways. First, by making it quick and easy to handle large volumes of documents, software allows investigators to quickly identify relevant information from data alone. Second, document review software makes it easy to cull out extraneous information. Teams can quickly organize data by sender, recipient, date range, or keywords, then cull out the information that doesn't matter, so they can focus on the files most likely to supply valuable insights—and reduce both the time requirements and potential invasiveness of an investigation.

How Internal Investigations Technology Works

Companies that are “investigation ready” will have the tools and policies in place to respond quickly and appropriately when an investigation is necessary. This includes having internal investigations technology on hand. Internal investigations software allows teams to quickly process and review documents, in order to gather the facts behind a potential incident.

Discovery software, such as Logikcull’s Instant Discovery platform, is increasingly being used in internal investigations. These tools allow investigators to quickly upload documents for review, from anywhere and on any device. Once data has been uploaded, it undergoes 3,000 automated processing steps, such as OCRing, indexing, metadata preservation, and virus scanning, to prepare documents for review.

Once a matter begins, an investigation team can be in the data, reviewing documents within minutes, creating powerful searches to find the most valuable documents and organizing files by date, author, recipient and more. Software can also be used to easily reduce the number of files requiring review, culling irrelevant documents and drastically reducing the time required and the invasiveness of review.

Finally, cloud-based, closed-loop tools allow in-house teams to keep control over their sensitive data, even when working with outside experts. Rather than send data to an outside vendor, files can be uploaded, processed, and readied for review in a secure, encrypted environment. Outside experts, such as law firms or security consultants, can be invited to aid in review, without documents ever being reproduced or taken out of the company’s control. Intuitive collaboration tools mean that teams can quickly share knowledge, while granular user permissions allow teams to keep information on a ”need-to-know” basis. With the right tools, the time required for investigations can be cut down 70 percent or more.In-house teams are using Logikcull to 10X their internal investigations

Checklist for Choosing the Right Internal Investigations Technology

Quick average time needed to begin review
Ease of use, intuitive design, and simple interface
Search accuracy, including "stop words"
Automated data processing
Ability to handle new data types, such as Slack
Data security and encryption
Ability to keep data in your possession
User permissions and collaboration features
Cost and estimated time savings

Get "The Ultimate Guide to eDiscovery"

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.