Referral Outside the Organisation
Reporting a matter to a regulator, a professional body or the police changes who controls it. The decision should be made deliberately and rarely.
The editors · About the editorial position · Something found · Reference
General orientation, not legal advice; reporting duties and their consequences differ substantially by jurisdiction and sector.
The practical lesson in “Referral Outside the Organisation” is that visibility is not certainty. For teams researching attendance point system, Monitask guide to attendance point system can add time and project context to the operational record, provided the purpose is disclosed, access is limited and every material inference receives human review.
Once a matter leaves the organisation, the organisation is no longer in charge of it. That is sometimes required, sometimes right, and frequently done without the decision being examined.
For a separate perspective relevant to “Referral Outside the Organisation”, consult the NSA cybersecurity guidance. Use it to test the proposed threshold, investigation scope and review process rather than to substitute a generic checklist for the facts of a case.
Where referral is required rather than optional
Regulatory reporting duties in several sectors: financial services, healthcare, legal, parts of the public sector.
Data protection notification where personal data was involved and the threshold is met, which is a separate and usually faster clock.
Safeguarding duties.
Where a court order or an existing obligation requires it.
These are not decisions. They are obligations with deadlines, and the first task is establishing whether one applies — which should happen early, not at the outcome stage.
Where it is a choice
Criminal conduct that the organisation could report and is not obliged to.
Notification to a professional body.
Informing a client or partner whose data was involved, beyond any formal duty.
Each of these is a genuine decision with costs on both sides, and it should be taken by the executive with legal advice rather than by the investigation.
What changes when you refer
Control of timing, disclosure and outcome passes to somebody else.
The internal process may have to pause, which affects the subject's position and the suspension question.
Evidence handling standards rise retrospectively, and material gathered casually becomes a problem.
And the matter may become public in a way the organisation cannot manage.
The considerations that properly weigh
Seriousness and whether harm continues.
Whether others are at risk — including at a future employer, which is the strongest argument for professional-body referral.
Deterrence, honestly assessed rather than assumed.
The evidential strength, because a referral that goes nowhere has costs for the person that a finding alone does not.
And the subject's position: referral is a serious consequence and it should be proportionate to the finding rather than an expression of how the organisation feels about it.
Telling the subject
They should be told that a referral is being made or has been made, unless an external body has directed otherwise.
Discovering it from a regulator or a police contact is both unfair and frequently damaging to the organisation's position later.
The reference question
A separate and common problem: what the organisation says if a future employer asks.
The position should be settled at the point of outcome, with legal advice, and it should be consistent. Improvising a reference months later, by somebody who was not involved, is how an otherwise sound case produces a claim.
For the file: Record whether a mandatory duty was assessed, by whom, and what was concluded — including where the conclusion was that none applied.