Appointing the wrong investigation firm can turn one loss into two. In South Africa, employee fraud costs a business around R2 million per case and roughly 5% of annual revenue (BusinessTech, citing CS Forensics, 2023). Yet the bigger risk for a Head of Risk, CFO or HR lead is often the investigation itself: an unregistered operator, a privacy breach, or evidence that falls apart at the CCMA. This guide sets out exactly what to check before you sign, so the firm you hire protects your case instead of sinking it.
TL;DR: Choose a corporate investigation partner on six things: PSIRA registration, evidentiary discipline (chain of custody), a POPIA-compliant method, proven discretion, sector experience, and honest reporting. Registration is a legal requirement, not a nice-to-have. Operating as a private investigator without PSIRA registration is a criminal offence in South Africa (Private Security Industry Regulation Act 56 of 2001).
What should you look for in a corporate investigation partner?
Look for six things, and treat registration as the first filter. PSIRA records list more than 2.6 million registered security officers and 12,059 registered security businesses in South Africa (PSIRA Annual Report 2023/24). Registration is verifiable in minutes, so there's no reason to accept a firm that can't prove it. The rest of the checklist protects the two things that decide the outcome: whether your evidence holds, and whether the method itself stays lawful.
A strong partner reads very differently from a weak one on each point. The table below puts the two side by side.
| What to check | What a strong partner looks like | Red flag to avoid |
|---|---|---|
| PSIRA registration | Current PSIRA registration number, provided on request and verifiable | Vague answers, expired registration, or "we work with people who are registered" |
| Evidentiary discipline | A documented chain of custody and corroborated, non-hearsay evidence | Relies on a single polygraph result or second-hand accounts |
| POPIA-compliant method | Lawful, proportional, purpose-limited collection with clear boundaries | Promises covert access to private spaces or personal devices with no limits |
| Discretion | Confidentiality protocols, need-to-know handling, no name-dropping of clients | Freely discusses other clients' cases to impress you |
| Sector experience | Relevant work in your industry (retail, logistics, finance, manufacturing) | One-size-fits-all approach with no sector-specific method |
| Reporting | Structured, regular, defensible reporting you can act on | A single verbal "we found something" with no documentation |
Why does time matter so much here? Because the cost of a case rises sharply the longer misconduct runs, which is exactly what a capable partner is meant to shorten.
Fraud caught within six months costs far less than fraud left to run: schemes that go undetected for two to three years reach a median loss roughly eight times higher (ACFE Report to the Nations, 2024). A partner who can shorten detection saves you money, not just admin. On these numbers, speed is the most useful thing they sell.
Why do PSIRA registration and a POPIA-compliant method matter?
They matter because both are legal exposures, not preferences. Operating as a private investigator without PSIRA registration is a criminal offence under the Private Security Industry Regulation Act 56 of 2001, and a POPIA breach carries an administrative fine of up to R10 million (POPIA offences and penalties). Hire the wrong operator and you inherit both risks.
PSIRA registration is the quickest disqualifier to apply. A private investigator is defined in law as someone who investigates another person's actions, character or property for gain, and anyone doing that work must be registered. Ask for the registration number. A firm that hesitates has told you something important.
POPIA changes how a lawful investigation is run. The Information Regulator issued its first fine, R5 million, against a public body in 2023, and continues to act on complaints (Bowmans, 2023). A credible partner works to a proportional, purpose-limited method: consent and purpose disclosure where required, and private spaces kept off-limits (Polity, 2025). That discipline is what separates a professional firm from a "camera and PI" operator who will hand you a POPIA problem on top of your fraud problem. For a fuller picture of the compliance boundaries, see our POPIA-compliant workplace investigations guide.
Why "evidence that withstands legal scrutiny" is the criterion that matters most
Because most employer cases are not lost on the facts; they're lost on the evidence. South African courts treat polygraph results with caution: in Mustek Ltd v Tsabadi NO and Others the Labour Court held that a failed polygraph alone is insufficient to justify a dismissal, and the onus under section 192 of the Labour Relations Act stays with the employer (De Rebus, 2021). Evidence is the whole game.
Hearsay is the other common way a case collapses. As a general rule of the law of evidence, hearsay is not admitted, and where an arbitrator wrongly allows it, the award is open to being reviewed and set aside (Labour Guide). Reinstatement follows in real cases: in CEPPWAWU obo Tshukudu v Solid Doors, a dismissal built on hearsay was found unfair and the employee reinstated with retrospective effect.
So ask how the firm builds a case, not just whether it "gets results." Chain of custody is a condition of admissibility, especially for video and digital evidence, which must be clear, untampered, and, if disputed, supported by the person who recorded it (LabourNet). A partner that preserves a documented chain of custody and corroborates covert findings is selling you evidence that holds up under scrutiny, which is the point of the exercise. This is the core of a proper forensic investigation that produces defensible evidence, and it's why the polygraph question deserves its own answer: read whether polygraph evidence is admissible in a CCMA case.
What questions should you ask before you hire an investigation firm?
Ask questions that force specifics, because only 59% of South African companies ran an enterprise-wide fraud risk assessment in the past year (PwC Global Economic Crime Survey, 2024). Most buyers are appointing a firm without a baseline of their own exposure, so the interview has to do the work. Seven questions separate a professional from a chancer.
- What is your current PSIRA registration number, and may I verify it?
- How do you preserve a chain of custody, and what does a sample evidence file look like?
- How do you keep the method POPIA-compliant, and where do you draw the line on surveillance?
- How do you corroborate covert findings so a case doesn't rest on one source?
- What is your reporting cadence, and can I see a redacted example report?
- What relevant experience do you have in my sector?
- Who on your team leads the engagement, and where is the work carried out?
Notice what the answers reveal. A firm that welcomes the PSIRA and chain-of-custody questions is comfortable being checked. A firm that deflects is telling you how the eventual case file will read.
In-house investigation or an external firm: which do you need?
Choose external when independence, specialist skill or covert capability decide the outcome, which is more often than most teams assume. Tips remain the single most common way fraud is caught, at 43% of cases, more than three times the next method (ACFE, 2024). Tips tell you something is wrong; they rarely build the defensible case, and that is the gap an external specialist fills.
An in-house team has real strengths: context, speed on small matters, and no external cost. But it struggles where it matters most in a serious case. A manager investigating their own department is neither independent nor unseen, and cameras and guards alone do not reduce loss where collusion is involved (Fidelity Services Group's Wahl Bartmann, via Business Explainer, 2026). Covert, embedded work and financial-crime tracing are specialist disciplines.
Use external help when the loss is significant or already suspected, when the suspect is senior or long-tenured, when collusion is likely, or when the matter will end in a disciplinary hearing or the CCMA. For a covert approach, an undercover audit places trained auditors inside your operation; for procurement and financial crime, a dedicated fraud investigation follows the money. Both sit under the broader discipline of a corporate investigation built to produce evidence you can act on.
Frequently asked questions
Do corporate investigators have to be registered with PSIRA?
Yes. Private investigation is a regulated security service, and operating for gain without PSIRA registration is a criminal offence under the Private Security Industry Regulation Act 56 of 2001 (ProtectionWeb). Always ask for a current registration number and verify it before you appoint a firm.
Can I dismiss an employee based on a failed polygraph test?
No, not on the polygraph alone. In Mustek Ltd v Tsabadi NO and Others, the Labour Court held that a failed polygraph is insufficient on its own to justify a dismissal; it can only corroborate other evidence (De Rebus, 2021). The onus to prove a fair dismissal stays with the employer.
Will an investigation put me at risk of a POPIA fine?
It can, if the method is unlawful. POPIA breaches carry administrative fines of up to R10 million (POPIA penalties). A proper partner runs a proportional, purpose-limited investigation and keeps private spaces off-limits, so the process itself doesn't create a second legal problem.
How much does a corporate investigation cost in South Africa?
It varies by scope, but weigh it against the loss. Employee fraud in South Africa averages around R2 million per case and roughly 5% of revenue (BusinessTech, 2023). A firm's value is measured by whether its evidence holds and how quickly it stops the loss, not by the lowest quote.
In-house or external: who should run a serious investigation?
Usually external, once the matter is significant. Fraud is most often surfaced by a tip (43% of cases), but tips rarely build a defensible case on their own (ACFE, 2024). An external firm brings independence, covert capability and financial-crime skill that an internal team, however capable, generally cannot.
The bottom line
A good investigation partner protects your case as carefully as it pursues the facts. Before you appoint anyone, confirm the six essentials:
- A PSIRA registration number you can verify yourself, not just an assurance that one exists.
- A documented chain of custody and corroborated, non-hearsay evidence.
- A POPIA-compliant method that won't create a second legal problem.
- Genuine discretion and confidentiality.
- Real experience in your sector.
- Structured, defensible reporting you can act on.
Get a confidential read on your exposure
Apply this checklist to every firm, including us. If you're weighing a suspected internal loss and want a discreet, lawful read on your exposure, speak to our team in complete confidence. The confidential Loss-Risk Assessment is free, no obligation, and handled the same POPIA-aligned way we run every engagement.
Enquire Confidentially