Compliance investigation case management, explained.

What a compliance investigation is, and why one takes about four weeks

One speak-up report, from a web form to a corrected record

1. A report comes inBy web form, hotline, email or a word to a manager. It may be anonymous. Someone reads it and decides where it goes.
2. Scope and legal holdWhat is alleged, whose records, which dates. A lawyer decides whether the case runs under counsel's direction. Records are frozen.
3. Evidence, timeline, interviewsRecords are collected and laid in date order, contradictions are found, and interviews are planned from the gaps. This guide is mostly about this step.
4. Findings and reportA person decides each allegation: substantiated, unsubstantiated or inconclusive. The report cites an exhibit for every statement. Counsel signs.
5. Corrective actionDiscipline, repayment, corrected government filings, a changed control. Prosecutors ask whether the root cause was addressed.2

A chronology is a date-ordered list of facts. An exhibit is one document kept as evidence, with a number. Counsel means the lawyer acting for the company.

Why speak-up investigations are hard: four facts that surprise newcomers

Legal hold, custodian, exhibit, substantiated: the investigator's vocabulary

Fourteen terms are defined in the one-page summary.

How many speak-up reports a company receives, who sends them and how many hold up

In shortThe best public benchmark comes from one vendor's customer data: 1.65 reports per 100 employees in 2025, more than half of them anonymous, and 44% substantiated. No source publishes these figures for drug companies alone, so nobody can honestly tell you how many investigations a pharma company "should" run. You can estimate your volume from headcount and measure the rest.

NAVEX, which sells reporting software, publishes the largest benchmark we found. Its 2026 report covers 2025 data from 4,052 organizations and 2.37 million reports.1 It describes that vendor's customers, in every industry, and only those with 10 or more reports in the year, so it may not match a drug or device company. Most teams and vendors still quote it, including its 28-day median.

Tips find more fraud than audits do

Speak-up channels matter because of where misconduct comes to light. The Association of Certified Fraud Examiners studied 2,402 cases of fraud inside organizations for its 2026 report. Tips uncovered 43% of them, nearly three times the 15% found by internal audit.5 More than half of those tips came from employees. Organizations with a formal reporting channel lost less and found the fraud sooner: a median $100,000 and 11 months, against $150,000 and 17 months without one.5

Anonymous reports are common, and harder to prove

Anonymous reports sit in the mid-50 percent range of all reports.1 They hold up less often: a median 34% were substantiated in 2025, against 50% for named reports.1 The usual reason is that nobody can ask the reporter a second question. Some systems let an anonymous reporter come back through a reference number, and the median follow-up rate on anonymous reports reached 31% in 2025, a five-year high.1 That second conversation is often what makes an anonymous report provable.

A warning on reading these numbers: a benchmark depends on what each company counts as closed. NAVEX cautions that cases closed on the day they arrive have often been passed to another department and remain under investigation, which gives the people overseeing the program a false picture.1 Check how your own "closed" is defined before you compare it with anyone's.

DOJ's compliance evaluation, the Anti-Kickback Statute, Open Payments and the EU Directive: what governs an investigation, and since when

In shortNo US law says "investigate this way". The Justice Department (DOJ) says what its prosecutors will ask afterward, and the Inspector General of the Department of Health and Human Services (HHS-OIG, or OIG) says what a good record holds. The conduct itself sits under the Anti-Kickback Statute and the False Claims Act, and payments to doctors under Open Payments. Europe is different: its Whistleblower Directive sets hard deadlines for acknowledging a report and giving feedback.

Speaker program investigations: the patterns the Inspector General names and what they cost companies

In shortSpeaker programs are the classic case in pharma compliance. A paid doctor presents to other doctors over a meal. OIG, the HHS Inspector General, says it is "skeptical about the educational value" of such programs and lists the patterns it treats as suspect. Public cases run from $59.7 million to $900 million. An August 2026 resolution, about dinners and retreats, records names falsely added to expense reports to lower the per-attendee cost, the same move this guide's fictional example uses.

Drug and device companies reported paying health care professionals (HCPs) nearly $2 billion for speaker-related services across 2017, 2018 and 2019.6 In 2020 OIG published an alert listing what it had seen in its cases.6 PhRMA, the industry's trade group, then revised its code, in force from January 1, 2022.7 Together they give an investigator a ready list of what to test.

Quotations are from the PhRMA Code's speaker program section. Your own procedure may set stricter rules, and a dollar cap is a company's own choice: the Code sets no figure.

What the Novartis, Gilead and Veloxis records say about meals and attendance

The government's Novartis allegations described "tens of thousands of sham educational events at high-end restaurants", with doctors giving no meaningful presentation.25 Gilead's case shows one way a meal cap gets beaten. Gilead made "extensive factual admissions" in its settlement.26 By one law firm's reading of the settlement papers, sales staff got around per-person meal limits by recording food and beverage costs as room fees, sales nominated the speakers, and a group of speakers repeatedly attended each other's programs.29

The newest public record comes closest on one point. On August 10, 2026 Veloxis Pharmaceuticals, which sells a kidney transplant drug, agreed to pay more than $46 million to resolve criminal and civil allegations.30 Prosecution is deferred for three years under an agreement in which the company accepts a statement of facts as true.

That statement says employees falsified expense reports "by falsely adding names to the list of attendees (to decrease the apparent cost per attendee of the meals) and omitting the names of health care professionals who did attend the meals (to avoid Sunshine Act reporting requirements)".31 Its examples are advisory board retreats and other dinners, so the setting differs from a speaker program, while the move on the expense report matches the one in this guide's fictional example. Some meals were also recorded as "internal" meetings.31

The false records left payments under-reported to CMS under the Sunshine Act, the law behind Open Payments, and that part drew a $1.55 million penalty, which DOJ's announcement calls the "Largest Sunshine Act Recovery in History".32,30 The company, people and dinner in this guide's example are invented, and nothing in them describes Veloxis.

Veloxis also signed a five-year Corporate Integrity Agreement, a compliance contract with OIG. It obliges the company to run a program for reports, ban retaliation, review each disclosure, and tell OIG within 30 days of determining that a Reportable Event exists: a matter a reasonable person would consider a probable violation of the relevant laws.33 For a company under such an agreement, the speed of an investigation has a contract date on it.

Which record answers which speaker program question

Legal hold and the case file: how evidence is preserved, collected and kept usable

In shortPreserve first, then collect only what the scope covers. OIG says to secure evidence, the federal court rules penalize a failure to take reasonable steps, and destroying records to impede a federal matter can carry 20 years. Prosecutors also ask about messaging apps. Every exhibit needs its source, its custodian and a record of who handled it.

OIG's guidance tells the compliance officer or counsel to "take appropriate steps to secure or prevent the destruction of documents or other evidence".8 The law backs that advice.

Under federal civil Rule 37(e), if electronic information that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps, a court may order measures to cure the harm. If the party meant to deprive the other side of it, the court may presume the information was unfavorable or end the case.34 Under 18 U.S.C. 1519, knowingly destroying or falsifying a record to impede a federal matter carries up to 20 years in prison.35

Scope, hold, collect, chain of custody: the order of work on evidence

The investigator and counsel make the decisions. An eDiscovery analyst, the specialist who collects electronic records for a case, does the collecting.

The systems a speaker program case draws from

Attorney-client privilege in an internal investigation, the Upjohn warning, and what confidentiality you may ask for

In shortInterviews run by or for company lawyers can be privileged, but the privilege belongs to the company and covers conversations, leaving the facts unprotected. So the interview opens with a notice, known as an Upjohn warning. Europe treats in-house lawyers differently. A confidentiality request needs care, and a 2026 ruling found no privilege in documents a criminal defendant made alone with a consumer AI tool.

Upjohn Co. v. United States (1981) held that communications from employees to company counsel can be privileged when they are made so the company can get legal advice.3 It left the underlying facts open to discovery, the stage of a lawsuit when each side can demand evidence from the other. The D.C. Circuit later said, in the Kellogg Brown & Root case, that an internal investigation stays privileged if getting legal advice was "one of the significant purposes", even when a compliance program also required it.36 That is one federal circuit's view, so ask counsel what applies where you are.

What a counsel notice at the start of an employee interview says

Because the lawyer represents the company, employees need to hear that before they speak. An American Bar Association working group published recommended wording in 2009, starting with whom the lawyer represents.37 In practice the notice covers five points:

The first line quotes the working group's sample and the rest is paraphrase. Its sample covers the first four points, and on confidentiality it says the person may not discuss the interview except with their own attorney, with no line about government agencies. The exception and the retaliation line go beyond that sample, and KBR's amended statement added both after the SEC action below, so take your wording from your own counsel.37,4

How privilege changes across the Atlantic and around AI tools

How to plan investigation interviews: who goes first, what to ask and which exhibit to show

In shortAn interview plan should come from the gaps in the evidence. Each question tests a dated fact, and you know which document you will show when. A common order is witnesses first and the subject last, so the subject can answer the whole picture. Questions written from memory are how a second round of interviews begins. No public figure measures how often that happens, so count yours.

What makes an interview question worth asking

Sample questions, from this guide's fictional case. A cover is a restaurant's word for one person served.

Interview order, and the people who need a different conversation

One practical check. Under NLRB v. J. Weingarten (1975), a union-represented US employee who reasonably believes an investigatory interview could lead to discipline may ask for a union representative, and refusing that request is a violation, so ask labor counsel before you schedule.43

Write up each interview promptly as a memo. OIG's list of what the record should include names "copies of interview notes and key document" and a log of witnesses interviewed and documents reviewed.8 Agree with counsel, in advance, who writes it and how it is labeled. A memo that reads as a transcript and one that records counsel's impressions may be treated differently, and that is a question for your lawyer.

Working through a speaker dinner: per-person cost, meal cap overage and the Open Payments correction

In shortAn expense report can sit just under a cap and still be $1,025.60 over. Divide by the people who ate, and the $139.20 becomes $345.12. Because meal values are reported to CMS, a false sign-in sheet also makes a false government record, for every name on it. Here is the whole calculation on the fictional July 9 dinner.

Why the sign-in sheet becomes a false government filing

Manufacturers report meals to CMS under Open Payments, by name. For a shared meal where each person's share cannot be separated, the rule says to divide the whole food and beverage cost by the number of people who actually partook, including those who are not reportable, such as staff.19

So the figure here is about $345.12 for each doctor who ate, or $320.32 if your reporting policy leaves out the tip. Eight records at $139.20 are wrong in two ways: at least four name someone who was not there, and the ones who did attend are understated.

The rule on errors is short: a manufacturer that discovers an error "must submit corrected information to CMS immediately upon confirmation".20 Each report and correction carries an officer's attestation.20 The regulation sets penalties of $1,000 to $10,000 per item for a failure to report accurately and $10,000 to $100,000 per item for a knowing failure, adjusted for inflation, with annual totals capped.44 The current adjusted amounts are below, with HHS making no 2026 change.45 Records must be kept for at least five years from publication.44

From allegation to finding: how substantiation is decided, what happens next and why root cause matters

In shortA finding is a person's decision on one allegation, tested against one rule, with the evidence on both sides written down. Many teams use three outcomes. Published benchmarks show discipline as the most common result, separations falling back and "no action" at a five-year low. DOJ asks what the root cause was, how high the finding went and whether it changed anything.

Set each allegation beside the clause it would break. List evidence for, evidence against, and what is still unknown. Write the standard of proof in your procedure, so that two investigators reach the same result on the same facts. A "substantiated" finding on a record with a real open question needs a reason, and an "inconclusive" that hides a decision nobody wanted to make is its own failure.

What DOJ asks after the finding

Prosecutors want to know whether investigations were "used to identify root causes, system vulnerabilities, and accountability lapses, including among supervisory managers and senior executives", and "how high up" findings go.2 OIG asks for the same record of outcome: the results, and any disciplinary or corrective action taken.8

A root cause names the weakness that let the conduct happen. Ask why the control did not catch it: was the expense review looking at one report at a time? Did a manager approve an exception nobody could see? Had the same person been coached before?

How people learn of the outcome matters too. NAVEX reads its 2025 data as a shift to more graduated responses and warns that training and documented discipline are less visible to the workforce than a termination, so employees may conclude nothing happened.1 Decide what you can tell people, including the reporter, about the fact that action was taken.

The deadlines around an internal investigation, and eight ways a case file fails

In shortSeveral clocks may run at once, and they start at different moments: 7 days to acknowledge in the EU, 60 days in OIG's guidance, 120 days in DOJ's pilot, 180 days for a Sarbanes-Oxley complaint. The usual failures are ordinary: a scope nobody wrote down, a hold issued late, a contradiction nobody saw, a statement with no exhibit behind it.

Investigating in the EU and UK: reporter protection, employee data, works councils and in-house counsel

In shortA US playbook does not travel. EU law sets the 7-day and 3-month deadlines and guards the reporter's identity. Data protection rules limit what you collect, and can oblige you to tell the person concerned. Works councils can have a say over reporting systems, retention limits apply, and in-house counsel may have no privilege. Plan EU cases with local counsel from day one.

The UK adds its own question. Since September 1, 2025 a large organization can be liable if an associated person commits a specified fraud for its benefit and it lacked reasonable fraud prevention procedures.12 A record of how you investigate and respond is part of what shows reasonable procedures.

AI in internal investigations: where it helps, what regulators ask and where a person has to decide

In shortAI helps with volume: reading thousands of items, ordering dated facts, comparing systems and drafting from a record. It should stop short of deciding whether a person did wrong. DOJ's questions apply directly. In the EU, AI that monitors or evaluates workers' behavior is listed as high-risk from December 2027. Most drug-specific AI rules do not reach this work.

What AI gets wrong in legal work, and how to catch it

The clearest public test we found did not study investigations. Researchers tested commercial legal research AI tools and found they produced false information between 17% and 33% of the time, with a general model doing worse.54 Those were 2024 versions, and the percentages will have moved. The lesson stands: a confident, well-written sentence can have nothing behind it. We found no peer-reviewed study of AI accuracy on compliance investigations, so a vendor's figure is the vendor's. Five controls follow from this:

Who runs a pharma compliance investigation today: the team, the hand-offs and where the days go

In shortAn investigator leads, counsel directs the sensitive cases, an eDiscovery analyst collects, internal audit handles the money, and HR handles the people. Most of the work moves through exports, a spreadsheet and a Word document. No study publishes how the days split, so the chart below is illustrative, and timing your own closed cases is a better guide.

The investigator, counsel, eDiscovery, audit, HR and the compliance officer

Three ways teams run compliance investigations

From a speak-up report to one investigation timeline: 2,318 items, 22 events and a link nobody had seen

In shortLena Ortiz, senior compliance investigator, opens case IC-1042 with an anonymous report on the screen and 2,318 items on legal hold. One click runs three AI agents read-only. Twenty-two events land on seven lanes, 11 of them flagged where sources disagree, each linked to the passage it rests on.

1

The report on the timeline, before any evidence is read

The case bar shows IC-1042: high risk, privileged, HCP interactions, subject Ryan Castell, counsel Omar Haddad, day 18 against an industry median of 28, legal hold LH-2026-031.

Under it, six sources wait on hold, for four custodians from January 1 to October 7. Report SU-2214 sits on the Speak Up lane with its key passages highlighted, and the reporter has asked to stay anonymous.

2

Load evidence: the collector reads 2,318 items and keeps 16

The evidence collector reads every item for the four custodians and keeps 16 exhibits in 14.2 seconds on the sample. The timeline builder lays events in date order and links them. The policy analyst sets five allegations against five clauses, and its proposals wait for Lena.

The header says what the agents may do here: read-only, legal hold respected.

3

Seven lanes, 11 flagged events and "2 days before the split payment"

Speak Up, Events, Expenses and payments, Email, CRM, Records and HR, and Interviews each get a lane. Flagged events are ringed in red. The close-up below shows the week of the dinner, day by day.

The red bracket is the moment the case turns: the builder links Ryan's July 7 email to the card split on July 9. The panel opens EX-16 at the passage that matters: "Can you ask Bellhaven to put the bar on its own ticket?"

4

Eight signatures on the sheet

Select the event and the panel says what it contradicts: "Same day, another source disagrees: Receipt: 5 covers." The sheet carries eight names, certified by the representative. On the scan alone, nobody can say who really signed, and the product records that as evidence against the allegation.

5

The receipt, with its chain of custody

The full exhibit shows five covers, food of $1,113.60, a bar of $488.00, a tip of $124.00 and a total of $1,725.60, paid in two card transactions at 9:51 pm and 9:58 pm. The record beside it gives the source, the custodian, the fingerprint and where it is cited.

The privilege row reads: "Case under counsel direction; exhibit itself is a business record." That is the Upjohn distinction, stated on the screen.3

6

A second report lands on the same dinner

On October 6 a practice manager in Marietta writes that Dr. Lund got a thank-you note for the July 9 dinner while she was at a conference in Denver. The intake agent reads it in 3.8 seconds on the sample, classes it as HCP interactions and high risk, and matches it to IC-1042 at 91%: same program, same restaurant, a name on the sheet.

It routes nothing. Lena decides whether to add the report as an exhibit or open a separate case. A named reporter's identity is shown to the investigator only, and an anti-retaliation notice goes out.

Select any screen to open it larger.

Interview outlines built from the gaps, each finding decided by a person, and a report with 38 statements cited

In shortFour gaps on the timeline become 17 questions for four people. Each question names the event it tests and the exhibit to show. Lena records each finding, with the agent's proposal beside it, and a new allegation goes to counsel first. The report writer drafts from her decisions, and it cannot go to counsel while a statement is uncited or an allegation is undecided.

1

Four interviews on the Interviews lane

The interview planner reads four gaps: who signed for the doctors who were not there, who approved ER-55822 and why, why needs assessments were waived, and whether prescribing drove the added programs. It places Alana Pierce on October 9, Jess Alvarado of the venue company on October 10, Mia Torrance on October 13 and Ryan Castell, the subject, on October 14.

Mia Torrance approved both expense reports and sits under "Subjects" in the case scope, while the outline labels her a witness. A real team would settle that with counsel before the meeting.

2

Every question tests an event and shows its exhibit

Ryan's outline has seven questions grouped by allegation. "On July 7 you asked the venue for a separate bar ticket 'to stay under $140 a head'. Why?" carries a chip for the July 7 email, gap G2 and a button that shows EX-16.

The counsel notice opens every employee outline and cannot be switched off. The wording on this screen is the sample's. Before you use it, add what Part A explains: a plain statement that nothing stops the person from going to a government agency.38,4

3

Each allegation beside its clause, with evidence on both sides

A1 sits beside clause 4.2 of the sample's procedure, SOP-HCP-014. Evidence for has three items, and against has two: the speaker agreement says selection is on expertise, and gap G4 is still open. The analyst proposes "substantiated" at 78%, and says why, and what is not yet known.

Three plain buttons follow: substantiated, inconclusive, unsubstantiated. The agent cannot press them.

4

Findings on the record, and a new allegation that waits for counsel

Lena's decisions carry her name and time. For A3 the analyst's reason reads: "The real cost was $345 a head, $1,025.60 over the cap for 5 people."

A5, needs assessments skipped for the added programs, was found outside the reported allegations. So its finding buttons stay locked until Omar Haddad, as counsel, decides whether it joins the scope. This is the DOJ scoping question built into the workflow.2

5

A draft report, every statement tied to an exhibit

The report writer uses the house format: allegations and scope, how the evidence was gathered, chronology, findings, root cause, corrective actions. The flagged events become the chronology, and Lena's decisions become the findings. It never uses a proposal as a finding.

The counter at the top reads 38 statements cited, 0 uncited, and the draft carries the privileged and confidential label.

6

Findings, root cause and six corrective actions with owners

Each finding repeats its evidence with citations, including what stands against it. The root cause names the control: expense review checks each report alone, so a split at one merchant on one night was not seen.

Actions include recovering the $1,025.60 over the cap and the $612.00 mis-filed charge. Those two figures overlap, since both sit inside one $1,725.60 bill, so a real team would set a single recovery amount. The actions also include correcting the July 9 transparency records for each listed doctor who did not attend, reviewing all nine programs, and a monitoring rule for split charges.

7

A check before it goes to counsel, then the signature

Send to counsel shows what is being attested: 38 statements cited, 5 findings decided, the label on every page, and who signs. Once Omar Haddad signs, the banner records it, the six actions become tasks and the case moves to Remediation.

The custody record, the audit trail, every open case, a report for Quality, the dashboard and your settings

In shortAround one case sit the screens a compliance team uses all year: full exhibits with chain of custody, the case activity record, all investigations with their clocks, a report routed to Quality, the numbers a chief compliance officer takes to the audit committee, and the settings that hold your procedure.

Six investigation agents, and the investigator and counsel who decide

In shortSix specialist agents read, order, compare, plan and draft. None can record a finding, widen the scope, reveal a reporter, move EU data or write an uncited statement. The investigator routes each report and decides each finding. Counsel approves scope changes and signs. Every step is on the audit trail.

What each investigation agent does, and where it stops

Who routes a report, who decides a finding and who signs

The people in the IC-1042 sample, in their own words

From speak-up reports and held records to a signed report with owned actions

Systems the evidence already lives in

Privilege, reporter protection and credentials your counsel will ask about

Cases under counsel direction carry the privileged and confidential label on every page and in the export. A label does not create privilege, so your counsel decides what qualifies, and a person's use of this solution should sit under that direction.36,40 Reporter identity is never shown to subjects, and an anti-retaliation notice goes to every named reporter. Evidence is collected read-only with a fingerprint and a chain of custody.

Botminds' information security is managed to ISO 27001 and audited under SOC 2 Type II. The solution runs at enterprise scale across regions and case categories, with roles, maker-checker approvals (one person prepares, another approves), integrations and an exportable audit trail. These are controls that support your own compliance program. Whether a given case is well run stays with your people and your counsel.

What a slow investigation and a thin case file cost a drug or device company

In shortThree kinds of cost sit here: investigator hours, outside counsel and forensic fees, and the outcome if a regulator or a whistleblower gets there first. Only the last has public numbers, and those are large and rare. No source publishes hours or cost per case, so your own closed cases are the evidence, and you can gather most of it in a week.

Six investigation costs you can measure in a week, starting with five closed cases

What a late chronology does that no spreadsheet prices

What investigation automation returns: investigator hours, faster closure and a file that holds up

In shortPut in your own numbers. The calculator values investigator hours released from collection, chronology and citation checks. It leaves out avoided penalties, because nobody can honestly price them. Defaults are illustrative, except the shares of time saved, which come from the solution's own pre-deployment estimate. A pilot should replace all of them.

Collection, chronology, interviews, citations, repeat patterns: where investigation time comes back

Investigator hours calculator: cases a year, hours per case and share saved

How ready your investigations team is: procedure, data access, privilege, and the proof you can show a regulator

In shortPick the answer closest to your team today. Eight questions score 0 to 2, and the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

Twelve questions for any investigation case management vendor, us included

In shortMost internal investigations software demonstrates well on one tidy case. These questions test what a demonstration hides: whether the tool reads the evidence or only stores it, whether a finding can be traced, who can widen a scope, and what happens to privileged material.

Testing investigation software in eight weeks: a closed speaker case, planted contradictions and one live case in parallel

In shortStart with a closed case you know well, so you can see whether the tool finds what your investigator found, and what she missed. Plant known contradictions to test whether the flags catch them. Then run one live case beside your usual process, under counsel's direction, and decide on five numbers.

Contradictions found, false alarms and days to first interview on your own case

Compliance investigation questions answered: timelines, privilege, Upjohn warnings, speaker programs and AI

In shortQuestions investigators and buyers commonly search for, each answered on its own. This is general information, so take your own counsel's advice on any case.