The first 48 hours: acting on a suspicion without ruining the case.

Be careful with the instinct to look

The strongest instinct is to look: open the laptop, read the mailbox, pull the file. Sometimes a first look is defensible and even necessary. The point is to decide, not to drift into it.

Two risks sit behind the instinct. The first is to the evidence itself. Using a live system can alter traces on it, and which traces survive ordinary use depends on the system, its configuration and what exactly is done. That uncertainty is the problem: once a device has been handled, you may spend the rest of the matter arguing about what the handling changed. Where a device or an account is likely to matter, the safer order is to secure it first and examine a preserved copy, so the argument never starts.

The second risk is to your head start. If the suspicion is right, the person concerned does not yet know you are looking, and that advantage is worth protecting. People rarely delete evidence before they feel watched. A password reset nobody requested, a folder that moved, colleagues who change their behaviour: small signals can be enough. Whether you spend the head start now or keep it is a real decision, and in the slow-burning cases it is often the central one.

Keep the circle small, and keep track of it

Involve the fewest people who can carry the next steps, and keep a note of who knows and since when. Partly this is about leakage, which in our experience travels less through malice than through ordinary conversation between colleagues who trust each other. Partly it is about something less comfortable: at this stage you do not yet know the shape of the problem, and suspicions that start one person wide sometimes end wider. The colleague who seems the natural person to consult may be closer to the matter than anyone assumes. Choose the circle by role rather than familiarity: someone who can decide, someone who can secure, and early access to advice.

Preservation usually cannot wait; analysis usually can

Preserving evidence means putting it beyond loss without yet examining it. The reason it belongs at the top of the list is that some material sits on a timer while the rest of the matter does not:

• Log and access data. Retention periods vary widely between systems and companies, and some are short. Finding out what is kept for how long, and stopping deletion for the systems concerned, costs little and is sometimes the difference between a documented timeline and a guess.
• Camera footage. Where recorded movement could matter, check the retention setting now rather than when the footage has become interesting.
• Devices and accounts. A returned laptop that re-enters the pool is typically wiped and reissued in the normal course of business. Setting it aside quietly, unused, keeps the option open. The same logic applies to accounts scheduled for routine deletion.
• Backups. Rotation schedules keep running unless someone pauses them for the systems concerned.
• Paper and physical items. Delivery notes, visitor records, keys, the contents of a desk. Unspectacular, and in our cases regularly decisive.

When in doubt, preserve. Deciding later that something preserved was irrelevant is cheap. The reverse is often not available.

Confrontation is a spend, not a reflex

Confronting the person early feels decisive, and occasionally it is the right call, for instance where an ongoing loss has to stop today. But it spends things that are difficult to recover: the head start, the chance to secure material calmly, and the value of a later interview held on documented facts. An account given before the facts are assembled is one the person is then committed to and you cannot yet test; a conversation held in anger can create problems of its own, particularly with an employee. If immediate action is unavoidable, the narrow version (stopping the payment, restricting an access) usually costs less than the full confrontation, and buys time to take advice.

Write down the question, and what you knew

At some point in the first days, it pays to stop and write two things in plain language. First, what exactly needs to be established, and what will be decided differently once it is. "Find out what is going on in purchasing" is a mood; "establish whether the purchasing lead holds an undisclosed interest in supplier X" is a question evidence can answer, and it marks the boundary of what may proportionately be examined. Second, why you suspect what you suspect, as of today. Once a matter develops, memory tends to reorder itself, and being able to show later what was known at the outset, and that the steps taken were measured against it, supports both the evidence and the company's own position.

Know which doors exist before choosing one

A few questions are cheap to consider early and expensive to discover late. Whether outside counsel should instruct the investigation rather than the company, which can matter where litigation is likely or a senior person is involved. Whether an insurance policy may cover the loss, and whether it carries notification requirements that are already running. Whether the matter is one that will, or should, end up with the authorities, in which case the way evidence is handled now will be judged by their standards later. None of these needs a final answer in the first days. It is enough to know the doors exist and to avoid closing one by accident.

Patterns we keep seeing

Every case is its own case, but some early mistakes recur often enough to list:

• The suspect device is examined in place, with good intentions, and its evidential value is now a matter of argument rather than fact.
• The circle of insiders grows by one trusted colleague at a time until the subject hears about it.
• A same-day confrontation produces a denial, a warned subject, and nothing usable.
• Retention periods quietly expire while the company deliberates.
• Nothing is written down, and months later nobody can reconstruct what was known when, or why a step was taken.