Ask what an internal investigation produced and you will usually be handed a narrative: a report that tells the story of what happened, in prose, with a conclusion. Narratives are readable, and boards like them. But when the findings are tested — by a regulator, a court, an opposing party or a sceptical audit committee — the narrative is not what holds. What holds is the thing underneath it, if it exists: a chronology in which every event is dated, described and traced to the document that evidences it.
Why chronologies beat narratives
A narrative smooths. It selects, orders for effect, and fills gaps with connective tissue — "it appears that", "presumably", "in this context". Each of those phrases is a small unsecured loan against the record. A chronology does the opposite: it exposes. Laid out event by event, the gaps become visible as gaps, the contradictions sit next to each other on the page, and assumptions have nowhere to hide.
That exposure is uncomfortable during the work and invaluable at the end. When someone challenges a finding, you do not defend a paragraph of prose; you point to the entry, and the entry points to its source. The narrative report can still be written — it should be — but as a layer over the chronology, not a substitute for it. The chronology is the load-bearing structure; the report is the facade.
One event, one date, one source
The discipline is simple to state. Every entry records the date, the event, and the document or documents that evidence it — a message, a contract version, a booking, a calendar entry, a log. No entry without a source. Where knowledge comes from an interview rather than a document, the entry says so, because interview evidence and documentary evidence have different weight and age differently.
The discipline also forces a distinction that narrative writing blurs: what a document says versus what it shows. An email in which someone writes "we discussed this yesterday" is evidence that the email was sent, and an assertion that a discussion happened. Keeping those layers separate is what makes a chronology usable by someone who was not in the room — including the tribunal that may read it years later.
What machine-scale review changes
Everyone has always known that complete chronologies are better. Almost no one built them, because extracting every dated event from tens of thousands of documents by hand is exactly the kind of work that made investigations slow and expensive. So teams built partial chronologies around the documents they happened to have read — which meant the chronology inherited every blind spot of the sampling that fed it.
Structured review changes the economics. Systems that read the full document set can extract events, dates and participants from every message and file, collapse duplicates, and assemble a draft chronology across the entire record rather than a slice of it. The lawyer's job shifts from transcription to curation: deciding which extracted events are relevant, which characterisations are right, which apparent facts are actually artefacts of the data. A complete chronology stops being a luxury and becomes the default working document of the investigation.
Working from the chronology, not towards it
Built early, the chronology stops being a reporting artefact and becomes the investigation's steering instrument. Gaps in the timeline tell you where to collect more — a silent six weeks in a busy channel is itself a lead. Contradictions between documents tell you what to ask in interviews, and in what order. When authorities are involved, a source-linked chronology is also the most credible thing a company can put on the table: it invites verification instead of demanding trust.
And it outlives the investigation. The same spine supports the board's decisions on consequences, later civil claims, insurance discussions and disputes that surface long after the report is filed — when memories are gone and only the record remains.
The judgment on top
A chronology does not interpret itself. Whether a documented sequence amounts to a breach, what it means for exposure, which events the report should foreground and what the company should now do — that is legal judgment, and it depends on the facts of each case. Machines propose the events; a lawyer decides what they mean and answers for the conclusion. If you are running an investigation and the findings feel more narrative than evidence, a chronology is usually the fastest way to find out what you actually know — and we are happy to help you build one.