Internal Investigations Checklist

An effective internal investigation protocol is key to an organisation’s ability to identify and respond to potential issues promptly and efficiently, before they turn into larger problems. A company capable of promptly handling emerging issues internally is more likely to avoid regulatory and government agency inquiries in the first place, and will be better positioned to effectively respond to more formal enforcement action and facilitate a favourable (and speedy) resolution.

This Internal Investigations Checklist outlines key steps for employers to consider when faced with an internal investigation. The checklist is not intended to be comprehensive, as each internal investigation must be tailored to the specific circumstances and issues of the particular complaint, but is designed as an aid to performing successful internal investigations. In addition, many aspects of an internal investigation will vary depending on the local laws in the relevant jurisdiction—seeking local advice is always recommended.

Define the Scope of the Investigation

• Determine the applicable scope of the investigation and identify relevant internal policies, key internal and external stakeholders, and immediate legal obligations (including any notification requirements).
• Ensure that the scope of the investigation aligns with key stakeholder objectives, and that tasks are strategically formulated to appropriately undertake the mandate.

Draft an Investigation Plan/Terms of Reference

• Record the relevant scope, purpose, date range, fact finding tasks, and anticipated closure date of the investigation.
• Define the client clearly, as well as the chain of command, decision making procedures, and internal reporting requirements (including, but not limited to, reports to the board of directors or relevant risk management committees).
• Ensure that the appointed investigation team is independent, impartial, and free from conflicts, and includes personnel who are, or who are capable of becoming, subject matter experts.
• Consider appointing a final “decision-maker” that would have independent oversight of the investigation, such as a non-executive director.

Preserve and Collect Relevant Data

• Identify potential sources of data and take immediate action to preserve and collate relevant documents.
• Identify relevant custodians, including those who have ceased employment with the company, or may do so in the near-term. Note that this list may change as the investigation evolves.
• Suspend routine document destruction procedures for relevant custodians for company-controlled data (e.g., email, instant messaging, recorded phone lines, etc.).
• Consider the sensitivity of the investigation, and whether to send a document preservation notice to custodians prior to interviews to minimise the risk of destruction of data that the company does not control, such as personal mobile data. This may not be an appropriate step for highly sensitive and confidential investigations.
• Document the relevant data sources, preservation and collection procedures, including any applicable internal policies, and next steps to process and review the materials.
• Privilege and disclosure rules may vary, as can data privacy rights (e.g., in relation to the imaging of mobile phone and electronic devices) and the ability to transfer data outside of the jurisdiction.

Engage External Counsel and/or Vendors

• Identify thresholds for when external counsel engagement is appropriate, including an assessment of reputational/monetary/regulatory risk, where independence is required, and/or where attorney-client privilege is likely to be a particularly important consideration. Consider whether additional, local counsel in foreign jurisdictions should be engaged.
• Consider whether other external vendors are required given the scope of the investigation (e.g., e-discovery vendors, foreign language experts or translators, forensic accountants, etc.).

Protect Legal Privilege

• Create a communications protocol to determine when issues should be escalated and reported, and to confirm which issues attract legal privilege.
• In cross-border investigations, clarify the relevant jurisdictions and privilege rules in each, including whether privilege would apply to communications with and/or advice from in-house counsel.
• Identify a narrowly tailored chain of privilege in the investigation plan, including key stakeholders involved on a need-to-know basis.
• Clearly mark and segregate privileged materials from non-privileged materials.
• Specify when external vendors are being retained under legal privilege, including in the formal engagement letter.

Conduct Interviews

• Identify relevant interviewees and determine whether to conduct preliminary scoping interviews prior to a full review of the relevant documents, or to wait until the document review is substantially complete.
• Carefully consider the timing and sequencing of interviews to ensure the credibility of both the witness(es) and the wider investigation.
• Determine appropriate level of documentation, including whether such interview notes will be legally privileged.

Consider When and How to Engage Regulatory Authorities/Other Stakeholders

• Evaluate early and often whether to engage with relevant regulatory bodies, based on both the initial analysis of the conduct, and ongoing fact-finding.
• Self-disclosures are of particular importance in gaining cooperation credit and reduced penalties for certain jurisdictions and agencies.
• Determine whether and when other external stakeholders will be notified (e.g., external auditors, shareholders, etc.).

Mitigate Further Risk & Consider Lessons Learned

• Ensure key stakeholders are kept apprised of decisions taken as result of investigation closure, and consider whether to inform others (e.g., whistleblowers, affected employees, etc.) of actions taken.
• Update company risk assessments, policies and training programs to mitigate the risk of similar issues arising in the future.
• Remediate any risk, controls, and compliance shortcomings.
• Maintain investigation records for appropriate retention period.
• Consider accountability measures for involved employees, including consequence management items, such as training, remediation, compensation adjustments, and termination.
• Prepare a media strategy if the results of the investigation must be disclosed publicly, including updating externally facing company publications (e.g., investor reports, company filings, etc.).

Be Flexible

• Be prepared to adapt your investigation on an ongoing basis, to ensure that the investigation is appropriately conducted for, and achieves, its stated purpose.

Visit us at mayerbrown.com

Mayer Brown is a global services provider comprising associated legal practices that are separate entities, including Mayer Brown LLP (Illinois, USA), Mayer Brown International LLP (England & Wales), Mayer Brown (a Hong Kong partnership) and Tauil & Chequer Advogados (a Brazilian law partnership) and non-legal service providers, which provide consultancy services (collectively, the "Mayer Brown Practices"). The Mayer Brown Practices are established in various jurisdictions and may be a legal person or a partnership. PK Wong & Nair LLC ("PKWN") is the constituent Singapore law practice of our licensed joint law venture in Singapore, Mayer Brown PK Wong & Nair Pte. Ltd. Details of the individual Mayer Brown Practices and PKWN can be found in the Legal Notices section of our website. "Mayer Brown" and the Mayer Brown logo are the trademarks of Mayer Brown.

© Copyright 2026. The Mayer Brown Practices. All rights reserved.

This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.