An internal investigation ends twice: once when the work is done, and again when the board reads the report. Plenty of investigations that were competently run fail at the second ending. The report blends what was found with what was assumed, states conclusions without saying where they come from, and recommends "strengthening the compliance culture". The board cannot act on it — and the risk the investigation was meant to close stays open.
A report the board can act on is a different kind of document. Its qualities are structural, not stylistic, and they are decided before the first sentence is drafted.
Keep facts, assumptions, analysis and recommendations apart
A usable report is built in four strictly separated layers. Facts: what the documents and interviews actually established. Assumptions: where the record has gaps, how they were bridged, and why. Analysis: what the facts mean when held against contracts, policies and the law. Recommendations: what should now be done.
When these layers blur, the whole report becomes fragile. A single challenged inference contaminates findings that were solid, because the reader can no longer tell which is which. The test is simple: every conclusion in the analysis should be traceable down to identified facts, and every stated fact should stand on its own without the analysis. Boards, auditors and — if it comes to that — courts read reports exactly this way.
Give every finding a source
Each factual finding carries a reference to its evidence: the document, the interview, the system record. This is not academic decoration. It serves the board now, because a director who asks "how do we know this?" gets an answer. And it serves the company later, because a report that may one day be read by a regulator or a court is only as strong as its weakest unsourced claim.
Sourcing also disciplines the drafting itself. A finding you cannot tie to evidence is not a finding — it is an assumption, and it must be labelled as one. Investigators who apply this rule consistently discover that some of their firmest impressions do not survive it. Better to discover that in the drafting than in the boardroom.
State scope and limitations plainly
Say what was reviewed and what was not: the period covered, the data sources searched, who was interviewed, who declined or was unavailable, what material could not be accessed. This is not defensive boilerplate. It defines what the board may rely on — and what remains open.
A report that is silent about its limits invites over-reliance, and over-reliance is a board risk in itself. Directors who take decisions on findings the investigation never actually supported are exposed twice: once by the underlying conduct, once by their response to it. Stating limitations honestly is what makes the rest of the report trustworthy.
Recommend what can be executed
The recommendations section is where most reports go soft. "Improve the tone at the top" is not a recommendation; it is a wish. Executable remediation is specific, owned and within the company's power: amend a defined policy, change an approval threshold, terminate or renegotiate a specific relationship, discipline identified persons, assess with counsel whether a notification is required, and verify implementation by a stated means.
For each item, the board should be able to see who acts, by when in relative terms, and how completion will be evidenced. Whether individual measures are legally required or merely prudent depends on the facts — and where it does, the report should say so rather than blur the line.
Write for the second reader
Investigation reports have a second life. Regulators, auditors, prosecutors, counterparties in litigation and future acquirers may all one day read what the board reads now. Questions of legal privilege, employee rights in interviews and future disclosure should be considered before drafting begins, not patched afterwards — how far protection reaches depends heavily on the facts and the forum.
The second reader also shapes the tone: findings, not adjectives. A report that describes conduct precisely needs no outrage to be damning, and precision survives cross-examination where rhetoric does not.
Much of an investigation is reading at volume — mailboxes, chat exports, accounting records. Systems can work through that record completely, so that no thread is dropped for lack of hours; the interviews, the weighing of evidence and the report itself belong to a named lawyer who answers for every finding in it. If your board is facing an investigation, or a report it cannot act on, we are happy to discuss it.