Investigating a report well

The stage in between, and why it gets skipped over

Most guidance on running a case well talks about the two visible endpoints — acknowledging that a report arrived, and giving feedback once it's resolved — and skips the part in between, which is where the actual work happens. The Directive calls this "follow-up": Art. 5(12) defines it as "any action taken by the recipient of a report... to assess the accuracy of the allegations made in the report and, where relevant, to address the breach reported, including through actions such as an internal enquiry, an investigation, prosecution, an action for recovery of funds, or the closure of the procedure." Art. 9(1)(d) requires that follow-up to be diligent — not just eventual. A channel that acknowledges fast and gives good feedback but investigates poorly, or not at all, in between has only got the two most visible parts right.

What diligent actually rules out

"Diligent" doesn't mean fast at all costs — it means proportionate, genuinely engaged, and not performative. A few patterns that fall short of it even when they technically happen:

• An investigation that's really just waiting for the 3-month clock. Diligent follow-up is active work — reviewing what was reported, gathering what evidence is reasonably available, and forming a view — not letting time pass until feedback is due.
• An investigation with no clear owner. See designating who handles reports — if nobody is actually accountable for moving a case forward, "in progress" can mean "untouched" for weeks without it being visible to anyone.
• Treating "we couldn't reach a conclusion" as an excuse not to investigate properly. Some reports genuinely can't be fully substantiated — that's a legitimate outcome (see writing Art. 5(13)-compliant feedback for why a clearly reasoned negative outcome still counts as feedback) — but it has to follow a real attempt, not stand in for skipping one.

Gathering evidence without tipping off the wrong people

An investigation that alerts the person being reported on before there's a reason to involve them can taint the evidence, prompt exactly the kind of detriment the Directive is trying to prevent (see what counts as retaliation), or simply give them the chance to interfere. Good practice, whatever channel you're running:

• Keep the circle small for as long as the investigation reasonably allows. The same deliberately narrow group discussed in designating who handles reports applies to who's read into a specific case during the investigation, not just who has general access to the channel.
• Be deliberate about when the person concerned is told, not just whether. They do have a right to be heard eventually — see protecting the person being reported on for what that actually requires — but the timing of that conversation is itself part of running the investigation well, not something to trigger by default the moment a report lands.
• Document as you go, not from memory afterward. A record built during the investigation — who was contacted, what was reviewed, when — is both better evidence if the finding is ever challenged and the raw material good feedback is written from. See audit logging: keeping a defensible record for what that record actually needs to contain.

Staying impartial through the middle of a case, not just at the start

Impartiality (Art. 9(1)(c)) is usually discussed as a hiring or designation question — who gets appointed as a handler — but it's just as much a discipline that has to hold up through the actual investigation. Reaching a preliminary view early and then only looking for evidence that confirms it is a common, human failure mode, not a deliberate one. Reviewing evidence that cuts against an early impression, and being willing to change course on the strength of it, is what impartiality actually looks like in the middle of a case rather than just at its designation.

How Provoxis fits into this

Provoxis doesn't run the investigation for you — gathering evidence, deciding who to talk to, and forming a view is inherently a human, organisational judgment, whatever tooling sits underneath it. What the platform does is give an investigation somewhere to actually happen accountably: internal notes attached to a case that stay separate from what the reporter sees, a secure channel back to the reporter for the clarifying questions a diligent investigation often needs, and an audit trail of what was done and when, so the diligence behind a finding is something you can actually point to later, not just assert.

Legal basis

• Art. 5(12), Directive (EU) 2019/1937 — the definition of "follow-up."
• Art. 9(1)(d) — the requirement for follow-up to be diligent.
• Art. 9(1)(c) — the requirement for the designated person or department to be impartial.