Case File Review: Policy and Process guidelines to complete a successful investigation
1.
Introduction
Properly conducted investigations form a key part in our strategy in protecting
assets and reducing loss. If poorly managed, an investigation can lead to
increased risk of future loss and significant damage to the corporate brand. In
commencing any investigation we need to consider the impact in terms of the
protection of business assets and limiting potential liabilities weighing against
the reputation of the organisation or damage to the brand should the investigation
fail. Post Office Security are almost unique in that unlike other commercial
organisations we are a non police prosecuting agency and are therefore subjected
to the Codes of Practice and statutory requirements of the Police and Criminal
Evidence Act.
There is another anomaly that sets us aside from other commercial investigators.
Of our 11,800 branches, only 370 are currently staffed by employees of the Post
Office. In the majority of cases branches are either Franchisees or Agents that
receive remuneration. As neither is deemed to be employees of the Post Office,
the usual practices and procedures of an employer employee investigation do not
apply.
In cases where fraud is uncovered and good evidence of criminality exists, then a
criminal investigation will invariably commence. At the same time Post Office
Contract Advisors have the responsibility to ensure that any contractual breaches
are investigated and impact on the business is minimised. As a result close
communication needs to maintain between the Security Manager investigating the
criminal investigation and the Contract Advisor who needs to maintain Post
Office services. If this relationship is maintained then solid decisions can be made
with the benefit of all the facts and evidence shared to ensure that there is a
successful outcome to the investigation that benefits the business.
With the stakes so high, the department must be seen, internally as well as
externally, to be acting fairly, appropriately and within the law. The investigation
needs to be properly conducted to establish evidence that will support a successful
criminal prosecution.
The Purpose
5.
This guide been prepared as part of the case file review and is intended to support
Security Managers from the commencement through to the conclusion of the
investigation. Included in the document is comprehensive guidance of the process
including key points to consider at various stages of the investigation.
POL00039970
POL00039970
POL00039970
POL00039970
6. Prior to commencing an investigation the Security Manager will have to consider
The Seriousness of the allegation
The level of criminality
Any contractual, compliance or regulatory concerns
The potential to damage the reputation of the Post Office
The expectations of key stakeholders
Aims and objectives
7. It is important to consider the aims, objectives and scope of the investigation. Not
all Post Office investigations are criminal; the Security Manager may be called
upon to investigate employees under the grievance and disciplinary procedure. It
is important to determine what type of investigation is required, what time frames
are in place, available resources and what other issues may affect the conduct of
the investigation. An example may be a flag case with potential to damage the
reputation of the business where senior stakeholders have an ongoing interest in
the progress of the investigation.
Investigation Plan
8. When a case is raised the Security Manager needs to prepare an investigation plan
which will outline the terms of reference in the way the investigation will be
conducted. Points to consider include:
Risk assessment
Duty of care
The source of the investigation
Statutory, regulatory or compliance considerations
Impact on the organisation
Media
Timeframes
The Investigation process
9. The Security Manager has been tasked to prove or dispel the allegation. In
criminal cases where the burden of proof is beyond all reasonable doubt, it is
necessary to draw on all available evidence which is likely to substantiate the
allegation. In cases concerning the Horizon system it is important to establish the
level of training the subject received, when this was received and action the
subject took to remedy any identified faults. A key points to cover template has
been produced to ensure that Security Managers establish these facts during the
interview process. As part of the evidence gathering process, the Security
Manager can collect evidence from various sources including :
Statements from witnesses [current, previous members of staff]
Expert witnesses
Post Office accounting and HR databases
Contract Advisor database
CCTV
Banking records
Telephone records
Interviews with suspects
It is vital that all available witnesses are interviewed. If there is a good reason for
not doing so this must be recorded in the progress of investigation log.
Progress of the Investigation
10.
All significant steps in the investigation including any lengthy delays in
concluding the enquiry need to be recorded. The progress of investigation
document will eventually form part of the unused material and should be
produced with the file. The details of investigation need to be sufficiently
informative although an element of objectivity needs to be applied.
. Recording an action or point on something which is fairly inconsequential is an
unnecessary waste of time; however significant points, recorded objectively can
become critical should the enquiry concern contact with Horizon experts, Fijitsu,
availability of witnesses, stakeholders or any other activity which enforces undue
delay.
. A culture needs to be embedded where Security Managers are aware and fully
understand the importance of providing a comprehensive chronological account
of an investigation, not merely to avoid undue criticism, but also where there
could be an issue with the case at some later stage which may undermine the
likelihood of successful prosecution.
Procedural fairness
13.
The Security Manager must not overlook the fact that a fair investigation is there
to establish the truth as well as substantiate the allegation so it is important that
any evidence uncovered that may support the suspects position is also recovered.
It is important to document every action, decision and reason for decisions being
made during the course of the investigation.
POL00039970
POL00039970
POL00039970
POL00039970
Supervision of the Investigation
14. Proper consistent supervision is vital to ensure that cases are thoroughly
investigated and submitted in a timely manner. Team leaders with the support of
the Financial Investigators need to quality assure the investigation making sure
prior to initial submission that all available evidence has been gathered.
15. From the point the case is first raised team leaders should give due consideration
to the merits of a criminal investigation.
16. The decided course of action needs to be proportionate and necessary. It may, if
the circumstances warrant be more appropriate to consider other actions that
could be done that don’t necessarily lead to a criminal investigation. Examples
include pursuing a civil enquiry for breach of contract, civil debt recovery,
training review refresher, briefers, additional auditing, a caution, warning letter
and or NFSP engagement. Some of these possible outcomes may not be obviously
apparent until the suspect is interviewed although should be built into the process
at this early stage. Close communication and cooperation with key stakeholders is
essential to ensure, proper and considered course of action is taken.
17. On completion of the file, it will be submitted to the team leader for checking,
signing off and forwarded to Legal Department via registration. Should further
investigation be deemed necessary at this stage, the file will be returned to the
Security Manager. Where a request is made from Post Office Legal for further
enquiries, the team leader will be copied into the relevant email. It is imperative
that the progress of enquiry document is comprehensively kept up to date and
copies of any generated emails saved. These can be inserted into the file when the
enquiries are complete.
18. Should advice be sought from Cartwright King solicitors, the team leader and
Legal will be copied onto to any requests for further evidence. The details of
investigation log must be maintained and copies of emails retained. On
completion of the enquiry, the green docket case file will be sent to the Security
Manager for copies of any emails to be inserted along with the progress of
investigation log prior to final submission to Head of Security via the team leader.
Conclusion of the investigati
19. On completion of the investigation, it is vital that a review of the route cause of
the investigation is undertaken by the Security Manager. It is important to
ascertain whether any system processes, integrity of the financial commercial
product, technical issues, training delivered or procedures may have provided an
opportunity to commit the offence. As important, the vulnerability of the product
or process in its current form and likelihood of similar offences being committed
POL00039970
POL00039970
in the future needs to be considered. A comprehensive report outlining the cause
of the offence will be submitted to Commercial Security at the conclusion of each
investigation.
Retention
20. As part of the Post Office retention policy, case files must be archived and
retained for at least 7 years.
BE INSERTED IN THE GUIDELINES AT APPROPRIATE PLACE
Lawyer Present
21. Where the rights of a lawyer to be present are offered to the subject who wants
his/her own solicitor and they are not available, consider your position in terms of
recovering evidence at not compromising the investigation. In this instance
inform the suspect that as his lawyer cannot attend within a reasonable time,
arrange for the suspect to be arrested and booked in local police station where
solicitor from nominated list can be offered or the duty solicitor scheme. [7his is
more likely to happen where the Security Manager is present at the time of the
audit and there is a justifiable need to conduct a recorded interview with the
subject to capture any evidence that otherwise may be lost]
22. Reasonable time may differ depending on the circumstances and any action taken
needs to be justified and documented. It is likely that an explanation for this
course of action will be required at court. A rule of thumb is what the average
layperson may consider reasonable given all the facts. It is important to note that
the need to gather evidence and investigate the case in a timely manner is not
unduly compromised.
23. Arrest by the police can be justified on the basis that there are reasonable grounds
to suspect an offence has been committed. Inviting the suspect to the police
station to obtain legal representation is not effective as the alleged offender is at
liberty to leave at any time. Asking for their own solicitor establishes an element
of control over the process. The investigator needs to remain in control without
jeopardising the suspect’s legal rights.
Interview
24. Consider maximising the opportunity to capture evidence at the earliest stage, ie
where there is a significant comment; in more complex cases where a more in
depth interview is required hold a preliminary interview, cover off the significant
POL00039970
POL00039970
comment and a second interview at a later stage when more evidence is gathered.
Think of the Golden Hour of capturing the evidence. Always follow the PEACE
model [Planning, Engage and Explain, Account, clarification and challenge,
Closure, Evaluation]. Consider the ingredients of the offence; dishonestly
appropriates property belonging to another with the intention of permanently
depriving the other of it. Ensure that these are established during the interview.
Deep dive into areas where defences are likely. These can be countered by careful
planning and skilful questioning. A comprehensive guide to conducting
interviews has been produced as part of the review and is available for reference
along with a template for interviewers that has been produced following
publication of the second sight interim report.
PARAS 24 TO 28 RELATE SPECIFICALLY TO THE AUDIT TEAM AND CAN BE
INCORPORATED INTO THEIR TRAINING PROGRAMME
Significant Comment
25. Auditors are to be encouraged to record any significant comment made in the
course of the audit either unsolicited or in response to a reasonable question to
complete the audit such as “ J have checked the money in the safe and there
appears to be a shortage, is there any money stored elsewhere that needs to be
checked” . In the case of the unsolicited comment, the auditor should record this
ie J know you will find a shortage, I borrowed the money. However any further
question such as “why” would constitute an interview.
26. In such cases, the auditor should inform the suspect that their comment will be
recorded but any further questions concerning the comment will be conducted
under caution where the suspect has been accorded their rights.
27. In cases where the suspect wishes to off load, the auditor again should record the
initial comment, advise the suspect as above and if they keep off loading, note in
the record, that the suspect was advised that he/she would have the opportunity to
be interviewed by a Security Manager under caution at a later stage. THEN
CONTINUE TO RECORD THE COMMENT. Again any questions even for
clarification from the auditor would constitute an interview and could/would
render the evidence inadmissible.
Record of Conversation
28. At the current time Auditors record any significant comment on a Record of
Conversation form. This encourages an interview to take place which will have an
adverse impact on the evidence. This should be changed immediately to “Record
of any significant comment”
POL00039970
POL00039970
Signing a declaration
29. Rather than the form printed “This is an accurate account of what was said” or
words to that effect, the suspect should be invited to record this declaration
themselves and sign. Should the suspect not wish to write this, then the auditor
must write it. Deal with refusal to sign in the usual way recording “ Declined to
Sign”
One on One interviewing
30. One on one interviewing should be considered on a case by case basis. There is no
reason why in a straight forward investigation where there have been admissions
and risk is considered low, that a one on one tape recorded interview should not
be considered. This will free up resources and should be encouraged wherever
possible. Clearly in more complex cases, where there is a need to pre prepare and
the nature of the investigation may benefit from an interviewer with greater
subject knowledge, then the interview must be conducted by two persons.
Similarly for training and development purposes.
31. Ht is good practice to switch the recorder on as soon as possible following the
Security Manager’s arrival at the premises where the subject is due to be
interviewed. Set the tone, by exchanging pleasant and engage in cordial
conversation, At the commencement of the formal interview, review with the
subject what has occurred so far. Again at the conclusion of the interview allow
for the machine to run on and review again what has occurred and invite the
interviewee to comment on any areas of concern. Not only does this serve as good
practice in making the interviewee feel at ease, significantly it protects the
interviewer against any malicious allegations that may occur in the future.
Case Summary
32. The case summary should be a succinct chronological account of the investigation
highlighting key facts. The rule of thumb is to produce an account which the
reader can quickly digest to get a general knowledge of the allegation. Key
witnesses and a brief outline of what they say can be included as well as a
synopsis of what was said during interview. The statement index, interview record
and exhibit list can be examined should the reader require further information.
Interview notes
33. In the majority of cases at initial submission, the MG15 [POL form: Notes of
interview] needs to be a brief account of the interview and any significant
POL00039970
POL00039970
comment. It is therefore good practice to write down a note of the interview and
generally what was said on completion. There will be less need to rely on
listening to the tapes again at a later stage which is time consuming. An example
note could be: throughout the interview the subject stated that he had borrowed
the money to make up a shortfall and when challenged over this accepted that it
was wrong/dishonest to take the money.
34. No comment interviews should not be transcribed. Unless there is a very good
reason for a full transcript in the majority of cases for the initial submission, a
note of interview will suffice. Where prosecuting lawyers request a transcript as
part of the advice process or for preparation for committal proceedings it will be
completed by the transcribers, checked and sent by the Security Manager.
Searching
35. In all cases a search of the premises should be considered and provided it is in the
spirit of Section 18 and 32 of PACE [Reasonable Grounds to suspect there is
evidence on the premises that relates to the offence [Need to check wording]
36. Searches are conducted by consent, however where the subject refuses to consent,
the same principle applies as [Confirm Martin Smith Cartwright King] with
delays over legal advice. Where there are reasonable grounds to suspect that
evidence that will dispel or confirm the suspect’s involvement in the offence will
be found, then contact police with a view to arrest the suspect. A search can then
be conducted by police following arrest [Section 32 PACE] or subsequently
following the suspect being detained at the station [Section 18 PACE]
w
=)
A note should be made in the progress of enquiry as to why a search was not
deemed necessary, and line manager informed. Likewise it is imperative that a
record is made of the reasons for arrest and subsequent search.
Continuity of Evidence
38. Good communication with the audit team is crucial to ensure evidential resilience
in relation to the continuity of exhibits. Where the auditor recovers original
documents following the audit, ideally these must be retained until arrangements
are made with the Security Manager to take the auditors exhibiting statement.
Every effort must be made to ensure that the person finding is the person
exhibiting and original documents that will form the evidential basis of the case
are retained until collection. The continuity will be stronger if the documents
seized are secured and handed over against a signature.
39. In circumstances where the only viable way is to send the documents through the
post they should be sent by the Auditor to the named Security Manager RD. In
such circumstances, the Auditor must ensure that a complete copy of all the
documents is made prior to despatch.
40. On receipt of original documents, they should be copied by the Security manager
and stored in a secure cabinet.
Copy documents
41. There is no reason why documents cannot be scanned to the Investigator prior to
preparing an interview, such as any significant comment in circumstances where
it is evidentially beneficial to get the suspects account on tape at the earliest
opportunity.
42. All exhibits should be signed and dated on the label, including future handling.
Post Office exhibits do not need to be inserted into a sealed tamper proof bag.
Although should be used in circumstances where the suspect hands over a
quantity of receipts or other potentially useful documents. These should be sealed
in the presence of the suspect in a tamper proof bag signed and dated by the
recipient. When subsequently examined by the security manager, any documents
used can be exhibited and the remainder form part of the unused material. The use
of a tamper proof bag will limit the likelihood of the suspect alleging that
documents were handed over that supported his case but were not recorded or
exhibited anywhere.
The continuity of exhibits remains a thorny issue which requires a best efforts approach.
More often than not, the Investigator is not present at the audit and has to rely on the
Auditor to gather the documentary evidence. Ideally the finder should be the exhibitor but
this perhaps sits more in the aspiration tray! The Auditors currently do not have the
necessary skill level required to manage a crime scene in terms of exhibit retrieval. The
current practice although short of ideal is for documents found to be handed into to the
lead Auditor who collectively packages the document, signs and seals the package and
sends to the named Investigator who exhibits the documents covering off the continuity in
the statement. Clearly where the Investigator has arranged the audit one would expect
him/her to be present. This would solve the problem with the exhibits.
Statement taking
43. Rather than a hand written Section 9 statement, there is no reason why a draft
statement cannot be prepared in note form. The statement can then be typed up
subsequently, with any changes, clarification or ambiguity amended. Provided the
original notes are retained [A ruled bound black and red where pages cannot be
torn out could be used per investigation, and form part of the disclosure bundle]
POL00039970
POL00039970
POL00039970
POL00039970
44. On typing up the statement it can be sent to the recipient for checking and
amending. Once agreed, the statement should be signed and sent back to the
investigator.
Statement taking over the telephone
45. Where this can be done to save time and resources, it must be encouraged.
Statement taking over the telephone is an accepted and modern practice. In the
case of statements where exhibits are produced it is vital that a copy of the exhibit
referred to in the statement is scanned and emailed to the witness.
Disclosure
46. Going forward, case files will include a schedule of unused non-sensitive material
and unused sensitive material [Public Interest Immunity, Legal Privilege and
documents that may highlight the methods used for investigation] The Appendix
“C” in the case file will be retained by the Security Manager as oppose to
submitted with the file. However this does not apply to the progress of enquiry
report which will stay with the file and marked up “Confidential, not subject to
disclosure” in ted font. Where solicitors may wish to examine any unused
material it should be requested and sent by the Security Manager.