What to include, and what not to do

A concern is easier to act on when it is specific. You do not need a dossier, but a few minutes of preparation makes a real difference to how quickly and seriously your concern can be handled.

Include the facts you have

• What you saw or heard, described factually and without speculation dressed up as fact
• When it happened: dates, times, or the period involved, as precisely as you can manage
• Who was involved or who else witnessed it
• Where any evidence already exists: documents, emails, system records, CCTV, or records you have legitimate access to
• Whether the problem is ongoing or likely to recur, since urgency changes the response

Stick to what you know and be clear about what is fact and what is suspicion. "I believe" and "I saw" are different statements, and saying which is which increases your credibility rather than reducing it.

Do not investigate it yourself

This is the most important boundary. Your job is to report the concern, not to prove it. Do not interview colleagues, covertly record people, search systems you are not authorised to access, or copy documents you have no right to hold. Amateur investigation can tip off the wrongdoer, contaminate evidence, breach data protection law, and put you in breach of your own contract, all of which makes the real investigation harder and can undermine your own position.

If evidence is available to you in the normal course of your work, note where it is and tell the person handling the concern. Let trained investigators do the rest.

Keep your own record

Keep a brief private note of what you reported, to whom, and when, along with any response you receive. If questions ever arise later about what was raised and when, a contemporaneous note is worth a great deal.