B.E.H.A.V.E.

Focus on missing entries, defensive replies, unexplained reassignment and inconsistent service notes. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure complaint register, call recordings, email trail, case management logs and officer allocation records. Place each item in its policy, location, system and role context before assigning weight.

Test possible workload pressure, avoidance of accountability, recordkeeping error or deliberate concealment. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess loss of trust, delayed service, procedural unfairness and risk of repeated complaint suppression. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on after-hours travel, route deviation, weak explanations and repeated fuel claims. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure GPS logs, fuel receipts, duty roster, assignment orders and supervisor approvals. Place each item in its policy, location, system and role context before assigning weight.

Test possible personal use, emergency work need, poor scheduling discipline or concealment. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess public resource misuse, safety exposure, financial loss and reputational damage. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on coded language, unusual private contact, urgency and unexplained processing movement. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure application records, messages, visitor logs, call records, payment traces and witness accounts. Place each item in its policy, location, system and role context before assigning weight.

Test possible corrupt benefit, misunderstanding, third-party manipulation or pressure to meet targets. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess unfair licensing outcome, corruption risk and loss of public confidence. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on unusual access, forwarding behaviour, delayed reporting and deletion attempts. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure document permissions, download logs, device records, chat copies and access list. Place each item in its policy, location, system and role context before assigning weight.

Test possible political advantage, personal grievance, negligence or poor access control. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess privacy breach, policy disruption, public trust damage and risk to affected persons. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on score changes, unusual pressure, private meetings and undocumented justification. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure tender documents, scoring sheets, meeting notes, emails and conflict declarations. Place each item in its policy, location, system and role context before assigning weight.

Test possible favouritism, external pressure, relationship conflict or genuine scoring correction. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess financial loss, unfair competition, legal challenge and governance damage. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on intimidating language, selective enforcement, body-worn camera gaps and complaint avoidance. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure inspection notes, body camera footage, witness accounts, prior inspection history and policy. Place each item in its policy, location, system and role context before assigning weight.

Test possible control, anger, bias, quota pressure or lawful enforcement misunderstood. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess harm to citizen rights, fear, public distrust and escalation risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on public humiliation, repeated comments, avoidance by resident and witness discomfort. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure CCTV audio where available, queue records, witness accounts, complaint notes and service policy. Place each item in its policy, location, system and role context before assigning weight.

Test possible bias, frustration, poor training or deliberate humiliation. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess emotional harm, reduced access to services and discrimination concern. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on metadata changes, inconsistent signatures, sudden file activity and defensive explanations. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure document metadata, audit notice timing, approval workflow, email trail and system logs. Place each item in its policy, location, system and role context before assigning weight.

Test possible concealment, panic correction, administrative backlog or instruction from a superior. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess false official record, audit failure, unfair decision-making and legal exposure. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on relationship indicators, unusually positive assessment, rushed approval and missing declaration. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure grant scoring, conflict forms, relationship evidence, emails and panel minutes. Place each item in its policy, location, system and role context before assigning weight.

Test possible loyalty, personal benefit, oversight failure or perceived conflict. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess unfair funding, reputational damage and challenge by unsuccessful applicants. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on sudden treatment change, isolation, adverse scheduling and witness pressure. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure duty rosters, meeting invites, messages, manager instructions and whistleblower policy. Place each item in its policy, location, system and role context before assigning weight.

Test possible retaliation, self-protection, operational need or team conflict. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess chilling effect, emotional harm, witness fear and integrity risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on public criticism, repeated targeting, after-hours pressure and staff avoidance. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure meeting records, chat messages, calendars, HR history and witness accounts. Place each item in its policy, location, system and role context before assigning weight.

Test possible control, performance pressure, retaliation or poor leadership style. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess psychological harm, turnover, reduced reporting and productivity loss. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on patterned overclaims, duplicate receipts, vague explanations and approval bypass. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure expense forms, receipts, GPS or travel records, calendars and approval chain. Place each item in its policy, location, system and role context before assigning weight.

Test possible personal benefit, misunderstanding of policy, pressure or deliberate fraud. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess financial loss, control weakness and unfair burden on other staff. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on vendor preference, suppressed alternatives, urgency and non-disclosure. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure purchase orders, quote records, emails, conflict declarations and vendor ownership records. Place each item in its policy, location, system and role context before assigning weight.

Test possible loyalty, kickback, convenience, concealment or genuine quality preference. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess financial loss, unfair competition and reputational damage. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on unapproved transfer, delayed reporting, file renaming and personal device use. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure access logs, cloud records, device inventory, DLP alerts and data handling policy. Place each item in its policy, location, system and role context before assigning weight.

Test possible convenience, negligence, competitive intent or concealment. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess privacy harm, regulatory exposure, client trust loss and onward sharing risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on avoidance, altered shift notes, witness silence and supervisor minimisation. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure CCTV, incident register, overtime roster, safety inspection records and witness statements. Place each item in its policy, location, system and role context before assigning weight.

Test possible fear of blame, productivity pressure, negligence or deliberate concealment. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess worker injury risk, repeated unsafe practice and regulatory exposure. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on script deviation, pressure selling, complaint repetition and incentive focus. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure call recordings, sales scripts, contracts, commission records and complaint logs. Place each item in its policy, location, system and role context before assigning weight.

Test possible commission pressure, poor training, deliberate misrepresentation or product confusion. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess financial harm, contract disputes and brand damage. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on unwanted attention, boundary crossing, alcohol context and post-event messages. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure venue CCTV, attendance list, transport logs, messages and witness accounts. Place each item in its policy, location, system and role context before assigning weight.

Test possible sexual intent, intoxication, power misuse or misunderstanding. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess psychological harm, fear of retaliation and workplace safety concern. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on manual edits, inconsistent activity, repeated approvals and vague task notes. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure time sheets, VPN logs, project records, manager approvals and device activity. Place each item in its policy, location, system and role context before assigning weight.

Test possible workload concealment, second employment, admin error or manager pressure. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess payroll loss, unfair workload and trust damage. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on unusual file access, external messaging, secrecy and possible deletion. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure email logs, access history, device records, external relationship evidence and market timeline. Place each item in its policy, location, system and role context before assigning weight.

Test possible personal benefit, loyalty, negligence or intentional leak. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess financial, legal, reputational and regulatory risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on sudden negative treatment, isolation, witness pressure and changed appraisal language. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure performance records, emails, witness accounts, complaint timeline and HR notes. Place each item in its policy, location, system and role context before assigning weight.

Test possible retaliation, defensive management, legitimate performance issue or team conflict. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess fear, silence, unfair appraisal and legal exposure. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on repetition, group targeting, laughter, isolation and victim avoidance. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure teacher notes, student accounts, seating plans, CCTV corridors and prior reports. Place each item in its policy, location, system and role context before assigning weight.

Test possible dominance, peer approval, retaliation or social exclusion. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess emotional harm, school avoidance and escalation risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on digital ridicule, coordination, deletion attempts and offline continuation. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure screenshots, full chat export, timestamps, participant list and school digital policy. Place each item in its policy, location, system and role context before assigning weight.

Test possible humiliation, revenge, entertainment or peer pressure. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess anxiety, reputational harm, wider sharing and self-harm risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on boundary crossing, secrecy, grooming indicators and unequal power. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure messages, call logs, timetable, witness information and safeguarding policy. Place each item in its policy, location, system and role context before assigning weight.

Test possible grooming, poor judgement, emotional dependency or misunderstood support. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess student safety risk, trust damage and safeguarding escalation. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on unusual confidence, clustered answers, access timing and secrecy. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure print logs, file permissions, student messages, seating patterns and staff access records. Place each item in its policy, location, system and role context before assigning weight.

Test possible cheating, staff leak, peer sharing or accidental exposure. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess unfair results, academic harm and institutional credibility damage. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on withdrawal, distress posts, avoidance and peer cruelty. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure pastoral notes, online posts, witness accounts, incident history and parent contact records. Place each item in its policy, location, system and role context before assigning weight.

Test possible bullying impact, social exclusion, retaliation or unrelated mental health crisis. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess immediate safety risk, emotional harm and safeguarding duty. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on public confrontation, intimidation, repeated messaging and staff fear. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure CCTV, visitor logs, messages, staff accounts and campus safety policy. Place each item in its policy, location, system and role context before assigning weight.

Test possible anger, perceived injustice, intimidation or misunderstanding. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess staff safety risk, student distress and school disruption. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on missing report, delay, unclear handover and repeated welfare signs. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure emails, safeguarding logs, staff statements, attendance records and student welfare notes. Place each item in its policy, location, system and role context before assigning weight.

Test possible administrative failure, avoidance, fear of escalation or poor training. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess continued harm, legal exposure and loss of trust. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on patterned discipline, inconsistent explanations, complaint clustering and staff defensiveness. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure discipline data, incident reports, student demographics, policy and appeal outcomes. Place each item in its policy, location, system and role context before assigning weight.

Test possible bias, inconsistent policy use, contextual difference or data error. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess unfair treatment, community distrust and student harm. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on unapproved posting, identifiable students, delayed removal and casual justification. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure social media capture, consent forms, event records, staff device and policy. Place each item in its policy, location, system and role context before assigning weight.

Test possible poor judgement, attention seeking, convenience or policy misunderstanding. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess privacy harm, parent distrust and safeguarding risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on group influence, bragging, silence and possible scapegoating. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure CCTV corridor footage, repair records, student messages and witness accounts. Place each item in its policy, location, system and role context before assigning weight.

Test possible peer pressure, retaliation, thrill seeking or false accusation. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess property loss, group escalation and unfair blame risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on fear response, avoidance, unexplained marks and caregiver defensiveness. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure care notes, roster, medical assessment, CCTV where available and family reports. Place each item in its policy, location, system and role context before assigning weight.

Test possible rough handling, workload stress, neglect or accidental injury. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess patient harm, dignity loss and immediate safety risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on chart inconsistency, late correction, staff silence and defensive handover. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure medication chart, eMAR logs, stock records, handover notes and vital signs. Place each item in its policy, location, system and role context before assigning weight.

Test possible concealment, fatigue, workload pressure or documentation error. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess patient deterioration, treatment delay and regulatory risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on care-plan mismatch, repeated condition signs, weak escalation and staff minimisation. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure fluid charts, care rounds, staffing levels, family reports and clinical notes. Place each item in its policy, location, system and role context before assigning weight.

Test possible neglect, understaffing, documentation falsification or poor supervision. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess serious harm, dignity impact and repeated neglect risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on curiosity access, no care role, repeated viewing and weak explanation. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure EHR logs, shift allocation, patient care team records and privacy training history. Place each item in its policy, location, system and role context before assigning weight.

Test possible curiosity, gossip, benefit, accidental search or poor access discipline. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess privacy harm, public trust loss and regulatory exposure. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on harsh language, patient distress, repeated accounts and staff denial. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure patient statements, witness accounts, care schedule, complaints history and policy. Place each item in its policy, location, system and role context before assigning weight.

Test possible frustration, burnout, control, bias or misunderstanding. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess emotional harm, fear of care and dignity breach. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on rule avoidance, repeated shortcuts, peer concern and possible fatigue. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure CCTV, ward audits, PPE stock records, outbreak timeline and supervisor notes. Place each item in its policy, location, system and role context before assigning weight.

Test possible complacency, workload pressure, resistance or poor training. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess patient infection risk, staff exposure and outbreak expansion. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on stock discrepancy, record alteration, unusual access and staff anxiety. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure drug register, access logs, CCTV, disposal records and roster. Place each item in its policy, location, system and role context before assigning weight.

Test possible diversion, counting error, documentation failure or theft. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess patient pain risk, substance misuse risk and legal exposure. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on confusion, rushed explanation, family concern and documentation gaps. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure consent form, clinical notes, interpreter records, appointment timeline and staff account. Place each item in its policy, location, system and role context before assigning weight.

Test possible poor communication, time pressure, language barrier or negligence. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess autonomy harm, complaint escalation and legal risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on aggression, intimidation, obstruction and escalating language. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure CCTV, security logs, triage notes, witness accounts and visitor records. Place each item in its policy, location, system and role context before assigning weight.

Test possible fear, frustration, intoxication, coercion or deliberate intimidation. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess staff harm, patient care disruption and wider violence risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on missing safety plan, rushed discharge, incomplete handover and repeated warning signs. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure discharge notes, risk assessment, family contact, referral records and clinical timeline. Place each item in its policy, location, system and role context before assigning weight.

Test possible workload pressure, assessment gap, miscommunication or negligence. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess serious patient harm, family distress and system risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on escalation, control, intimidation, isolation and fear behaviour. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure victim account, photos, messages, prior calls, witness reports and risk assessment. Place each item in its policy, location, system and role context before assigning weight.

Test possible coercive control, jealousy, retaliation or substance-linked violence. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess serious harm risk, repeat victimisation and child exposure. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on repeated presence, unwanted contact, online monitoring and fear response. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure CCTV, messages, location evidence, witness accounts and device security logs. Place each item in its policy, location, system and role context before assigning weight.

Test possible obsession, control, intimidation or accidental overlap. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess fear, restricted movement and risk of escalation. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on injury, group movement, intoxication, retaliation talk and inconsistent accounts. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure CCTV, medical records, security logs, phone videos and witness statements. Place each item in its policy, location, system and role context before assigning weight.

Test possible provocation, self-defence, group loyalty or revenge. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess physical harm, retaliation and public safety risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on access opportunity, inconsistent account, financial pressure and avoidance. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure CCTV, entry records, messages, cash location, witness accounts and banking activity. Place each item in its policy, location, system and role context before assigning weight.

Test possible theft, misunderstanding, debt pressure or false suspicion. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess financial loss, relationship harm and further targeting risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on threatening contact, secrecy, fear, withdrawal and possible third-party pressure. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure messages, call logs, witness account, suspect connections and timing. Place each item in its policy, location, system and role context before assigning weight.

Test possible intimidation, retaliation, panic or unrelated conflict. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess case integrity risk, witness harm and continued offending. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on surveillance, unusual questions, route testing and repeated timing. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure CCTV, staff observations, access points, prior incidents and local intelligence. Place each item in its policy, location, system and role context before assigning weight.

Test possible robbery planning, curiosity, delivery confusion or legitimate site visit. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess staff safety risk, financial loss and violent escalation. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on distress, memory gaps, delayed disclosure and possible intoxication. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure victim account, medical options, messages, location data, witnesses and toxicology considerations. Place each item in its policy, location, system and role context before assigning weight.

Test possible sexual offending, incapacity, coercion or disputed consent context. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess trauma, safety needs and evidence loss risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on pre-fire presence, dispute timing, accelerant signs and rapid exit. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure fire report, CCTV, access records, witness accounts and prior threats. Place each item in its policy, location, system and role context before assigning weight.

Test possible revenge, insurance motive, accident or careless conduct. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess danger to life, property loss and repeat fire risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on grooming, fear, unexplained items, secrecy and school absence. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure messages, travel patterns, school records, family account and peer links. Place each item in its policy, location, system and role context before assigning weight.

Test possible exploitation, coercion, status seeking or debt pressure. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess youth harm, criminal exploitation and retaliation risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on sudden disappearance, control history, phone silence and financial changes. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure phone records, bank use, CCTV, messages, prior domestic reports and family account. Place each item in its policy, location, system and role context before assigning weight.

Test possible coercion, voluntary absence, fear, mental health crisis or crime. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess serious harm, isolation and evidence loss risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on suspicious login, forwarding rule, rapid access and possible embarrassment delay. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure email headers, sign-in logs, forwarding rules, MFA records and user report. Place each item in its policy, location, system and role context before assigning weight.

Test possible phishing victimisation, negligence, account takeover or insider collusion. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess data exposure, fraud and lateral compromise risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on urgent payment request, subtle email change, invoice pressure and trust exploitation. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure email headers, payment records, supplier confirmation, domain data and approval workflow. Place each item in its policy, location, system and role context before assigning weight.

Test possible external fraud, internal collusion, process weakness or compromised supplier account. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess financial loss, supplier dispute and repeat attack risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on privileged login, off-hours access, tool execution and possible log clearing. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure EDR alerts, VPN logs, admin actions, backups, change tickets and account history. Place each item in its policy, location, system and role context before assigning weight.

Test possible compromised account, insider aid, weak credentials or external intrusion. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess operational outage, data theft and public reporting obligations. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on identity misuse, customer targeting, link sharing and account confusion. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure fake profile captures, platform data, customer messages, domain registration and staff account security. Place each item in its policy, location, system and role context before assigning weight.

Test possible external scam, disgruntled insider, credential compromise or prank. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess customer fraud risk, brand damage and privacy concern. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on bulk download, folder browsing, resignation timing and external storage use. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure cloud audit logs, device records, employment timeline, file sensitivity and exit process. Place each item in its policy, location, system and role context before assigning weight.

Test possible IP theft, legitimate handover, panic copying or poor offboarding. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess commercial loss, privacy breach and legal exposure. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on coercive threats, urgent payment demand, fear and repeated contact. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure messages, payment details, account handles, image metadata and platform reports. Place each item in its policy, location, system and role context before assigning weight.

Test possible extortion, grooming, account compromise or organised scam. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess severe emotional harm, privacy harm and self-harm risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on unsafe device use, delayed reporting, endpoint alert and curiosity behaviour. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure EDR logs, USB serial data, CCTV, user account activity and policy training. Place each item in its policy, location, system and role context before assigning weight.

Test possible curiosity, negligence, planted device or targeted attack. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess system compromise, data loss and lateral movement risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on unusual account creation, leave mismatch, privilege use and possible shared password. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure IAM logs, leave records, MFA logs, admin workstation data and change tickets. Place each item in its policy, location, system and role context before assigning weight.

Test possible credential sharing, compromise, insider misuse or emergency access. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess privilege abuse, system integrity risk and audit failure. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on secrecy, gifts, isolation, migration of platform and age manipulation. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure chat logs, game account data, device records, payment items and guardian report. Place each item in its policy, location, system and role context before assigning weight.

Test possible grooming, exploitation, peer prank or mistaken identity. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess child safety risk, coercion and evidence loss. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on digital humiliation, rapid sharing, denial, deletion and group silence. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure original files, chat exports, metadata, device records and witness accounts. Place each item in its policy, location, system and role context before assigning weight.

Test possible harassment, retaliation, sexual humiliation, prank or third-party creation. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess privacy harm, reputational damage and psychological impact. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on bank-change request, urgency, similar invoice format and approval pressure. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure invoice metadata, supplier confirmation, email headers, payment records and approval workflow. Place each item in its policy, location, system and role context before assigning weight.

Test possible external fraud, insider collusion, compromised mailbox or process failure. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess financial loss, supplier dispute and repeat fraud risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on document inconsistency, changing explanations, unusual broker pressure and missing verification. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure payslips, employer confirmation, bank statements, broker records and application timeline. Place each item in its policy, location, system and role context before assigning weight.

Test possible fraud, broker coaching, misunderstanding or document error. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess credit loss, regulatory breach and unfair approval. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on phantom record, repeated approval, linked address and weak onboarding file. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure HR records, payroll history, bank details, access card data and manager approvals. Place each item in its policy, location, system and role context before assigning weight.

Test possible payroll fraud, onboarding error, identity misuse or collusion. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess financial loss, tax issues and control failure. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on layered transactions, inconsistent story, third-party deposits and avoidance of detail. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure KYC file, transaction history, source-of-funds records, communications and sanctions checks. Place each item in its policy, location, system and role context before assigning weight.

Test possible laundering, tax avoidance, business cash flow or third-party control. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess regulatory penalty, criminal exposure and institution risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on personal items, delayed receipts, repeated coding changes and vague client names. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure card statements, receipts, calendar, client records and approval notes. Place each item in its policy, location, system and role context before assigning weight.

Test possible personal benefit, poor policy knowledge, pressure or deliberate concealment. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess financial loss, control weakness and fairness concern. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on inflated value, inconsistent ownership history, urgency and missing original receipts. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure claim form, purchase records, photos, police report, repair history and interview notes. Place each item in its policy, location, system and role context before assigning weight.

Test possible exaggeration, misunderstanding value, broker influence or deliberate fraud. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess financial loss, premium impact and unfair claim settlement. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on unrealistic promises, off-platform communication, pressure and secrecy. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure customer messages, account statements, adviser records, marketing materials and commission trail. Place each item in its policy, location, system and role context before assigning weight.

Test possible fraud, unauthorised product sale, poor advice or misunderstanding. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess financial harm, vulnerable customer impact and regulatory exposure. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on repeated shortage, weak counting process, nervous behaviour and delayed reporting. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure cash logs, CCTV, till records, supervisor checks and roster. Place each item in its policy, location, system and role context before assigning weight.

Test possible theft, counting error, training gap or supervisor failure. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess financial loss, staff suspicion and control weakness. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on inflated pricing, repeated approvals, relationship concealment and unusual payments. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure invoices, vendor ownership, bank records where lawful, approvals and emails. Place each item in its policy, location, system and role context before assigning weight.

Test possible kickback, conflict of interest, poor price checking or collusion. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess financial loss, corruption exposure and reputational damage. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on unusual withdrawals, third-party presence, confusion and fear of displeasing caregiver. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure bank records, branch CCTV, staff observations, account mandate and family contact. Place each item in its policy, location, system and role context before assigning weight.

Test possible coercion, undue influence, legitimate support or scam pressure. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess loss of savings, dependency abuse and ongoing exploitation. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on route avoidance, night movement, lookout behaviour, coached answers and vehicle coordination. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure border camera footage, patrol notes, footprints, vehicle records, phone data and interpreter-supported interviews. Place each item in its policy, location, system and role context before assigning weight.

Test possible smuggling facilitation, asylum fear, labour exploitation, family reunification pressure or organised routing. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess exposure to injury, exploitation, evidence loss, cross-border crime and humanitarian risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on document handling anxiety, rehearsed travel story, inconsistent route details and avoidance of secondary questions. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure passport scan, UV inspection, airline records, visa history, CCTV and interview notes. Place each item in its policy, location, system and role context before assigning weight.

Test possible identity fraud, trafficking facilitation, fear-based travel, stolen document use or courier instruction. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess identity uncertainty, unlawful entry, trafficking exposure and security risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on control of documents, scripted answers, fear, dependency and restricted communication. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure travel bookings, phone messages, hotel details, payment records, CCTV and separate interviews. Place each item in its policy, location, system and role context before assigning weight.

Test possible trafficking, debt bondage, coercion, language dependency or legitimate group travel. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess victim exploitation, retaliation risk, disappearance after entry and organised crime exposure. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on seal damage, route deviation, inconsistent cargo explanation and driver stress. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure seal records, cargo manifest, x-ray scan, GPS route, inspection photos and driver statements. Place each item in its policy, location, system and role context before assigning weight.

Test possible contraband smuggling, driver coercion, loading error, organised concealment or customs fraud. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess dangerous goods movement, financial loss, criminal network activity and driver safety risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on avoidance, dependency on employer, fear of reporting and lack of personal documents. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure worksite records, wage logs, accommodation details, passport custody evidence and supervisor communications. Place each item in its policy, location, system and role context before assigning weight.

Test possible labour exploitation, debt bondage, immigration fear, employer coercion or voluntary overstay. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess worker harm, wage theft, intimidation and repeat exploitation of others. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on covert landing, rapid transfer, no port clearance and possible spotter activity. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure coastal CCTV, vessel tracking, resident reports, vehicle plates, shoreline evidence and phone pings. Place each item in its policy, location, system and role context before assigning weight.

Test possible migrant smuggling, contraband transfer, fishing emergency, trafficking route or organised transport. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess marine safety risk, unknown identities, contraband movement and community safety concern. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on concealed payment, nervous explanation, urgency and possible prior targeting of officers. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure CCTV, officer notes, passport handling footage, undeclared goods record and cash evidence. Place each item in its policy, location, system and role context before assigning weight.

Test possible bribery, panic response, cultural misunderstanding, organised facilitation or concealment of goods. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess corruption risk, unfair border processing and evidence integrity concern. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on child silence, adult answering for child, document mismatch and fear response. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure travel consent forms, birth records, booking data, CCTV, child-sensitive interview and contact checks. Place each item in its policy, location, system and role context before assigning weight.

Test possible abduction, trafficking, custody dispute, family emergency or documentation error. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess child safety risk, wrongful removal and immediate safeguarding need. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on concealment, route familiarity, minimising answers and repeated undeclared items. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure baggage scan, inspection photos, declaration form, travel frequency and seizure records. Place each item in its policy, location, system and role context before assigning weight.

Test possible commercial import, family food transport, avoidance of duties or biosecurity ignorance. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess disease introduction, agricultural harm, enforcement burden and repeated non-compliance. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on identity similarity, route concern, incomplete documents and stress under questioning. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure biometric records, passport history, booking route, watchlist data, interview notes and liaison checks. Place each item in its policy, location, system and role context before assigning weight.

Test possible mistaken identity, deliberate route masking, document fraud or security concern. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess unlawful detention risk, public safety risk and diplomatic sensitivity. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on packet division, cash pattern, coded messages and route movement. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure seized items, phone extraction, cash count, body camera footage and witness observations. Place each item in its policy, location, system and role context before assigning weight.

Test possible personal use, street-level supply, debt pressure, coercion or group dealing. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess drug harm, exploitation of vulnerable users and repeat supply risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on bag ownership uncertainty, inconsistent packing story, unusual travel and nervousness. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure luggage scan, residue test, travel booking, messages, baggage tags and interview record. Place each item in its policy, location, system and role context before assigning weight.

Test possible courier role, grooming, debt coercion, deliberate trafficking or unwitting carriage. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess serious drug distribution, exploitation, imprisonment risk and network exposure. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on stock mismatch, record alteration, unusual access and defensive explanation. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure drug register, access logs, disposal witnesses, roster, CCTV and clinical records. Place each item in its policy, location, system and role context before assigning weight.

Test possible diversion, addiction, documentation error, collusion or poor supervision. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess patient pain harm, staff safety risk, legal exposure and repeated diversion. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on coded posts, rapid account changes, buyer targeting and payment links. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure platform captures, wallet records, chat logs, delivery data and device evidence. Place each item in its policy, location, system and role context before assigning weight.

Test possible online supply, scam, youth targeting, organised distribution or account misuse. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess overdose risk, youth harm, cross-border supply and evidence deletion. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on structured purchasing, identity variation, unusual quantities and storage secrecy. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure sales records, delivery addresses, CCTV, chemical inventory and payment data. Place each item in its policy, location, system and role context before assigning weight.

Test possible illicit manufacture, legitimate business use, proxy buying or experiment activity. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess explosion risk, toxic exposure, community harm and organised manufacture. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on targeting younger students, secrecy, peer pressure and unexplained cash. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure student accounts, CCTV corridors, messages, seized items and pastoral records. Place each item in its policy, location, system and role context before assigning weight.

Test possible peer supply, gang grooming, debt pressure, experimentation or false allegation. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess student health harm, coercion, school fear and wider distribution. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on medical emergency, flight, panic messages and hidden substances. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure medical report, witness accounts, messages, remaining pills, CCTV and toxicology where available. Place each item in its policy, location, system and role context before assigning weight.

Test possible reckless supply, fear, contaminated substance, peer pressure or organised sale. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess death risk, contaminated batch exposure and witness fear. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on concealed hand movement, intoxication, coded calls and visitor nervousness. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure visit CCTV, inmate medical check, search records, call logs and visitor booking data. Place each item in its policy, location, system and role context before assigning weight.

Test possible visitor coercion, inmate debt, organised smuggling, false suspicion or medication issue. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess custody disorder, overdose, coercion and corruption risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on compartment concealment, route inconsistency, tool marks and driver stress. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure vehicle inspection photos, residue tests, GPS route, ownership records and phone data. Place each item in its policy, location, system and role context before assigning weight.

Test possible trafficking, vehicle loan misuse, debt coercion or mechanical modification without driver knowledge. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess drug movement, organised network activity and public safety risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on cash structuring, weak invoices, coded communication and third-party deposits. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure bank records, sales data, tax filings, messages, CCTV and supplier records. Place each item in its policy, location, system and role context before assigning weight.

Test possible drug proceeds, tax evasion, informal cash business, nominee accounts or laundering network. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess criminal finance growth, asset concealment and community harm. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on ideological fixation, isolation, grievance language and secrecy. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure device history where lawful, family account, social posts, messaging contacts and welfare records. Place each item in its policy, location, system and role context before assigning weight.

Test possible radicalisation, mental health crisis, identity search, provocation or online manipulation. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess self-harm, violence risk, recruitment exposure and family safety concern. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on surveillance pattern, route testing, interest in security posture and evasive answers. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure CCTV, security logs, photographs, access attempts, vehicle data and witness reports. Place each item in its policy, location, system and role context before assigning weight.

Test possible hostile reconnaissance, tourism, journalism, protest planning or curiosity. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess mass casualty risk, infrastructure disruption and public fear. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on structured transfers, nominee accounts, vague purpose and offshore link. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure bank records, charity registration, communications, device evidence and sanctions checks. Place each item in its policy, location, system and role context before assigning weight.

Test possible terrorist financing, humanitarian donation, fraud, concealment or third-party misuse. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess funding violence, regulatory exposure and harm to legitimate charities. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on fragmented purchasing, target research, secrecy and technical searching. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure purchase records, search history, delivery data, CCTV and storage location evidence. Place each item in its policy, location, system and role context before assigning weight.

Test possible attack preparation, hobby use, industrial need, fantasy behaviour or third-party procurement. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess explosion risk, mass harm and urgent intervention need. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on leakage language, fixation, weapons display and countdown behaviour. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure social media captures, weapon access checks, event details, witness reports and mental health context. Place each item in its policy, location, system and role context before assigning weight.

Test possible attack intent, suicidal crisis, attention seeking, extremist influence or domestic grievance. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess mass violence, self-harm, public panic and copycat risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on route masking, sudden travel, ideological contact and deletion of messages. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure booking records, passport history, messages, financial data and border interview. Place each item in its policy, location, system and role context before assigning weight.

Test possible foreign fighter travel, humanitarian purpose, family visit, journalism or coercion. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess training exposure, security threat, exploitation and legal risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on targeted distribution, anonymous posting, coded links and group tension. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure flyers, CCTV, online posts, printer records, witness accounts and campus reports. Place each item in its policy, location, system and role context before assigning weight.

Test possible extremist recruitment, provocation, hate incident, hoax or external agitator. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess community fear, radicalisation exposure and retaliatory conflict. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on unauthorised access, file downloading, route interest and weak explanations. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure access logs, file audit trail, work orders, CCTV, device records and supervisor instructions. Place each item in its policy, location, system and role context before assigning weight.

Test possible hostile planning, curiosity, task misunderstanding, external pressure or data theft. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess facility vulnerability, public safety risk and insider compromise. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on specific threat detail, timing, venue knowledge and anonymous channel use. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure message metadata, venue maps, prior threats, ticketing data and CCTV around entry points. Place each item in its policy, location, system and role context before assigning weight.

Test possible terrorist threat, hoax, grievance, extortion or insider leak. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess public panic, event harm, resource diversion and reputational damage. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on repeated flight path, camera orientation, timing and operator concealment. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure drone detection logs, CCTV, witness reports, RF data and nearby launch area search. Place each item in its policy, location, system and role context before assigning weight.

Test possible hostile surveillance, hobby flight, media activity, protest monitoring or smuggling. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess security mapping, operational disruption and collision risk. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on coordinated threats, repeated targeting, fear, money demands and use of runners. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure messages, payment accounts, CCTV, paint evidence, phone records and victim statements. Place each item in its policy, location, system and role context before assigning weight.

Test possible organised loan shark activity, personal debt dispute, copycat harassment or extortion. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess victim fear, property damage, escalation and recruitment of vulnerable runners. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on lookout behaviour, coded entry, cash handling and rapid shutdown procedures. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure CCTV, betting records, devices, cash, customer lists and building access records. Place each item in its policy, location, system and role context before assigning weight.

Test possible illegal gambling syndicate, private social gaming, money laundering or venue owner complicity. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess financial crime, debt harm, corruption and community disorder. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on document control, fear, debt bondage, restricted movement and poor living conditions. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure employment records, accommodation inspection, wage data, passports, messages and worker interviews. Place each item in its policy, location, system and role context before assigning weight.

Test possible trafficking, labour exploitation, immigration fear, subcontractor abuse or debt dispute. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess serious victim harm, retaliation and organised exploitation. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on coordinated supply, repeated packaging defects, cash handling and evasive supplier details. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure seized goods, supplier invoices, stall records, messages, delivery CCTV and payment trails. Place each item in its policy, location, system and role context before assigning weight.

Test possible counterfeit syndicate, grey-market goods, supplier deception or trademark ignorance. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess consumer harm, brand loss, tax evasion and organised revenue. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on team roles, repeated routes, concealment tools and rapid resale indicators. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure store CCTV, incident logs, vehicle plates, recovered goods and online listings. Place each item in its policy, location, system and role context before assigning weight.

Test possible organised theft crew, opportunistic theft, coercion of youths or resale network. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess staff safety risk, financial loss and escalation to violence. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on scripted deception, role separation, pressure calls and device rotation. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure call scripts, devices, network logs, rental records, bank complaints and payment accounts. Place each item in its policy, location, system and role context before assigning weight.

Test possible scam syndicate, coerced workers, legitimate telemarketing cover or money mule coordination. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess mass financial harm, vulnerable victim targeting and cross-border crime. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on plate alteration, warehouse staging, document falsification and repeated vehicle models. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure vehicle records, warehouse CCTV, shipping papers, tool marks and phone data. Place each item in its policy, location, system and role context before assigning weight.

Test possible export syndicate, chop shop, insurance fraud or document broker involvement. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess major property loss, violence risk and cross-border trafficking. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on recruitment scripts, quick transfers, account handover and minimising explanations. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure bank records, chat logs, device evidence, recruitment posts and victim fraud reports. Place each item in its policy, location, system and role context before assigning weight.

Test possible money mule network, youth exploitation, ignorance, coercion or deliberate laundering. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess fraud loss, criminalisation of vulnerable recruits and network growth. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on repeated demands, intimidation visits, property damage and community silence. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure victim accounts, CCTV, payment records, damage reports and phone messages. Place each item in its policy, location, system and role context before assigning weight.

Test possible protection racket, gang dispute, personal vendetta or false claim. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess business fear, violence escalation, economic harm and underreporting. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.

Focus on template similarity, repeated contact details, coached explanations and intermediary involvement. Treat these behaviours as investigative signals, then corroborate them through records and witness accounts.

Secure submitted documents, metadata, printer marks, phone records, payment evidence and applicant interviews. Place each item in its policy, location, system and role context before assigning weight.

Test possible forgery syndicate, migration fraud, employment fraud, applicant deception or third-party exploitation. Motive must be supported by facts such as timing, benefit, pressure, opportunity or prior conflict.

Build a before, during and after sequence showing when the concern emerged, who knew, what changed and where the record contains gaps or contradictions.

Assess identity fraud, unlawful benefit, vulnerable applicant harm and system abuse. Consider immediate protection, wider exposure, retaliation, repeated harm and support needs.

Weigh established facts, disputed facts, credibility, missing evidence, alternative explanations and proportional recommendations before finalising the conclusion.