Author: Mr Adrian Ramdat (Director of Training & Consultancy)
September 2026
When people talk about investigation, the conversation often focuses on evidence. What evidence do we have? What evidence do we need? Where can we find it? How do we secure it and how do we present it?
All of those questions are important, but finding evidence is only one part of being a good investigator. Investigation is about understanding what you are trying to establish, identifying what you know and, just as importantly, what you do not know, assessing the information available to you and making reasonable decisions about what needs to happen next.
For me, that requires more than knowing investigative techniques. It requires an investigative mindset, and that mindset is relevant regardless of the type of investigation being undertaken.
I have spent much of my career involved in investigations, initially as a detective and later in roles where I was responsible for developing and training other investigators. I have also conducted internal and employment investigations, and that experience has reinforced for me that, although the legal framework, purpose and standard of proof may differ, many of the fundamental principles of good investigation remain the same.
Whether you are investigating a criminal allegation, a regulatory matter, a workplace concern or an internal disciplinary issue, the investigator still needs to understand what they are trying to establish, gather and assess relevant information, consider alternative explanations, test what they have been told and make reasonable decisions about what further work is required.
Be professionally curious
One of the qualities I consider essential in an investigator is being professionally curious. It is something that has always been important to me when conducting investigations. I have never been particularly comfortable simply accepting an account because somebody has given it confidently, because it fits the information already available or because other people have already decided that they know what happened.
For me, professional curiosity means looking beyond what you have initially been told and wanting to understand what is actually happening. It is about asking why something happened, whether there is another explanation, what might be missing and whether there is something that does not quite fit with the account you have been given.
It also means being prepared to ask questions. I have never regarded asking questions as a sign that I did not understand something. Quite the opposite. If something did not make sense to me, I wanted to understand why. If somebody gave me an explanation that raised another question, I was quite prepared to ask it. That applied regardless of who I was speaking to. A person could be a witness, a suspect, a colleague, a manager or somebody with considerably more experience than me. If there was something I did not understand, I believed it was my job as the investigator to ask.
That approach is just as relevant in an internal or employment investigation as it is in a criminal investigation. The circumstances and procedures may be different, but the need to understand what has actually happened does not change.
Professional curiosity does not mean pursuing every possibility simply because it exists. An investigation still needs to be proportionate and focused. It does, however, mean not accepting things too readily simply because they appear to make sense at first.
Sometimes the most important part of an investigation is the question that nobody thought to ask.
Don't become committed to your first explanation
Investigators naturally develop theories about what has happened. That is part of making sense of the information they receive and deciding what needs to happen next. The problem arises when a working theory gradually becomes a conclusion and the investigator starts interpreting everything they subsequently find through that conclusion.
This is something I have always been conscious of in my own investigations. When the initial information appears to point in a particular direction, it is very easy to start building the investigation around that explanation. An allegation may initially appear credible, a witness may provide an apparently convincing account, or the circumstances may seem to point strongly towards one particular explanation.
Once that happens, it can be tempting to look for evidence that supports what you already believe rather than genuinely testing whether your understanding is correct.
I have always found it useful to ask myself whether I could be wrong and, perhaps more importantly, what I would expect to find if my current understanding was wrong. That does not mean refusing to form a view. Investigators need working hypotheses because those hypotheses help them decide what to do next.
The important thing is not to become so committed to the hypothesis that information which contradicts it is ignored, explained away or given less weight than information which supports it.
There is a significant difference between having a working hypothesis and becoming committed to an outcome. A working hypothesis helps you investigate. Becoming committed to an outcome can prevent you from doing so.
The purpose of an investigation is not to prove that your original theory was correct. It is to establish what actually happened.
Follow the evidence, even when it takes you somewhere unexpected
There will be times when the evidence does not take an investigation where the investigator expected it to go. An allegation may turn out to be less substantial than it first appeared, a witness who initially seemed important may prove to be less reliable, or another person may emerge as being more relevant than originally thought.
An investigator has to be comfortable with that.
In my experience, this is one of the things that separates investigation from simply following a process. You can start an investigation with a reasonable view about what you think has happened, but you have to be prepared for the evidence to take you somewhere else. Sometimes that means accepting that something you initially believed was wrong.
It can be difficult to do that, particularly when you have already invested considerable time and effort in a particular line of enquiry, but the evidence does not change simply because you have invested time in reaching a particular conclusion.
Good investigation requires the ability to recognise when circumstances have changed and to change the direction of the investigation accordingly. Sometimes that means acknowledging that an assumption made at the beginning was wrong. That is not a failure of investigation. Failing to recognise that it was wrong and continuing regardless is much more likely to be a problem.
Know what you know, and what you don't
Another important part of having an investigative mindset is being able to distinguish between what is known, what is believed and what is simply not known yet.
There is a temptation, particularly as you become more familiar with an investigation, to fill in the gaps yourself. You begin to understand the circumstances, develop a view about what has happened and, before long, can find yourself treating your own assumptions as though they were established facts.
An investigator may have information suggesting that something happened, but that is not necessarily the same as having evidence that establishes that it happened. Equally, an investigator may have a strong belief about what has happened, but that belief remains a belief until it is properly supported by the available evidence.
Being able to identify those gaps is therefore an important investigative skill. An investigator should be able to look at an investigation and identify what has been established, what remains uncertain and what needs to be done to resolve those uncertainties.
This is particularly important in workplace investigations, where an investigator may be dealing with conflicting accounts, incomplete records and people who have very different perceptions of the same events. The fact that somebody genuinely believes something happened in a particular way does not necessarily mean that it did. Their account needs to be considered alongside the other available information and evidence.
Good interviewing is part of good investigation
Investigative interviewing is another area where the quality of the investigator can make a significant difference. Witnesses, victims, suspects, employees, managers and others involved in an investigation may hold information that cannot be obtained from any document or database.
My approach to interviewing has always been closely connected to professional curiosity. Asking questions is important, but listening to the answers is equally important. There is little point asking somebody a question if you have already decided what you expect them to say.
That means asking appropriate questions, allowing people to give their account, recognising areas that require further exploration and avoiding the temptation to put words into somebody's mouth. It also means being prepared to listen to an answer that you did not expect.
One of the easiest mistakes for an investigator to make is to become so focused on the questions they want to ask that they fail to properly listen to the answers they are receiving. If you are professionally curious, the answer you have just been given should often lead you to another question.
Good interviewing is not about asking the largest number of questions. It is about obtaining the information that is relevant to the investigation and understanding what that information actually means.
Investigation requires organisation and defensible decision making
There is also a practical side to investigation that should not be underestimated. Investigators can find themselves dealing with large quantities of information, multiple witnesses, documents, digital material, enquiries, actions and decisions. Without good organisation, it is remarkably easy for something important to be overlooked.
I have worked on investigations where there was a considerable amount of information available, but the challenge was not finding more information. It was making sense of what was already there, understanding what it established and identifying what still needed to be done.
An investigator needs to know what has been done, what remains outstanding and why particular enquiries were undertaken or not undertaken. That last point is particularly important because investigations are often reviewed after the event, sometimes by people who were not involved in them at the time.
A decision that appeared entirely reasonable when it was made may look very different several months later if there is no record explaining the circumstances and the reasoning behind it. Good record keeping is therefore not simply an administrative burden. It is part of good investigative practice.
Investigation also involves constant decision making. An investigator has to decide which enquiries should be prioritised, which witnesses should be spoken to, what evidence needs to be obtained and when a particular line of enquiry can reasonably be closed.
What matters is whether the decision was reasonable based on the information available when it was made and whether the investigator can explain the reasoning behind it.
This is particularly relevant when conducting employment and internal investigations. Decisions about which allegations require further investigation, which witnesses should be interviewed and what evidence should be obtained may all subsequently be scrutinised. The investigator needs to be able to demonstrate that those decisions were based on the information available at the time rather than simply on hindsight.
Evidence needs to be considered in context
Another common mistake is to consider individual pieces of evidence without properly understanding their context. A document may appear significant until you understand why it was created. A message may appear incriminating until the wider conversation is examined. A witness may provide information that initially appears compelling but becomes less persuasive when considered alongside other evidence.
Evidence rarely exists in isolation.
This is particularly important now that investigators are dealing with ever greater quantities of digital information. It is relatively easy to find something that appears significant. The more difficult task is understanding what it means, where it came from, whether it is reliable and how it fits with everything else that is known.
More information does not necessarily produce a better investigation. Sometimes it simply produces more information.
Don't be afraid to challenge
Good investigators need to be prepared to challenge, including challenging their own assumptions. That may mean challenging a witness, asking a colleague to explain something that does not make sense, questioning a decision that has already been made or suggesting that the investigation needs to look at something from a different perspective.
For me, this goes back to professional curiosity. I was never particularly concerned about asking a question simply because I thought somebody might wonder why I was asking it. If I did not understand something, I needed to understand it. If an explanation did not make sense, I wanted to know why. If I thought something had been overlooked, I was prepared to raise it.
That does not mean that an investigator should challenge people simply for the sake of challenging them. Challenge needs to be appropriate and based on the circumstances and information available. But an investigator should not be afraid of asking the difficult question simply because it might be uncomfortable.
An investigation is not a popularity exercise. The investigator's responsibility is to establish the facts as far as reasonably possible, not simply to follow the path that is most convenient or least contentious.
Know when you need specialist help
No investigator can be an expert in everything. An investigation may involve financial information, digital evidence, specialist legislation, technical material or some other area that is outside the investigator's own experience.
There is nothing wrong with recognising that and seeking appropriate assistance. In fact, trying to deal with something you do not understand because you do not want to admit that you need help is far more likely to cause problems.
Experience has taught me that recognising the limits of your own knowledge is not a weakness. It is part of being a good investigator. Bringing in an expert does not remove the investigator's responsibility for the investigation, but it can ensure that decisions are being made on a properly informed basis.
Good investigation is about mindset as much as technique
Ultimately, good investigation is about much more than finding evidence.
Whether the investigation concerns a criminal offence, regulatory matter, disciplinary allegation, workplace issue or something else, the investigator needs to approach it with the right mindset. The standard of proof may differ and the legal or organisational framework may be different, but the fundamentals remain remarkably consistent.
Looking across the different investigations I have conducted, from criminal investigations through to internal and employment investigations, the qualities I have valued most have not simply been technical knowledge or the ability to find evidence. They have been curiosity, judgement, the willingness to ask questions, the ability to challenge assumptions and the confidence to change direction when the evidence tells you that you should.
A good investigator should be professionally curious, willing to challenge assumptions, prepared to follow the evidence wherever it leads and able to recognise the difference between what is known, what is believed and what still needs to be established. They need to be able to make decisions, explain those decisions and recognise when a decision needs to be revisited.
For me, that is what makes a good investigator. It is not simply somebody who can find evidence, but somebody who has the curiosity and judgement to understand what evidence they need, the discipline to test what they think they know, the confidence to ask difficult questions and the willingness to change direction when the evidence tells them they should.
The investigative mindset does not belong exclusively to policing. It is just as relevant to organisations conducting internal investigations, employment investigations, regulatory enquiries or other forms of workplace investigation. The circumstances may change, the rules may change and the consequences may change, but the qualities required of the investigator remain remarkably consistent.
Developing better investigators
The Signature Brand provides investigator training for organisations that want to develop the practical skills, knowledge and judgement needed to conduct effective and defensible investigations.
Our training can be tailored to the type of investigations your staff undertake and can cover investigative planning, evidence, interviewing, statement taking and writing, decision making, disclosure and the practical management of investigations.
For organisations looking for a more formal route to professional development, we also offer the AIM Qualifications Level 3 Award in Gathering & Using Information in an Investigation. This provides a recognised qualification alongside practical investigator development.
Whether you want to give existing investigators a stronger grounding in investigative practice, develop staff who are moving into investigation for the first time, or provide a recognised qualification for those responsible for gathering and using information during investigations, we can tailor the training to your organisation, the investigations it undertakes and the level of experience of your staff.
Contact The Signature Brand to discuss your investigator training or the AIM Qualifications Level 3 Award in Gathering & Using Information in an Investigation.
Photo by atelierbyvineeth ... on Unsplash