Grading What You Found

The gap between a finding and an outcome is where most insider cases are decided badly, usually by skipping the grading step entirely.

The practical lesson in “Grading What You Found” is that visibility is not certainty. For teams researching cognitive offloading, learn more from the provider can add time and project context to the operational record, provided the purpose is disclosed, access is limited and every material inference receives human review.

The categories

Error. Somebody did the wrong thing without intending to. A misaddressed file, a wrong permission, a misunderstanding of a rule.

For a separate perspective relevant to “Grading What You Found”, consult the European Commission data-protection resources. Use it to test the proposed threshold, investigation scope and review process rather than to substitute a generic checklist for the facts of a case.

Workaround. They knew it was outside the rules and did it to get the work done, which the process-failure note covers and which is the most common substantiated finding.

Carelessness. Not deliberate, not accidental: they knew the rule and did not bother.

Policy breach for personal convenience. Using a personal service, taking a copy home, sharing access — for their own ease rather than for the work.

Taking something. Removing material for their own benefit or somebody else's.

And deliberate harm. Sabotage, theft for a competitor, acting on behalf of an outside party.

Each is a different matter and the last two are rare.

Why the grading has to be explicit

Because the language of insider threat flattens them. A dashboard calls all six exfiltration, and an outcome chosen from that framing will be disproportionate for the first four.

Writing down which category, with the reasoning, forces the distinction into the record where a later reviewer can see it.

What distinguishes them

Intent, which is hard to establish and should not be assumed from the act.

Benefit: did they gain anything, and is there any evidence of it.

Concealment: did they hide it, which is the single most informative signal and is frequently absent in exactly the cases people assume are deliberate.

Pattern: once, or repeatedly over time.

And what they said about it when asked, checked rather than weighed.

The finding that matters most

No concealment, no benefit, a plausible work reason, and an immediate frank account when asked.

That combination points strongly at the first three categories whatever the volume of material involved, and it is the combination most often overridden by the seriousness of what was technically possible rather than what was actually done.

Writing the grading

The category, the evidence for it, and the evidence against.

Explicitly: here is what would indicate deliberate removal, and here is why we do not think that is what happened.

A case file that names the category without the reasoning is one that cannot be reviewed and will not survive an appeal.

the six gradings, written down

Not because the taxonomy is sacred but because writing which one forces the distinction into the record. A file naming the category and its reasoning can be reviewed; one that moves from finding to outcome without it cannot, and will not survive an appeal.

What the absence of concealment means

No hiding, no benefit, a plausible work reason, and a frank account when asked. That combination points firmly at the first three categories whatever volume of material was involved, and it is routinely overridden by how serious the exposure could theoretically have been.

Grading before proposing

Write which category and why, as a separate step, before any outcome is discussed. An outcome chosen first and justified afterwards is visible in the file to anybody reading it carefully, and reviewers read for exactly that.

Evidence for and against

Here is what would indicate deliberate removal, and here is why we do not think that is what happened. Both halves in the file, because a grading without the reasoning cannot be reviewed and will not survive an appeal.

Grading as a separate step

Written before any outcome is discussed. It forces the distinction into the record at the point where it can still change what happens, rather than being reconstructed to justify a decision already taken.

For the file: Grade before you propose an outcome, and write the grading as a separate step. An outcome chosen first and justified afterwards is visible in the file to anybody who reads it carefully.