What should be in your investigative protocol. I would suggest five steps: (1) Opening and Categorizing the Case; (2) Planning the Investigation; (3) Executing the Investigation Plan; (4) Determining Appropriate Follow-Up; and (5) Closing the Case. If you follow this basic protocol, you should be able to work through most investigations, in a clear, concise and cost-effective manner. Furthermore, you should have a report at the end of the day that should stand up to later scrutiny if a regulator comes looking. Finally, you will be able to document, document, and document, not only the steps you took but why and the outcome obtained.

Step 1: Opening and Categorizing the Case. This first step, to categorize a compliance violation and it should be accomplished in one to three days after the allegation comes into compliance.

Step 2: Planning the Investigation. After assembling your investigation team, determine the required investigation tasks. These tasks should be integrated into a written investigation or work plan so that the entire process going forward is documented. If there is a variation from the written investigation plan, such variation and the reason should be documented. Step 2 should be accomplished with another one to three days.

Step 3: Executing the Investigation Plan. Under this step, the investigation should be completed. This Step 3 should be accomplished in one to two weeks. 

Step 4: Determining Appropriate Follow-Up. At this step, the preliminary investigation should be completed and you are ready to move into the final phases. You should be ready to decide on the appropriate disciplinary steps or other actions to take. This Step 4 should be completed in one day to one week.

Step 5: Closing the Case. Under this final step, communicate the investigation results to the stakeholders and complete the case report. The case report should be completed. This Step 5 should be completed in one day to one week.

Your investigative protocol is important on several fronts. First, you want to have an established procedure in place before an issue comes in for investigation, so you are not making it up as you go. Second, the government will expect rigor around your protocol so having a written protocol in place is important if the regulators come knocking. Finally, by having a known protocol it will help make it appear the investigation is performed fairly.