Error, negligence, breach of policy, abuse of authority and criminal conduct are not interchangeable concepts. The assessment must start with the act and evidence, not the employee's title.
Questions that shape characterisation
Did the employee make a false representation, use false records, divert property entrusted because of employment, conceal a conflict, or obtain an unlawful benefit? What loss followed, and what evidence connects the person to the act?
Indicators requiring investigation
- A fictitious vendor or altered payment details.
- Transaction splitting to bypass approval limits.
- False documents or concealment of material records.
- A benefit routed to the employee or a connected person.
- Repeated conduct combined with deletion or misleading explanations.
These indicators do not prove an offence. They shape the scope of the internal investigation.
Why authority and entrustment matter
The analysis asks how the employee obtained control of the funds or data, what authority was granted, how it was exceeded and whether the conduct was intended to secure a benefit or cause loss. An employment sanction does not automatically establish criminal liability.
Build an evidence-led file
Create a chronology, preserve originals, trace funds and connect digital identity to actual conduct. Use the first 24 hours protocol, then assess the separate positions of the employee, managers and entity through the liability guide.