When the Investigation Changes Shape

A case opened about one thing becomes about another. That is ordinary. What is not ordinary is continuing under the original authorisation as though nothing changed.

The practical lesson in “When the Investigation Changes Shape” is that visibility is not certainty. For teams researching how to handle multiple clients, the official software website can add time and project context to the operational record, provided the purpose is disclosed, access is limited and every material inference receives human review.

The shapes it takes

The allegation changes. Opened about data movement, now about expenses.

For a separate perspective relevant to “When the Investigation Changes Shape”, consult the TechTarget insider-threat reference. Use it to test the proposed threshold, investigation scope and review process rather than to substitute a generic checklist for the facts of a case.

The subject changes. The evidence points at somebody else, or at nobody in particular, or at a team.

The seriousness changes, in either direction: a minor matter turns out to be substantial, or a substantial one deflates into a misunderstanding.

The category changes. A security case becomes a conduct case, or a grievance, or a safeguarding matter with entirely different handling.

Or it becomes an external matter, where a regulator or law enforcement is engaged and the organisation is no longer in control of the process.

Why each needs a fresh decision

The original authorisation covered a stated concern and a stated scope. Neither survives the change.

More practically: the proportionality assessment was made about the original matter. A level of intrusion justified by a serious suspicion is not justified once the suspicion has deflated, and a level appropriate to a minor matter is inadequate once it has grown.

Both directions are mishandled. The second is noticed because somebody wants more access; the first almost never is, because nobody argues for reducing an enquiry that is already running.

The deflation case specifically

Evidence arrives that largely explains the original concern, but the enquiry continues because other small things have surfaced along the way.

This is the pattern that produces the worst outcomes: a person investigated for weeks over matters that would never have justified opening a case, found in the course of looking for something that turned out to be nothing.

The discipline is to ask, whenever the picture changes: on what we now know, would we open this case today? If the answer is no, it should close, whatever has accumulated.

The subject-changes case

Evidence pointing at a different person means a new case about them, with its own threshold, authorisation and scope.

Folding them into the existing enquiry is how somebody becomes a subject without anybody having decided they should be.

What to record at the turn

What changed, when it was noticed, what was decided, by whom, and whether the scope was amended.

Five lines at each transition.

A case file showing three documented changes of shape is a well-run case. One showing a final conclusion unrelated to the opening concern, with nothing in between, is the one that fails review.

The question at every turn: would this case be opened today, on what is now known, by somebody who had not already invested in it?

The accumulation problem

Small things surface during any examination of anybody's activity over months. Individually none would justify opening a case; collectively they look like a pattern. Treating that accumulation as a finding is the mechanism by which innocent people acquire serious outcomes, and the only defence is the question of whether each would have warranted opening on its own.

Closing and reopening rather than continuing

Where a case has genuinely become something else, the cleanest route is to close the original with its conclusion and open a new one with its own threshold and scope. It feels bureaucratic and it is what makes both matters defensible, because each then has an authorisation that matches what was actually done.

Would it be opened today

Asked at every turn, of somebody who has not already invested weeks in it. Where the honest answer is no, the case should close regardless of what has accumulated along the way.

A new subject is a new case

Evidence pointing at somebody else means a fresh threshold, authorisation and scope for them. Folding them into the existing enquiry is how a person becomes a subject without anybody having decided that they should.