chevron-down Created with Sketch Beta.
September 17, 2019 Articles

Internal Investigations Best Practices, Part II: Interviews

The investigator's job is to be methodical and well prepared with an investigation plan, yet willing to adjust course as the evidence dictates.

By Paul Rodrigues and Thomas Wagner

This article is the second in a two-part series on internal investigations best practices. As discussed in the first part of the series, once proper protocols are established, the on-site investigation can proceed.

In the second part of this series, we focus on the role that interviews play in the investigation. The approaches and techniques used in interviews will vary based on the type of interviews conducted. For purposes of this article, we will be focusing on “fact-gathering interviews” and “admission-seeking interviews.” A fact-gathering interview is an interview designed to gather facts and to further inform the investigation; this type of interview typically is conducted with witnesses. An admission-seeking interview is an interview designed to encourage a suspect to admit wrongdoing.

The Interview Plan

We cannot overstate how important it is to properly prepare for the interview. All aspects of the interview should receive careful attention, including creation of a list of witnesses and suspects; background investigations of witnesses and suspects; formulation of questions; order of interviews and a plan for when and how to contact the witnesses; and consideration of the interview location(s) and the preparation of the interview space, if practical. Determine with legal guidance from the attorney directing the investigation whether the interview can be videotaped or audiotaped. Also determine whether a goal of the interview is to obtain an affidavit, creating discoverable evidence.

The interview plan should include the identification of witnesses to be interviewed. Witnesses can be a useful resource and help the investigator connect the dots of the investigation. Witnesses can also help the investigator by, for example,

  • shedding light on potential motives,
  • providing the names of any parties potentially involved,
  • providing details on how the scheme was carried out, and
  • providing insight into the potential extent of the stolen assets and any disposition of the stolen assets.

The interview plan should also include a list of potential suspects, as well as where and when the interviews of those potential suspects will take place. If the investigator is fortunate enough to be engaged prior to the suspect leaving the organization, the investigator should move forward quickly, with a goal of interviewing the suspect prior to his termination or prior to his retention of an attorney.

Prior to interviewing witnesses and suspects, thorough background investigations should be performed. These investigations may include searches for motives, such as financial distress (e.g., bankruptcies, liens, judgments, tax warrants, etc.), hidden assets, or indications that the subject is living beyond his means. Social media research frequently reveals useful information. However, investigators should take precautions to not reveal their identity inadvertently to the subject. If a dark-web investigation is deemed prudent, be sure to use an expert in the field. Due to the nature of the dark web, reliable information may only go back approximately three weeks.

The stronger the investigator’s understanding of the case and the scheme perpetrated, the more likely it is that the investigator will ask the right questions. The investigator should have an outline of questions to be asked, starting with open-ended general questions and then moving to more focused questions as the witness loosens up and starts providing basic information. The investigator should be sure to close the loop on each incident with the five W’s (who, what, when, where, why) and the H (how).

One of the primary concerns during the interview process is that once witnesses have been contacted, they might start talking to other witnesses and potentially the suspect, even when asked to keep the interview confidential. Therefore, the investigator should predetermine the order of interviews and how and when the witnesses will be approached. The order could depend on various factors, including which witnesses are still employed and are obligated to cooperate, the likelihood that someone will cooperate, and the evidence implicating the potential witnesses.

When developing an interview plan, one strategy is to organize the names of all of the potential witnesses into a circle. The witnesses who are most likely to cooperate (and who generally have the least involvement in the case) should be placed on the outer rim of the circle. The witnesses who are more likely to have pertinent information (and who generally are more likely to be reluctant to cooperate) should be placed toward the center. The suspect(s) should be placed in the epicenter. Start interviewing witnesses on the outside, working your way in, as feasible. This way, as the case proceeds, the investigator gains more relevant knowledge and has as much information as possible when finally confronting the suspect(s) during an admission-seeking interview. The cooperating witnesses (often unbeknownst to the suspect(s)) can be used to help guide the order of future witnesses, providing suggestions for lines of questioning and avenues of investigation.

It is best to have an environment clear of distractions if possible, but the interview location may be challenging. Some interviews will take place under less-than-ideal circumstances, so be prepared to improvise. For example, it’s not unheard of to interview farmers while they are milking cows, CEOs while they are at a health club, contractors at a construction site, or witnesses at their homes on a weekend afternoon.

Because of budget and time constraints, some clients may request that interviews be conducted telephonically rather than in person. This should be discouraged. First, the chances of actually obtaining a phone interview versus an in-person interview are significantly decreased due to a witness or suspect not dialing in for a call or not answering the phone. It is much easier for a witness to decline to be interviewed via telephone than to refuse a face-to-face request. Second, the investigator will be deprived of all personal contact and opportunities to build rapport and read the witness’s body language and any other nuances of the interview not captured during a telephone conversation. These observations can be crucial to an investigator in determining if the witness is truthful or dishonest.

The Interview

The investigator’s first order of business is to establish rapport with the witness/suspect. This process starts the second that the investigator makes contact with the witness and continues throughout the entire interview. Be creative. Sometimes something as simple as the investigator noticing a university bumper sticker on someone’s vehicle as she approaches the house and telling the witness that the investigator’s niece or nephew also attended that university can build rapport instantly and help ease tensions. Start with something, no matter how small, and build from there. Always look for commonalities on which to capitalize. Rapport also means recognizing the interviewee’s body language, speech cadence, and temperament and adapting one’s interviewing style accordingly.

If the interview is in a controlled environment, such as a conference room, give witnesses the impression that they can leave if they want to so as to avoid a false imprisonment situation. Accordingly, do not block or lock the door; either leave the door cracked open, or, better yet, seat the witness closest to the door and have the witness close it. If a second investigator/notetaker is used, this person should sit off to the side so as not to distract the interviewee.

At the beginning of the interview, investigators should clearly identify who they are, who they represent, and the general topic or subject to be discussed, unless a cover story is deemed necessary by the attorney leading the investigation.

An interview is a conversation that the investigator gently, yet strategically, directs. Acting as the witnesses’ ally and as a sounding board can help them feel validated and can assist them in expressing and/or rationalizing the wrongdoing. Keep the interview a judgment-free zone. The interview is a place where the investigator gives a new “best friend” permission to complain or cry about the environment and circumstances in place that facilitated, or even encouraged, the wrongdoing. It is important to be patient, giving interviewees the opportunity to complete their train of thought without interrupting the flow of information.

In an admission-seeking interview, the investigator may want to show the suspect documentary evidence to overcome any objections or denials. However, in some situations, it is a better strategy to let deceptions go unchecked, waiting to confront the suspect with the evidence later. The investigator is always one question away from a suspect walking out of an interview.


Investigators must be careful about promises and information that they offer. The investigator cannot guarantee that a witness’s statement will be kept confidential, even if asked to keep a statement confidential. Sometimes suspects or witnesses may ask the investigator if they will be prosecuted. Investigators should discuss this possible scenario with counsel before the interview; and when such situations do arise, they must be careful in answering. Using the threat of criminal prosecution to gain a civil advantage might constitute extortion, so the investigator should not make any promises to a suspect regarding potential prosecution.


When using direct questions in an admission-seeking interview, sometimes it is helpful to ask alternatively worded questions. Instead of asking suspects if they committed an act, one technique is to form the question with a built-in assumption. Thus, the following is an inferior question:

“Did you falsify the accounting data?”

Alternatively, ask the following question:

“Did Fred convince you to falsify the inventory spreadsheets, or did you do that before you brought Fred in on the deal?”

In the event that the investigator receives an admission(s), the investigator should be prepared to write an affidavit on the spot, or, better yet, have the suspect write his own admission statement.

An affidavit should outline all of the incidents of fraud or wrongdoing to which the suspect admits and should include the five W’s and the H for each instance. An affidavit should declare that the statement was given voluntarily and that no promises were made to the affiant. In addition, the affidavit should clearly identify the investigator. If the investigator is in private practice, specifically state whom the investigator represents and that the investigator is not representing any law enforcement agency or district attorney’s office. The affidavit should be initialed at the top and bottom of every page; should end with an oath; and, if possible, should be notarized.


In conclusion, the investigator’s job is to be methodical and well prepared with an investigation plan, yet willing to adjust course as the evidence dictates.

The interview itself calls for the investigator to take on several roles. In addition to having command of the logical and factual aspects of the case, the investigator will employ interpersonal communication and observational, emotional, and relationship skills to initiate and nurture a complex, albeit brief, relationship with the witness/suspect. During this relationship or conversation, the investigator should engage in metaphorical hand-holding, guiding the suspect and providing the suspect with space and permission to vent, complain, and, most of all, rationalize actions and explain motivations. The conversation can result in something of a catharsis, presenting an opening for the suspect to get gain relief by making an admission.

Obtaining a signed confession usually leads to swift settlements and recovery from the perpetrator and/or insurance claims—an optimal result that often follows from employing internal investigations best practices.

Paul Rodrigues, CFE, CPA, CFF, CGMA, MST, is a senior director at the BERO Group LLC, Milwaukee, Wisconsin. Thomas Wagner, CFE, CLI, is the managing member at Wagner & Associates LLC, Milwaukee, Wisconsin.

Copyright © 2019, American Bar Association. All rights reserved. This information or any portion thereof may not be copied or disseminated in any form or by any means or downloaded or stored in an electronic database or retrieval system without the express written consent of the American Bar Association. The views expressed in this article are those of the author(s) and do not necessarily reflect the positions or policies of the American Bar Association, the Section of Litigation, this committee, or the employer(s) of the author(s).