The Triangle: Security, HR and Legal

An insider case is simultaneously a security event, an employment matter and a legal exposure. Each function sees a different thing and each is right about the part it sees.

The practical lesson in “The Triangle: Security, HR and Legal” is that visibility is not certainty. For teams researching getting teams to meet deadlines, this practical resource can add time and project context to the operational record, provided the purpose is disclosed, access is limited and every material inference receives human review.

What each brings, and what each gets wrong

Security has the technical capability and the evidence. Its instinct is to establish what happened, thoroughly, and it is comfortable with intrusion. Left alone it over-collects and under-weighs the employment consequences.

For a separate perspective relevant to “The Triangle: Security, HR and Legal”, consult the KrebsOnSecurity analysis. Use it to test the proposed threshold, investigation scope and review process rather than to substitute a generic checklist for the facts of a case.

HR owns the relationship with the subject and the process that affects their employment. Its instinct is procedural fairness and it is usually right about what will survive a tribunal. Left alone it moves slowly and sometimes under-weighs genuine risk.

Legal sees privilege, disclosure, regulatory duties and the shape of a dispute. Its instinct is caution. Left alone it can stall a matter that needed a decision.

None of these instincts is wrong. The failures come from one function running the case as though it were only its kind of matter.

Where the lines should fall

Security: technical collection, within an authorised scope, and analysis of what the records show. Not: deciding to open, deciding the outcome, or conducting the interview alone.

HR: the process affecting the person, the interview, the outcome, and the subject's welfare. Not: directing the technical work or deciding what evidence is sufficient.

Legal: advice on scope, privilege, disclosure and risk; involvement whenever dismissal or external referral becomes plausible. Not: owning the case.

And a single named case owner, which is usually HR for employment matters and security for pure security ones, with the other two in support.

The handover that goes wrong

Security completes a technical investigation and hands HR a conclusion. HR then runs an employment process built on evidence it cannot evaluate and did not scope.

The fix is joint involvement from the opening decision, not a relay. The three should agree the scope and the evidence standard before collection starts, which the next notes set out.

The disagreement that should be welcomed

Security wants to look at more; HR thinks it is disproportionate. That argument, had explicitly and recorded, is the governance working.

Where it never happens, one function is deferring, and the usual pattern is HR deferring to security on technical matters it cannot assess — which is how scope quietly expands.

What to settle in advance

Who owns a case of each type. Who authorises each level of intrusion. When legal must be involved rather than may be. And who speaks to the subject.

One page, agreed when nothing is happening.

The triangle only works if all three are present at the opening decision. A case that starts in one function and arrives at the others later has already made its mistakes.

The case that starts in the wrong function

Security receives an alert, works it for three weeks, and hands HR a conclusion. By then the scope decisions, the evidence standard and the covert period have all been set by a function without an employment mandate, and HR is asked to run a process on foundations it did not choose and cannot assess.

What legal is for, and what it is not

Advice on scope, privilege, disclosure and exposure, and involvement whenever dismissal or external referral becomes plausible. Not ownership, and not a veto on proceeding. A programme where legal decides everything moves at the speed of the most cautious reading, which harms the subject more than anybody.

Agreeing it while nothing is happening

Who owns which case type, who authorises each intrusion level, when legal must be involved, who speaks to the subject. One page, written in a quiet week, and it is the difference between three functions collaborating and three functions improvising.

The disagreement worth having

Security wants broader scope, HR thinks it disproportionate. That argument, conducted explicitly and recorded, is the governance working. Where it never occurs, one function is deferring, and the scope expands by default.