WorkflowCompliance & Ethics

Investigation Case Builder

Compliance investigations with the evidence gathered, ordered and cited before you start

Every investigation starts with its evidence gathered, ordered and cited, and closes in a median of 18 days.

See one case, screen by screen ↓
demo2,318itemscollected from 6 sources for 4 custodians under legal hold, 16 of them kept as exhibits
demo10flagson a 21-event timeline where one source contradicts another
target18daysmedian to close an investigation, against an industry median of 28
target100%of report statements tied to their exhibit, ready for counsel to sign
The problem

Why investigations run past the 28-day median

A Speak Up report lands and the case is open. Before the investigator can weigh a single allegation, someone has to place a legal hold, pull email, CRM call notes, expense reports, event records and training history for every custodian in scope, and work out which of thousands of items actually matter.

Then the facts have to be put in order by hand. The contradiction that decides the case — a sign-in sheet with 8 signatures against a receipt for 5 covers — sits across three systems, and only shows when the dates line up. Interview outlines get written from memory rather than from the gaps, and the report is drafted at the end, when every statement still has to be traced back to its source before counsel signs.

typical28daysindustry median to close an investigation
demo29daysmedian open across the team’s open cases, against a target of 21 or less
demo4of 8open cases already past the 28-day median
Where an investigation’s days goestimated
By hand28 days
With the solution16 days
  • Triage and planning3 → 2 d
  • Collecting and reviewing the evidence8 → 2 d
  • Building the timeline and weighing each allegation5 → 2 d
  • Interviews6 → 6 d
  • Report and counsel sign-off6 → 4 d

Estimated split for a typical investigation, in days, by hand and with the solution.

How it works

How a case moves

Six specialist agents triage the report, collect the records, build the timeline, weigh each allegation, plan the interviews and draft the report; the investigator decides each finding and counsel signs.

What comes in
Report inSpeak Up report · web, hotline or email
Agents at work
Intake & triage agentcategory, risk, privilege
Then
Evidence collectorunder legal hold
Then
Timeline builderevents and contradictions
Policy & substantiation analystallegation against clause
Then
Interview plannerquestions that close gaps
Then
Report writerevery statement cited
A person decides
Investigatordecides each finding; counsel signs
What comes out
Signed investigation report
Corrective actions
Cited exhibit index
One case, step by step

One investigation, from the case file to counsel’s signature

An anonymous web report says the Corventa speaker dinners with Dr. Victor Hale in Atlanta North repeat the same doctors, list people who were not there and split the bar bill. Here is IC-1042, screen by screen, in the working solution.

  1. 01Afternoon

    Her docket, every case on its clock

    Lena Ortiz · Senior compliance investigator

    Lena opens the solution to 8 open investigations, 4 items that need her today and 4 cases past the 28-day median. IC-1042 is at the evidence stage on day 18. A new named report, SU-2291, is waiting in Speak Up: the intake agent read it, matched it to IC-1042 at 91 % and sent the reporter the anti-retaliation notice. Lena adds it to the case as exhibit EX-16.

    Needs you: “IC-1042 · Build the case file — 2,318 items collected from 6 sources.”

  2. 02Day 18

    The case, scoped and on legal hold

    Lena Ortiz · Senior compliance investigator

    IC-1042 is high risk and privileged, run under the direction of employment counsel Omar Haddad. The scope names two subjects, territory manager Ryan Castell and district manager Mia Torrance, 4 custodians and Jan 1 – Oct 7, 2026. The evidence collector already holds 2,318 items: 1,684 from the email archive, 412 CRM notes, 96 expense lines, 58 event records, 4 training records and 64 policy documents.

    “About a minute · nothing leaves the case workspace.”

  3. 03One click

    “Build case file”, and every step runs in view

    The agents

    The evidence collector reads the 2,318 items in 14.2 s and keeps 16 exhibits. The timeline builder puts 21 events in order across 6 sources and flags 10 where sources disagree. The policy analyst lays 5 allegations against 5 policy clauses and proposes a finding for each. The interview planner writes 4 outlines with 16 questions tied to 4 evidence gaps, with the counsel notice added.

    “Waiting for you — each finding is yours to decide · scope changes go to counsel.”

  4. 04Jul 16, ringed

    The night the records disagree

    Timeline builder

    Zoomed to the flagged week, the timeline shows Jul 16–17 marked “sources disagree”. The sign-in sheet carries 8 signatures; the restaurant receipt shows 5 covers and $1,610.40, including $488 at the bar. Expense report ER-55821 claims $998.40 for 8 attendees, and a second report, ER-55822, files the remaining $612.00 as an “office lunch”. Each dot opens its exhibit with the passage highlighted.

    ER-55821: “Per attendee: $124.80 — just under the $125 cap, so no extra approval was triggered.”

  5. 05Next

    Each allegation against its policy clause

    Policy & substantiation analyst

    A3 — meal cap exceeded and the charge split across two reports — is laid against SOP-HCP-014 §6.1 and §6.4. Four pieces of evidence for, each with its exhibit: the receipt, both expense reports and two card transactions seven minutes apart. Nothing found against it. The proposal is Substantiated at 96 %, with the reasoning written out.

    “Three records agree. The real cost was $322 a head — $985.40 over the cap for 5 people. A similar case was substantiated in 2024.”

  6. 06Decided

    She decides each finding

    Lena Ortiz · Senior compliance investigator

    A4 — the sign-in sheet lists HCPs who were not there — now carries the second report as evidence: Dr. Lund was at a conference in Denver that week. Against it, signatures cannot be verified from the scan, and gap G1, who signed for the HCPs who were not there, is on an interview outline. Lena marks it Substantiated; the decision is recorded with her name and the time.

    The analyst never records a finding. Proposals below 70 % are never pre-selected.

  7. 07Outside scope

    A new allegation goes to counsel first

    Omar Haddad · Employment counsel

    Building the timeline turned up something nobody reported: needs assessments are missing for the 4 programs added after Jun 4, and the district manager wrote “skip the needs assessments for the add-ons”. Because the case runs under counsel direction, A5 cannot be decided until Omar Haddad adds it to the scope. Lena asks him from the allegation; he adds it.

    “Found while building the timeline — it is outside the reported allegations, so counsel decides whether to add it to the scope.”

  8. 08Planned

    Interviews that close the gaps

    Interview planner

    Four outlines, witnesses first and the subject last: specialty representative Alana Pierce, the venue coordinator at Lakeline Meeting Services, Mia Torrance and then Ryan Castell. Mia Torrance’s outline opens with the counsel notice and asks why the four add-on programs were approved and the needs assessments waived. Every question names the gap it closes and the exhibit to show.

    Counsel notice: “This conversation is privileged; the privilege belongs to the company, which may decide to share it.”

  9. 09Drafted

    The report, every statement cited

    Report writer

    The report writer drafts the investigation report in the house format: allegations and scope, how the evidence was gathered, chronology, findings, root cause and corrective actions. It works from Lena’s decisions, not the proposals, and marks every page “Privileged & confidential · prepared at the direction of counsel”. 37 statements cited, 0 uncited.

    When Lena first sends it, the check stops her: “1 finding still proposed — a person decides every finding before counsel signs.”

  10. 10Signed · day 18

    Counsel signs, and the actions start

    Omar Haddad · Employment counsel

    With all 5 findings decided, the report goes to Omar Haddad, who signs it. Six corrective actions become tasks with owners and due dates: a referral to the discipline committee, recovery of the $985.40 over-cap spend and the $612.00 mis-filed charge, corrected transparency records for the Jul 16 dinner, a pause on new bookings for Dr. Hale, a manager accountability review, and a monitoring rule for split charges. The case moves to Remediation.

Who it’s for

Built for everyone who carries a case.

The same investigation, seen by the five people who work it — what their weeks looked like, and what they look like now.

LO
Lena OrtizSenior compliance investigator
Investigator
Before
Spends the first week of a case on exports and spreadsheets before she can weigh an allegation.
Now
Starts from a cited timeline, proposed findings and interview outlines, and decides each finding herself.
OH
Omar HaddadEmployment counsel
Counsel
Before
Receives reports he cannot trace and new allegations he hears about late.
Now
Approves every scope change first, and signs a privileged report in which every statement links to its exhibit.
PR
Priya RamanInternal audit manager
Auditor
Before
Reconciles receipts and expense reports by hand to find the money.
Now
Sees the split charge on one screen and owns the recovery as a tracked action with a due date.
SP
Sam PateleDiscovery & data analyst
Evidence admin
Before
Issues legal holds and pulls each source by hand.
Now
Sees every source counted under one legal hold, with a fingerprint and chain of custody on every exhibit.
DO
Dana OkaforChief compliance officer
Case committee
Before
Learns how long cases take when the quarter is over.
Now
Sees days to close, what the allegations came to and where the days go, by category and region.
Built on the engine

6 agents. Each with one job, and hard limits.

Six specialist agents triage the report, collect the records, build the timeline, weigh each allegation, plan the interviews and draft the report; the investigator decides each finding and counsel signs.

Intake & triage agent

Reads each Speak Up report, sets category, risk and privilege, and matches it to open and closed cases.

  • Never decides — proposes with reasons, and you route
  • Never reveals a reporter’s identity
  • Anti-retaliation notice to every named reporter
  • Low confidence goes to a person
Evidence collector

Collects email, CRM, expense, event, HR and training records for the custodians and dates in scope, under legal hold.

  • Collects only the custodians and dates in scope
  • EU records stay in the EU region
  • Read-only connections
Timeline builder

Orders every event across sources, links each to its exhibit and flags dates where sources disagree.

  • Every event cites a passage
  • No inference presented as fact
Policy & substantiation analyst

Lays each allegation against the policy clause, weighs evidence for and against, and proposes a finding with confidence.

  • Never records a finding — a person decides
  • Scope changes go to counsel
  • Below 70 % is never pre-selected
Interview planner

Writes interview outlines whose questions close specific evidence gaps and show the right exhibit, witnesses first and the subject last.

  • Counsel notice on every employee outline
  • No leading questions to witnesses
Report writer

Drafts the investigation report from the timeline and the investigator’s findings — every statement cites its exhibit.

  • Uses the investigator’s decisions, never the proposals
  • Refuses to write an uncited statement
  • Privilege label when under counsel direction
Investigator

Decides each finding; counsel signs. The agents propose; a named person decides.

Ask in plain words

Ask about any case, in plain words

Ask about any case, exhibit or rule — or say what to change. Answers cite the exhibits they rest on.

What is the strongest evidence for the sign-in sheet allegation?

The receipt and the venue booking put the Jul 16 dinner at 3 or 4 HCPs at most, against 8 signatures — and a CRM note the next morning records Dr. Brooks saying she missed it. Still open: who signed for the HCPs who were not there (G1) — on the interview outline for Ryan Castell on Oct 14.

How much money is involved?

For Jul 16 alone: the real bill for 5 covers was $1,610.40; at $125 × 5 the allowed amount is $625.00, so $985.40 is over the cap, and $612.00 was mis-filed as an “office lunch”. Speaker fees for the nine programs total $22,500. The recovery action is with Priya Raman, due Oct 31.

Do we need to correct transparency reports?

Yes. The Jul 16 meal was reported at $124.80 for each of 8 HCPs, but the receipt shows room for 3 at most — so at least 4 of those records name someone who was not there. Those records must be corrected, the value per HCP who did attend restated, and the other 8 programs reviewed the same way.

Add a rule: flag split charges at one merchant on one day

Done. New monitoring rule: flag two or more expense charges at the same merchant on the same day by the same employee when either one is a program meal. Run over the last 12 months it finds 6 more pairs in 3 territories — queued for Priya Raman. The rule is on in Settings and recorded in the audit trail.

Every screen

The working solution, as it ships.

13 screens from the working solution, on its sample data. Pick one to see it large.

The investigations docketEvery open case on its stage line and its clock against the 28-day median, what needs the investigator today, and what the agents are doing.
The case fileWhat was reported, the scope, the allegations and the items collected per source, on legal hold, ready to build.
Agents at workCollect, timeline, policy check, then a stop for the investigator, then interviews and the report — each step with what it found.
The swim-lane timelineEvents from Speak Up, events, expenses, email, CRM and HR records in one view, the dates where sources disagree ringed.
The allegation boardEach allegation against its policy clause, evidence for and against with exhibits, and a proposed finding with its confidence.
Your findingSubstantiated, inconclusive or unsubstantiated — decided by the investigator, with her name and the time on the record.
A scope change, through counselAn allegation found outside the report waits for counsel to add it to the scope before anyone decides it.
Interview outlinesWitnesses first, the subject last; the counsel notice at the start; every question tied to a gap and the exhibit to show.
The investigation reportAllegations, method, chronology, findings, root cause and corrective actions — 37 statements cited, 0 uncited, privileged label on every page.
The check before sign-offA report with a finding still proposed cannot go to counsel until a person decides it.
Signed by counselCounsel signs, the corrective actions become tasks with owners and due dates, and the case moves to Remediation.
The investigations dashboardCases closed, median days to close against the industry median, what the allegations came to and where the days go.
Your procedure’s rulesCounsel direction, privilege labels, scope approval, proposed findings, the confidence bar, EU data and the date window evidence is gathered for.
Governance

Built for investigations that will be read by counsel: cited, decided by people, on the record.

Every statement cites an exhibitEach event, each piece of evidence and each report statement links to the passage of the exhibit it rests on. The report cannot be sent while a statement is uncited.
A person decides every findingThe agents propose substantiated, inconclusive or unsubstantiated with a confidence; the investigator decides. A report with a finding still proposed cannot go to counsel.
Counsel controls scope and privilegeAllegations the agents find outside the report go to counsel before they are investigated. Memos and drafts under counsel direction carry the privileged label, and every employee interview opens with the counsel notice.
Legal hold and chain of custodyEvidence is collected over read-only connections under legal hold, and each exhibit records its source system, custodian and a SHA-256 fingerprint.
Reporters protected, data kept in regionA reporter’s identity is never shown to subjects, and every named reporter gets the anti-retaliation notice. EU employee data stays in the EU region; cross-border access needs the data protection officer’s approval.
Every step on the recordEach agent step and each human decision — a finding, a scope change, a signature — is written to the case activity, with who and when.
Configuration

Your investigations procedure, not ours

Privilege, privacy, sign-off and the rules the agents apply are settings.

SettingDefaultChoose from
Start these cases under counsel directionOnHCP interactions, anti-bribery, retaliation, patient support
Mark interview memos and report drafts privileged and confidentialOnOn · Off
Scope changes need counsel approvalAlways onRequired by the investigations procedure
Show the agents’ proposed findingOnTurn off to decide each allegation without seeing a proposal first
Call out proposals below this confidence70 %60 · 70 · 80 %
EU employee data stays in the EU regionOnOn · Off
Default collection windowAllegation dates ± 90 days± 60 days · ± 90 days · Calendar year to date
Report sign-off for HCP interactions and anti-briberyOmar HaddadOmar Haddad · Priya Raman · Dana Okafor · HR counsel
Connections

Works with the systems your evidence lives in

Email archiveeDiscovery search, legal hold respected
CRMcall notes, calendars, sample logs
Expense systemreports, receipts, card feed
Event systemspeaker programs, sign-in sheets, needs assessments
HR and learning systemsorg, roles, ratings and training completions
Speak Upweb, hotline and email reports
What it changes

The difference, in numbers.

Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.

target
18days
median to close an investigation, against an industry median of 28
Closed on day 18
industry median is 28 days
estimated
30–50%
shorter investigation cycle, most of it saved in the evidence stage
Today28 days
With agents14–20 days
target
100%
of report statements tied to their exhibit, ready for counsel to sign
statements cited

“demo” = seen in the working solution, on its sample case data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (whistleblowing benchmark, 2025, 4,000+ organisations: median closure 28 days). People named on this page are characters in the working solution; Northwind Bio, Corventa and the doctors in the case are its sample names.

Questions

What compliance investigators ask us.

What is investigation case management software?

Software that takes a compliance concern from the Speak Up report through triage, gathering the evidence, interviews, findings and a signed report to corrective actions, with every step recorded. The Investigation Case Builder adds agents that collect the evidence, build the timeline, weigh each allegation against policy, plan the interviews and draft the report.

How does it build the timeline?

The timeline builder creates one event per fact, with its date, its source and the passage of the exhibit it comes from. When another source on the same date contradicts it, the event is flagged and the date is ringed — in the sample case, 8 signatures against a receipt for 5 covers on Jul 16.

Does the AI decide whether an allegation is substantiated?

No. The policy and substantiation analyst proposes a finding with a confidence and the evidence for and against; the investigator decides. Proposals below the confidence bar you set are flagged and never pre-selected, and you can switch proposals off to decide without seeing one.

How is privilege protected?

Categories you choose start under counsel direction. Interview memos and report drafts carry the privileged and confidential label on every page and in the export, every employee interview opens with the counsel notice, and new allegations go to counsel before they are investigated.

Does it respect legal holds and data privacy?

Yes. Evidence is collected over read-only connections, only for the custodians and dates in scope, and under legal hold, with a fingerprint and chain of custody on every exhibit. EU employee data stays in the EU region, and cross-border access asks for the data protection officer’s approval.

Which systems does it connect to?

Your email archive, CRM, expense system, event system, HR and learning systems, and your Speak Up channels — web, hotline and email. It also reads your policy library, so each allegation is laid against the clause it concerns.

Do investigators and counsel stay in control?

Yes. Every finding is decided by a named person, scope changes need counsel’s approval, and the report goes to the signer you set for each category. Every agent step and human decision is written to the case activity.

How long does it take to go live?

The Agentic Solution Engine builds and deploys it from your requirements — your investigations procedure, policies, report format and a sample of closed cases — and it goes live once every quality gate has passed. We will walk you through it on your own cases first.

See it on
your cases.

We’ll run the Investigation Case Builder on a sample of your own closed investigations.