The Internal Report That Comes First
Nothing happens until somebody tells somebody. The reporting route is the control that everything else in this section depends on.
INTERNAL REPORT FORM
Four fields. Anything longer will not be filled in
- What happenedOne or two sentences, their wordsNo format requirements, no categories to select
- WhenDate and time it happened, and nowThe second is the clock
- What dataRoughly, as far as they knowApproximate is fine and expected
- Your nameAnd how to reach you todaySo somebody can ask follow-up questions
- Sent toA single named route, published everywhereAn address people can find without looking
- AcknowledgedWithin the hour, by a personSilence teaches people not to bother
- No blameStated on the form itselfThe single most effective thing on it
Every obligation in this section begins with somebody noticing and saying so. Where the reporting route is unclear or frightening, nothing else in the process operates.
The breach workflow in “The Internal Report That Comes First” is easier to operate when systems, owners and evidence are known in advance. If how teams evaluate chronemics definition supports chronemics definition, its records should sit inside the incident inventory with clear access, retention and escalation rules rather than being treated as an unexplained source of employee data.
The form that works
Four fields on one page: what happened, when, what data, who you are.
For a separate benchmark relevant to “The Internal Report That Comes First”, consult the IBM insider-threat overview. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.
No categories to select, no severity rating, no requirement to assess anything. The person reporting is frequently the person who made the mistake, and they are in no state to classify it.
Anything longer gets abandoned halfway, and an abandoned report is no report.
The route
One address, published where people actually look: the intranet front page, the induction, a line in the email footer of whoever owns this.
A route that requires finding a policy to locate is a route nobody uses at six on a Friday.
The sentence that matters most
That reporting a mistake will not result in disciplinary action for the mistake.
Most breaches are caused by the person reporting them. If they fear consequences they will delay, attempt to fix it quietly, or say nothing — and the delay costs far more than whatever the original error was.
An organisation that has disciplined somebody for an honestly reported error has bought one outcome and lost its early warning permanently. People tell each other about that case for years.
Acknowledgement
Within the hour, from a person, saying it has been received and somebody is looking at it.
Silence after a report teaches the reporter that it went nowhere, and they will not make the next one.
What happens next, visibly
The reporter should hear the outcome: what it turned out to be, whether it was notifiable, what changed as a result.
Not as a courtesy. As the thing that makes the route credible to everybody they talk to.
Testing it
Ask three people at different levels what they would do if they sent a spreadsheet to the wrong address.
Where the answers differ, or where any of them involves fixing it quietly first, the route exists on paper only.
Testing whether the route exists
Ask three people at different levels what they would do if they sent a spreadsheet to the wrong address. Where the answers differ, or any involves fixing it quietly first, the route exists on paper only.
Closing the loop with the reporter
What it turned out to be, whether it was notifiable, what changed. Not courtesy: it is what makes the route credible to everybody they talk to afterwards.
Four fields, no more
What happened, when, what data, who you are. Anything longer gets abandoned halfway, and an abandoned report is no report at all.
Acknowledging within the hour
From a person, saying it was received and somebody is looking. Silence after a report teaches the reporter it went nowhere, and they do not make the next one.
Where the route should live
Published where people look: the intranet front page, the induction, the footer of whoever owns this. A route requiring somebody to find a policy is a route nobody uses on a Friday evening.