Corporate Investigation Services: What Each Type Covers and Which One Your Situation Calls For

A category, not a product

"Corporate investigations" names a family of disciplines rather than a single service, which is why a competent firm's first conversation is about the situation rather than the catalogue. A general counsel holding an anonymous letter, a CFO looking at a margin that will not reconcile, a private-equity partner three weeks from signing, and a board that has just been told its chief executive is being followed all need investigative work — and almost none of the same work. Buying the wrong discipline is the most common way this spend is wasted: a records screening sold where an interview program was needed, or a full investigation opened where a two-day verification would have closed the question.

What the disciplines share is method. Every one of them is built on the same three sources — public and court records, licensed commercial data, and lawful human inquiry — and on the same evidentiary hygiene: verified fact separated from reported allegation, allegation separated from analyst inference, and every material finding tied to a record a reader could pull independently. That discipline is the actual product. The subject matter changes; the standard does not.

What separates them is what the finished work has to survive. An internal investigation may face an employment claim, a regulator, and eventually a court. A diligence report faces a deal committee that will act on it and a counterparty that may later dispute it. A tracing report faces an adversary's cross-examination. Those different audiences drive real differences in sequencing, documentation, and who is allowed to conduct the work — which is why investigative services are scoped to the decision they serve rather than sold as a fixed product.

Fraud and financial investigations

This is the discipline most people mean by "corporate investigation": money has left the company, or is leaving, and the accounting record does not explain it. The work reconstructs transactions, tests vendor and payroll files for fictitious or related-party entries, follows funds through accounts and entities, and corroborates what the documents suggest with interviews of the people who touched them. The output is a chronology a reader can follow and a quantification of loss that will hold up if it is ever put in front of an insurer, a court, or a prosecutor.

The scale is well measured. The Association of Certified Fraud Examiners' Report to the Nations estimates organizations lose roughly five percent of annual revenue to occupational fraud, with a median loss of about $145,000 per case and a median duration of twelve months before the scheme is detected — the year of undetected loss is usually larger than the fee to end it. The same research finds tips are by far the most common detection method, ahead of internal audit and management review, which is why so many of these engagements begin with a hotline report rather than a control failure.

External fraud belongs here too. The FBI's Internet Crime Complaint Center recorded roughly $2.77 billion in business email compromise losses in 2024 alone — payment-diversion fraud that presents as an ordinary invoice or a routine change of banking details. Where the money has already moved, the fraud investigation and the asset tracing run in parallel from day one, because recovery windows close in days. The broader landscape of these offenses is mapped in our explainer on white-collar crime investigations.

Internal and workplace investigations

When the allegation is about conduct rather than cash — harassment, retaliation, conflicts of interest, policy or safety breaches, expense abuse — the question shifts from what happened to who may credibly establish what happened. HR can competently investigate most line-level complaints. The moment an allegation reaches an officer, touches the finance function, or implicates the people who would ordinarily supervise the inquiry, internal ownership becomes the finding's weakest point, and independence stops being a preference.

The legal architecture matters here more than in any other discipline. Where counsel directs the work, Upjohn Co. v. United States governs how privilege attaches to employee interviews and how the warning is given; the Justice Department's Evaluation of Corporate Compliance Programs treats a company's willingness to investigate itself credibly as evidence about the whole program. Getting the sequence wrong — interviewing before preserving, or preserving before counsel has scoped privilege — is rarely recoverable later.

We treat this as its own body of practice; the escalation logic, the privilege sequencing, and the point at which an outside investigator becomes necessary are set out in when a company has to investigate itself, and the buyer profile is the general counsel and audit committee we serve across corporations.

Investigative due diligence

Diligence is the only discipline in this family where the client is still ahead of the problem. The question is prospective — who is this company, who actually controls it, what does the principal's record show, and what would we regret not knowing before we sign, fund, appoint, or acquire. The work covers corporate ownership through the layers that hold it, litigation and judgment history in the courts that actually heard the matters, regulatory and sanctions exposure, source of wealth, and reputation gathered from people who have dealt with the subject rather than from a keyword search.

The distinction that costs buyers money is between screening and diligence. A screening product matches names against lists and returns hits; investigative diligence establishes facts, including the facts a subject has arranged not to be findable by name. Both have a place, and the honest answer for a low-value, low-risk counterparty is usually the screening. The definitional treatment is in what investigative due diligence actually is, and the transaction-grade version — the buyer's checklist before an acquisition — is in the enhanced due diligence checklist.

Where the counterparty, the principals, or the money sits outside the United States, this becomes its own specialty: records that are not centralized, languages that keyword tools miss, and registries that answer a differently phrased question. That is the work behind our international due diligence practice.

Asset tracing and recovery support

Asset tracing answers a narrow, expensive question: where did the money go, and what is still reachable. It is retained by judgment creditors facing a debtor who pleads poverty, by fraud victims in the first days after a transfer, by trustees and receivers, and by counsel deciding whether a claim is worth filing at all. The method is documentary before it is anything else — corporate registries, land and lien records, court files, UCC filings, transfer records — assembled into a picture of ownership and control that can be put to a court rather than asserted.

The discipline earns its fee twice: once by finding assets, and once by telling a client early that there is nothing worth chasing, before the legal spend commits. Our anonymized methodology walk-through is inside a cross-border asset trace; the remedies that actually convert findings into money — freezing orders, disclosure orders, and the rest — are covered in what legal remedies actually recover the money.

Litigation support

Litigation support is investigative work performed to an evidentiary standard, for counsel, inside a matter that is filed or about to be. It includes background and asset work on adverse parties, witness location and interviews, economic damages and forensic accounting, document and ESI review support, and — where a finding has to be explained to a fact-finder — expert testimony that survives challenge. The distinguishing constraint is that everything produced may be disclosed, so method and sourcing are built for an adversary's scrutiny from the first hour.

The commercial case for doing this before filing rather than during discovery is straightforward: facts developed early change what is pleaded, what is demanded, and whether the matter is worth bringing. That is the argument in pre-litigation due diligence before filing, and the full-service picture — damages, tracing, and testimony — is in our litigation support pillar and the litigation support practice page.

Threat assessment and protective intelligence

The last discipline in the family differs from the others in tense: it is retained about something that has not happened yet. When the exposure attaches to a person rather than a balance sheet — a terminated employee whose language has escalated, an activist campaign that has moved from the company to the chief executive's home address, a family whose travel pattern is published — the work is assessment first and protection second. A competent assessment maps who is actually interested in the principal, what is publicly discoverable about their movements and residences, and which of the findings is worth spending money on.

This matters commercially because it is the one place where a client can be sold a great deal of manpower without ever being told what the manpower is for. Posture should follow assessment, never precede it. The method is set out in security risk and threat assessment, and the delivery side sits under security services.

Which one your situation calls for

Matching the matter to the discipline is most of the buying decision, and it can usually be done in a sentence. The mapping below is the triage a senior investigator runs in a first call — and the honest version includes the cases where the answer is that no investigation is needed yet.

• Money is leaving and the numbers do not explain it — fraud and financial investigation, with tracing opened in parallel if funds have already moved.
• A complaint names someone senior, or the finance function — an independent internal investigation, scoped by counsel before anyone is interviewed.
• You are about to sign, fund, or appoint, and cannot verify the other side — investigative due diligence, sized to the exposure rather than to the counterparty's size.
• A judgment is unpaid and the debtor pleads poverty — asset tracing, with an early read on whether anything is reachable before further legal spend.
• A matter is heading for filing, discovery, or trial — litigation support, engaged through counsel so the work product is protected.
• A person, not a company, is the exposure — threat assessment first; protective measures only after the assessment says what they are for.
• Something feels wrong but nothing is specific yet — no investigation. A scoping conversation, and often a records-level verification, will either produce a question worth investigating or close it cheaply.

What makes it an investigation rather than a search

Anyone can run a database. What a client is actually buying is the difference between output and evidence, and it shows up in four places. Licensing: investigative work in the United States is regulated state by state, and most states require firms conducting investigations to hold private-investigator licenses — the legal floor beneath any provider claim, and a real question to ask before retaining. Method: lawful collection only, with a documented chain from record to finding, because a single unlawfully obtained fact can contaminate an otherwise sound file.

Sourcing and limits: a defensible report states what was searched, in which jurisdictions, over what period, and — the part weak reports omit — what was not examined and why. Stated limits are what let a board rely on the parts that are established. And usability: the finished product has to be read by people who were not there, sometimes years later, in a forum that is not friendly. Findings attributed to unnamed "sources", risk scores with no stated basis, and database extracts pasted in as analysis all fail that test.

The same standard is what regulators look for. The Justice Department and SEC's FCPA Resource Guide treats documented, risk-based diligence as a hallmark of a functioning compliance program — the reason sourcing and documentation are commercial requirements, not formatting preferences. How to test a provider against these criteria before retaining is set out in how to choose a corporate intelligence firm, and the practice itself sits under corporate intelligence.

Scope, cost, and how a matter actually starts

Pricing follows the discipline. Scoped diligence is normally fixed-fee and tiered by depth — records-level verification at the base, full investigative diligence with human-source work above it. Investigations, tracing, and litigation support are typically hourly against an estimate, because the fact pattern controls the effort and no honest firm can price an unknown chronology as a product. The cost drivers, in every model, are the number of subjects, the number of jurisdictions, whether discreet human inquiry is required, and speed.

Two practices distinguish a serious provider. The first is phasing: a well-run matter is scoped so an early phase decides whether the next one is necessary, rather than selling maximum scope on day one. The second is candor about the cap — what happens when the estimate is reached, who decides whether to continue, and what the client holds if it stops there. Vagueness on either is a preview of the invoice.

At Fortaris, every matter is led and worked at Managing Director level by professionals with federal investigative and forensic-accounting backgrounds, and the first step is the same in all six disciplines: a confidential conversation about the situation, before any scope is proposed. Often that conversation establishes that the right answer is a narrower piece of work than the client expected — which is the point of asking someone who has run the matter type before.