A report lands. Through the hotline, in an email to the general counsel, or because someone closes the door of an office and starts talking. Most of what will later make the investigation credible — or vulnerable — is decided in the first two days, usually by people who were not expecting to decide anything that week.

The temptation is to do something visible: confront the person named, call a meeting, demand an explanation. Almost everything on that instinct list is wrong. The first 48 hours are about preservation, scope and structure — quiet work that keeps every option open.

Preserve first, assess second

Before anyone forms a view on whether the allegation is plausible, make sure the evidence that would answer the question still exists next month. Suspend routine deletion for the mailboxes, chat channels, shared drives and devices of the people plausibly involved — including accounts of employees who have already left, which are often on short retention clocks. Preservation should be broader than the allegation, because you do not yet know its edges.

Resist the urge to let IT "have a quick look". Opening files, forwarding mailboxes and browsing folders changes metadata and can contaminate exactly the record you may later need to rely on. Preservation is a controlled, documented step; searching comes later, under instruction.

Define what you are investigating — in writing

Write down, early, what the allegation actually is: the conduct alleged, the people and entities named, the period concerned, and the questions the investigation must answer. Untethered investigations drift — they expand into everything the reviewers find interesting, take months, and end without answering the original question.

Just as important is writing down what you are not investigating yet. Adjacent issues can be logged and parked. A defined scope is also what lets you say later, credibly, that the review of the full document set was complete for the questions asked.

Who investigates — and whether they are independent

Then the structural decision: who runs this? Legal or compliance can handle many matters internally. But the test is independence, and it is unforgiving: no one should investigate conduct they participated in, approved, supervised or benefited from. If the allegation touches senior management, or the people who would normally run investigations, the work belongs with external counsel — reporting to the board or its audit committee, not to anyone within reach of the allegation.

Who commissions the investigation also shapes confidentiality. In Switzerland, communications with external counsel are protected by professional secrecy in a way in-house work generally is not; if the findings may ever face a regulator or a court, that difference belongs in the day-one decision, not the day-ninety regret. Whether the facts warrant external counsel depends on severity, exposure and who is implicated — when in doubt, the question itself is worth an external call.

The reporter and the subjects

Two duties run in parallel and pull in different directions. The reporter deserves protection: a tight need-to-know circle, no identifying details in emails that will be forwarded, and a clear line that retaliation is unacceptable — under Swiss employment law, dismissing an employee for a good-faith report can qualify as abusive. Do not promise absolute anonymity you may not be able to keep if the matter becomes a proceeding; promise confidentiality within what the law allows, and mean it.

The subjects, meanwhile, should not learn of the investigation from its side effects. Sudden access revocations, a canceled recurring meeting, a calendar invite titled "HR — confidential" all announce that something is happening. Until preservation is complete and the strategy is set, the circle stays small and the surface stays calm. Subjects have rights too — data protection, and in due course a fair chance to respond — but "in due course" is not hour six.

The mistakes that are hard to undo

A short list, each drawn from the same pattern: acting before thinking.

  • Confronting the named person on day one — evidence disappears, and the interview that mattered most is wasted.
  • Forwarding the report widely "for information" — confidentiality is gone and privilege may go with it.
  • Assigning the investigation to a manager in the reporting line of the person implicated.
  • Deleting, "tidying" or editing anything, however innocent the intention.
  • Promising the reporter an outcome, or the subject an all-clear, before any fact has been established.

None of this requires knowing whether the allegation is true. That question comes later, and answering it well is a different article. The first 48 hours only require calm sequencing — and someone with the standing to hold the line. If a report has just landed on your desk, we are happy to think through those first steps with you.