An internal investigation must restore the facts before the company makes a decision
BLACKFILE helps boards, owners, legal, compliance and HR teams independently verify a corporate incident, reconstruct the sequence of events and separate confirmed circumstances from assumptions.
We cross-reference lawfully provided documents, corporate and financial connections, open sources and available digital traces. Personnel, legal and disciplinary decisions remain with the company's authorized bodies and its advisers.
At the first stage it is enough to describe the situation without names, documents or sensitive materials.
FINDINGS CONTROL MAP
A complaint, discrepancy or disputed decision is recorded as a statement, not as an established fact
The lawful basis, the client's rights, conflict of interest and jurisdictional limitations are verified
It is determined what needs to be preserved and who has the right to do so, so that the original picture is not altered
Events, documents and decisions are arranged in sequence with reference to sources
Roles, authorities and corporate connections are verified against lawful registers and open sources
Material conclusions undergo cross-verification against an independent source. Alternative explanations are tested on equal footing with the primary version.
A conclusion receives one of four statuses: fact, analytical assessment, working hypothesis or unresolved question.
Every statement passes through seven steps. Only the point of material discrepancy is marked in red, not the participant
01 Исходный сигнал. Жалоба, несоответствие или спорное решение фиксируются как утверждение, а не как установленный факт. 02 Полномочия. Проверяются законное основание, права заказчика, конфликт интересов и ограничения юрисдикции. 03 Сохранение материалов. Определяется, что нужно сохранить и кто имеет право это сделать, чтобы исходная картина не изменилась. 04 Хронология. События, документы и решения выстраиваются в последовательность с привязкой к источникам. 05 Связи. Роли, полномочия и корпоративные связи проверяются по законным реестрам и открытым источникам. 06 Проверка. Существенные выводы проходят встречную проверку по независимому источнику. Альтернативные объяснения проверяются наравне с основной версией. 07 Статус вывода. Вывод получает один из четырех статусов: факт, аналитическая оценка, рабочая гипотеза или неразрешенный вопрос.
INITIAL SIGNAL
LEGAL BASIS
PRESERVATION
CHRONOLOGY
CONNECTIONS
FINDING STATUS
02 / INDEPENDENCE
An internal review loses its value if its outcome is predetermined
A complaint, a suspicious transaction or a disputed decision creates pressure on management. Starting with an accusation, mass access to data or uncoordinated interviews risks violating the rights of those involved and destroying the original chronology.
PRESSURE
a rumor within a department
a complaint with a ready-made version of events
a conflict between teams
a demand to resolve the matter today
INDEPENDENT VERIFICATION
Here an unconfirmed claim is separated from a confirmed fact, not turned into a conclusion
BASIS FOR A DECISION
confirmed circumstances
analytical assessments with a confidence level
open questions and gaps
options for lawful further action
The first result of an investigation is not the name of the person responsible. The first result is a preserved and verifiable picture of what happened.
03 / SCENARIOS
What clients bring to an internal review
The basis for an independent review need not be a formal complaint. Sometimes the question arises from a recurring discrepancy between documents, decisions, financial interests and the actual conduct of those involved.
The factual part of the statement must be verified without turning the complaint into evidence and without disclosing it more widely than necessary
An employee, manager or related person may hold external corporate or commercial interests affecting the company's decision
The choice of supplier, contract terms or recurring exceptions from procedure require independent verification of connections and the sequence of decisions
Internal reporting, primary documents and external information describe the same transaction differently.
It is necessary to determine the boundaries of the incident, the scope of confirmed access and the connection between the disclosure and internal processes.
Approval bypassed the established procedure, and it is necessary to establish when, by whom and on what basis the exception was made.
Shareholders or the legal team need to understand what data the decision was based on and who actually took part in the approval.
The report contains verifiable details but requires independent confirmation and careful handling of the source's identity.
The signal arrives on an ordinary working day and rarely looks like an incident
ОБЩИЙ ВОПРОСWhat can be lawfully confirmed?
04 / SUBJECT OF THE CHECK
The investigation answers not a single question but a system of related questions
The scope of work is defined by the specific incident, the client's authority, the jurisdiction and the availability of lawful sources. Each conclusion carries its own basis and level of confidence.
ONE INCIDENTEIGHT AREAS OF THE CHECK
01
Authority and the sequence of decisions
Who had the right to make the decision, approve the transaction and alter the record. A formal position is not equivalent to actual involvement.
02
Documents and their versions
Differences between document versions, dates, approval routes and the actual actions of the parties involved.
03
Corporate and personal connections
Connections among employees, executives and counterparties available in lawful registers, corporate data and open sources.
04
Available financial traces
Confirmed payments, contractual obligations and economic interests, within the limits of lawfully provided data.
05
Lawfully provided digital traces
Logs, metadata and file versions, where the company has the right to provide them and the processing is permissible in the relevant jurisdiction.
06
Communications within the scope of authority
Work correspondence is examined only where the company has the right to do so and the scope is proportionate to the purpose of the check.
07
External sources
Registers, publications, court and regulatory information obtained lawfully in the relevant jurisdictions.
08
Alternative explanations
Each version is tested together with the explanations that would refute it. Otherwise the check merely confirms its starting point.
PRESERVATION
Before the first conclusion, a simpler question must be resolved: what materials need to be preserved now so that there is something to examine a month from now.
05 / VERIFICATION
Each conclusion must show what it is based on and where the certainty ends
Findings Control Map - a working map of the investigation's conclusions. On the left, a chain of seven steps that every statement passes through; below, rows of conclusions with their status and basis.
FINDINGS CONTROL MAP
A complaint, discrepancy or disputed decision is recorded as a statement, not as an established fact
The lawful basis, the client's rights, conflict of interest and jurisdictional limitations are verified
It is determined what needs to be preserved and who has the right to do so, so that the original picture is not altered
Events, documents and decisions are arranged in sequence with reference to sources
Roles, authorities and corporate connections are verified against lawful registers and open sources
Material conclusions undergo cross-verification against an independent source. Alternative explanations are tested on equal footing with the primary version.
A conclusion receives one of four statuses: fact, analytical assessment, working hypothesis or unresolved question.
Every statement passes through seven steps. Only the point of material discrepancy is marked in red, not the participant
01 Исходный сигнал. Жалоба, несоответствие или спорное решение фиксируются как утверждение, а не как установленный факт. 02 Полномочия. Проверяются законное основание, права заказчика, конфликт интересов и ограничения юрисдикции. 03 Сохранение материалов. Определяется, что нужно сохранить и кто имеет право это сделать, чтобы исходная картина не изменилась. 04 Хронология. События, документы и решения выстраиваются в последовательность с привязкой к источникам. 05 Связи. Роли, полномочия и корпоративные связи проверяются по законным реестрам и открытым источникам. 06 Проверка. Существенные выводы проходят встречную проверку по независимому источнику. Альтернативные объяснения проверяются наравне с основной версией. 07 Статус вывода. Вывод получает один из четырех статусов: факт, аналитическая оценка, рабочая гипотеза или неразрешенный вопрос.
SignalSourceCorrelationStatusMeaning
F-01
The head of the division influenced the choice of supplier
ASSESSMENT - an analytical assessment with a stated level of confidence
Grounds
The signature at the approval stage is recorded in the version of the document provided by the company.
Limitation
The document exists in several versions; the sequence of changes has not been fully established.
Significance for the decision
Involvement is confirmed at one stage; influence on the outcome is a matter for separate assessment
F-02
The counterparty's owner is connected to the head of the division
FACT - a fact with documentary basis
Grounds
A register entry on the ownership structure as of the date of the transaction.
Limitation
The register entry confirms the connection but does not confirm the receipt of benefit.
Significance for the decision
The connection exists and must be taken into account in assessing the procedure
F-03
The terms of the contract differed from the company's usual practice
ASSESSMENT - an analytical assessment with a stated level of confidence
Grounds
Comparison with internal procedures and comparable contracts from the same period.
Limitation
A market benchmark does not substitute for an appraiser's opinion on the specific subject of the contract.
Significance for the decision
A deviation has been recorded; economic justification requires assessment by a specialised team
F-04
Part of the approvals bypassed the standard procedure
FACT - a fact with documentary basis
Grounds
The approval route does not match the one required under the regulations in force at the time.
Limitation
The reason for the exception has not been established; no explanation has been requested from the participants.
Significance for the decision
A material discrepancy between the regulations and the actual decision route
F-05
Funds may have been transferred to a related party
HYPOTHESIS - a working hypothesis requiring further verification
Grounds
Coincidence of the payment period with the approval stages.
Limitation
The counterparty's banking information is not lawfully accessible at this stage.
Significance for the decision
The version is unconfirmed and cannot serve as grounds for a personnel decision
F-06
Earlier versions of the document were altered after the signal was raised
UNRESOLVED - an unresolved question: the available materials do not provide a reliable answer
Grounds
Different modification dates on copies of the same document.
Limitation
Logs for the relevant period are missing; they cannot be restored within the scope of this task.
Significance for the decision
The matter is referred to the preservation plan and to the IT team's area of responsibility
The lines in the map are an anonymised working example of the structure of conclusions, not materials from a specific engagement.
One strong document does not confirm the entire version of events. That is why BLACKFILE shows not only the conclusion, but also its basis, the cross-check, the limitations and the practical significance.
06 / WORK MODEL
First, authority and preservation of materials. Then, analysis and conclusions
The route passes through two checkpoints. Until a checkpoint is cleared, the next stage does not begin.
01
Verification of lawfulness, authority and conflict of interest
The assessment covers the legal basis for the task, the client's authority to raise the question and transfer materials, jurisdictional limitations and the need for a specialist lawyer.
LEGAL GATEAdmissibility confirmed
Without a lawful basis, client authority and a jurisdiction assessment, the work does not begin.
02
Secure briefing
A secure channel, the subject of the check, the scope of access, completion criteria and the roles of the legal, compliance, HR and IT teams are agreed.
03
Preservation plan
A preservation plan for materials under the client's control: what to preserve, who is entitled to do so and how to avoid altering the original picture.
04
Plan of questions and hypotheses
Initial statements are converted into verifiable questions. For each, sources, alternative explanations and confirmation conditions are recorded.
05
Timeline and connection map
The sequence of events, decisions and document versions is reconstructed, and the roles, authority and confirmed connections of the participants are established.
06
Verification of sources
The origin of each piece of material is recorded together with its limitations. Data without a clear source does not become the basis for a conclusion.
EVIDENCE GATEMaterial conclusions are cross-checked
A conclusion without independent confirmation is not carried into the final report as fact.
07
Control of material conclusions
Each material conclusion undergoes cross-checking. Contradictions and missing data are not concealed, but included in the map of limitations.
08
Report and working session
The authorised team receives the factual basis, the status of each conclusion, open questions and options for further lawful action, discussed at a working session.
Interviews, digital forensics and legal actions are included in the work only where the process is lawfully organised and the relevant specialists are involved. BLACKFILE does not carry them out in place of the company and its advisers.
07 / RESULT
Not a mass of data, but a verifiable basis for a decision
INVESTIGATION RECORD
01
Executive summary
A brief account of the situation, the key confirmed circumstances, risks and questions requiring a decision.
02
Chronology of events
A sequence of events linked to sources, document versions and the level of confirmation.
03
Map of participants and connections
Roles, corporate interests, access and confirmed connections, without unwarranted attribution of intent.
04
Register of materials and sources
Each item of material with its origin, date of receipt, limitations and a reference for verification.
05
Table of facts, assessments, hypotheses and gaps
Findings Register: four statuses of conclusion in a single table, so that certainty is not confused with assumption.
06
List of material discrepancies
A separate list of points where documents, explanations and external data do not align with one another.
07
Questions for the legal, HR or compliance team
What the company itself must decide or request: this falls within its own authority, not BLACKFILE's conclusion.
08
Appendices and limitations
What remains unverified, why, and under what conditions the conclusion may change.
The format of the outcome is agreed before the project begins. If the material is intended for use in judicial, regulatory or disciplinary proceedings, the client's legal team must determine the requirements for admissibility, preservation and disclosure of data.
08 / CLIENTS
For those who must make a responsible decision within the organisation
CL-01boards of directors and supervisory boards
CL-02shareholders and owners
CL-03audit committee
CL-04legal departments and external counsel
CL-05compliance and internal control
CL-06HR in cases of serious complaints and conflicts of interest
CL-07banks, funds and regulated companies
CL-08family offices and corporate groups
CL-09interim management following a corporate conflict
The client must have a lawful basis and the authority to set the task and provide materials. The status of an owner or manager does not by itself override employee rights or data processing requirements.
09 / COMPOSITE EXAMPLE
Complaint of a conflict of interest in vendor selection
Composite example. Circumstances have been combined and altered. It illustrates the method of work and does not describe a specific client
A contract sheet and two pens on a meeting room table
Following an internal complaint, the company suspected that an employee was connected to a vendor. The check identified several confirmed overlaps but did not confirm part of the original claims.
The report separately set out the facts, indications of connection, alternative explanations and documents the company itself should have requested. The HR and legal decision remained with the authorized team.
The value of an independent check was not to confirm the original version but to show which part of it holds up under scrutiny.
SIGNALInternal complaint of a conflict of interest
The claim was treated as a question, not a conclusion
CHECKEDConnection, involvement in the decision and contract terms
Each question was checked separately, using its own source
CONFIRMEDSeveral confirmed overlaps
Confirmed by registers and company documents
UNRESOLVEDPart of the original claims
Insufficient material for a reliable conclusion
DECISIONHR and legal decision
Left to the company's authorized team
10 / ENGAGEMENT FORMAT
The scale of an investigation is determined by the number of questions, materials, participants and jurisdictions
The three formats differ in the depth of verification and the composition of the results. All three are shown at once, without a toggle
01Initial verification of a signal
Initial Fact Review
from €5,000
usually 2-4 business days after access and the set of materials are agreed
One signal, an initial chronology and a decision on whether a full check is needed.
What is included
verification of the lawfulness of the task, authority and conflict of interest
breaking down one signal into checkable questions
initial timeline of the event
assessment of the risk of losing the original picture
memo with a conclusion on the required depth
decision on the composition and limits of the next stage
02Internal Investigation
Internal Investigation
12 000-35 000 €
usually from 10 business days; the timeframe depends on volume, availability of materials and jurisdictions
Full factual verification of the incident with a fact map, report and working session
What is included
several participants, divisions and sources
full map of facts, assessments, hypotheses and gaps
timeline and connections map
register of materials and sources
list of material discrepancies
report and working session with the authorized team
03International incident
Cross-Border Investigation
Individual estimate after initial assessment
the timeframe is determined stage by stage, after the initial assessment and agreement on scope
Work across several jurisdictions with local legal limitations and phased coordination
What is included
several countries, companies and languages
local legal limitations for each jurisdiction
phased coordination with the legal, compliance and technical teams
checkpoint decisions at each stage
regular status report
separate materials for different authorized groups
The exact cost and timeline are determined after the initial assessment. The subject matter, sources, budget, scope of access and completion criteria are agreed before each stage begins. The timeline starts not from form submission but after the task is agreed and the permissible set of materials is obtained. Prices are stated without taxes and third-party expenses
11 / LIMITATIONS
A company's authority does not override employee rights or data requirements
BLACKFILE takes on only lawful and proportionate tasks. Before work begins, the client's authority, the purpose of processing, the scope of data, jurisdictions, employment relationships, confidentiality, the rights of affected persons and the need for involvement of a specialist lawyer are assessed
BLACKFILE does not obtain unauthorized access to personal or corporate devices, accounts, correspondence, government, banking or other closed systems. The company does not install covert monitoring tools and does not conduct pressure or interrogations
Whether work correspondence, logs, devices, call recordings, video materials or personal data can be used depends on the country, employment and procedural law, internal policies, transparency of processing and the specific legal basis. Such a set of materials must be separately agreed with the legal team
What needs to be understood before starting
BLACKFILE does not determine guilt: this is the authority of the court and authorized bodies
a complaint is not evidence, even if it is detailed and convincing
work is limited by law, the client's authority and the agreed scope
access to deleted or closed materials cannot be promised
a conclusion may remain partially confirmed - this is an honest result, not a shortcoming
a report does not guarantee an HR, judicial or regulatory outcome
legal qualification is provided by a specialist lawyer, not an analyst
Principles of work
01lawful basis
02specific purpose
03necessity and proportionality
04data minimization
05limited access
06preservation of source and version
07separation of fact, assessment and hypothesis
08separate assessment of cross-border data transfer
BLACKFILE uses these documents as professional reference points. The company does not hold ISO certification, and we will not claim otherwise. This page describes a general approach and is not legal advice: the admissibility of specific actions is determined separately for each jurisdiction.
12 / RELATED AREAS OF WORK
If the task is broader than an internal investigation
What needs to be determined before an internal check
An authorized party: the owner, the board of directors, the audit committee, the legal, compliance or another function with lawful authority. The specific status and scope of authority are verified before sensitive materials are received.
The type of signal, the approximate period, the affected units, which functions are already involved and what question needs to be resolved. Names, documents and correspondence are not needed at the first stage.
Yes. The initial assessment of admissibility and the depth of the check is made based on a description of the situation. Personal data is transmitted later, through a secure channel and only to the agreed extent.
BLACKFILE is not subordinate to any party to the conflict, does not receive compensation for a particular conclusion, and records alternative explanations on equal footing with the main version. Conflicts of interest are checked before work begins, and if one is found, the matter is not taken on.
Not in place of the company. Interviews and official explanations are organized by the company itself and its legal team, in an admissible format. BLACKFILE can help with a list of questions and take part where the process is organized lawfully.
Only if the company has the right to provide it, and the processing is necessary, proportionate and permissible in the given jurisdiction. Personal accounts and devices do not become available for review merely because a person works at the company.
It remains in the report with the status of a hypothesis or an unresolved question, indicating what data was missing. An unconfirmed version is not rewritten as a conclusion and does not disappear from the report.
An internal investigation begins with an incident, not a theory: a complaint, a conflict of interest, a leak, a procedural violation or a disputed decision. A corporate fraud investigation applies once the subject has already narrowed to indications of a fraudulent scheme. Often the second service becomes a continuation of the first.
14 / INITIAL ASSESSMENT
Describe the internal signal. We will help determine the first lawful step.
Do not attach documents, correspondence, records, personal data or the names of suspected participants. General context is sufficient for the initial assessment.
