Investigation Closure Time

Goal of the analysis:

Measure how long internal misconduct and policy investigations take to close, identify bottlenecks across the investigation lifecycle, and improve speed without sacrificing quality or fairness. For executives and boards, shorter, predictable closure times reduce risk, limit business disruption, reinforce trust in the speak-up process, and meet regulatory or policy SLAs. This analysis quantifies median and tail (75th/90th percentile) closure times overall and by severity/type, isolates delay drivers (triage, evidence gathering, legal review), and links performance to investigator capacity, case mix, and outcomes.

Data required:

• Case intake and metadata:
  • Case ID, report date/time, intake channel (hotline/web/phone/manager), anonymous vs named, reporter type, language.
  • Business unit/region/site, implicated entity/manager, allegation category/subcategory (harassment, fraud, ABC, safety, privacy, conflicts, T&E).
  • Severity/criticality tier, risk flags (regulatory/reportable, safety, data sensitivity), legal hold status.
• Workflow milestones and timestamps:
  • Triage start/completed, investigator assigned, first contact with reporter, first interview, data collection start/complete.
  • Analysis complete, legal/HR review, disciplinary decision, case closure date, reopen date (if any).
  • Pause periods: formal stays, regulator-imposed holds, parallel law enforcement, medical leave (for key parties).
• Outcomes and remediation:
  • Substantiation outcome, discipline type, control changes, recovery amount (if applicable), appeal status/resolution.
  • Sensitivity flags that may justify longer closure (e.g., multi-jurisdiction, class complaints).
• Resourcing and workload:
  • Investigator/team assigned, investigator role/seniority, active caseload over time, outside counsel/vendor use (eDiscovery).
  • Estimated complexity score (claim count, data sources, jurisdictions) if available.
• SLA and policy references:
  • Defined SLAs by severity/category (e.g., triage ≤2 business days; median closure ≤30–45 days routine; ≤60–90 days complex/high-severity).
  • Regulatory timelines (e.g., privacy notification windows) and documentation standards.
• Systems and mapping:
  • Hotline/ethics case management (Navex/EthicsPoint, ServiceNow GRC, Archer), HR case systems, eDiscovery logs.
  • HRIS for org/manager mapping; identity directory for active staff; regulator reporting tools where applicable.

Detailed step-by-step instruction on how to conduct the analysis:

1. Define scope and measurement rules.
   • Include cases opened within the lookback window (e.g., last 12–24 months) and all cases closed in period for historical duration calculations.
   • Primary metric: Calendar Closure Time = closure date − intake date.
   • Optional: Active Closure Time = Calendar time − paused days (formal stays, legal holds with documented start/stop).
   • Exclude administrative closures (duplicates, misroutes) from duration KPIs; report separately.
2. Extract, cleanse, and normalize data.
   • Export case lists with milestones and outcomes from case systems; standardize timestamps to a single time zone.
   • Ensure each closed case has intake and closure dates; validate event order (no negative durations).
   • Map cases to BU/region/site, manager, investigator, severity, and allegation category using consistent taxonomies.
3. Compute lifecycle durations.
   • Triage Time = triage complete − intake.
   • Assignment Time = investigator assigned − triage complete (or intake if immediate).
   • Time to First Contact = first contact − assignment.
   • Evidence Collection Time = collection complete − collection start.
   • Analysis/Decision Time = decision date − collection complete.
   • Closure Time = closure date − intake; compute both Calendar and Active (if using pauses).
   • Calculate median, mean, and 75th/90th percentiles overall and by segment; favor medians due to skew.
4. Handle open cases (censoring).
   • For operational risk, track Elapsed Open Time for open cases and aging buckets (0–30, 31–60, 61–90, 91–180, >180 days).
   • For predictive insights, use survival analysis (Kaplan–Meier) to estimate time-to-closure including right-censored open cases.
5. Segment and compare.
   • By severity, allegation category, BU/region/site, investigator/team, intake channel (anonymous vs named), language, jurisdiction.
   • By complexity proxies (multi-party, multi-jurisdiction, data-heavy), and by use of outside counsel.
6. Assess SLA performance.
   • % Triage within SLA; % First Contact within SLA; % Closed within SLA by severity/category.
   • Track median vs SLA targets and tail performance (90th percentile) to manage outliers.
7. Driver and capacity analysis.
   • Correlate closure time with caseload per investigator, anonymous share, category mix, and use of vendors.
   • Identify bottlenecks by stage using stage duration shares; diagnose common blockers (witness availability, data access, legal review).
8. Trend and cohort views.
   • Quarterly trend of median/75th percentile closure times; overlay mix changes (severity/category) to avoid false signals.
   • Cohorts by intake quarter to observe lifecycle improvements after process or staffing changes.
9. Quality and fairness checks.
   • Ensure documentation completeness (investigation plan, evidence, outcome rationale) especially for fast closures.
   • Compare substantiation rates vs duration; unusually fast closures with low documentation merit review.
   • Monitor appeal/reopen rates as a quality backstop; high reopen suggests premature closure.
10. Set targets and alerts.
    • Define targets by severity (e.g., routine HR/Code cases median ≤30–45 days; complex fraud/ABC ≤60–90 days; triage ≤2 business days).
    • Automate alerts for cases breaching 75th percentile thresholds or stalled stages (e.g., evidence collection >30 days).

Format of the output of analysis:

• Executive summary: median and 75th/90th percentile Closure Time (calendar and active), SLA attainment by severity, aging of open inventory.
• Lifecycle dashboard: stacked stage-duration bars showing where time accumulates; bottleneck heatmap by BU/region and investigator.
• Trend charts: rolling 4–8 quarters of median closure times with mix-adjusted line.
• Segmentation views by category/severity, anonymous vs named, region, and investigator; traffic-light vs targets.
• Open-case pipeline: aging buckets with owner, current stage, next milestone, and blockers.
• Quality overlays: substantiation vs duration scatter, reopen/appeal rates, documentation completeness checks.
• Appendix: definitions (start/stop, pauses), SLA table, taxonomy, and data quality notes.

How to interpret results:

• Declining median and tail (90th percentile) closure times with stable substantiation and low reopen rates indicate genuine process improvement.
• Shorter times paired with falling substantiation or rising reopens may signal superficial investigations; review quality controls and documentation.
• Long tails (large gap between median and 90th percentile) reflect outlier cases; focus on complex categories, specific regions, or investigator capacity.
• Anonymous cases often take longer due to limited contact; if gaps are large, improve secure two-way communication and intake quality.
• Stage heatmaps pinpoint bottlenecks (e.g., evidence collection delays due to system access); address with tooling or escalations.
• Mix effects matter: spikes in complex fraud/ABC or multi-jurisdiction cases can lengthen overall metrics; compare within-category trends.

Steps a company can take to improve on this measure:

• Process and playbooks:
  • Mandate Early Case Assessment and investigation plan within 5 business days; standardize templates and checklists.
  • Set stage SLAs (triage, first contact, evidence collection) and enforce escalations for stalls.
  • Define closure criteria to prevent premature closes; require peer or counsel review for high-severity cases.
• Resourcing and capability:
  • Balance caseloads; add investigators or surge capacity (ALSPs) during peaks; specialize by category (HR vs fraud/ABC).
  • Train investigators on interviewing, digital evidence, and bias mitigation; maintain an expert roster (forensics, data privacy).
• Data, systems, and tooling:
  • Integrate case management with HRIS, email/chat, and eDiscovery to accelerate collections; enable secure two-way anonymous messaging.
  • Automate SLA tracking and stage alerts; provide dashboards for managers and executives.
  • Preconfigure data access playbooks (legal holds, mailbox and device imaging) with approvals to reduce wait time.
• Governance and quality:
  • Monthly investigation council reviewing aging outliers, SLA breaches, and quality metrics (reopen, appeal).
  • Implement case audits and calibration sessions to ensure consistency and defendability.
• Intake and communication:
  • Improve intake forms to capture necessary details upfront; enable multilingual guidance and prompts.
  • Set communication SLAs with reporters and implicated parties to maintain engagement and reduce delays.
• Scenario actions:
  • If evidence collection is the bottleneck: standardize collection kits, expand eDiscovery capacity, and pre-approve access workflows.
  • If regional teams lag: add local training, embed experienced investigators short-term, and address legal constraints (works councils).
  • If anonymous cases drive delays: promote portal messaging, request specific information early, and provide FAQs to reporters.

Benchmark comparisons:

General benchmarks:

• Triage time:
  • Best-in-class: ≤2 business days for ≥95% of cases.
• Median closure time (indicative; portfolio mix dependent):
  • Routine HR/workplace conduct: 20–40 days; 75th percentile ≤60 days.
  • Code of Conduct (non-fraud) mixed categories: 30–45 days; 75th percentile ≤75 days.
  • Fraud/ABC or data-heavy matters: 45–90 days; 75th percentile ≤120 days.
• Tail control:
  • 90th percentile closures within 90 days (routine) and 150 days (complex) in mature programs.
• Quality safeguards:
  • Reopen/appeal rates ≤5% of closed cases; documentation completeness ≥95%.

Segment- or industry-specific benchmarks:

• Financial services and highly regulated sectors: tighter expectations; median closures near 30–45 days for conduct cases; complex AML/ABC may extend to 60–120 days with regulator visibility.
• Manufacturing/industrial with frontline workforce: HR/safety cases often close in 20–35 days; complex safety incidents longer due to root-cause and CAPA requirements.
• Technology/professional services: privacy or data misuse cases can be data-heavy; aim for 30–60 days with strong eDiscovery support.

If external benchmarks are not directly comparable, build internal ones: establish 24–36 month baselines by category/severity and region; set targets at top-quartile internal performance (median and 75th percentile); monitor stage-level SLAs to manage bottlenecks; and refresh targets annually or after material process, staffing, or portfolio changes.