0–2 hoursWrite down what you already know

What was noticed, and by whom. Dates, amounts, account names, invoice numbers, systems involved. Who else is aware. Keep it in a single document you control, off shared drives. A note written before anyone starts investigating carries far more weight than one reconstructed afterwards. Tell as few people as possible — every additional person is a route back to the subject.

0–2 hoursWork out who you are required to tell — before you tell anyone

Two reporting questions arise immediately, and they pull in opposite directions.

Internally — who needs to know, and who must not? Escalation to the board, the audit or risk committee, or the responsible executive is often required by your own policies or constitution, and delay is itself a governance failure. But if the matter may involve someone senior, the reporting line you would normally use may be the wrong one. Decide the escalation path deliberately, and record why you chose it.

Externally — you may have an obligation to report to police, a regulator, or your professional body, and the obligation may carry a deadline you are already inside. Reporting obligations differ by industry, entity type and the nature of the conduct, so establish yours rather than assuming.

Some disclosures carry confidentiality obligations of their own. Where the matter reaches you as a protected whistleblower disclosure, the identity of the discloser is protected and revealing it without consent carries penalties. Police or a regulator may also direct you not to disclose that a report has been made while they assess it. Telling the wrong person that you have reported can be a worse problem than the conduct you reported.

• Speak to a person, not a portal. Where you can, contact the receiving body directly. An online form will not tell you what you are and are not permitted to say internally.
• Ask three things: what they require from you, what you must not disclose and to whom, and how they want evidence preserved.
• Follow their preservation instructions over any internal plan. If police or a regulator direct you on handling, their direction takes precedence over the steps in this sheet.
• Record every instruction you are given — who you spoke to, when, and what they told you.

2–12 hoursPreserve the records. Do not investigate them.

Opening a file changes it. Every document records when it was created, last modified and last opened, and copying, printing or logging in updates those timestamps.

• Devices and accounts — do not wipe, reissue, or log into them
• Financial and system records — take exports and backups, keep the originals intact
• Backups — suspend automatic purge and overwrite schedules immediately
• Physical documents — secure originals, do not annotate or re-file

If devices are likely to matter they need forensic imaging before anyone else touches them. Screenshots are weak evidence — easily disputed, and stripped of the metadata that gives a document weight.

12–24 hoursControl access without raising the alarm

Changes that look like ordinary business are safest: bring forward a review of approval limits; require a second signature above a threshold, applied across a team rather than one person; reassign duties as a normal workload change; confirm who holds administrator access to finance and payroll. Do not suspend or confront yet. Confrontation is a doorway that only opens one way.

24–48 hoursBring in the right people, in the right order

An independent investigator, before the trail goes cold — your own review, however competent, is the first thing an opposing lawyer will attack. An employment lawyer, before any step that affects the person's job. Your insurer, if you hold fidelity or crime cover; notification deadlines are short and late notice alone can decline a claim.

AvoidFive things that destroy a case

1. 1.Logging into the employee's accounts or personal devices
2. 2.Building your own bundle by forwarding and printing
3. 3.Letting IT wipe or reissue a device before it has been imaged
4. 4.Deleting or moving files to “secure” them
5. 5.Confronting on a hunch

ThenScope it, plan it, and record why

• Record decisions, not just evidence. What was decided, by whom, and the reasoning at the time — who would investigate, what was in and out of scope, who was told and who was not, what was preserved and what was deferred. Evidence shows what happened; the decision record shows the process was sound. It is the half that is missing when a matter is reviewed a year later.
• Scope and plan before you start. Define the questions to be answered, the period, the people involved, and what is explicitly excluded. An investigation without a defined scope expands until it collapses under its own weight, and an unbounded process is far harder to defend than a narrow one.
• Case manage it. One named owner, a running chronology, target dates for each stage, and a record of every step taken — including the steps considered and rejected. A matter that drifts becomes a psychosocial hazard in its own right.