12.2 Client Review of Findings, Secure Distribution & Disclosure Limits

Client Review of Findings, Secure Distribution & Disclosure Limits

Core Practice Standard: Two knowledge statements sit at the end of subarea 2C and are routinely under-prepared: K83, methods for securely distributing reports, and K84 through K86, methods for conveying information, explaining technical terms and abbreviations, and addressing client responses to investigation outcomes. Behind them sits K80, the law on disclosure of public and non-public information. A perfect investigation delivered badly is a liability, not an asset.

---

Who May Deliver the Report

BPC § 7539(c) is precise: "A written report shall not be submitted to a client except by the licensee, qualified manager, or a person authorised by one or either of them, and the person submitting the report shall exercise diligence in ascertaining whether or not the facts and information in the report are true and correct."

Three operational consequences:

1. A field operative does not send the report to the client. The operative's product comes to the licensee or qualified manager, who reviews it and issues the report — or expressly authorises someone to do so.
2. The person who transmits it owns a verification duty. "Diligence in ascertaining whether the facts are true and correct" is a legal standard, not a courtesy. Reconcile the narrative against the field notes, the timestamps, the log, and the exhibits before it leaves the office.
3. This pairs with BPC § 7539(h), which requires all business of the licensee to be conducted in the name of and under the control of the licensee — so the report goes out on the agency's letterhead, not the operative's.

---

To Whom: The Disclosure Rule

BPC § 7539(a) governs. A licensee, or its officers, directors, partners, members, managers, or qualified manager, may divulge to any law enforcement officer or district attorney, or their representative, any information acquired as to any criminal offence. But they "shall not divulge to any other person, except as otherwise required by law, any information acquired by them except at the direction of the employer or client for whom the information was obtained."

The last row catches more licensees than any other. A "recent case study" on an agency website that identifies a matter, even loosely, is a § 7539(a) disclosure.

Public versus non-public information (K80). The fact that a component is drawn from a public record does not make the compilation public. A dossier assembled from Recorder, Assessor, and court indexes is information acquired during the investigation and is subject to § 7539(a) in the investigator's hands.

---

Conveying the Findings

Explain the Terms (K85)

Write for a reader who is intelligent, busy, and not an investigator.

Expand every abbreviation on first use — APN, UCC, SDT, POS, SI-550, FQ, AME, SIU — and keep a glossary in reports that carry many.

Structure the Review Meeting

+---------------------------------------------------------------------------+
|  1. RESTATE the objective and the authorised scope                        |
|  2. SUMMARISE what was done: dates, hours, methods, sources                |
|  3. PRESENT the findings, each tied to its evidence                       |
|  4. STATE the disposition in the fixed vocabulary                         |
|  5. NAME the gaps: what was not covered, and why                          |
|  6. OPTIONS: what further work could close a gap, and at what cost        |
|  7. NEXT STEPS: deliverables, testimony availability, retention           |
+---------------------------------------------------------------------------+

Step 5 is the one investigators skip and clients most need. A client who does not know what was not covered will assume it was.

Addressing Client Reactions (K86)

Clients who receive unwelcome findings react predictably: disbelief, pressure to reinterpret, a request to "just take that part out," or a demand for more work at no charge. The professional responses:

• Disbelief → walk through the evidence chronologically, showing the source of each fact.
• Pressure to reinterpret → distinguish observation from inference explicitly. "The footage shows X. It does not show Y. An expert could be asked whether X implies Y."
• "Take it out" → decline. Removing a material finding to change the report's overall impression is a knowingly false report under BPC § 7539(b). Correcting a genuine factual error is different, and should be done promptly with a dated, versioned amendment.
• "Do more for free" → return to the change-control process: written scope, cost, and approval.
• Anger → acknowledge the disappointment, do not defend the finding emotionally, and put the options in writing afterwards.

---

Secure Distribution (K83)

Investigative reports contain exactly the categories a data breach makes catastrophic: addresses, vehicles, employment, medical references, and images of third parties.

1. Encrypt in transit and at rest. Encrypted portal or password-protected archive with the password sent by a separate channel; not plain email attachments.
2. Name the recipients. Address the report to named individuals, not to a shared inbox or a role alias, and confirm the address before the first transmission.
3. Watermark and paginate. Agency name, matter number, page x of y, and a confidentiality legend on every page.
4. Log the distribution. Who received it, when, by what method, and which version.
5. Version control. Amendments are issued as new dated versions with the change identified — never as a silent replacement of a file already delivered.
6. Physical delivery where the client requires it: sealed, tracked, signature on delivery.
7. Retention and destruction in line with the file's retention schedule and any litigation hold, and secure destruction — shredding and verified electronic wiping — at the end of it.

The single most common breach is neither hacking nor theft. It is autocomplete putting the wrong address in the "to" field. Confirm the recipient before the first send, and use a portal that requires authentication so a misdirected link is not a disclosure.

---

Case Example: The Reply-All

Scenario: An investigator emails a surveillance report as an unencrypted attachment to a client's general inbox, claims@carrier.example. The inbox is monitored by six people, one of whom is related to the claimant. The report is forwarded outside the company within a day. The client then asks the investigator to remove a paragraph noting that the subject was not observed during a four-hour gap, because it "weakens" the report.

Two failures. The delivery breached BPC § 7539(a) — information acquired during the investigation reached people the client never directed it to — and would be a serious problem even without the leak, because a shared inbox cannot be a named recipient. Removing the four-hour gap paragraph would make the report affirmatively misleading about coverage, and a report engineered to create a false impression is a knowingly false report under BPC § 7539(b).

The correct handling. Deliver to named recipients through an authenticated portal, log the distribution, and keep the coverage-gap paragraph. If the client wants the gap closed, that is a change-control conversation about additional surveillance — the honest and, incidentally, more profitable answer.