What a corporate investigation covers, and how to choose the firm to run it

Short answer: a corporate investigation establishes what happened inside or around a business, who was responsible and what can be proved, so that the board, its lawyers or a court can act. It usually covers fraud, bribery, misconduct, leaks of confidential information, insider threats or a counterparty that is not what it claims to be, and its product is evidence, not opinion.

Most investigations start from one of four triggers. Money has gone missing or a payment pattern looks wrong. A whistleblower, auditor or regulator has raised a concern. Confidential information has leaked or a competitor seems to know too much. Or a deal, partner or senior hire needs checking before the business commits. Each trigger calls for a different first step, and getting that first step right matters more than anything that follows.

The work itself combines several disciplines. Forensic accounting reconstructs payments and shows who benefited. Digital forensics preserves and examines email, devices and systems so that what is found can be relied on later. Corporate and open-source research maps the companies, people and relationships involved, in the UK and abroad. Interviews, discreet enquiries and, where lawful and proportionate, surveillance fill the gaps that documents leave.

Who instructs the investigation matters. Where proceedings or a regulator are possible, the investigation is often instructed through the company's lawyers so that questions of legal privilege can be managed from the start. An investigation run directly by management can still be valuable, but it is harder to protect and easier to challenge.

The legal backdrop has raised the stakes. Under section 7 of the Bribery Act 2010, and since September 2025 under the failure to prevent fraud offence in the Economic Crime and Corporate Transparency Act 2023, large organisations can be liable for offences committed for their benefit unless they had reasonable procedures in place. How a business responds when it finds a problem, including how well it investigates, is part of that picture.

There are lines a reputable firm will not cross. Bank records, phone records and other personal data cannot lawfully be obtained by pretexting or by paying insiders; doing so is an offence under section 170 of the Data Protection Act 2018, and evidence obtained that way can wreck the case it was meant to support. Lawful routes exist, usually through disclosure and court orders obtained by lawyers.

Choosing a firm comes down to a few questions. Who will actually do the work, and what is their background? Can they show how evidence is preserved and recorded so that it stands up in court or before a regulator? Do they cover the disciplines this case needs, or will they subcontract them? Can they work in the countries involved? How do they report: a short factual account that lawyers can use, or a long narrative? And are scope and fees agreed in writing before work starts?

Size is not the same as fit. Large global consultancies suit multi-year programmes across many jurisdictions. Many matters are better served by a smaller senior team that works the case itself and reports directly to the client and its lawyers. The right choice depends on the problem, not the brand.

Cato & Veil runs corporate investigations from London with offices in Dubai, Hong Kong, Mumbai and Sofia, and is led by Neel Chakrabarti, a former Metropolitan Police intelligence officer. The first conversation is free and confidential. Tell us what has happened and what you need to decide; we will tell you how we would approach it and what it is likely to involve, and agree scope and fees before any work begins.

Cato & Veil practice note. General information, not legal advice. Decisions about privilege, reporting to authorities and proceedings belong to your lawyers.