Preserve first, ask second
· 1 min read · דניאל מעוז
The single most expensive mistake in internal investigations is confronting the subject before the evidence is secured. Here is the order that works.
Every internal investigation has a moment where somebody wants to just ask the person directly. That instinct is understandable, and acting on it early is the most expensive thing you can do.
What an early confrontation costs
It converts an unaware subject into an aware one. Within hours: files deleted, devices reset, accounts accessed from home, and — in more than one file we have run — a resignation letter that removes your access to the person entirely.
The order that works
- Devices out of use. Not powered down mid-write, not examined, but isolated.
- Images and mail backups taken by someone who can testify to how.
- Access and permission logs pulled before retention policy expires them.
- Interviews from the outer circle inward. The subject is last.
By the time you sit down with the subject, the documents should already be on the table. That conversation is for their explanation, not for your discovery.
The one exception
Where there is an immediate risk of ongoing loss — funds still moving, access still live — containment comes first. Even then, containment and confrontation are different actions, and only one of them can wait.
These articles are general information and are not a substitute for specific advice. The law differs between jurisdictions, and every matter is assessed on its own facts.