Glossary
Investigation Plan
A written plan that scopes a whistleblower investigation, identifies evidence sources, and assigns roles. A typical plan includes a neutral statement of alleged conduct, rules potentially breached, evidence sources, witness order, privilege assessment, confidentiality protocol, timeline anchored to the 3-month feedback deadline, named roles, and a decision-rights matrix.
Full definition
An investigation plan converts a triaged report into an executable workstream. A typical plan includes: a statement of the alleged conduct in neutral terms; identification of the specific policies, contracts, or laws potentially breached; an inventory of evidence sources (documents, system logs, witness interviews, expert opinions); a witness list with order of interview (peripheral witnesses first, subject last is standard practice); a privilege assessment (which workstreams should be conducted under legal privilege); a confidentiality protocol referencing Article 16 of EU Directive 2019/1937; a timeline aligned with the three-month substantive-feedback obligation; named roles (lead investigator, document custodian, interviewer); and a decision-rights matrix specifying who approves the closure recommendation. Good investigation plans are revised as evidence emerges; the original and revisions are part of the audit log. Most regulatory criticisms of corporate investigations point not to bad evidence-gathering but to absent or vestigial planning at the start.
Related terms
- Case Handler The trained individual inside an organisation who triages, investigates, and resolves whistleblower reports. Under EU Directive 2019/1937 Article 9 the case handler must acknowledge receipt within 7 days, maintain confidentiality, log every action, and deliver substantive feedback within 3 months. Case handlers must be free of conflicts of interest and trained in trauma-informed interviewing.
- Chain of Custody The documented record of who handled evidence, when, and with what authority, from receipt through final disposition. Defective chain of custody can render evidence inadmissible in disciplinary, civil, or criminal proceedings. Practical discipline requires cryptographic hashes on upload, immutable log entries on access, signed URLs that expire, and an exportable audit trail.
- Interview Protocol The procedural rules followed when interviewing reporters, witnesses, and subjects in a whistleblower investigation. Covers preparation (review records, prepare outline, decide on recording), conduct (explain confidentiality, free narrative before specific questions, avoid leading questions), and documentation (contemporaneous notes, formal memorandum within 48 hours, interviewee opportunity to review).