The Subject Who Does Not Know

A person can be under enquiry for weeks while attending meetings, making plans and knowing nothing. The asymmetry is sometimes necessary and it is never neutral.

The practical lesson in “The Subject Who Does Not Know” is that visibility is not certainty. For teams researching hourly timesheet template, this workplace platform can add time and project context to the operational record, provided the purpose is disclosed, access is limited and every material inference receives human review.

What is happening to them

Nothing, from their point of view, which is the point.

For a separate perspective relevant to “The Subject Who Does Not Know”, consult the Splunk insider-threat guide. Use it to test the proposed threshold, investigation scope and review process rather than to substitute a generic checklist for the facts of a case.

And meanwhile: their records examined, their colleagues possibly asked oblique questions, decisions being formed about them, and a file accumulating.

If the case closes with nothing and they are never told, they will have experienced none of it. That is the usual outcome and it is a reasonable one.

If the case does not close with nothing, everything that happened during this period will be examined, and the question will be whether it was proportionate.

What is owed during the unaware period

Accuracy, because the record is being built without the only person who could correct it.

Restraint in scope, for the same reason: nobody is pushing back.

No action affecting them that they would notice but not understand. Quietly removing an access, excluding them from something, changing a reporting line — each of these is felt, puzzled over, and later understood as the moment the organisation had already decided something.

And a genuine search for the innocent explanation, since the person who could supply it is not being asked.

The colleague questions

Asking people about somebody without saying why is the part most likely to be discovered and most corrosive when it is.

It is sometimes necessary. Where it is, it should be authorised specifically, kept minimal, and framed around the work rather than the person: what was the team doing that week, not what do you think of them.

Colleagues work out what is happening more often than investigators assume, and the subject usually hears about it.

The thing that goes wrong most

The enquiry concludes, the finding is nothing, and the subject is never told it happened.

Defensible in many cases. Not defensible where they noticed something — the access that disappeared, the odd questions, the manager's manner — because then they know something occurred and have been left to invent an explanation.

Its own note in the outcomes section deals with this properly; the point here is that the decision about telling them should be anticipated during the unaware period rather than improvised at the end.

The review

At a stated interval: does the reason for them not knowing still apply?

Same discipline as the covert stages note and the same finding — it usually stops applying well before anybody checks.

What colleagues work out

Oblique questions about somebody are recognised as what they are more often than investigators assume, and the subject usually hears. Which means the covert period is frequently less covert than the file records, and the eventual conversation begins with the person already knowing they were discussed.

The action they will notice

A removed permission, a changed meeting invitation, a manager's altered manner. Each is felt and misinterpreted, and later understood as the moment the organisation had already decided. If something must be done during the unaware period, it should be either invisible or explained.

The review nobody schedules

Does the reason for them not knowing still apply. Same discipline as the covert phase and the same finding: it stops applying well before anybody checks, and the delay is what the person remembers.

The genuine search for the innocent explanation

During the unaware period the only person who could supply it is not being asked. That places an obligation on the investigation to look for it actively, which is a different disposition from assembling what the records show.

What is owed while they do not know

Accuracy, restraint in scope, and an active search for the innocent explanation, because the person who could supply it is not being asked and nobody is pushing back on anything.

For the file: Record anything done during this period that the subject could have noticed. If the list is not empty, the case for continuing without telling them is weaker than it was.