8.3 Company Operations, Risk Controls & Record Security

Company Operations, Risk Controls & Record Security

A private-investigation company combines a state credential, qualified leadership, licensed people, documented processes, and secure information handling. Company compliance is broader than forming an LLC.

Company qualification

Under T.C.A. § 62-26-206, the relevant applicant, partners, or corporate qualifying agent satisfy the personal requirements and company examination. The company must possess or employ at least one person with:

• 2,000 hours of compensated, verifiable investigative experience satisfactory to the Commissioner; or
• one year of applicable related experience or education in a related area approved by the Commissioner.

Rule 1175-01-.19 describes documentation such as a detailed résumé, employer verification, transcripts, qualifying military investigative experience, out-of-state business records, and letters of good standing.

Do not describe this as a universal individual-license requirement or insist that the qualifying agent personally accumulated the hours over a fixed two-year span. Apply the current statutory alternatives.

Current company fees

The current TDCI fee page lists:

Fees change. Check the live page for a real filing. Do not combine individual fees, company application fees, and company renewal fees.

Qualifying-agent continuity and changes

When a qualifying agent stops regular duties, § 62-26-212 requires notice within 30 days and a substitute within three months, subject to a reasonable extension by the Commissioner. Other company changes can trigger 30-day notice under § 62-26-213 and the rules.

Maintain a compliance calendar for:

• company and individual expirations;
• qualifying agent and officer changes;
• employee/affiliate roster changes;
• branch locations;
• addresses;
• criminal charges or other reportable events;
• continuing education for individuals; and
• complaints and response deadlines.

Do not wait for renewal to correct the record.

Supervision and unlicensed activity

The company cannot lend its name to allow an unlicensed person to evade the Act. Verify every operative’s active status and scope before assignment. An apprentice works only after written confirmation and in the direct physical presence of a responsible licensee.

Use written assignment records, supervisor designation, check-ins, method limits, equipment issue, expense approval, and report review. A subcontractor’s separate business status does not excuse licensing verification or conflict screening.

Chapter 1175-04 can expose a company to discipline for affiliated investigators’ violations when the company knew or should have known and failed to take timely preventive or remedial action. Training and supervision must be real.

Insurance as risk management

The reviewed Tennessee PI licensing statute, rules, and current application pages do not impose a single universal requirement that every company carry general liability, errors and omissions, cyber, workers’ compensation, commercial auto, or hired/non-owned auto coverage.

That does not make insurance unimportant. Coverage should be selected with a licensed insurance professional based on employees, vehicles, surveillance driving, subcontractors, evidence custody, cyber risk, and client contracts.

Do not claim that every personal auto policy “universally” excludes every business use. Policies differ. Disclose operations accurately to the insurer and obtain written coverage analysis. Hired/non-owned auto can address some company exposure when people use vehicles not owned by the company, but scope, exclusions, limits, and driver coverage matter.

Workers’ compensation, unemployment, payroll, and classification obligations depend on workforce and law beyond the PI rules. Calling a worker an independent contractor does not settle legal status.

Marketing and licensed identity

Rule 1175-04-.06 requires promotional material to bear the true name under which the person or company is licensed. It prohibits misrepresenting qualifications, accomplishments, personnel, or identity and forbids suggesting law-enforcement association.

Rule 1175-01-.08 prohibits claiming recommendation or endorsement by the Commissioner or Department. It does not state that every advertisement and social profile must display a company license number. A company may choose to display a truthful number, but do not teach an unsupported universal mandate.

Review names, domains, profiles, proposals, letterhead, badges, clothing, and vehicles. Avoid “official,” “agent,” seals, or police styling that misleads.

Record retention

No one retention period fits every file. Build a written schedule by record category and legal trigger:

• client contracts and billing;
• investigative notes, reports, and media;
• evidence custody;
• employee and apprentice records;
• education and licensing records;
• tax and payroll records;
• FCRA consumer-report files;
• data-vendor audit logs; and
• complaints and legal holds.

Contract, tax, employment, privacy, discovery, court orders, subpoenas, insurer requirements, source contracts, and anticipated litigation can set different periods. Suspend destruction when a legal hold applies. Record authorized disposition.

The original draft’s generic three-to-seven-year rule was a risk suggestion, not a Tennessee licensing requirement.

Information security

Use role-based access, unique accounts, multifactor authentication, encryption appropriate to the risk, secure transfer, backups, patching, endpoint protection, and access logs. Remove access promptly when a worker leaves.

Encryption labels such as “AES-256” do not by themselves prove a secure system. Key management, passwords, devices, recipients, backups, and human error matter. Collect less unnecessary data and segregate especially sensitive case types.

Have an incident-response plan covering containment, preservation, legal assessment, client notice, vendor contact, and required notifications. Do not delete logs to hide an incident.

File closure

At closure:

1. confirm work and expenses;
2. issue the report and itemized statement when required;
3. return property and obtain receipts;
4. identify preservation obligations;
5. revoke temporary access;
6. classify records under the retention schedule;
7. record unused-fund handling; and
8. document destruction when later authorized.

Exam method

Choose current company qualification and fee tiers, timely notices, active-license verification, genuine supervision, truthful licensed names, risk-based insurance, and lawful retention. Reject answers importing a lawyer trust rule, one mandatory insurance product, or an invented advertisement-number requirement.