Internal Compliance Investigations Training Course

Duration 5 days 11 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Compliance Managers, Internal Auditors and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-FFC-042

Before you join: Participants should have working experience in compliance, internal audit, risk, finance, legal, HR, security or a related control function.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Internal compliance investigations begin when a hotline report, audit exception, sanctions alert or management concern suggests misconduct. The task is not simply to find a plausible explanation. Investigators must preserve evidence, protect reporting persons, establish facts fairly and give decision makers a record that can withstand challenge. Poorly scoped enquiries can compromise legal privilege, alert subjects, overwrite data, prejudice disciplinary action or leave regulatory notification too late. For banks, public bodies, NGOs and multinational companies, cases frequently cross functions, countries and data systems while senior stakeholders demand timely answers.

This course develops the practical discipline required to manage fraud, bribery, conflicts of interest, financial misconduct and other compliance allegations. Participants learn to triage reports, establish investigation governance, define allegations, prepare investigation plans, preserve physical and digital evidence, analyse financial records and conduct defensible interviews. The course also addresses whistleblower protection, procedural fairness, data protection, reporting standards, root-cause analysis and corrective action tracking. Participants practise making decisions where evidence is incomplete, stakeholders disagree and business continuity must be maintained.

Teaching combines focused instructor briefings with realistic case work, group analysis, document-review simulations and structured interview planning. Cases reflect issues such as procurement fraud, expense manipulation, third-party bribery, payroll irregularities and suspicious vendor payments. Participants leave with a reusable internal investigation case-file toolkit containing planning, evidence, interview, reporting and remediation documents. The course is particularly relevant for professionals who commission, lead, support or oversee internal investigations and need a consistent method for producing fair, well-documented findings.

What you will be able to do

  • Triage allegations using credibility, materiality, jurisdiction and immediate-risk criteria
  • Draft an investigation plan linking allegations, evidence sources, milestones and decision rights
  • Apply legal hold, chain-of-custody and evidence-register controls to case materials
  • Analyse financial transactions using anomaly tests, funds-flow analysis and journal-entry review
  • Prepare and conduct witness interviews using the PEACE interviewing framework
  • Assess evidence against defined allegations using corroboration and proof-matrix methods
  • Write defensible investigation reports separating facts, analysis, findings and recommendations
  • Design corrective action plans that address root causes, control failures and recurrence risks

Benefits of attending

For you

  • Handle allegations with a documented, repeatable investigation method
  • Make defensible scope and escalation decisions under time pressure
  • Recognise financial evidence patterns associated with fraud and misconduct
  • Conduct better structured interviews without contaminating witness accounts
  • Produce reports suitable for senior management, counsel and audit committees

For your organisation

  • Faster, more consistent responses to fraud and compliance allegations
  • Stronger evidence preservation and reduced risk of compromised cases
  • More reliable findings for disciplinary, recovery and disclosure decisions
  • Earlier identification of control weaknesses causing repeat misconduct
  • Clearer remediation ownership, monitoring and board-level reporting

Course modules

11 modules over 5 days

Participants can assess an allegation, identify immediate risks and set an appropriate initial response.

  • Allegation intake, triage criteria and immediate preservation decisions
  • Distinguishing misconduct, control failure, policy breach and criminal indicators
  • Materiality, credibility, jurisdiction and seniority within an investigation risk assessment
  • Setting case objectives, scope boundaries, authorities and decision rights
  • Applying ISO 37301 compliance management system investigation obligations
  • Escalation thresholds for regulators, law enforcement, insurers and boards

Participants can establish investigation governance that protects independence, confidentiality and legal interests.

  • Investigation charters defining mandate, independence, reporting line and resources
  • Legal privilege protocols agreed with counsel before substantive fact gathering
  • Conflict checks for investigators, decision makers, witnesses and external advisers
  • RACI matrix for oversight, approvals, notifications and remedial ownership
  • Documenting management direction without compromising investigator independence or impartiality
  • Data protection, employment law and cross-border transfer constraints
  • Whistleblower confidentiality, anti-retaliation controls and protected disclosure handling

Participants can build a proportionate investigation plan with clear hypotheses, evidence priorities and controls.

  • Investigation plan linking allegations, elements, evidence sources and milestones
  • Fraud triangle used to frame pressure, opportunity and rationalisation hypotheses
  • Proof matrix mapping each allegation to facts, documents and witnesses
  • Sequencing enquiries to protect evidence, confidentiality and interview integrity
  • Time, cost and resource estimates supported by decision gates
  • Risk register covering retaliation, tipping-off, data loss and business disruption
  • Communication protocol for need-to-know updates and stakeholder requests

Participants can preserve, register and assess evidence in a manner suitable for internal review and challenge.

  • Legal hold notices specifying custodians, repositories, retention suspension and acknowledgements
  • Chain-of-custody log recording collection, transfer, storage and access
  • Hash values and forensic images used to demonstrate digital evidence integrity
  • Collecting paper records, access logs, CCTV and physical exhibits
  • Evidence register distinguishing originals, copies, extracts and working papers
  • Secure review environments and access permissions for sensitive case material
  • Authenticity, relevance, reliability and provenance tests before relying on evidence

Participants can scope and review digital evidence while maintaining proportionality, traceability and data controls.

  • Scoping email, chat, shared-drive and mobile-device data sources
  • Keyword lists, Boolean search strings and date filters for collection
  • Technology-assisted review concepts, including deduplication, threading and near-duplicate detection
  • Metadata analysis identifying authorship, timestamps, file paths and deletion activity
  • Structured data extraction from ERP, expense, vendor and payment systems
  • Preserving personal data while applying proportionality and minimisation principles
  • Documenting search decisions for reproducibility, challenge and disclosure

Participants can identify and investigate financial anomalies using targeted tests and transaction analysis.

  • Benford's Law, ratio analysis and trend testing for anomaly detection
  • Duplicate-payment tests using invoice numbers, amounts, dates and vendor fields
  • Related-party screening through ownership records, addresses and bank accounts
  • Funds-flow analysis tracing payments through accounts, entities and intermediaries
  • Expense claim testing against policy limits, receipts and travel records
  • Journal-entry analysis targeting manual postings, period-end entries and unusual users
  • Quantifying loss, exposure and potential recovery using defensible assumptions

Participants can plan and conduct structured interviews that obtain reliable information fairly.

  • PEACE framework for preparation, engagement, account, closure and evaluation
  • Cognitive interviewing techniques for accurate recall without contaminating accounts
  • Witness interview plans built from allegation elements and available evidence
  • Question funnels moving from open prompts to controlled clarification
  • Handling reluctant, vulnerable or represented interviewees within agreed protocols
  • Testing accounts against documents without disclosing unnecessary case information
  • Contemporaneous notes, interview records and participant corrections preserved securely

Participants can manage people-related risks while maintaining fair and confidential investigation processes.

  • Trauma-informed and culturally aware approaches to complainant and witness contact
  • Retaliation risk assessments and protective measures following protected disclosures
  • Presumption of innocence, procedural fairness and consistent treatment principles
  • Separate fact-finding from disciplinary decision-making and sanction recommendations
  • Confidentiality limits explained without making assurances investigators cannot keep
  • Managing conflicts between employee privacy, disclosure rights and investigation needs
  • Support referrals, welfare check-ins and communication boundaries throughout investigations

Participants can reach evidence-based findings and identify the control failures that enabled misconduct.

  • Burden and standard of proof applied under internal investigation policies
  • Fact chronologies separating established evidence, inference and unresolved questions
  • Corroboration analysis weighing consistency, plausibility, motive and documentary support
  • Allegation-by-allegation findings using substantiated, unsubstantiated or inconclusive classifications
  • Root cause analysis using five whys and control failure mapping
  • Distinguishing individual misconduct from process weakness and supervisory failure
  • Quality assurance review for accuracy, fairness, completeness and defensibility

Participants can prepare clear investigation reports and brief decision makers on material findings and risks.

  • Investigation reports structured around mandate, methodology, facts, findings and recommendations
  • Neutral language that separates evidence, analysis, conclusions and management action
  • Executive summaries presenting material issues, decisions required and residual risks
  • Appendices indexing evidence, interviews, chronology and relevant policies
  • Disclosure-ready writing that avoids speculation, advocacy and unsupported assertions
  • Oral briefings for boards, audit committees, counsel and senior management
  • Record retention schedules for reports, evidence and decision documentation

Participants can close investigations properly and track remedial actions through to verified completion.

  • Corrective action plans assigning owners, deadlines, controls and verification measures
  • Control remediation mapped to root causes, risks and process owners
  • Disciplinary, regulatory and recovery decisions tracked through defined governance
  • Lessons-learned reviews identifying policy, training, monitoring and culture actions
  • Case closure criteria covering evidence disposition, notifications and records retention
  • Post-investigation monitoring indicators testing remediation effectiveness and recurrence risk
  • Personal application plan for an active or anticipated investigation

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Investigation intake and triage checklist
  2. Investigation plan and proof-matrix template
  3. Evidence register and chain-of-custody log
  4. Financial fraud testing model
  5. PEACE interview planning template
  6. Investigation report and corrective action plan

Who should attend

  • Compliance Managers — responsible for receiving, coordinating or escalating misconduct allegations
  • Internal Auditors — requiring investigation methods beyond routine control testing
  • Financial Crime Specialists — investigating suspicious transactions, fraud indicators and policy breaches
  • Risk Managers — overseeing material incident governance and remediation tracking
  • Legal Counsel — advising on privilege, fairness, reporting and regulatory exposure
  • HR Investigators — handling employee misconduct cases with financial or compliance dimensions

Skills and tools covered

Allegation triageEvidence preservationForensic financial analysisInvestigative interviewingFindings assessmentRemediation planning

Tools and standards

ISO 37301 Compliance Management Systems, ISO 37008 Internal Investigations of Organizations, PEACE Interviewing Framework, COSO Fraud Risk Management Guide

How the course runs

Training methodology

The course uses short instructor briefings to introduce investigation standards, decision frameworks and evidence principles. Participants work through linked fraud and misconduct cases, assessing allegation intake, planning enquiries, reviewing records, analysing transaction data and preparing interview strategies. Group exercises test judgement on privilege, confidentiality, witness protection and reporting choices. Simulations build practical confidence in evidence handling and questioning. Each participant develops an application plan and adapts the course templates for use within their own investigation governance arrangements.

Requirements and prerequisites

Participants should have working experience in compliance, internal audit, risk, finance, legal, HR, security or a related control function. They should be comfortable reading policies, reviewing business records and discussing workplace misconduct objectively. Familiarity with fraud risks, financial controls or whistleblowing arrangements is useful but not essential. The course does not require prior investigation leadership experience, forensic accounting qualifications, coding skills or specialist digital-forensics training. It is not a substitute for jurisdiction-specific legal advice or formal law-enforcement investigator certification.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

You should have working experience in a compliance, audit, risk, finance, legal, HR or related control role. Previous responsibility for leading investigations is useful but not required.

Bring a laptop if possible, as participants may adapt templates and work with case materials. You may also bring a redacted policy, investigation procedure or control issue from your organisation for application planning.

The course suits professionals who receive, support, oversee or conduct internal compliance investigations. It is particularly relevant where allegations involve fraud, financial misconduct, bribery, conflicts of interest or third-party risks.

Fraud awareness courses focus on recognising red flags, while forensic accounting courses concentrate on financial analysis and quantification. This course covers the end-to-end management of an internal investigation, including governance, evidence, interviews, findings and remediation.

Participants can use the investigation plan, evidence register, interview template and report structure for current or future cases. The methods also support reviews of whistleblowing procedures, case governance and remediation tracking.

Each training day runs from 08:30 to 16:30 and provides about 6.5 contact hours. Time is divided between instructor briefings, case analysis, group work, simulations and application planning across the full investigation lifecycle.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.