1. Describe the concern without deciding the outcome
Write down exactly what triggered the concern: the alert, account, document, message or observation, together with its source and time. “An account downloaded a client folder” is a testable starting point. “The employee stole our clients” adds conclusions about identity, intent and use that may not yet be established.
Identify the information potentially involved and why it matters. A customer database, bid submission, source-code repository and pricing spreadsheet create different business exposures. Ask the information owner to explain normal access and approved sharing. A large download may be routine for one role and unusual for another.
Keep alternative explanations visible. Authorised work, synchronisation, a compromised account, accidental sharing and deliberate removal may produce overlapping signals. Record what evidence would distinguish them. The investigation should be capable of clearing an initial suspicion as well as substantiating it.
2. Put a small, accountable team in charge
Assign one investigation lead and named contacts for security or IT, HR, the affected business area and legal advice. NIST includes HR in incidents involving suspected intentional employee activity and emphasises defined response authority. Agree who can restrict access, approve collection and communicate with the person concerned. [1]
Limit discussion to people with a role in the response. Avoid circulating accusations in management chats or asking colleagues to investigate independently. Keep a central record of decisions and evidence requests, with a time for the next update.
If the concern involves a senior decision-maker, route oversight to an appropriate independent authority within the organisation. The subject of an allegation should not control the investigation into it. An external specialist may help where the internal team lacks capacity, relevant experience or sufficient independence.
3. Confirm the boundaries before examining personal information
Have legal and privacy advisers establish the permitted scope for the relevant jurisdiction, workplace policies and systems. Clarify the accounts, devices, dates and categories of information that may be examined. A company-issued device can contain personal information; an employment relationship is not unrestricted authority to investigate private life.
The UK ICO’s worker-monitoring guidance requires a defined purpose and consideration of less intrusive methods. It is UK-specific guidance, not a universal permission rule. For a cross-border business, local advisers should determine the applicable requirements, including notices, worker consultation and any restrictions on transferring material. [2]
Do not ask staff to obtain private passwords, enter personal accounts or install monitoring software as an improvised response. If potentially relevant material is outside the authorised scope, document the gap and ask counsel how it may properly be addressed.
4. Control ongoing exposure and preserve a usable record
If information is still leaving the business, authorised administrators should assess proportionate containment: restricting a sharing link, suspending an affected session or limiting access to a specific repository. Record the reason, approver and time. Consider operational dependencies before disabling an account that also supports a critical service.
Ask the investigation lead to identify evidence that may disappear through routine retention or account offboarding. Coordinate preservation before a returned laptop is reassigned, an account is deleted or a device is wiped. Urgent containment should proceed where needed; document changes that affect the evidence.
Keep collected originals and their handling records in a restricted evidence repository. NIST’s preservation guidance addresses source documentation, integrity checks and controlled storage. An exported spreadsheet should retain its original source and collection context rather than becoming an unexplained attachment passed between managers. [3]
5. Establish what the recorded activity actually means
Ask the examiner to separate access, download, transfer and subsequent use. These are different questions. Microsoft’s audit documentation, for example, distinguishes a SharePoint file download from other operations such as modification and sharing. The event name and service context matter when interpreting a log entry. [4]
A download record alone does not establish that the file reached a competitor. Equally, finding no transfer event in one system does not establish that no transfer occurred. Examine the coverage and limits of the available records before drawing either conclusion.
Where authorised and available, compare relevant cloud records, endpoint activity, email evidence and the employee’s business responsibilities. Build a timeline that can accommodate conflicting evidence. Ask the analyst to identify which account performed an action, what links it to a person and what alternative explanations remain.
Keep interviews coordinated with HR and counsel. A technical timeline can inform questions, but it should not become a script that assumes the answer. Record explanations accurately and check them against the evidence.
6. Translate findings into business decisions
The business needs more than a count of downloaded files. Establish which information was involved, whether external access remains possible, which customers or projects may be affected and which facts are still uncertain. Prioritise protection around the actual material rather than treating every file as equally sensitive.
Give legal advisers the evidence needed to assess reporting, contractual, employment and potential enforcement decisions. Those decisions depend on the facts and applicable requirements; a generic checklist cannot decide them. Keep technical findings distinct from legal conclusions and disciplinary outcomes.
Choose practical follow-up actions with owners: remove an unnecessary sharing route, review permissions for a sensitive repository, clarify approved export practices or improve offboarding. Close the investigation with a reasoned outcome, including an unsubstantiated concern where that is what the evidence supports.
A checklist for the first investigation meeting
Use the first meeting to agree a bounded plan and the next decision point. The useful output is a shared understanding of the concern, immediate protection and evidence needed—not a premature verdict.
- Record the original concern and separate observations from assumptions.
- Name the lead, decision-makers and confidential communication channel.
- Identify the sensitive information and any continuing exposure.
- Confirm authorised systems, people, dates and collection limits.
- Preserve relevant records before routine deletion or offboarding.
- Assign questions that could confirm or challenge the suspicion.
- Set the next update, with owners for unresolved evidence requests.
