How documenting facts helped a company protect assets worth EUR 2.8 million

The enquiry did not begin with an incident but with an accumulated sense of unease. The management of a European company had, for several months, observed the behaviour of one of its senior executives and could not account for part of what was happening through ordinary business logic. Certain decisions were made faster than usual, certain approvals bypassed the customary route, and some business contacts were reflected neither in the calendar nor in reporting.

Taken individually, none of these observations meant anything. An accelerated decision could result from urgency, an unexplained meeting could be a private matter, and a change in working style could simply be fatigue or preparation for leave. The problem lay not in the observations themselves but in the fact that they could neither be confirmed nor ruled out.

At the same time, the cost of error was high in either direction. If the suspicions were well-founded, delay meant risk to contracts, the client base and commercial information. If the suspicions were mistaken, any careless action by the company toward a senior executive would itself become a legal and reputational risk - potentially escalating into an employment dispute in which the employer would have to account for its own methods.

The board framed the task in a form unusual for such a situation. The requirement was not to "find a violation" but to establish what was actually happening and to obtain material that would withstand scrutiny outside the company: by lawyers and, if necessary, by an external authority.

It was precisely this wording that defined the entire subsequent project. An assignment to confirm suspicions and an assignment to establish facts are different tasks with different outcomes. The second can be carried out correctly, the first cannot.

The first attempt to look into the matter was internal and reasonable enough. Security and finance compared the information available to them: approvals, internal correspondence within the corporate network, departmental reporting, meeting calendars. The work took several weeks and produced an important but discouraging result.

Internal data showed consequences, not causes. It revealed that part of the processes were not proceeding as described in the regulations, but not why. Any explanation remained a hypothesis, and a hypothesis is not grounds for either a personnel decision or a referral to lawyers.

The second limitation was legal. An organization acts toward its own employees within a narrow frame: what is technically possible is far from always permissible. Extended monitoring of work devices, access to personal correspondence, covert technical means - each such measure, under Austrian law, requires its own basis, and is sometimes not possible at all. A company that takes up these tools on its own and without assessment most often deprives itself of a result: the material obtained turns out to be unusable, and the employer itself becomes the violator.

The third limitation was organizational. An internal investigation cannot remain unnoticed by the person it concerns. In a mid-sized company, widening the circle of those in the know is a matter of days. Once the subject of the review becomes known, behavior changes, and any subsequent observations lose their meaning.

By the time the client approached BLACKFILE, it had reached an honest conclusion: the task could not be resolved with internal resources, not for lack of qualification but because of a structural conflict. An organization cannot simultaneously be a party to a conflict and an independent recorder of facts about it.

The work began with an assessment not of the suspicions but of the task itself. Before discussing any actions, the team examined the legal basis for the engagement: what substantiates the company's interest, what obligations bind the parties, what information the employer is entitled to establish and to what extent, and which questions do not fall within the competence of an external provider at all.

Separately, a list was recorded of what the project does not involve. No access to devices, accounts or correspondence. No technical interception means. No actions affecting private life beyond business activity. No interaction with the individual concerned or his circle. This list was agreed in writing before work began and was not revised during the project.

Such a framework narrows the possibilities - and this is a deliberate trade-off. Part of what concerned the client was recognised from the outset as unattainable by lawful means, and this was stated directly, before signing. An expectation that "we will come up with something along the way" leads, in such projects, to material that a lawyer will not be able to use.

The second part of the preparation was the criterion for the admissibility of results. The parties agreed in advance on what material would be considered usable: it must be obtained lawfully, be verifiable, contain a direct indication of its source within the report, and not mix observation with its interpretation. Material that fails to meet even one of these conditions does not go into the report - even if it appears convincing.

Finally, responsibility was delineated. BLACKFILE establishes and describes the factual circumstances and identifies the limitations of the information obtained. The legal characterisation of these circumstances, the choice of procedure, and any accusatory conclusions are made by the client's authorised legal team.

The main error in corporate conflicts is the conflation of three different things: an observation, a conclusion drawn from it, and a hypothesis about motive. Outwardly they look equally convincing, but their legal weight differs, and the consequences of an error are not comparable.

An observation is something recorded and verifiable. A conclusion is an interpretation of several observations, one that carries a degree of justification but no independent evidentiary value. A hypothesis is a version of causes and intentions, and in public and legal circulation it must not be presented as either of the other two.

In the report these three levels were physically separated. Each item was labelled: confirmed, assessed, limitation. For assessed items, the degree of confidence was stated along with the basis on which it was determined. For limitations, it was stated directly what could not be established and why - including where the answer would have been desirable for the client.

This separation produces an unpleasant but useful effect: part of the material that in an ordinary presentation would look like evidence becomes, under honest labelling, merely an observation. The client sees this immediately and does not build a strategy on something that will not withstand scrutiny.

A separate caveat regarding the unproven was included in the material. A number of the client's assumptions - in particular about the content of business contacts and about intentions - were not confirmed by lawful means. The report records this as an inability to confirm, not as a refutation and not as a confirmation.

The outcome of the project is not a finding of guilt and not a recommendation on a personnel decision. The company received structured factual material from which its lawyers could build their own position.

The first element was a chronology: a sequence of events in time, with the basis for each item indicated and with a direct division into confirmed, assessed and unestablished. This format allows a lawyer to understand in a single reading which items can be used in proceedings and which are suitable only for internal understanding of the situation.

The second element was a map of business connections, built on publicly available corporate information. It showed which organizations and roles correlate with one another and where these correlations are confirmed by official sources, and where they remain an assumption.

The third element was a list of limitations. It states directly which questions remain open, which information cannot be obtained by lawful means, and which formulations the company is not entitled to use publicly. In practice this section proves the most needed: it protects the client from its own excessive statements.

The materials were transferred through an agreed secure channel and were intended for internal procedures and the pre-litigation stage. At no stage did BLACKFILE act as a representative of a party, conduct communication with the subject, or provide legal opinions.

First. In a corporate conflict, the winner is not the one who acted earliest, but the one who obtained a verifiable picture earliest. Acting without facts almost always costs more than the week spent establishing them.

Second. Legal limitations are not an obstacle to the project but a condition of it. Material obtained beyond the bounds of what is permissible is not merely useless: it shifts the company from the position of an injured party to the position of an offender. In jurisdictions with strong employee protections, this happens faster than is commonly assumed.

Third. Marking the degree of confidence matters more than volume. A hundred-page report that does not separate facts from conclusions cannot be used by a lawyer. A short chronology with an honest indication of grounds and limitations can be.

Fourth. An external provider is needed not because it has greater capabilities, but because it holds a different position. It is not a party to the conflict, does not depend on internal politics, and is obligated to describe, among other things, what runs counter to the client's expectations.

Fifth. The outcome of such work is not universal. The timeframe, scope and result depend on jurisdiction, documents and factual circumstances. Nine days in this project is neither a standard nor a promise: a different situation may require substantially more time or prove unresolvable by lawful means.

A check usually makes sense if at least one of the following conditions applies. This is not a diagnosis or a promise of a result, but indicators of a task that is resolved through documenting facts.