Investigating white-collar crime is like any other investigation concerned with the past. Investigating is to find out what happened in the past. A negative event or a sequence of negative events can be at the core of an investigation. If there is no certainty about events, then finding out whether or not something has occurred can be at the core of an investigation. An investigation can be concerned with events that did occur or events that did not occur. An investigation is a reconstruction of the past. Information is collected and knowledge is applied to reconstruct the past. What happened or did not happen? Investigators first develop their know-what in terms of events or absence of events. It might be a bribe that was paid, money that was embezzled, tax that was not paid, or a bank that was defrauded. An investigation typically starts by finding facts about what happened. How did it happen or not happen? Investigators develop a hypothesis about the path for what happened. They identify information sources that support or disapprove the hypothesis. If the hypothesis is discarded, then a new path for what happened is identified. Why did it happen? Investigators try to establish causality in terms of cause and effect. The cause may be a motive, another event, or something else. Causality is easily assumed but very difficult to prove in terms of evidence in an investigation. Who did what to make it happen or not happen? This is where investigators have to be very careful, especially when it comes to suspects of misconduct and crime. Investigators should work just as hard to prove innocence as to prove guilt. Investigators should give suspects the benefit of the doubt. Suspects must be given the right of contradiction, where they can disagree with what investigators claim to have found out about them.