---
title: "Evidence Over Intuition: Highlights from the Lecture at SB Club"
description: Discover key insights from Oleg Lagodienko's lecture on evidence collection and analysis, emphasizing the importance of facts over intuition in investigations.
---

[Ethics Control Blog | Ethicontrol](https://ethicontrol.com/en/blog)

# [Evidence Over Intuition: Highlights from the Lecture at SB Club](https://ethicontrol.com/en/blog/dokazy-zamist-intuitsii-sb-club-en)

 Written by [Oleg Lagodiyenko](https://ethicontrol.com/en/blog/author/oleg-lagodiyenko) | 09/09/2026, 07:00

On September 8, Ethicontrol co-founder Oleg Lagodienko delivered a lecture titled “Collection and Analysis of Evidence” at an SB Club training session on ISO 37008. We would like to draw your attention to the key points.

 

## 1. An Investigation Is About Building an Evidence-Based Case, Not Merely Finding the Truth

A fact, a hypothesis, and a judgment are three different things, and only the first should appear in the final report.

A **fact** is something that has already been established and does not require further proof: the date a company was registered, the amount of a payment, or the time a user logged into a system.

A **hypothesis** is a reasoned assumption that still needs to be verified: “They colluded because they studied together.”

A **judgment** (or assessment) is a subjective conclusion made by an observer: “He appeared to be drunk,” “the price was inflated,” or “she was aggressive.” Only facts should be included in the final investigation report; judgments and unverified hypotheses have no place there.

The distinction may seem obvious on paper, but in practice it is regularly blurred even by experienced professionals. “The test showed a blood alcohol concentration of 0.2‰” is a fact. “He came to work drunk” is a judgment unless that condition has been confirmed by a test. “Petrenko raised his voice and hit the table with his hand, and there are three witnesses” is a fact. “He is an aggressive person” is a judgment.

This distinction matters because courts and regulators assess facts supported by evidence, not the investigator’s impressions.

 

## 2. The standard of proof is chosen at the outset, rather than tailored to fit a predetermined conclusion

| Standard of Proof | Threshold of Conviction | When to Use |
| --- | --- | --- |
| Reasonable suspicion | ~20–25% | Start of the preliminary inspection, preventive measures |
| Possible grounds | ~30–40% | Decision on a full investigation, access to email and logs |
| Balance of probabilities | \>50% | Minor disciplinary measures—civil cases are structured in the same way |
| Clear and convincing evidence | ~65–75% | Dismissal of a top executive; notification to the regulator or shareholders |
| Beyond a reasonable doubt | ~95%+ | Submission of Materials to Law Enforcement Agencies |

 If it is already clear during the planning stage that the matter could potentially result in the dismissal of a manager or a referral to law enforcement, the standard of proof should be raised immediately, rather than at the last minute.

Most corporate investigation policies boil down to a balance of probabilities—this is insufficient when it comes to serious ethical decisions—it is worth applying the “clear and convincing evidence” standard, and if there is an immediate desire or requirement to refer the case to law enforcement, then only beyond a reasonable doubt.

 

## 3. The right to search is no less important than what is found

| Standard | What it establishes | Practical consequence |
| --- | --- | --- |
| Constitution, Articles 31 and 32 | Confidentiality of correspondence and non-interference in private life; exceptions are permitted only by court order | Employees' personal emails and messaging apps are not read, even on their work laptops |
| Criminal Code, Article 163 | Violation of the confidentiality of correspondence is a crime | The risk of personal liability for the head of the security service, not just for the company |
| Law of Ukraine “On the Protection of Personal Data” No. 2297-VI, Articles 6, 7, and 11 | The purpose of the processing is legitimate and has been determined in advance | The purpose and legal basis must be established before data collection begins, not afterward |
| Labor Code, Articles 147-1, 148, 149 | Enforcement—no later than one month from the date of discovery and six months from the date of the offense | A flawlessly conducted investigation that lasted three months may turn out to be fruitless |
| ECHR, Art. 8, ECHR case law | Proportionality of Any Interference with Private Life | The court considers not only what was found, but also whether the search was conducted lawfully |

Reading an employee’s corporate email is lawful if all seven of the following conditions are met: prior and clear notification of monitoring, understanding of its scope (traffic or the content of correspondence), a legitimate basis, minimal intrusion, proportionality of consequences, procedural safeguards (limited circle of individuals, access log), and the employee’s right to appeal.

The safest point of entry for any investigation is access logs, access control systems, ERP systems, and VPNs: this data pertains to the performance of work duties, not to private life.

Video surveillance is permissible if the camera records an area rather than specifically targeting a particular person (Supreme Court ruling in Case No. 759/4191/19).

An employee’s personal phone may be monitored only with voluntary written consent for a specific scope or through law enforcement agencies.

A hidden keylogger, screen-monitoring software, webcam, or microphone is not an investigative tool but a way to create a problem for yourself rather than gather evidence.

## 4. The most valuable evidence is lost in the first few days

| Source | Typical lifespan | What to Do Right Away |
| --- | --- | --- |
| Random Access Memory, open sessions | Minutes | Do not turn off the device until the forensic expert has made a decision |
| CCTV Footage | 7–30 days, often exactly 7 | A written export request with a timestamp—this is what gets lost most often |
| Firewall, proxy, and VPN logs | 30–90 days, rotation | Stop the rotation, export with a checksum |
| Mailbox | Until deleted by the user | Legal hold in Microsoft 365 or Google Vault—can be enabled in 5 minutes |
| Version History in the Cloud | 30–180 days | Export the version history along with the file, not just the current version |
| Data on an employee's laptop | Before passing it on to someone else | Remove from the inventory, create an image—do not send it to IT for reinstallation |

A legal hold order specifies the basis, the subject matter (data, mailboxes, time period), the recipients by name, a specific action (stop rotation, prohibit reinstallation of equipment), and the duration.

Two common mistakes: a verbal order, after which IT says, “No one told me,” and a hold that is not lifted after the case is closed, causing the company to retain unnecessary personal data for years in violation of data protection laws.

 

## 5. Evidence has seven requirements and five levels of reliability

Before admitting evidence into the case, the following is verified:

- whether it pertains specifically to the fact under investigation (relevance);
- whether there is sufficient evidence to support a conclusion (sufficiency);
- whether the source is trustworthy and whether the data has been altered (reliability);
- whether it is truly what it appears to be and has remained unchanged since it was collected (authenticity and integrity);
- whether the fact is corroborated by independent sources (triangulation);
- whether another expert could replicate the analysis (reproducibility);
- whether there was a legal basis for collecting the data and whether any unnecessary data was collected (legality and proportionality).

An example of the last point: when investigating a complaint about a specific tender, correspondence is retrieved based on the tender dates and participants—not all email correspondence from the entire year.

There are five levels of evidence reliability:

- unverified statements and anonymous reports—the lowest;
- verbal explanations from employees without corroboration—low;
- documents created internally but corroborated by external evidence (a contract with a bank payment)—medium;
- documents from independent external sources—high;
- evidence obtained directly from a third party independent of the company (bank balance confirmation, external expert opinion)—the highest.

Conclusions should not be based solely on low-level evidence—cross-verification with evidence of another type is required.

 

### When Expert Analysis Is Needed and Why a Polygraph Is Not Evidence

Even reliable evidence can be called into question if it is not backed by an expert assessment—such as an evaluation of a document’s authenticity, an examination of a digital medium, or an analytical or ethical compliance review (an assessment of an employee’s actions against the code of ethics must be conducted by someone not involved in the investigation itself).

**Practical guideline:** Expert analysis is needed first and foremost when a case may go to court—such as the termination of a top manager, reputational risk, or a report to a regulator. It’s also important to remember: a polygraph test is not evidence.

A person with the right skills can easily pass it without “triggering” the machine, so at best it is a supplementary tool for the process owner, not a basis for a conclusion.

 

## 6. Real-Life Ukrainian Cases

Case 1. Case No. 536/1109/19. The Supreme Court ruled that the dismissal of a manager was unlawful because the employer failed to specify the misconduct and, in effect, had the employee on the payroll without a clear description of the violation. An investigation was conducted—but without proper documentation of the facts, the court’s decision was overturned ([sud.ua](https://sud.ua/uk/news/publication/366804-verkhovnyi-sud-vyznav-nezakonnym-zvilnennia-kerivnyka-iakyi-fiktyvno-pratsevlashtovuvav-robitnyka-bez-konkretyzatsii-prostupku-zvilnennia-nezakonne)).

Case 2. Case No. 538/1991/23. An employee was terminated for absenteeism while working remotely. The Supreme Court defined the limits of evidence evaluation: a mere record of absence from the workplace is a document of moderate reliability (created internally by the company, not corroborated by external sources), and it is insufficient. Evidence of absenteeism should consist of connection logs to corporate systems that record the location of the connection—that is, precisely the “mix of evidence” mentioned above ([sud.ua](https://sud.ua/uk/news/sudebnaya-praktika/367090-pratsivnyka-zvilnyly-za-prohul-pid-chas-dystantsiinoi-roboty-verkhovnyi-sud-vyznachyv-mezhi-otsinky-dokaziv)).

Case 3. A Viber screenshot as evidence. A Supreme Court ruling dated January 9, 2026 (Case No. 751/4083/24) recognized a Viber screenshot as valid evidence of an employee’s notification regarding the suspension of the employment contract. However, the decision was not based on the screenshot alone: the court evaluated it in conjunction with information regarding salary calculations, the prolonged absence of payments, and the employee’s inaction in defending their rights during that time. A single screenshot constitutes evidence of low or moderate reliability; when combined with other evidence, it is a different story ([sud.ua](https://sud.ua/uk/news/sudebnaya-praktika/352670-verkhovnyy-sud-priznal-sms-cherez-viber-nadlezhaschim-dokazatelstvom-oznakomleniya-rabotnika-s-prikazom)).

 

What all three cases have in common is that the court never evaluates evidence in isolation. It looks at the totality—the triangulation of facts from various sources. That is precisely why a single piece of evidence, o

 

## 7. A screenshot is a statement. It is validated by its hash and the chain of custody.

The problem with most internal investigations is not a lack of evidence, but a lack of properly collected and documented evidence.

The classic chain: discovery → seizure → transfer → storage → use.

For each piece of evidence, it is important to record a unique identifier, who handled it, under what conditions it was copied or seized, and who had access to it.

This can be tracked in a simple spreadsheet—the key is that a specific person is responsible for maintaining the record, and access is restricted.

 

## Five Takeaways for a Security Team Checklist

1. Only facts are included in the final report—there is no place for opinions or unverified hypotheses.
2. Set the standard of proof at the outset: if there is a risk that a top manager could be fired or that the case could be referred to law enforcement, raise the bar for proof immediately.
3. The legality of the evidence is just as important as the substance of the evidence—especially in the case of unpopular disciplinary decisions.
4. The most valuable evidence is lost in the first few days: digital traces last only a matter of hours, not weeks.
5. The absence of a conclusion is also a legitimate outcome of an investigation. A commission that always finds someone to blame is no longer about justice.

 

## Frequently Asked Questions

### How does a fact differ from a hypothesis?

A fact has already been established and is easy to verify (the date of the company’s registration, the payment amount). A hypothesis is an assumption that requires further verification and may be confirmed or refuted by new facts.

 

### Is a screenshot of a conversation considered evidence in an internal investigation?

A screenshot alone is evidence of low or moderate reliability. Courts (in particular, the Supreme Court in Case No. 751/4083/24) recognize such evidence as admissible only in conjunction with other supporting evidence—such as server logs, payment data, and the parties’ conduct.

 

### How long must digital evidence be preserved after an incident is detected?

The first 24–48 hours are critical: RAM data lasts only minutes, CCTV recordings are often overwritten within a few days, and firewall logs are frequently retained for only 3–10 days. Decisions regarding a legal hold and the preservation of logs should be made immediately during the planning stage of the investigation.

 

### Is a polygraph result admissible as evidence?

No. A polygraph is not admissible as evidence in an internal investigation; a skilled individual can pass it without triggering an “alert.” It is, at most, a supplementary tool, and any conclusions drawn from it must be corroborated by other reliable evidence.

 

*[Ethicontrol](https://ethicontrol.com/en/main?hsLang=en) helps compliance and corporate security teams document internal audits—from receiving reports via the hotline to maintaining a chain-of-custody log and automatically calculating file hashes—on a platform with [transparent pricing](https://ethicontrol.com/en/pricing?hsLang=en) and no hidden fees for basic features.*

[View full post](https://ethicontrol.com/en/blog/dokazy-zamist-intuitsii-sb-club-en)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Oleg Lagodiyenko"
  },
  "dateModified" : "2026-10-28T10:12:41.637Z",
  "datePublished" : "2026-09-09T07:00:00Z",
  "headline" : "Evidence Over Intuition: Highlights from the Lecture at SB Club",
  "image" : {
    "@type" : "ImageObject",
    "height" : 630,
    "url" : "https://ethicontrol.com/hubfs/ChatGPT%20Image%20Sep%208%2c%202026%2c%2010_30_33%20PM%20%281%29.jpg",
    "width" : 1200
  },
  "mainEntityOfPage" : "https://ethicontrol.com/en/blog/dokazy-zamist-intuitsii-sb-club-en",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://7713219.fs1.hubspotusercontent-na1.net/hubfs/7713219/Ethicontrol%20LOGO%20square.jpg",
      "width" : 60.0
    },
    "name" : "Ethics Control Blog "
  }
}
```