What changes the answer

The signal ledger.

These facts move the question beyond a label and into a product, money-flow and control analysis.

Signal
Ask the operating question
Why it changes the route
Authority/legal basis
Which authority is conducting the investigation and under what power?
This determines response obligations.
Scope
Which products, entities, conduct and periods are named?
Scope controls preservation/interview preparation.
Documents/devices
What systems/devices have been requested or accessed?
Collection scope drives preservation/privilege/data handling.
Employee interviews
Who is being interviewed and in what capacity?
Status affects preparation/representation.
Parallel issues
Are criminal or data-security issues emerging?
Parallel exposure needs coordinated response.
Prepare before you escalate

Bring a compact evidence docket—not a pitch deck.

Give a compliance team or counsel the operating facts that reveal the perimeter.

01response contact treeEstablish authorised response, escalation and privilege channels.
02hold protocolShow that relevant documents and devices were preserved promptly.
03IT contactsIdentify the systems, custodians and personnel needed for preservation.
04facility/access planEstablish the specific facts and legal significance of facility/access plan for this route.
05regulator/counsel logEstablish the specific facts and legal significance of regulator/counsel log for this route.

Primary authorities

Reviewed sources support orientation, not a fact-specific assessment.

Sources last checked: