What happened was not dramatic. No breach alert, no raid just a routine internal investigation triggered by a whistleblower email. Finance was asked for records, IT was asked for logs, HR was asked for emails. Everyone cooperated, everyone was confident and yet, three weeks later, the organisation realised something unsettling: the most important evidence no longer existed.
Not deleted out of malice, not destroyed in panic. It simply vanished through normal work. This is how good organisations lose cases they should have won.
I have seen this pattern repeatedly across banks, NGOs, telcos, insurers, and regulators. Strong policies, reputable people, competent professionals still when the investigation reaches the reporting stage, the evidence trail is thin, contested, or legally useless.
The issue is not intent but design. Once during an investigation, my case would become more difficult after each briefing to the EXCO. As the investigations progressed we noted some EXCO members had a strong connection to the fraud and would tip the key suspects off! For that reason, we decided to share case updates with only the CEO and Chair, Audit Committee.
In some rare cases, only the Chair and Audit Committee is given updates! The law is blunt on this point. Once you reasonably anticipate a dispute, investigation, or litigation, you are on the spotlight.
You have a duty to preserve evidence. Failure to do so, even innocently, exposes the organisation to adverse inferences, regulatory sanctions, and collapsed cases. Courts do not reward good intentions. They reward discipline.
Where it goes wrong is predictable.
First, organisations confuse “access” with “preservation.”
Someone says, “The emails are still in the system.” That is not preservation. Systems are living organisms, mailboxes auto-delete, logs rotate and backups overwrite.
Cloud retention rules execute silently at 2 a.m. The moment an allegation arises, evidence must be frozen, not merely available. In many cases I have handled, critical emails disappeared because the custodian changed roles, exceeded mailbox limits, or left the organisation.
IT did nothing wrong, they followed policy but the organisation failed to suspend policy. Once during an investigation, I went to the telecom company Internal Auditor (a former colleague). I showed him the email of my interest, they opened the server and found all emails intact. They printed one email, and then suddenly said, “Mustapha, go first bring a court order, I cannot give you these records.” I rushed out to bring the court order. I did an expedited processing, an hour later, I came to the man’s office.
When he opened the suspect mail box, all messages had dissappeared. As I moved out of the office, head down, I remembered he had printed a document before asking me for a court order, and to my resque, that email from the suspect mailbox had a smocking gun which improved my case.
That is how investigators can be lucky. Of course we applied to court for an order to access the telecom server, in vain, as it contained so many other people’s information… it was an interesting case… the smocking gun helped us to not pursue the matter further. Thank God for the printers!
Second, IT is brought in too late, and usually incorrectly.
Investigators often ask IT for “copies” of data. IT exports what is easy: PST files, spreadsheets, screenshots. In doing so, metadata is altered. Timestamps shift, file paths disappear, hash values are never calculated and chain of custody is broken before the first interview is conducted.
Later, when counsel asks, “Can you prove this email was not altered?”, the room goes quiet. Evidence without integrity is opinion, not proof.
This is where many leaders misunderstand technology risk. Digital evidence is fragile. According to guidance consistently articulated by leading digital forensics experts like Craig Ball, authenticity is everything. If you cannot show how evidence was identified, preserved, collected, and analysed, you do not have evidence. You have a story.
Third, people keep working on the evidence.
This is the silent killer. A finance officer opens a file “just to check something.” An HR manager forwards an email to clarify context. A compliance officer annotates a PDF.
Each action changes metadata and each action creates spoliation risk. No one tells them to stop because no one issued a legal hold. By the time the investigation report is written, the evidence has been touched by half the organisation. The report reads confidently. In court or before a regulator, it collapses.
Fourth, investigations rely on interviews before data.
This feels human but it is also backwards. Interviews contaminate memory and shape narratives. People delete, explain, justify, and clean up once they know the questions. The disciplined approach is evidence first, people second. Capture systems, preserve devices, secure logs. Then interview against facts, not recollection. Organisations that reverse this order lose leverage immediately.
Fifth, cloud comfort creates false confidence.
Many executives believe cloud systems “keep everything.” They do not. Retention is configurable. Deletion is automated. Admins can purge with a click.
Third-party vendors control infrastructure you do not own. When investigators ask for logs older than 90 days, the answer is often, “That’s not available.” Not because of wrongdoing, but because no one designed for investigations. Cloud efficiency and forensic readiness are not the same thing.
Sixth, no one owns evidence governance.
Risk thinks Legal owns it, Legal thinks IT owns it, IT thinks Compliance owns it, and Compliance thinks investigators own it.
In reality, evidence sits in the cracks. When something goes wrong, everyone is helpful, but no one is accountable. Evidence governance is a leadership function. It requires authority to stop systems, override policies, and issue holds immediately. Without that authority, evidence loss is inevitable.
Let me ground this in a simple case I have seen more than once.
An organisation investigates procurement fraud. Payments look inflated. The suspect vendor is linked to an employee. Finance provides payment schedules. HR provides emails. IT exports mailbox data. What is missing? Access logs showing who approved changes.
Those logs rotated after 14 days. No one preserved them. The suspect resigns. The report is written anyway. When the regulator asks for proof of manipulation, the answer is circumstantial then the case dies. The organisation absorbs reputational damage quietly.
This was not a bad organisation. It was an unprepared one. A good organisation designs for investigations before they need one.
That means, first, a standing legal hold protocol. Not a memo written during crisis, but a pre-approved mechanism that can be triggered within hours.
It suspends deletion, retention schedules, and user actions across relevant systems. Everyone knows what it means. Everyone knows to stop touching data.
Second, forensic-first data handling. Bring in the experts early. This helps with preservation. Evidence is collected using methods that preserve metadata and integrity.
Hashing is standard, access is logged, and copies are controlled. If you cannot explain chain of custody in one page, you are exposed.
Third, minimum human contact with evidence. Investigators work on forensic images, not live systems. Business users are instructed clearly: do not open, forward, edit, or “just check.” This feels extreme until you lose a case because someone tried to be helpful.
Fourth, investigation-aware technology configuration. Log retention aligned to risk, not convenience. Email retention aligned to regulatory reality.
Endpoint monitoring designed to support facts, not surveillance theatre. These are governance decisions, not IT preferences.
Finally, leadership clarity. When an investigation starts, the organisation understands one thing clearly: the burden is on us. The ball is in our court. If evidence is lost, the explanation “we didn’t know” does not survive scrutiny.
Good organisations lose evidence because they optimise for operations, not accountability. They trust systems instead of discipline. They move fast when they should pause. Evidence does not disappear in scandals. It disappears in normal work.
The organisations that win investigations are not more ethical but more deliberate. They assume scrutiny will come and they build accordingly.
Copyright Summit Consulting Limited, 2026. All rights reserved.
