3.3.1 Investigations

General principles

For detailed information on how to carry out electoral investigations, see the IFES Election Investigations Guidebook: Standards, Techniques and Resources for Investigating Disputes in Elections.

The purpose of an investigation should always be to establish the facts in order to reach a view on the evidence. It should not be based on any desire to prove anyone is innocent or guilty, and not assume, or care, what the facts will prove to be. You should gather relevant evidence and consider the evidence impartially, and be fair to everyone. In this way you will reach conclusions that are objective and evidence-based. For the same reason, it is important that investigations are conducted by appropriately trained officers and without political influence or interference. There are three main ways an oversight institution’s own actions might undermine an investigation:

By not conducting the investigation properly - not competently
By conducting the investigation in a biased manner - not objective or impartial
By either taking too long or rushing the investigation - and was therefore unfair to those involved

To conduct an investigation that will lead to the right outcome and avoid potentially successful legal challenges to your decisions (see Avoiding successful challenges to investigations.pdf), your investigation should meet the following criteria:

All of the relevant evidence is obtained properly - that means in accordance with any statutory powers and all relevant domestic laws (for example relating to human rights, equalities, and use of data).
Everyone involved is treated fairly - that means consistently, but also recognising each individual’s needs or circumstances; you will want to avoid perceptions that public officials or officeholders receive preferential treatment because of their positions.
The evidence is considered objectively and without any bias by a specialized staff - everyone who works on an investigation must be able to declare that they have no conflict of interest, so that they can show they are not biased. If there is any conflict of interest, a person should not work on the case (see UK electoral commissions conflicts of interest template for investigations.pdf).
The investigation is conducted in a reasonable time, enough to ensure the conclusions are sound, but no longer - different investigations will need different amounts of time, but all should be completed as quickly as they properly can be.
The investigation complies with all relevant legal requirements, policies and internal procedures of the oversight body.

The last point above is vital. If the investigation does not comply with the relevant legal requirements, it is unlikely to survive a challenge. And every step, from your decision to open the investigation to the final conclusions, should be documented in accordance with the institution’s written procedures. Having an 'audit trail' (e.g., a contemporaneous record of decisions and actions and the reasons for them) is critical in case the investigation is challenged.

3.3.1.1 Triage - Deciding whether to investigate

Matters that could become investigations can arise from any of the compliance control mechanisms the oversight body operates. Regardless of source, it is good practice, unless prohibited under domestic legislation, to conduct a triage exercise when deciding whether to open an investigation into a potential breach. Remember that the person doing the triage must have no conflict of interest, as they are affecting a decision about a possible investigation. The triage usually involves a basic assessment of the matter to establish whether there is a case to answer and whether an investigation is warranted. Factors may include:

Would the allegations, if proved, constitute a violation of the law?
Is there sufficient evidence to justify an investigation?
Is it appropriate to investigate? In some countries this can involve what is known as a "public interest test".

Whether it is appropriate to investigate can involve a number of considerations, and you will need to consider every case on its own facts, but some common factors that might be relevant are:

The seriousness of the offence - was it deliberate or was a significant sum involved?
The compliance history of the organisation - is this the first time there has been a potential breach?
The responsible officer being absent and a less experienced officer trying to help but making a mistake.
Illness or even death of a responsible officer which was a direct cause of the breach.
The time that has passed since the potential breach - the more time has passed, the less an investigation might be able to achieve, although efforts to hide a breach or delay an investigation should not be rewarded.
The co-operation of the organisation - did it self-report the issue before it became public, or when notified of the issue did it immediately apologise and seek to put things right?

In some situations, there may be other, more appropriate ways to deal with the matter, such as providing guidance or issuing a warning, but it will always depend on all of the facts.

For example, where a new political party delivers a donation report in which some figures are slightly wrong, it might be an option to provide some guidance rather than opening an investigation. On the other hand, where a political party appears to have deliberately tried to hide an illegal donation of substantial value, an investigation is much more likely to be appropriate.

3.3.1.2 Planning an investigation

It is recommended to produce a written plan for each investigation and in the case of complex cases, highly recommended - an investigation plan template is available here (see Investigation plan template.pdf). Your investigation plan should set out what is going to be done, and how it will be done. Your plan will show that all of the key issues were considered appropriately from the very beginning. It does not always need to be very long or detailed, but it should set out:

The scope of the investigation - what specific potential breach(es) are you investigating? And what standard of proof applies?
What evidence do you require to establish whether the breach(es) occurred?
Where can you obtain that evidence?
How will you obtain it - what powers can you use, and is it appropriate to use them or to use a voluntary approach, if this is recognised as an option in your jurisdiction?
What order might you want to obtain evidence in? It is common to gather physical evidence first, and then consider getting explanations or testimony.

And remember that any person who works on the investigation should declare that they have no conflict of interest. That includes decision makers, not just people gathering evidence. For inspiration, see the UK Electoral Commissions conflicts of interest template for investigations.pdf.

3.3.1.3 Gathering evidence

The conclusions of an investigation must be based on evidence, not suggestions or speculation. Evidence is generally any material that can help to establish facts. In some jurisdictions, the evidence must also be 'admissible' in a court of law. In other jurisdictions, inadmissible evidence falls within the scope of investigation if it could reasonably lead to admissible evidence (e.g. using a statement from an anonymous source to lead you to admissible evidence). And, many jurisdictions impose requirements that all evidence be obtained lawfully. This highlights how important it is that everyone involved in conducting investigations is well-trained about the applicable law in your jurisdiction.

There are generally four types of evidence:

Physical documents - for example bank statements, notes of meetings, letters etc
Digital evidence - for example emails, digital images, text messages etc
Other physical evidence - for example campaign items like banners or flags
Testimony from witnesses - usually records of interviews

The most common types of evidence in political finance investigations are physical documents, but digital evidence is quickly becoming more common. Testimony from witnesses can be important in explaining more about physical evidence or recalling events.

If you have planned the investigation well, the evidence gathering phase should be mostly a matter of following your plan. However, your plan may change or expand as the investigation advances. As evidence is gathered you may identify new or further evidence you need to obtain, and it is important to be ready to adapt the investigation when that happens. You need to record changes to the plan, and there are different ways to do this. For example, you can update the investigation plan throughout the course of the investigation, or you can instead make a separate record of actions and decisions after the plan was made, which shows how the investigation changed. In some cases that might involve identifying new and different breaches to those that led to the investigation. Depending on the relevant laws or policies in your jurisdiction, you may need to consider whether the scope of the investigation should be expanded to include them and, if so, whether you need to notify the person or organisation being investigated.

You should conduct all evidence gathering in writing so that there is a clear record. If you are using a legal power to require the production of evidence, you must comply with all relevant requirements for use of the power.

Documentary and Other Physical Evidence

Draft requests for evidence carefully. You need to frame them objectively and clearly, explaining any words or terms that may be open to interpretation and specifying the period covered by the request. The requests should be broad enough to cover all forms (digital and hard copy) and all non-identical copies of the original documents (copies with handwritten notes). It is a good idea for the request to advise what the recipient should do if they have doubts about disclosing any material. For example, in some countries legal advice is exempt from disclosure on the grounds of 'legal professional privilege'. One option is to require a brief description of material not being disclosed and the reasons for it being withheld, another is to require the recipient to contact you if they have any doubts about whether material should be disclosed.

You should specify how the evidence is to be produced - for example is it to be sent to you in hard copy or electronically, or made available for inspection elsewhere? Finally, you should set a deadline for responding which is reasonable to the request (e.g. a request for massive amounts of documents may require considerable time whereas a request for a single, readily available document may require only a minimum amount of time to produce). Although reasonable deadlines are important and generally should be met, you may offer to consider a request for more time if good reasons are presented to justify the request.

Digital evidence can produce unique challenges. It is easy to take screenshots for example, but it is also easy for material to disappear or to be manipulated. You therefore need to take particular care in establishing the reliability of digital evidence.

Testimony from Witnesses

Obtaining testimony from witnesses, or from the subjects of investigations, is best achieved through interviews. Generally, it is best to interview individuals only after obtaining all documentary or physical evidence, so that it is clear what you wish to discover from the interview. In some cases, it may be helpful to ask witnesses to provide answers to written questions before an interview to establish simple facts (e.g. dates and times of meetings, names of certain people). Answers to these types of questions can help the investigator prepare for the actual interview and thus make it more focused and productive.

Your approach may differ depending on the person being interviewed, but some general principles apply to all interviews:

An interview is a way of gathering evidence and needs to be planned carefully and conducted professionally
It should have a clear purpose
Interviews should always be recorded or documented

Some more detailed guidance for interviews can be found here: Interview guidance.pdf.

3.3.1.4 Records of evidence

Just as it is vital to have a record of actions and decisions you have taken during an investigation, it is also critical to maintain a record of all of the evidence acquired during the investigation - when it was obtained, from where, and how. This is sometimes called a schedule (see Evidence schedules template with example content.pdf). This can be a simple spread sheet in many cases. Each piece of evidence should have a unique reference and a brief, factual description. This includes interview records.

Record keeping takes time and effort; it is reasonable for the level of record keeping to reflect the complexity or seriousness of the case. For example, if there are only four pieces of evidence it may not be necessary to create a schedule. The essential point here is that an accurate record makes it harder to challenge the evidence, as well as making the administration of the investigation easier.

3.3.1.5 Assessment of evidence

Once the initial evidence gathering process is complete, it is important that you review all the evidence. This process enables you to establish firstly whether there is enough evidence to reach a view on the facts or if you require further evidence, and secondly which facts are confirmed by the different sources of evidence, and which appear to be disputed. If further evidence is needed, it should be obtained at this point.

3.3.1.6 Reaching conclusions on the facts

Once you have gathered all relevant and obtainable evidence, you can decide what the facts are, in other words what you have decided happened.

There will generally be some agreed facts. Agreed facts are ones that all of the evidence supports. For example, if money was transferred from person A to person B, and both people agree that happened, as well as bank records showing it, that is an agreed fact. Agreed facts can be accepted without further work. If all of the facts are agreed, you can decide what happened straight away and proceed to determine whether the facts support a finding of breach or no-breach.

However, there will usually also be disputed facts, where all of the evidence does not support one view. For example, person A says they gave money to person B in cash, but person B says the money was never given, and no bank record exists.

Disputed facts mean you need to decide what really happened. Reaching a view on disputed facts always depends on the specific circumstances, but some general approaches are often used:

Weight of evidence - if a significant majority of the evidence indicates one view, and only a small minority indicates another view, the majority may be more reliable.
Quality of evidence - if two witnesses describe something differently, but one was in a better position to describe it (for example one was at a meeting but the other was only told about it), that evidence may be deemed of better quality.
Reliability of evidence - if two witnesses give different evidence, but there are reasons to doubt the evidence of one (for example, other evidence they gave has been shown to be inaccurate) the more reliable witness may be given precedence.

As noted, these factors are merely illustrative, and there will be many other factors you need to consider in and particular case when deciding how to resolve disputed facts.

Once you have identified all the agreed facts and reached a view on any disputed facts, you have decided what transpired in relation to the allegations. You now must weigh the evidence against the relevant standard of proof that must be met to reach a decision for each potential breach, on the specific facts of each. Where your decision rests on disputed facts which are finely balanced, that may have an impact on whether the standard of proof can be met.

You should set out your decision on each potential breach in writing. This may be in a report, a legal notice, or some other form. Whatever the form, it is important that:

You set out the findings of fact, along with the analysis of the evidence that has led you to find those facts;
You then apply the facts to the required elements of the potential breach(es) or offences with analysis of whether breaches or offences have occurred.
Your findings should be accompanied by supporting documents - a schedule of evidence and a record of actions and decisions taken during the investigation.
The subject of the complaint be afforded the opportunity to review the proposed findings and supporting documentation and to put forward evidence and/or arguments in opposition to your conclusions. The exact nature of what the subject is provided with, and at what stage, may be set out in law or, if not, should be included in your institution’s policies/ procedures, to ensure consistency.