Chapter 10 — Supervised investigation
Lesson map
Lesson 10 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["10.1 The concern"]
N2["10.2 Evidence"]
N3["10.3 Reporting"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 The concern"]
N2["10.2 Evidence"]
N3["10.3 Reporting"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX046"]
[Learning outcomes]
|
v
[10.1 The concern]
|
v
[10.2 Evidence]
|
v
[10.3 Reporting]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) investigate an identity concern under supervision; (2) preserve evidence; (3) report facts.
10.1 The concern
A partner reports that a client file seems to have been opened by someone in another office. Helen supervises Daniel's investigation, with the managing partner's written approval. The question is narrow: who accessed the file, through which account and group, and was it authorised? Daniel agrees not to draw conclusions about anyone's intentions. A narrow, approved question keeps the investigation proportionate and fair to staff who may have done nothing wrong. Daniel records the question and approval at the top of his notes.
10.2 Evidence
Daniel exports the file share's access log for the file and the directory's sign-in log for the relevant account and day, recording export times. The log shows access by an administrator in the north office, through a group granting client-files access. He saves exports in the evidence folder with notes. He does not open the client file itself. Preserving exactly the evidence needed, with times and methods recorded, lets others check his findings later. Helen checks the exports against his notes before he analyses them.
10.3 Reporting
The administrator's access came through the recorded exception approved earlier for scanning documents. Her manager confirms she scanned the client's posted documents into the folder that day. Daniel reports the facts: who, how, when, and that access matched an approved exception. He recommends that exception holders note scanning tasks in the job log so future questions are answered quickly. Reporting facts without speculation protects staff and gives partners a clear basis for decisions. The managing partner accepts the report and closes the concern.
Worked example
A file access concern is traced to an approved scanning exception; the report states facts and recommends job log notes.
Synthetic case. Events, people and evidence are synthetic.
Errors and limits
Speculating about intentions in an investigation report harms staff and undermines trust.
Exercises
- EX046 — Investigation question. What was the investigation question? Rubric: 3 = who accessed, how, and was it authorised;; 2 = who and how;; 1 = why;; 0 = none.
- EX047 — Approval. Who approved the investigation? Rubric: 3 = managing partner, in writing;; 2 = partner;; 1 = Daniel;; 0 = none.
- EX048 — Evidence sources. What logs were exported? Rubric: 3 = file share access log and directory sign-in log;; 2 = two logs;; 1 = emails;; 0 = none.
- EX049 — Finding. Through what was access granted? Rubric: 3 = approved scanning exception;; 2 = exception;; 1 = attack;; 0 = none.
- EX050 — Recommendation. What was recommended? Rubric: 3 = note scanning tasks in the job log;; 2 = job log;; 1 = remove access;; 0 = none.
Synthesis
Narrow, approved investigations with preserved evidence and factual reporting resolve concerns fairly.
Continue studying — chapter 10 of 12
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →