whistleblower / retaliation investigation — methodology

what evidence exists and how fast it dies

the first 10 minutes

1. issue legal hold on ethics, hcm, hr acuity, and servicenow hrsd — before anyone “cleans up” case status.
2. export the hotline report by case id — do not rely on dashboard screenshots.
3. pull ethics audit log for status changes, dismissals, and reassignment on the report date forward.
4. export hcm employee history for the reporter id — job code, title, manager, compensation effective dates.
5. pull HR Acuity investigation by employee or case number linked to the ethics report.
6. export ServiceNow HRSD tickets referencing the same employee or er case id.
7. record who requested exports and utc timestamps — chain of custody starts here.
8. do not deanonymize the reporter without counsel — improper identity access is retaliation evidence too.
9. notify compliance / board audit committee if the report category is sox or financial fraud.
10. begin the path below.

the path

1. 1. navex ethics hotline export forensic analyzer

   Navex / EthicsPoint hotline csv export. parses report id, category, reporter token, status transitions, and assigned investigator across the ethics queue.why first: the hotline record is the anchor — every retaliation claim starts with when the report was filed and who touched it before adverse action.

2. 2. ethics retaliation pattern detector

   ethics event timeline csv. flags pip, demotion, transfer, and termination events inside the post-report retaliation window — e.g. pip and hcm demotion within 17 days of NAV-2026-0312.why second: adverse employment action timing is the prima facie signal — map it before you chase dismissal metadata.

3. 3. ethics unauthorized case dismissal detector

   ethics audit and dismissal event export. surfaces closes by non-investigator accounts, missing approval chains, and audit tamper rows — svc-hr-ethics-admin from 198.51.100.55 in the morgan bundle.why third: a dismissed ethics case is not a resolved ethics case. unauthorized close is often the cover-up, not the conclusion.

4. 4. cross ethics hcm retaliation correlator

   paired ethics + hcm exports. links hotline report timestamps to job-code changes, title demotions, and compensation adjustments on the same employee id.why fourth: ethics and hcm live in different systems — correlation proves the employment action followed the report, not a scheduled review cycle.

5. 5. hr acuity investigation export forensic analyzer

   HR Acuity investigation csv. parses case id, allegation type, investigator, status, and close reason — ER-22901 premature close without findings in the fixture.why fifth: employee relations runs parallel to ethics — acuity holds the formal investigation record counsel will subpoena.

6. 6. cross er hrsd case correlator

   paired HR Acuity + ServiceNow HRSD exports. correlates ER case ids to HRSD ticket numbers — ER-22901 ↔ HRSD-884 in morgan.why sixth: er and hrsd tickets split across platforms — link them before you accept “case closed” on either side.

7. 7. servicenow hrsd case export forensic analyzer

   ServiceNow HRSD case export csv. parses case state, task history, assigned group, and close actor — flags unauthorized resolution from non-hrsd admin accounts.why seventh: hrsd is where hr ops closes the loop — premature close from an ethics admin ip is a separate artifact from the acuity investigation.

8. 8. case report generator

   structured case report form + evidence file hashes. assembles examiner, dates, findings, and manifest inputs into a court-ready report pdf.why last: board, counsel, and regulators want one narrative — generate it after the cross-system timeline is stable.

common false leads

• performance pip predates the report — check effective dates; backdated pips after hotline filing are common.
• ethics case closed means resolved — unauthorized dismissal by hr admin is closure without investigation.
• er and hrsd are duplicate records — they often diverge; one closed prematurely while the other still open.
• reporter was not demoted — title and job-code changes in hcm may not match what the employee sees on the org chart.
• hotline report was anonymous so no retaliation possible — deanonymization access logs and manager timing still matter.
• adverse action was “business restructuring” — correlate headcount events against individual reporter id, not department averages.

what we can tell you, what we can't

we can tell you:

• hotline report metadata and status transition timelines from navex exports
• retaliation-window hits — pip, demotion, transfer clusters after report date
• unauthorized case dismissal patterns — actor, ip, missing approval chain
• cross-system correlation between ethics reports and hcm employment actions
• HR Acuity investigation lifecycle and premature close indicators
• ER ↔ HRSD case linkage and inconsistent close states
• structured case report assembly with evidence file hashes

we can't tell you:

• whether retaliation was legally proven — that is counsel, agency, or court territory
• reporter identity from anonymous reports without your authorized deanonymization export
• live platform state — we analyze exports you provide, not vendor apis
• manager intent or “pretext” quality — artifacts show timing; interviews show motive
• guaranteed regulatory outcome — osha, sec, or state whistleblower statutes vary by jurisdiction

handing it off

• employment counsel: cross-system timeline csv, unauthorized dismissal findings, hcm action dates, case report pdf with evidence hashes.
• compliance / audit committee: hotline case summary, ethics admin actors, sox-category escalation if applicable.
• outside forensic / ediscovery: full platform exports under legal hold, export chain of custody, and tool outputs as json/csv attachments.
• regulatory agency (if referred): representative ethics + hcm + er/hrsd export set, timeline of adverse action relative to report date — not conclusory labels.

further reading

• OSHA — whistleblower protection statutes
• SEC whistleblower program
• DOL OIG hotline guidance

reference investigation