Set the mandate and response team
Define the allegation, immediate risk, decision-maker, reporting line, legal oversight and need for technical or forensic support. Check conflicts and independence before evidence collection or interviews begin.
Preserve without signalling unnecessarily
Identify custodians, devices, business systems, chat platforms, access logs and third-party data. Stop relevant deletion and overwriting. Use targeted notices and document the preservation action rather than circulating allegations widely.
Secure urgent operational risks
Separate continuing safety, payment, access-control, retaliation and data-loss risks from the fact-finding process. Temporary controls should be proportionate, documented and periodically reviewed.
Build chronology before key interviews
Gather core records, identify gaps and create an issue-based timeline. Sequence interviews to reduce contamination and test accounts against documents. Use a consistent notes and acknowledgement protocol.
Communicate verified facts only
Prepare a small set of accurate internal messages and identify who can contact regulators, insurers, counterparties or authorities. Record decisions and preserve privilege where applicable. Early certainty is attractive but unsupported conclusions damage the process.
Working checklist
- Written scope and governance
- Conflict and independence check
- Custodian, device and system map
- Preservation notices and technical holds
- Immediate-risk controls
- Evidence and chronology register
- Interview sequence and protocol
- Notification and communications owners