This document discusses best practices for conducting workplace investigations and determining root causes. It outlines the key elements of a thorough investigation, including debriefing involved parties, gathering and analyzing evidence, and assessing credibility. When making a determination, the investigator should have proof for each policy element and close any gaps. There are three potential conclusions: substantiated, unsubstantiated, or inconclusive. Root cause analysis seeks to understand why the misconduct occurred by examining multiple contributing factors beyond any one individual, such as organizational systems involving people, methods, policies, management, and communication. Identifying all potential causes can help prevent recurrence.

1. Investigating Misconduct:
Reaching a Decision and Determining Root Causes
Meric Craig Bloch, Principal, Winter Compliance LLC

2. Meric Craig Bloch
Meric Bloch is the Principal of Winter Compliance LLC, a consulting
practice helping organizations create effective internal investigations
programs through investigation process design, investigator training,
and investigations management.
•Creator of the “Winter Method” for conducting workplace
investigations
•Attorney and past compliance officer for two multinational companies
•Certified Compliance and Ethics Professional - Fellow, Certified Fraud
Examiner, and Professional Certified Investigator
•Author, Workplace Investigations: Techniques and Strategies for
Investigators and Compliance Officers; and The First Information Is
Almost Always Wrong
•Faculty, Society of Corporate Compliance and Ethics’ Basic Compliance
and Ethics Academy
•Conducted approximately 400 workplace investigations

3. The Winter Method

4. Elements of a Workplace Investigation
• A good-faith inquiry that reaches a rational conclusion.
• Thorough debriefing of the reporter, the implicated person, and
witnesses with relevant information.
• Consideration of the relevant issues and standards implicated.
• Gathering and analysis of all relevant evidence.
• Assessment of the credibility of the investigation participants and
the strength of the evidence.
• A rational, legally defensible conclusion of whether the conduct
complained about actually occurred.

5. Identifying Information
• The primary purpose of an investigation report is gathering and preserving
evidence.
• For evidence to be meaningful, it must be concrete and specific.
• We want to know who was involved in the conduct, what that person did,
when and where he did it, and why.
• The facts help decision-makers reach conclusions regarding the root causes
of the event and who should be held accountable.
• The fact findings are generally presented as a factual narrative.
• Know the difference between fact, inference and opinion.

6. Evidence Concepts
• Your evidence must be relevant.
• Your evidence must be material.
• Your evidence must be competent.
• Your evidence must be authentic.
• There is a difference between direct and circumstantial evidence.
• There is a difference between fact and opinion evidence.
• Understand the limitations on hearsay evidence
• A statement of fact repeated by a witness that was made by someone else but is
used to prove the truth of the statement of fact
• There are multiple exceptions to the hearsay rule.

7. Discussion of the Evidence
• Acknowledge the positions of each party
• Describe the evidence in support of each position
• Identify the relevant facts
• Include any admissions of improper conduct
• Discuss exculpatory evidence and mitigating circumstances
• As to disputed facts, assess credibility of the witness
• State the findings of fact that are needed to reach each conclusion
• State the conclusion reached as to each policy element

8. Assessing Credibility
• Is the explanation you are given inherently plausible?
• Does the explanation follow the known timeline of events?
• Is there corroborating evidence to support the explanation?
• Does the person have actual knowledge of that information, or is it
hearsay?
• Are there other objective factors that give it credibility?
• Avoid personal interpretations of the other person’s credibility.

9. Making a Determination
• Did you complete your investigation plan?
• Did you follow your investigation protocol?
• Did you look for proof on each policy element?
• Do you need to re-interview any witnesses?
• Are there any gaps, and how can they be closed?
• Are there any new issues to be investigated?
• Do you need a second opinion?

10. Making a Determination
• Investigations are not based on what you believe happened.
• Your gut feelings are not a substitute for proof.
• The burden of proof is a “preponderance of evidence”
• The criminal justice burden of proof does not apply to workplace
investigations

11. Types of Conclusions
• Substantiated: An allegation is substantiated when an
investigation identifies sufficient evidence to show that it is more
likely than not that each element of the policy / business standard
occurred.
• Unsubstantiated: An allegation is unsubstantiated when an
investigation either (i) cannot meet the burden of proof to
substantiate the allegation, or (ii) proves affirmatively that the
alleged conduct did not occur.
• Inconclusive: An allegation is inconclusive if the investigation is
unable to determine whether the allegation can be substantiated.

12. Framing Your Investigation Finding

13. Root Cause Analysis
• Find out what happened, why it happened, and to identify what can be
done to prevent it from happening again.
• RCA is a structured way of looking at events
• Events are rarely just the fault of one person doing the wrong thing
• People operate in a system. The system can make it easier for them to
do the right thing or more difficult.
• Look to multiple contributing factors.
• If you don’t identify all potential causes, the misconduct is likely to
happen again.
• RCA is not about finger pointing or assigning blame.

14. Two Approaches to Root Cause Analysis

15. Organizational Systems to Consider in RCA
• People
• Education and competence
• Training
• Skills and qualifications
• Methods
• Policies and procedures
• Communication of techniques
• Coordination within and across departments
• Management
• Oversight
• Communication of expectations
• Professional development
• Tone at the Top

16. Different Root Cause Analysis Theories
• The Blame Game
• Blame and shame: Whose fault is this
• Guilt: You committed misconduct when you hired your brother-
in-law
• Move instead from who did to why did this happen.
• Human Factors
• Elements that influence the performance of people
• Policies, training, supervision and experience
• Physical and cognitive abilities to do the job

17. Different Root Cause Analysis Theories
• Tunnel Vision
• When reconstructing what happened, the investigator views the misconduct
causes with a hindsight bias. Outcome determines culpability.
• We look at the misconduct by seeing all the options our colleagues could
have or should have done.
• We perceive it all to be so clear that our colleagues shouldn’t have missed
it. So we judge people for what they did.
• But the quality of decisions are not determined by their outcome.
• But red flags often don’t arrive as revelations.
• But your role is not to judge people for their errors. Instead, we need to
understand why they did it.

18. Different Root Cause Analysis Theories
• The Swiss Cheese Model
• Imagine human systems as multiple slices of Swiss chees,
stacked together side by side.
• An organization’s defenses against failure are modeled as a
series of barriers, represented as slices of Swiss cheese.
• Holes in the cheese slices represent individual weaknesses in
individual parts of the system. Holes are continually varying in
size and position in all slices.
• System produces a failure when all holes in each of the slices
momentarily align.

19. The Swiss Cheese Model

20. Referring the Findings to Law Enforcement
• What are your business goals in contacting law enforcement?
• Do not shop the case around to different agencies.
• Do not contact law enforcement prematurely.
• Be prepared to overcome the perception of an unsympathetic
victim.
• Gift wrap the investigation findings.
• Be prepared to cooperate fully.
• Manage the expectations of your management.
• Resolve your business problems first.

21. Thank-you for participating
If you have any questions about the webinar, please contact:
Meric Craig Bloch
Principal, Winter Compliance LLC
(973) 768 3756
mbloch@wintercompliance.com
@fraudinvestigat8r
https://www.linkedin.com/in/mericbloch
If you have any questions about i-Sight, please contact:
Joe Gerard, Vice President Marketing and Sales, i-Sight
j.gerard@i-sight.com