Corporate Interviewing and Insider Threat: The Investigative Edge

Most workplace investigations fail not because the evidence is absent, but because the interviewing is poor. The interview is the most powerful investigative tool available in a corporate investigation — and the most commonly misused. In insider threat investigations in particular, the quality of interviewing is often the difference between a case that results in a provable finding and one that collapses because nothing usable was obtained from the subject or witnesses.

Regulated businesses face a specific intersection of risks in insider threat investigation. The insider may have significant institutional knowledge and access. The investigation needs to be conducted without alerting the subject prematurely. The outputs need to be legally defensible — usable in disciplinary proceedings, regulatory reporting, and in some cases law enforcement referral. And the interviewers need to operate within the constraints of employment law, data protection, and the organisation's own investigation policies.

Why Standard Workplace Interviews Fail

Most managers who conduct workplace investigation interviews are not trained investigators. They approach the interview with a set of questions, an expectation that a guilty person will confess and an innocent person will deny, and no methodology for assessing the reliability of what they hear. The result is interviews that confirm whatever the interviewer already believed, fail to surface information that was available, and produce documentation that does not hold up to scrutiny.

The specific failures are predictable:

• Confirmation bias in question design: Questions structured to confirm a conclusion already reached, rather than to gather information neutrally. Closed yes/no questions that allow the subject to give minimal responses without revealing anything.
• Failure to challenge inconsistency: Accepting inconsistent or incomplete answers without challenge, because the interviewer does not have a framework for identifying when a response warrants follow-up.
• Premature accusation: Confronting the subject with allegations before establishing a full account, destroying the opportunity to identify deception through inconsistency.
• No structured account development: Failing to obtain a full, detailed, chronological account of the subject's version of events — the basis for any subsequent inconsistency analysis.
• Poor documentation: Notes that summarise the interviewer's interpretation rather than recording the subject's actual words, losing the detail that matters for subsequent analysis and legal use.

The Wicklander-Zulawski Method: What It Actually Is

The Wicklander-Zulawski (WZ) method is one of the most widely used structured interviewing approaches in corporate investigation globally. It is specifically designed for the non-confrontational elicitation of truthful information — including admissions — in employment and investigation contexts. Unlike the Reid Technique (which has faced significant criticism and legal challenge for its confrontational approach), WZ is built around rapport, information development, and a structured approach to admission-seeking that is ethically sound and legally defensible.

The WZ approach is characterised by:

WZ training produces interviewers who can conduct legally compliant, non-coercive, effective investigative interviews — and who understand the documentation standards required for the outputs to be used in subsequent proceedings.

Insider Threat Interview Specifics

Insider threat investigations in regulated environments have specific characteristics that require adaptation of standard interviewing approaches. The subject is typically an employee or former employee with institutional knowledge — including knowledge of the investigation process itself. They may have had time to prepare a cover story, destroy evidence, or align their account with colleagues. The investigation may be ongoing at the time of the interview, meaning the full picture is not yet known.

Key considerations for insider threat interview planning:

• Timing: The decision of when to interview the subject — and in what sequence relative to witnesses — is an investigative decision, not a procedural one. Interviewing the subject before witnesses are identified gives the subject the opportunity to influence subsequent witness accounts. Interviewing witnesses first allows account development that can then be tested against the subject's version.
• Pre-interview intelligence: The interviewer should have a comprehensive picture of all available evidence before the interview — not to confront the subject with it prematurely, but to know what is available for later challenge and to recognise when the subject's account is inconsistent with established facts.
• Account contamination avoidance: The interview should be designed to obtain the subject's account before any specific allegations are raised. An account given before the subject knows what is known is more revealing than one given in response to disclosed evidence.
• Legal and procedural compliance: The right to be accompanied (in employment investigation contexts under UK law), the recording and documentation of the interview, and the subject's rights under data protection and employment law must all be addressed before and during the interview.

Witness Interviews: The Overlooked Capability

Most insider threat investigation focus on the subject interview. Witness interviews — from colleagues, managers, customers, or third parties — are often conducted informally or not at all. This is a significant gap. In many insider fraud cases, the most useful information comes not from the subject but from witnesses who observed behaviour, had conversations, or noticed anomalies without understanding their significance.

Structured witness interviewing applies many of the same principles as subject interviewing: open account development, chronological narrative, avoidance of leading questions, and detailed documentation. The additional considerations for witness interviews are:

• Witnesses are not suspects — the approach should be information-gathering rather than admission-seeking, but the account should be just as detailed and complete
• Memory contamination is a significant risk in witness interviews — witnesses who have discussed events with colleagues may have adopted a shared narrative that does not reflect what they individually observed
• Witnesses have employment and data protection rights that must be observed, including confidentiality expectations about the investigation that need to be clearly communicated
• Witness accounts should be documented contemporaneously and in the witness's words — not paraphrased in the interviewer's language, which loses the granularity needed for reliability assessment

Documentation and Legal Defensibility

The output of any investigation interview is only as valuable as its documentation. Contemporaneous notes, audio recording where legally permitted and procedurally appropriate, and structured interview summaries are the record that will be examined if the case proceeds to disciplinary hearing, regulatory review, or litigation.

Common documentation failures in workplace investigation interviews:

• Notes taken after the interview rather than during, losing specific language and sequence
• Summaries that record the interviewer's conclusions rather than the subject's actual responses
• Failure to document the subject's denials, explanations, and counter-narratives — which are as evidentially relevant as admissions
• No record of the procedural framework — rights communicated, representation offered, cautions given — leaving the interview vulnerable to procedural challenge

The documentation standard for a legally defensible investigation interview is essentially contemporaneous verbatim notes or a recording, with a typed-up summary produced and signed off within 24 hours of the interview. Where audio recording is used, the recording and transcript are the primary record; summary notes are secondary.

This article reflects the operational perspective of the Wise Key Solutions founding team, which holds Wicklander-Zulawski Specialized Interviewing and Investigation Techniques certification. It does not constitute legal advice. Investigation procedures should be reviewed with qualified employment counsel before implementation.