Investigation cases and priorities
When an investigation finishes, ScoopVault groups the notable findings into cases: sets of related findings that probably describe one situation, or a single notable finding on its own, each with a priority, a recommended next step, and a written explanation.
What a case shows you
A priority band: one of High, Medium, Low, or Informational, shown as a coloured pill.
A recommended action for a human to take: Recommended escalated review (highest-priority; review promptly and consider escalation), Recommended standard review (review in the normal course of the investigation), Recommended monitoring (keep an eye on it; no immediate action implied), or Retain for context (low signal; kept on file for completeness, not flagged for action).
A rationale: a plain-English explanation of why the case got its priority and action: the main contributing signals, how many findings and actors are involved, the business impact, whether the findings have plausible innocent explanations, and two confidence indicators.
Two confidences: one for how sure ScoopVault is that the findings belong together as a case, one for how stable the recommended action is. Both are deliberately conservative.
Single-finding cases
A finding that doesn't connect to any other finding becomes its own single-finding case, scored and explained on its own merit. Its rationale says plainly that it "rests on a single finding with no corroborating findings", so a lone but serious item still gets a recommended action and isn't overlooked, while the case never reads as if other findings supported it.
ScoopVault recommends; you decide
Even the lowest action, Retain for context, keeps the case on file for your discretion. Every case rationale notes that the recommendation is not a determination of wrongdoing and should be checked against the underlying source material, and states plainly: "Priority bands guide review attention only. The reviewer decides any subsequent action."
How priority is decided (in brief)
Priority combines the number and strength of contributing findings, the seniority or sensitivity of the participants involved, and pattern signals such as urgency language, secrecy language, or financial terms. Scoring is deterministic and versioned so the identical inputs always produce the identical output, and the exact methodology version is stamped on every case.
Can't find what you need? Contact support — we aim to respond within one business day, during UK business hours.