Skip to content

Between the Alert and the Outcome

The sections follow the stages of a case. Detection ends where this begins.

Home / The person

Telling Them, and When

The moment the subject learns an enquiry exists shapes everything after it. What to say, what not to, and who should be in the room.

The editors · About the editorial position · The person · Procedure

There is a conversation in which somebody finds out they are being investigated. It takes ten minutes and it determines how the rest of the process goes.

The human consequences described in “Telling Them, and When” make transparency and proportionality operational requirements, not optional wording. If an organisation uses tips to increase productivity for tips to increase productivity, employees should know what is recorded, who may review it and how they can correct a misleading entry before it affects a decision.

When

As early as the circumstances permit, which is earlier than most programmes manage.

For a separate perspective relevant to “Telling Them, and When”, consult the OWASP logging guidance. Use it to test the proposed threshold, investigation scope and review process rather than to substitute a generic checklist for the facts of a case.

Once evidence is preserved and the specific reason for covertness has passed, there is usually no remaining justification for delay, and each additional week makes the eventual conversation worse.

Before any step they would notice. Discovering an enquiry through a removed access or a cancelled meeting is the worst available introduction.

What to say

That an enquiry is taking place and what it concerns, specifically enough that they can understand it.

Why they are being told now.

What it means practically: their access, their work, what is expected of them.

What happens next and roughly when.

Who they can contact, and that they may be accompanied at any meeting.

And that no conclusion has been reached, which is true at this point and is the sentence they will most need.

What not to say

Details of evidence, which belongs in the interview with proper preparation.

Anything implying a finding.

Reassurance that cannot be kept: this is probably nothing, you have nothing to worry about. It may well be nothing, and saying so and then dismissing them is worse than saying nothing.

And no speculation about outcomes.

Who should be there

The case owner, usually from HR.

Somebody to take a note.

Not the subject's line manager, if the manager raised it or has an interest, which the conflicts note covers.

Not a crowd. Two people is a conversation; four is an event.

The practical arrangements to settle first

Whether they continue working, which the suspension note treats and which should be decided before the conversation rather than during.

What their team is told, which should be as little as possible and agreed in advance.

Whether they have support available, and how to offer it without implying they will need it.

The response to expect

Shock, usually, and sometimes an immediate explanation that resolves the whole matter.

That second possibility is worth planning for: investigators occasionally discover at this meeting that the ordinary explanation they never found is supplied in thirty seconds. Being prepared to hear it, rather than treating it as a prepared story, is part of doing this well.

Afterwards

A written summary of what was said, to them, the same day.

People retain very little of a conversation like this. The letter is what they will read three times that evening, and it should be written accordingly: plain, accurate, and free of anything that reads as an accusation.

Preparing for the answer that ends it

A meaningful share of enquiries are resolved in this conversation, by an explanation nobody found. Going in prepared to hear it, with the authority to check it immediately, is the difference between a case that closes that week and one that runs another month while the explanation is treated as a position to be assessed.

The letter they will read three times

People retain almost nothing of this conversation. The written summary sent the same day is what they actually absorb, and it should be plain, accurate, free of anything that reads as an accusation, and explicit that no conclusion has been reached.

Settling the practical questions first

Whether they keep working, what the team is told, what support exists. Deciding these during the conversation produces improvised answers that the person will hold you to, and they are all answerable in advance.

Told before anything they would notice

Discovering an enquiry through a removed access or a cancelled meeting is the worst available introduction, and it is avoidable by sequencing the conversation before the operational steps rather than after.

For the file: Write down what was said and what they said, including any explanation offered. The explanation given in this first meeting resolves a meaningful share of cases, and it should be checked rather than discounted.