Preparing findings and recommendations

1. Regulatory Concept & Core Standards

In this video we will consolidate a skill: write a report separating facts, assessment and proposed measures. Use the case to test what you would do in a similar situation. We will explain the proposed response step by step so that you can understand each choice and recognise when more information would be needed. Internal fact-finding requires scope, authority and fair assessment. It does not replace police or court powers. The aim is a reasoned finding within lawful access boundaries and proportionate action.

The report must answer the mandate's questions. Distinguish established facts, unsubstantiated matters and inconclusive issues. Explain method, sources and relevant limitations. An internal finding is not a court conviction. Disciplinary or contractual measures and referrals to authorities require proper authority and their own procedures.

Apply the following rule: Article 13 permits direct external reporting where the internal route is absent, would be ineffective, or the person believes there is a risk of retaliation. Choose the authority by the subject of the breach. KPK is not the sole authority for every matter; it also provides support and statutory protection functions. Public disclosure has separate article 18 conditions. Advice, statistical reporting and reporting a breach are different services.

2. Practical Implementation & Procedure

Organise the report by allegation and identify support for each finding. Avoid adjectives and speculation about intentions. Prepare versions appropriate to recipients while protecting identities. Link recommendations to identified weaknesses and assign owners and implementation checks. Communication to the reporting person follows separate rules and does not automatically require sending the whole report. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

Evidence establishes an unauthorised change but not its author. The team proposes better access controls and logs rather than attributing it to the nearest employee. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Must someone be named to make the report look complete? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. State evidential limits. An honestly qualified conclusion is more useful than unsupported certainty.

One mistake to avoid is: writing vague recommendations such as strengthening controls without an action, owner or verification method.

Now apply the national rule to a second decision. An advice page is listed as the sole recipient of every report. What is missing?

A competence check. Select the authority by the breach and article 13 external-route conditions. KPK has support and other statutory duties but is not the only competent authority. Distinguish advice, reporting and public disclosure.