Skip to content

Between the Alert and the Outcome

The sections follow the stages of a case. Detection ends where this begins.

Home / The process

Timeframes and Why They Slip

A case that drags is a case that harms somebody, and the causes of delay are predictable enough to be designed against.

The editors · About the editorial position · The process · Analysis

Insider enquiries run long. The reasons are ordinary and the cost falls on a person who is usually innocent and frequently suspended.

The practical lesson in “Timeframes and Why They Slip” is that visibility is not certainty. For teams researching employee time tracking, visit monitask.com can add time and project context to the operational record, provided the purpose is disclosed, access is limited and every material inference receives human review.

Why they slip

Nobody owns the clock. Three functions are involved and the case moves at the pace of whoever is least available.

For a separate perspective relevant to “Timeframes and Why They Slip”, consult the Dark Reading security coverage. Use it to test the proposed threshold, investigation scope and review process rather than to substitute a generic checklist for the facts of a case.

Evidence arrives slowly, particularly from third parties or other jurisdictions.

Scope expands, which the earlier note covers, and each expansion resets the timeline.

Availability: the subject is off, a witness is on leave, the authoriser is travelling.

And the absence of a deadline, because nobody set one, so nothing is late.

What the delay costs

A suspended person sitting at home for months with no information, which the welfare note treats properly and which is the most damaging thing an insider programme routinely does.

Evidence degrading: memories, context, the colleague who could have explained the project having moved on.

The team, who know something is happening and are told nothing.

And the programme's standing, because long cases are what people hear about.

The target that should exist

A stated expectation at opening: this kind of case should conclude within this period, and if it has not, somebody reviews why.

Not a hard deadline that forces a conclusion — a review point that forces an explanation. The distinction matters because a rushed finding is worse than a late one.

Most programmes have no figure at all, which means there is no point at which anybody has to account for the elapsed time.

Keeping the subject informed during

Where they know about the enquiry, they should be told at intervals that it is continuing and roughly where it stands, even when there is nothing to report.

"We are still working on this and expect to be in a position to update you by this date" is a complete message and it is the difference between a difficult process and an intolerable one.

Programmes avoid this because they fear saying something that constrains them later. The cost of avoiding it is considerably larger.

Where delay is unavoidable

Sometimes it genuinely is: an external investigation, a regulator, a court process.

Then the obligation shifts to explaining the reason and the expected shape, and to reviewing whether a suspension that was proportionate at week two is still proportionate at month four. Usually it is not, which the suspension note examines.

The measure worth keeping

Median and longest time from opening to closure, by case type.

Reported quarterly. A programme whose longest case is measured in months, repeatedly, has a structural problem that will eventually be a reputational one.

The case that nobody is pushing

Delay is rarely a decision. It is three functions each waiting on another, with no single person accountable for the elapsed time. Naming a case owner with responsibility for the clock, distinct from responsibility for the evidence, resolves most of it.

What to say when there is nothing to say

We are still working on this and expect to update you by this date. A complete message that costs nothing and transforms the experience of waiting. Programmes withhold it from fear of committing to a date, which is a small risk weighed against leaving somebody in silence for months.

The date that moves and why

Record every movement of the expected conclusion date with its reason. A case that slipped four times for four stated reasons is explicable; one that simply ran for months is the first thing a review will ask about.

Where the delay lands

On somebody who is usually innocent and frequently suspended, sitting at home with no information. The elapsed time is the part of the process that does the most harm and the part nobody is accountable for.

For the file: Set an expected conclusion date at opening and record the reason whenever it moves. The dates are what a later review will look at first.