At PPM, we provide those involved in investigation management, security, and risk with the best incident management software to enhance their business processes. Part of our ethos is also sharing knowledge relating to the business with those involved in it. With this ongoing commitment in mind, we have invited John Buckley to share his ideas on how professionals can effectively manage investigations, brand protection, and loss prevention. If you haven’t yet, read John’s previous posts in this series: Defining Incident Management, Protecting Your Brand by Knowing the Extent of the Problem, and Intelligent Loss Prevention.
“If you can’t describe what you are doing as a process, you don’t know what you’re doing.” – W. Edwards Denning
Is an Investigation Management Process Overkill?
William Edwards Denning was a USA-born engineer and management consultant. He is often credited as being one of the most influential figures in the post-World War 2 economic recovery of Japan, so perhaps he knew a thing or two about systems and processes.
The process discussed here is that of investigation management. For many businesses, the thought of actually developing a process to investigate incidents may seem something of an overkill. Assured in themselves that nothing bad will happen, and that they do not need an actual investigation process, businesses adopt a laissez-faire approach, confident that they will be able to muddle their way through anything that occurs. Others may be more confident that they have a process in place that can manage an incident and they happily go about their daily business—but ask any staff member how they would go about managing the investigation of an incident and there are likely to be blank faces all around.
So why does every business, whether public or private, manufacturing, retail, or service need an investigation process? Quite simply, if ‘bad things’ are not already happening, then at some stage down the tracks they undoubtedly will. The organization needs to be able to investigate what happened and why. If they don’t, bad things will continue, damaging the business.
Incidents can come in many shapes and forms and can include health and safety, criminal acts, alleged breaches of employment law, cyber-attacks, copyright breaches, and staff complaints of harassment or bullying. Each of these types of incidents needs thorough investigation, not only to protect the company, but also because a failure to investigate such incidents may have legal ramifications. For example, if an employee makes allegations of sexual harassment and chooses to begin a lawsuit against the company, a court is likely to look very unfavourably on that company. Especially if the business was unable to produce evidence of how they investigated the alleged incidents.
Setting aside potential legal ramifications, effective investigation is important because it is about minimising harm to the company. No sane employer wants their employees to be injured at work, but if a company does not thoroughly investigate the causes of every health and safety incident that occurs, then they are unlikely to be able to prevent similar events from happening in the future. In a similar vein, if a company doesn’t carry out comprehensive investigation into criminal acts, such as retail theft, then profits will continue to walk out the door.
Comprehensive investigation is not merely recording the facts about what happened; it is about seeking to find out how and why something has happened and drawing from the knowledge gained to mitigate the risk of it occurring again. It requires time and effort and where some incidents may be relatively simple to investigate, others may be highly complex. If there is no process in place to manage the investigation, it is much more likely that pieces will be omitted or overlooked and important evidence may be lost. A proper investigation management process details how the investigation should be carried out, each of the steps that the investigator should take including, what needs to be recorded, completed, and where evidence should be kept. It’s also imperative to include a record of what decisions where made and who made them.
Businesses need to remember that often the people charged with investigating an incident may have little or no prior experience. Few organizations have the benefit of having trained investigators on the payroll. Investigating an incident may fall to a line manager, or if it is personnel related, to the head of human resources—yet it is rare for such a person to be qualified to carry out the task. They need to be shown the steps to follow and be able to check off each task as they have completed it. For businesses that have trained investigators, the need for an effective process to manage an investigation is even more pressing. If the business has large enough problems to warrant an investigator on their team, they need an effective investigation management process. It is self-evident that their investigations are likely to be much more complex. Investigators need the tools to enable them carry out their job. It is foolish to waste money on employing an investigator only to put them in a broken or dysfunctional investigation system. As Denning says: “A bad system will beat a good person every time.”
About the author: John Buckley is an independent consultant, speaker, and author with many years of practical know-how in assisting organisations with forming their business priorities and investigation management. He specialises in investigation, intelligence, risk management, and counter terrorism protective security. He is the author of three books relating to intelligence and risk management, and provides training and consultancy on an international basis. John currently resides in the United Kingdom.
If you would like more information on how PPM’s investigation and security case management software can work for your organisation, send us an email. We’d love to hear from you.
The post Is an Investigation Management Process Overkill? appeared first on PPM.