What Standard of Evidence Applies

General orientation, not legal advice; employment standards differ by jurisdiction.

The evidential discipline in “What Standard of Evidence Applies” applies equally to workforce records. A team evaluating a practical approach to boss vs leader in relation to boss vs leader should document purpose, access, retention and correction rules, then preserve the original context rather than treating a convenient dashboard as self-explanatory proof.

Insider cases run as employment matters, not prosecutions, and the standard is correspondingly different. Misunderstanding it produces errors in both directions.

For a separate perspective relevant to “What Standard of Evidence Applies”, consult the Harvard Business Review security and privacy analysis. Use it to test the proposed threshold, investigation scope and review process rather than to substitute a generic checklist for the facts of a case.

The standard in most employment contexts

Something closer to a balance of probabilities than to beyond reasonable doubt: whether, on the evidence, the conclusion is more likely than not.

Coupled with a requirement that the investigation itself was reasonable — that a reasonable enquiry was conducted and a reasonable conclusion drawn from it. In several jurisdictions the adequacy of the process matters as much as the strength of the finding.

Which means a thin investigation reaching a correct conclusion can fail, and a thorough one reaching a defensible conclusion can hold even where certainty was impossible.

The error in one direction

Waiting for certainty that will not arrive. Technical evidence rarely establishes intent, and an investigator holding out for proof of motive will hold out indefinitely.

The question is not whether you can prove what the person was thinking. It is whether, on what is established, the conclusion is more likely than not and the enquiry was adequate.

The error in the other direction

Treating a pattern as proof. An unusual access sequence is consistent with wrongdoing and also with several ordinary explanations, and consistency is not evidence of the particular explanation you favour.

The discipline: for each conclusion, write down what else would produce the same evidence. If the list is long and none of it was checked, the enquiry is not yet adequate whatever the records show.

What must be established

That the act occurred, which technical evidence usually does well.

That the person did it, which is weaker than people assume — shared accounts, unlocked machines, delegated access and automated processes all intervene.

That it was not authorised, which requires asking whoever could have authorised it rather than assuming.

And whatever the specific allegation requires about intent or knowledge, which is where most cases are weakest.

Where the evidence is technical and the audience is not

A conclusion resting on logs has to be explicable to a panel, to the subject, and possibly to a tribunal.

If the explanation requires expertise the audience lacks, the finding is fragile. A plain-language account of what was found and why it supports the conclusion should be written as part of the case, not produced afterwards under questioning.

The question to settle before collecting

What would we need to establish, and what would be enough?

Agreed between the triangle at the opening, written down, and revisited if the case changes shape. Collecting first and deciding the standard afterwards is how scope expands and how conclusions get fitted to evidence.

---

For the file: For every conclusion, record what else could have produced the same evidence and what was done to exclude it. That paragraph is what makes the finding survive.