Running a case
How to scope an investigation, what counts as a finding, and how to write a decision somebody can check later.
Most alerts have an innocent explanation. A good investigation finds it quickly when it exists and builds a defensible record when it does not. Both halves matter, and the second is the one that is judged years later.
This section covers the craft rather than the controls: what order to establish facts in, which observations are worth recording, how to write a reason that still reads as reasonable to somebody who was not there, and where the threshold for handing a case on actually sits.
In this section
How to run a case
Scoping the question, the order to work in, and how investigations go wrong.
What makes a finding material
Three tests, and why three findings beat thirty observations.
Writing a reason that survives an audit
Writing for the reader who was not there and cannot ask you anything.
When to escalate
Why suspicion is judged objectively, and what is not a reason to escalate.
The analyst’s sequence. The product’s own case lifecycle is drawn on the Investigating hub.
Last checked against the product on .