Preserve quietly
Secure relevant email, endpoints, file shares, logs and transaction records before confronting suspects or changing access.
Separate systems
Preserve source systems and create working copies where appropriate. Avoid analysis directly on original evidence.
Build a timeline
Correlate communications, logins, document access, transactions and physical events.
Coordinate roles
Legal, HR, finance, IT and forensic personnel should have defined responsibilities and controlled information sharing.
Report objectively
Distinguish verified facts, technical inference, witness information and unresolved questions.
Important: This is general guidance. Legal authority, privacy, employment law, privilege and evidential requirements should be considered for the specific matter.