NOON-TIME FORUM 2016 HUMAN RESOURCE (HR) FINANCIAL FORUM Conducting a Digital Investigation –

1. NOON-TIME FORUM2016 HUMAN RESOURCE (HR) FINANCIAL FORUM Conducting a Digital Investigation – The Role of HR Presenters: Brian Logan, Hermann Kelley, & Ray Stanford The Noon-Time Forum tackles legal challenges faced by workplace professionals. For this reason, the Forum’s comments and discussion are not intended to be legal advice or counsel. As with all legal matters, participants should look to licensed counsel to deal with a specific matter.

2. Noon Welcome & Introduction • 12:10 ________ • 12:20 ________ • 12:30 ________ • 12:40 ________ • 12:50 ________ • 12:55 Q&A Conducting a Digital Investigation – Role of HR

3. Purpose: To present and explain a simple template called “How to Conduct a Workplace Digital Investigation (WDI).” Workplace Digital Investigations - Overview

4. What is an investigation? A formal inquiry or systematic study. Workplace Digital Investigations - Overview

5. Why the term “Workplace Digital Investigation?” Today, workplace performance involves technology. Therefore, every workplace investigation should assume IT is necessary until shown otherwise. Workplace Digital Investigations - Overview

6. Most HR professionals already know how to conduct a traditional workplace investigation. A WDI simply involves an IT expert listening to the same story, then asking similar questions, but taking appropriate IT steps. In other words, a WDI simply layers an IT perspective over the traditional workplace investigation template. Workplace Digital Investigations - Overview

7. A 21st century workplace investigation requires a collaborative effort of different skills that include IT and HR. WDI may include other skills such as: • Finance • Compliance (legal) • Operations • Risk Management Workplace Digital Investigations - Overview

8. Step 1 – Put out the Fire! (aka Don’t Make It Worse!) Workplace Digital Investigations – Step 1

9. Fires may include: • Violence • Criminal Activity • Personal Harm • Business Disaster • (Immoral Act?) WDI: Step 1 – Put out the Fire!

10. IT Basics: • Business Continuity Planning • Incident Response • Incident Forensics Preservation • Forensic Analysis WDI: Step 1 – Put out the Fire!

11. IT Fires include: • __________ • __________ • __________ WDI: Step 1 – Put out the Fire!

12. Step 2 – Objective A WDI must have an objective. Workplace Digital Investigations – Step 2

13. Step 3 – Plan A WDI must have a plan. Workplace Digital Investigations – Step 3

14. This WDI template is an Investigation Plan, i.e. a set of steps to follow whenever a Workplace Investigation is required. You must provide the objective. WDI: Step 3 – Plan

15. Step 4 – Go to Source or Victim Normally, the initial source or victim is the most suitable basis for developing an investigation. While the source or victim will rarely provide a complete picture, beginning with the source or victim is a step recognized as the proper first step by most laws, regulations, and risk management programs. Workplace Digital Investigations – Step 4

16. Inquire about: • Who • What • When • Where • How • Why WDI: Step 4 – Go to Source or Victim

17. IT understanding of: • Who • What • When • Where • How • Why WDI: Step 4 – Go to Source or Victim

18. Step 5 – Go to Culprit (aka The Other Story) After obtaining and vetting information from the source or victim, obtaining information from the alleged culprit normally is a prudent next step. Most Workplace Investigations involve people. Often a dispute. A motive. And necessarily, at least two people. This means… two stories. Workplace Digital Investigations – Step 5

19. Who is the alleged culprit? Is there more than one alleged culprit? WDI: Step 5 – Go to Culprit

20. Before approaching alleged culprit (aka “target”), determine: • Whether target can cause further harm? • Whether target can undermine investigation? If yes to either question, consider moving directly to Step 6. WDI: Step 5 – Go to Culprit

21. How to approach a culprit? Ask who, what, when, where, how, and why questions. WDI: Step 5 – Go to Culprit

22. (Insert summary of “inquiry”) WDI: Step 5 – Go to Culprit

23. (Insert summary of possible IT actions when dealing with culprit or target) WDI: Step 5 – Go to Culprit

24. Step 6 – Stop and Think After identifying the objective, creating a plan, obtaining and vetting information gained through the Source/Victim and the Alleged Culprit (Target), the Investigation Team should stop and assess the status of the investigation: apply steps of risk management. Workplace Digital Investigations – Step 6

25. Risk managementis the identification, assessment, and prioritization of risks (e.g. ISO 31000 “the effect of uncertainty on objectives, whether positive or negative”) followed by coordinated and economical application of resources. • to minimize, monitor, and control the probability and/or impact of unfortunate events or • to maximize the realization of opportunities WDI: Step 6 – Stop and Think

26. Risk Management Elements: • What are the objectives? • What is uncertain about the objectives? • What is the potential effect (positive or negative) of uncertainty about the objectives? • Identify (list) risks. • Assess the risks. • Prioritize the risks. • Amend WDI Plan to: minimize, monitor, and control probability/impact of unfortunate events, or maximize realization of opportunities. WDI: Step 6 – Stop and Think

27. Step 7 – Look Around and Ask Around Workplace Digital Investigations – Step 7

28. Step 8 – Take Action Action items should: • Contain Objectives • Conform to WDI Plan • Obtain Authorization • Be Memorialized • Be Secure Workplace Digital Investigations – Step 8

29. Step 9 – Follow-Up Workplace Digital Investigations – Step 9

30. QUESTIONS? Conducting a Digital Investigation – The Role of HR

31. Brian Logan Managing Director JURISi Atlanta, GA blogan@jurisi.com (404) 991 – 7300 Presenter

32. Hermann Kelley Title Company Location Email Phone Number Presenter

33. Ray Stanford Founding Attorney SIO Law Group Atlanta, GA rstanford@siolaw.com (404) 991 - 7301 Presenter

34. THANK YOU FOR PARTICIPATING!