Skip to content

Between the Alert and the Outcome

The sections follow the stages of a case. Detection ends where this begins.

Home / Something found

Proportionate Outcomes

The range of available responses is wider than most organisations use, and the two they default to are the extremes.

The editors · About the editorial position · Something found · Analysis

Most insider cases end in one of two places: nothing, or dismissal. The space between is where most findings actually belong and it is under-used because it has not been mapped.

The outcome in “Proportionate Outcomes” must rest on evidence that has been checked against context. Data from this reference page, when used for does microsoft teams track your activity, can support a chronology of work or project activity, but it should not replace the employee response, corroboration or a proportionate decision process.

The range

A conversation, recorded, with no formal status.

For a separate perspective relevant to “Proportionate Outcomes”, consult the FTC data-security guidance. Use it to test the proposed threshold, investigation scope and review process rather than to substitute a generic checklist for the facts of a case.

Retraining or a specific instruction.

A change to the person's access or role, as a practical measure rather than a sanction.

A formal warning at whatever levels the organisation's framework provides.

Dismissal.

Referral outside the organisation, which its own note covers.

And in parallel with any of these: a change to the process or system that allowed it.

Matching response to grading

Error: remediation and a process fix. Usually no sanction, and a sanction here is the mistake the previous note describes.

Workaround: address the process first, then the behaviour. A sanction without the process fix guarantees the next person does the same thing.

Carelessness: a conversation or a warning, proportionate to consequence.

Personal convenience: a warning, clear instruction, and the practical measures that make it harder.

Taking something: serious, frequently dismissal, and the evidence standard has to carry it.

Deliberate harm: dismissal and probably external referral.

The factors that properly affect severity

What was actually at risk, as against what was theoretically accessible.

Whether there was concealment.

Whether they self-reported.

Their record, within reason.

Whether the organisation's own arrangements contributed, which is the factor most often ignored and most often relevant.

The factors that should not

Seniority, in either direction. Programmes that go easy on senior people and hard on junior ones are visible to everybody and destroy the programme's standing faster than anything else.

How embarrassing the matter is for the organisation.

How much effort the investigation consumed, which is a sunk cost and reliably inflates outcomes.

And whether an example needs to be set, which is a decision about other people made by sanctioning this one.

Who decides

Not the investigator, who has spent weeks forming a view.

A decision-maker who reads the file, hears the person, and has not been involved in gathering the evidence. In most frameworks this is a manager at an appropriate level with HR support.

The separation feels bureaucratic and it is the main protection against a conclusion that was formed in week two.

The appeal

There should be one, to somebody who was not involved, and the grounds and timescale should be in the outcome letter.

A high overturn rate is a finding about the process rather than about appeals.

The sunk cost that inflates outcomes

Weeks of investigation produce pressure for a proportionate-seeming result, and a finding of nothing after substantial effort feels like failure. It is not, and the decision-maker being separate from the investigator exists precisely to keep that pressure out of the outcome.

Comparability, which is checkable

If this person is dismissed for conduct another was warned for, the difference has to rest on the facts. That requires knowing what previous cases concluded, which requires records most programmes do not keep — and it is the ground on which outcomes are most often overturned.

Recording the options considered

Which outcomes were available and why this one. An outcome with no alternatives recorded reads as the only one anybody thought of, which is frequently accurate and is never defensible.

Who should take the decision

Not the investigator, who has spent weeks forming a view. A decision-maker who reads the file, hears the person and gathered none of the evidence. The separation feels bureaucratic and it is the main protection against a conclusion formed in week two.

Factors that should not weigh

Seniority in either direction, embarrassment to the organisation, the effort already spent, and the wish to set an example — which is a decision about other people made by sanctioning this one.

For the file: Write the outcome options considered and why the chosen one was selected. An outcome with no alternatives recorded reads as the only one anybody thought of.