Deciding what warrants it.
WHAT TYPICALLY PROMPTS INVESTIGATION
A suspected compromise Data apparently taken or leaked Misuse of systems by a person Suspected fraud A dispute about what someone did An incident that must be reported
WHAT TO ESTABLISH FIRST
Whether this is an operational problem or something requiring evidence.
WHY THAT DISTINCTION
It determines whether you may simply fix it.
WHAT INDICATES EVIDENCE IS NEEDED
Someone may be dismissed Someone may be reported to authorities A claim may follow A regulator must be informed Insurance is involved A dispute exists
WHAT TO DO IF ANY APPLY
Preserve before acting.
WHY
The opportunity exists once.
WHAT TO ASSESS
Seriousness Whether it is continuing What is at risk now
WHAT TO PRIORITISE WHERE HARM IS CONTINUING
Stopping the harm.
WHY
Evidence matters less than preventing further damage.
WHAT TO DO
Contain it in a way that preserves what you can.
WHAT TO ESTABLISH
Who authorises an investigation.
WHY
Investigations examine people's activity and they require authority.
WHAT TO CONSIDER
Whether the matter should go to specialists or authorities immediately.
WHAT WARRANTS THAT
Serious criminality Significant data breach Anything you lack capability to handle Anything involving senior people
WHAT TO AVOID
Beginning an investigation without deciding its scope Investigating something that should be reported
