In thirty years of conducting internal investigations — first as a federal Special Agent in Charge of the U.S. Secret Service's Inspection Division, and later as the Senior Director of Enterprise Corporate Security at a multibillion-dollar cyber firm — I have read the after-action of a great many insider matters. The matters were varied. The pattern was not.
Three signals appear with striking consistency before a senior insider case becomes a matter. The signals are not the act itself. They are the announcement of the act, sent out into the institutional environment by the actor weeks, months, sometimes years before the act is complete. The signals are observable. They are usually observed. They are almost never assembled into a coherent picture in time to matter.
This essay is about why.
— I. The first signal: a change in the relationship with documentation.
Senior insider matters begin with a change in how the actor relates to the institution's records. The change is subtle and easily explained at the moment of observation. Documents that previously flowed through normal channels begin to bypass them — sometimes upward, sometimes laterally, sometimes off-system entirely. Email patterns shift. Calendar entries become less specific. The actor begins to express, in small ways, frustration with the institution's compliance burden, audit cycles, or transparency norms.
The signal is rarely a single dramatic anomaly. It is a drift. The actor who previously cc'd legal on routine matters begins not to. The executive who previously sent contracts to the records team for filing begins to retain them personally. The senior leader who previously welcomed audit oversight begins to ask, with increasing frequency, whether a particular review is "really necessary."
These behaviors are individually unremarkable. Each carries a plausible explanation — workload pressure, fatigue with bureaucratic process, frustration with a specific auditor. The plausibility is the point: the actor relies on the plausibility to make each instance defensible. The pattern is only visible at aggregation.
— II. The second signal: a change in the relationship with peers.
The second signal is interpersonal. The actor begins, gradually, to disengage from the peer relationships that previously connected them to the institution's informal feedback loops. The change is not absence — the actor remains visible, remains at meetings, remains seemingly engaged. The change is depth.
Peers who previously received informal updates begin not to. Colleagues who previously could expect a quick informal conversation about a sensitive matter find that the conversation is no longer available, or that it returns sanitized. The actor becomes, in the language of behavioral assessment, harder to read. The reduction in informal information flow is not random. It correlates with the matter the actor is preparing to obscure.
This signal is particularly hard to surface inside the institution because the affected peers do not, individually, perceive themselves as affected. Each peer experiences a small reduction in access — a missed lunch, a shorter email, a deflected question — and processes it as a function of workload, of seniority differential, or of the actor's stress. The peer rarely connects their own minor experience to the larger pattern. The institution rarely asks them to.
— III. The third signal: a change in the relationship with risk.
The third signal is the most reliable, and the most often missed. The actor, prior to the matter ripening, begins to display an altered relationship with risk — sometimes a heightened risk appetite in domains where their behavior was previously conservative, sometimes the reverse. The shift is not generalized; it is targeted at the domain where the matter will eventually surface.
In financial misconduct cases, the actor's risk profile shifts in the financial domain — discretionary authority is exercised more aggressively, controls are tested, the boundary of policy is approached and held. In information-handling cases, the actor's risk profile shifts in the data domain — access requests increase, retention practices change, devices and credentials are handled differently. In personnel matters, the shift appears in hiring, promotion, or termination decisions that begin to favor a specific structure.
This signal is the one that institutional governance is, in principle, designed to surface. Audit, compliance, and HR functions exist precisely to identify shifts in the risk profile of the people they monitor. But in senior cases, the actor has often participated in designing the very controls intended to surface their behavior. They know what the controls look at, what they do not look at, and how to position activity in the second category. The control fails not because it is poorly designed but because the designer is the subject.
— IV. Why the signals are missed.
Three institutional failures explain the consistent miss.
The first is aggregation. The signals appear across HR, legal, audit, IT, peer relationships, and external indicators. No single function sees all three. The institution lacks — almost universally — a designated function whose job is to assemble small signals from multiple sources into a single picture. The information exists. It is not synthesized.
The second is seniority. When the suspected actor is senior, the institutional reflexes that would surface a junior case do not engage. Inquiries that would be initiated against a mid-level employee are deferred. Conversations that would be had directly are had indirectly, or not at all. The actor's seniority — which is itself a function of trust accumulated over time — becomes a procedural shield that protects them at the moment institutional skepticism is most needed.
The third is cultural. Most institutions are uncomfortable acknowledging that the people who lead them might also be the people who damage them. The discomfort is human. It is also operational, because the discomfort produces hesitation, and hesitation produces delay, and delay produces precisely the time the actor needs to complete the matter the early signals were announcing.
— V. What governance can do.
The instinct, when reading a piece like this, is to ask whether technology — analytics, monitoring tools, AI — can compensate. It can, but only in narrow domains, and never as a substitute for what is fundamentally a governance question. The signals are human, the pattern is human, and the assembly of signals into a coherent picture is a human discipline. Technology helps surface the data; it does not interpret it.
What governance can do is design the function. Specifically:
A designated office — typically reporting to general counsel rather than to operating management — whose explicit charter is to aggregate cross-functional indicators on senior personnel.
A trip-wire framework that defines, in advance, what combinations of indicators escalate, and to whom.
An external advisory relationship that can be activated when the case approaches the most senior layer of the institution — because by definition, the internal function cannot impartially investigate the people who own its budget.
A cultural posture from the board that treats the existence of the function as evidence of institutional maturity rather than of distrust.
The fourth point is the difficult one. In many institutions, the existence of a senior-misconduct early-warning function is itself a sensitive matter — boards worry that visible scrutiny of senior leadership signals lack of confidence. The opposite is true. Boards that lack visible senior-misconduct architecture are not signaling confidence in their leadership. They are signaling that they have not yet encountered the matter that would require such architecture. The matter, when it arrives, does not consult the institution's preparation calendar.
— VI. A closing note.
The pattern described here is consistent enough that I will say something stronger: in the senior misconduct matters I have reviewed, the early signals were present and observable in advance of the act in the substantial majority of cases. The signals were observed by individuals inside the institution. The signals were not assembled. The institution learned the matter from an external source — a regulator, a journalist, an audit, a counterparty — rather than from its own architecture.
This is, structurally, an avoidable failure. The discipline to avoid it exists. It is not exotic, not expensive, and not technology-dependent. It requires only that an institution decide it is willing to look at its own senior people with the same discipline it applies to its junior ones — and to fund the architecture that makes the looking honest.
That decision sits with the board.
