Preparing findings and recommendations

1. Regulatory Concept & Core Standards

In this video we will consolidate a skill: write a report separating facts, assessment and proposed measures. Use the case to test what you would do in a similar situation. We will explain the proposed response step by step so that you can understand each choice and recognise when more information would be needed. An internal investigation seeks to establish facts methodically while respecting the rights involved. It does not replace the authorities or grant police powers to the team. These organisational techniques are good practice and must be adapted to applicable employment, disciplinary, criminal and data protection rules.

The report must answer the mandate's questions. Distinguish established facts, unsubstantiated matters and inconclusive issues. Explain method, sources and relevant limitations. An internal finding is not a court conviction. Disciplinary or contractual measures and referrals to authorities require proper authority and their own procedures.

Apply the following rule: The Whistleblower Protection Office provides advice, receives reports and exercises protection powers. Competent bodies deal with criminal and administrative matters; a prosecutor or administrative authority grants formal protection for a qualified report under sections 3–6. Advice services, internal platforms and competent authorities are not interchangeable. Public disclosure has separate section 2 conditions.

2. Practical Implementation & Procedure

Organise the report by allegation and identify support for each finding. Avoid adjectives and speculation about intentions. Prepare versions appropriate to recipients while protecting identities. Link recommendations to identified weaknesses and assign owners and implementation checks. Communication to the reporting person follows separate rules and does not automatically require sending the whole report. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

The report establishes an unauthorised change but does not identify who ordered it. It recommends stronger logs and approvals while stating that individual responsibility remains inconclusive. Management can improve controls without filling that gap with an unproven accusation. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: How should the report address a proven weakness where responsibility remains unclear? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

Describe the weakness, supporting material and limitation concerning responsibility. Appropriate preventive measures can be recommended. Do not assign individual responsibility for convenience or to produce an apparently complete finding.

One mistake to avoid is: writing vague recommendations such as strengthening controls without an action, owner or verification method.

Now apply the national rule to a second decision. An advice webpage is listed as the only recipient of all reports. What is missing?

A competence check. The Whistleblower Protection Office, prosecutor and relevant administrative authority have different roles. Use the current designated route and distinguish reporting, protection applications and advice. Public disclosure requires a separate assessment of statutory conditions.