NNPCL GRC Information Gathering PDF

2.3 Information Gathering The information gathering phase of an investigation involves obtaining information which will be relevant in achieving the objectives of the investigation. Investigators should also be cautious when gathering information for investigations as information obtained from vario...

2.3 Information Gathering The information gathering phase of an investigation involves obtaining information which will be relevant in achieving the objectives of the investigation. Investigators should also be cautious when gathering information for investigations as information obtained from various sources (e.g. departments of the Company, suspects, third parties, witnesses etc.) may sometimes be incomplete or unreliable. Information that could be required for an investigation include but are not limited to: a) Relevant information on financial transactions: i. Contracts ii. Purchase orders iii. Invoices iv. Goods receipt notes v. Receipts vi. Work completion certificates vii. Bid documents b) Approval documents c) Relevant standard operating procedure documents d) Laws of external regulators e) Personnel list f) Organogram g) Correspondence h) Information on physical and system access rights i) Digital evidence recovered from desktops, laptops, and mobile devices j) Information generated from business applications such as accounting ledgers, transaction volumes per vendor, etc. k) Multimedia information such as pictures and videos l) Vendor lists and contact information m) Incorporation documents of certain vendors NNPC Limited Investigation Processes and Procedures Investigations must be based on factual findings noted during analysis of relevant information rather than on assumptions and suspicions that are unsupported. Investigators should be cautious when gathering information for investigations as information obtained from various sources (e.g. departments of the Company, suspects, third parties, witnesses etc.) may sometimes be incomplete or unreliable. 2.3.1 Procedures in Information Gathering The following procedures should be followed in information gathering: Procedures S/N 1. 2. Responsibl e Party Description Investigatio n Team Prepare an information request list based on the existing Investigatio n Team Where there is a possibility that information might be knowledge of the case. manipulated upon preparation of an information request list, co-ordinate the best approach to adopt in the circumstance, to avoid tampering. 3. Investigatio n Team Where no determination is made regarding (2) above, communicate list of required information to relevant personnel. Specific timelines for delivery should be tied to each information request to minimise delays and prevent the documents from being tampered with. NNPC Limited Investigation Processes and Procedures Procedures S/N Responsibl e Party Description In the event of non-availability of information or lack of cooperation from staff, escalate to the Chief Compliance Officer (based on the level of the staff involved). 4. Investigatio n Team Obtain/gather information. Where required, conduct a search and seizure to gather information. However, it is paramount that relevant authorisation is received prior to performing a search and seizure exercise, and the exercise is legally permissible. (Refer to 2.3.2 for more details). 5. Investigatio n Team The following should be captured per information received:  Title of information received  Time of receipt  From whom the information was received  Where the information is maintained  Transfer of information, where applicable Where practicable, original documents should be maintained as received without any alterations. Working copies should be made by Investigation team for daily use. 6. Investigatio n Team Conduct interviews to gather information from individuals in a position to have relevant knowledge or facts on the investigation. NNPC Limited Investigation Processes and Procedures Procedures S/N 7. Responsibl e Party Description Investigatio n Team Where necessary, obtain additional information by carrying out the following: i. Review external information such as public records, vendor information, information held by third parties etc. ii. Carry out site visits for physical observation. iii. Conduct desktop searches to gather additional information. Perform digital evidence recovery on digital devices such as laptops, workstations, mobile phones etc. to retrieve electronically stored information. 8. Investigatio n Team Review and categorize all data collected. 9. Investigatio n Team Recheck investigation objectives and ascertain if additional information is required. Input & Output Documents Input & Output Documents S/N Document Description Type Frequency Source Recipient 1. Information request list Input As need arises Required personnel Investigation Team in NNPC Limited Investigation Processes and Procedures Input & Output Documents S/N Document Description Type Frequency Source Recipient the relevant department 2. 3. Minutes interview of Output As need arises Designated GRC Officer Head, Investigation Team Analysis of data collected Output As need arises Information request list from required personnel Investigation Team KPIs Key Performance Indicators S/ N 1. 2. Performance Measure Basis Measurement of Timefram e Target Timeliness of information request list Latest date of issue of the request As required Within 1 week of receipt of request list Quality of data analysed Sufficiency and effectiveness of data cleaned and processed As required Zero error 2.3.2 Search, Seizure and Surveillance A search and seizure involve the search of a suspect’s workspace to confiscate any relevant evidence. It is important that jurisdiction laws are considered before any search and seizure exercise. The key aspects of search procedures are as follows: a) Ensure a witness is present at the time of the search. b) Take photographs before commencing search. c) Each search team should consist of at least two individuals. One person should search and identify relevant documents while the second person should collate the documents and fill the search documentation. d) Each seized item should be tagged with a unique numbered label attached to the bag which serves as a cross reference to the Evidence log. e) Once all items have been labelled and recorded, they should be stored in a secure area with restricted access. f) Make copies of all relevant seized documents and use copied materials for analysis and review rather than originals. g) A forced entry may be made in instances where the lawful owner/occupier refuses to grant entry into the premises. Forced entry into the premises should be made only within the ambits of the law, upon obtainment of the requisite lawful Order to back such entry. h) Covert surveillance activities or observation of people or places could be conducted physically. It could also be conducted electronically by observing the suspects communications and transactions. The key aspects of surveillance procedures are as follows: i. Select appropriate type of surveillance to be conducted on target. ii. Record the surveillance activities by taking photographs or voice recordings. iii. Maintain safety and inform stakeholders on surveillance undertaken. NNPC Limited Investigation Processes and Procedures 2.3.3 Interviewing Techniques The investigation team may need to interview accused persons, suspected co- conspirators, neutral witnesses, corroborative witnesses or any individual who may have relevant knowledge or facts on the investigation. Depending on the facts available and the timing of the interview, the interviewer should ask different categories of questions such as introductory, informational, assessment, closing, leading and admission seeking questions. The following are tips to be considered when conducting interviews: a) Identify and document the objectives of the interview; state the policy on employee rights and any matters concerning retaliation (prior to the interview). b) Begin interviews with a simple line of questioning and give the respondent sufficient time to respond. Do not assume you know what the respondent is about to say. c) It is advised that interviews are conducted by two members of the investigation team. One team member asks the questions while the other team member takes notes. d) The second team member can also serve as a witness to the proceedings. Having more than two team members for an interview may crowd and intimidate the interviewee. e) Ensure questions are clear to the interviewee and if necessary, repeat the questions. f) Do not be distracted/do not give the respondent the impression that you are not paying attention. g) Take notes but do not be carried away by attempting to write all that the interviewee says. NNPC Limited Investigation Processes and Procedures h) Inform the interviewee on the recording of the interview electronically where legally permissible. i) Confirm the facts gathered at the end of the interview. j) Do not induce responses from interviewees by making promises or threats. k) It is advised that interviewee sit close to the exit to avoid claims of forceful imprisonment by interviewees. l) Upon close of the interview, request the interviewee to contact the unit with any additional information and/or documents. 2.3.4 Preservation of Evidence The investigation team is responsible for preserving the integrity of any evidence obtained during investigations in a state that is admissible in a court of law. The investigation team should adopt the following procedures among others in handling evidence: a) Original copies of documents should be obtained where possible and should not be altered or defaced in any way. b) Where original copies of documents are unavailable, copies of the documents should be obtained and preserved. c) Interview statements should be signed by the interviewee and attested to by a witness. d) Where the evidence obtained is stored electronically, the investigation team should obtain the primary storage device (e.g. hard drive, memory card, flash drive) of such evidence and preserve it in the state it was at the point of obtaining it. 2.3.5 Preservation of Employee Rights Whenever there is an allegation of fraud or collusion against employees or other stakeholders of the Company, the GRC or relevant function is obligated to ensure that the investigation process is fairly conducted NNPC Limited Investigation Processes and Procedures without causing harm to employees. To safeguard the rights of employees, GRC and relevant function should adopt the following practices during investigations: a) Information about a fraud allegation against an employee should be kept strictly confidential and should only be shared on a business “needto-know” basis. b) The investigation team should approach the investigation with an open mind, and without any prejudice. There should be no bias or appearance of bias, i.e. the team should be impartial and also be seen to be impartial. c) Whenever it is necessary to interview alleged fraud perpetrators or witnesses who are employees, the following measures should be implemented: i. Explain the allegation or reason for the interview to the employee and allow him/her to make his defence if any (i.e. fair hearing). ii. Explain the possible outcomes of the investigation e.g. exoneration, convening of disciplinary hearing, sanctions etc. iii. Prevent harassment or intimidation of employee during the interview. There should be no interrogation of the interviewee. 2.4 Analysis of Information Subsequent to gathering information relevant to any investigation, the information should be analysed using various types of parameters in order to enable the investigation team to ascertain the veracity of the allegations being investigated. Such analysis could be financial, non-financial and visual depending on the nature of information collected and the investigation case in question. The investigation team will decide on the nature and extent of analysis to be carried out on each investigation on a case-by-case basis.