Oh, absolutely. In my arena, finance, there's no way you'd use your own staff - it would go straight to external auditors who'd conduct the investigation or contract specialist firms to investigate. Of course, not always going to be the case for smaller companies and more minimal impact cases.