Gathering evidence
ISO 370008:2023 – Internal Investigation in organizations, recommendations

The internal investigation procedure provides for time-stamped archiving of evidence. Each piece of evidence is stored in a confidential space and regulatory retention periods are taken into account in this process. The methods used to collect, process, and analyze this evidence are documented. The types of data (personal data, economic and commercial documents) are categorized. A data confidentiality scale is applied to each document constituting evidence.

An inventory of the evidence collected and consulted for the purposes of the internal investigation is documented. This inventory lists the documents that have...