INVESTIGATIONS GUIDE
How an investigation runs
An investigation runs in stages: a private first conversation, a scope with agreed questions and an estimate, the collection and documentation of evidence, and a written report. This guide walks through each stage, so you know what will be asked of you and what to expect back.
Last reviewed
What happens in the first conversation?
It starts with a private discussion of what has happened and what you need to decide. You do not need a neat account. A rough sequence of events, the names involved and the question that worries you most are enough to begin.
Initial consultations are without obligation; charges apply only once work begins. If confidentiality worries you, we can sign a non-disclosure agreement (NDA) on request. Remote consultations are also available on request if meeting in person is awkward.
Please don’t send case details or evidence until we’ve agreed a secure way to receive them.
How is the work scoped and priced?
A good scope turns a worry into answerable questions. “Is someone stealing from us?” becomes “Were these supplier payments genuine, and who approved them?” Narrow questions lead to clearer findings and a fairer cost.
Set the questions
Agree what the investigation must establish, and what sits outside it.
Identify the sources
List the records, devices, people and open sources likely to hold the answers.
Agree the limits
Confirm what is lawful to collect, who may be approached and how contact is handled.
Confirm the estimate
It depends on the case; we give an estimate before work begins.
Scopes can change as facts emerge. If a new line of enquiry appears, agree any change to the scope and the estimate before it is pursued.
What should you gather beforehand?
You can save time by collecting what you already hold, without digging further yourself. Leave originals where they are and note their location.
- A short timeline of when the concern arose and what prompted it.
- Names and roles of the people involved, including anyone who raised the alarm.
- Contracts, invoices, statements or correspondence you already have copies of.
- Any court orders, judgments or demand letters, if the matter is already in dispute.
- A list of company devices and accounts that may be relevant, with who controls them.
How do different matters differ?
The stages above apply to every matter. What changes is the material examined and the question being answered.
| Matter | What the work looks at | The usual question |
|---|---|---|
| Fraud | Fraud examination supported by forensic analysis of records and transactions, cross-checked against emails and approvals. | How did the scheme work, who was involved and what amounts were involved? |
| Asset tracing | Property, vehicles, company interests and funds, followed through available records. | What does a person or company own, and where is it held? |
| Intellectual property | Suspected trade secret theft or data leakage, and online marketplaces monitored for infringing or counterfeit listings. | Has confidential material left the business, or is a copy being sold? |
| OSINT | Lawful research using information that is openly available to the public. | What can be established about a person, company or network from open sources? |
How is evidence kept and documented?
Every item received is logged on a chain-of-custody record: what it is, where it came from, when it arrived and who has handled it since. Original paperwork is handled as little as possible and kept in the state it arrived in.
Digital material is copied in a way that leaves the source unchanged, and a cryptographic hash value is recorded so anyone can later check that the copy matches. Open-source findings need the address and date they were seen recorded alongside them, because web pages change or disappear.
What does the report say, and who sees it?
A useful report sets out what was examined, what was found and how each finding was reached, in plain language. Facts are kept apart from opinion, and gaps or uncertainties are stated rather than smoothed over. Findings are peer reviewed by a senior examiner in line with our standard operating procedures.
Decide early who will receive it. A short list protects the people named and the integrity of any later process. If litigation is possible, ask your advocate whether the investigation should be commissioned through them, which can affect whether the report stays confidential.
An investigation establishes facts; it does not decide blame. Whether evidence is admitted is decided by the court in each case. Our examiners give expert witness testimony when instructed by counsel or the court.
Terms in this guide
Questions
How long does a private investigation take?
It depends on the case; we give an estimate before work begins. Matters with many records or several countries usually take longer than a single focused question.
Will the person being investigated find out?
Raise this at the outset. Who may be approached is agreed with you during scoping, and limiting who knows inside your organisation helps keep the matter discreet.
Is OSINT research legal?
Open-source intelligence uses information that anyone can lawfully access. It does not involve hacking accounts, pretexting or obtaining private records, and personal data found this way is still handled in line with Kenya’s Data Protection Act 2019.
Can an investigation recover stolen money?
An investigation can establish what happened and where assets appear to be held. Recovery itself then depends on legal action, which your advocate leads.