Learning, solved.

From

Director of Customer Services

To

Investigating team

Subject

Ombudsman referral: root cause analysis required

The Ombudsman has upheld a complaint against us and wants our root cause analysis by the end of the month. I have read the file twice and I cannot give them one. Six contacts across eleven months, every case note accurate, every handover documented, every case closed inside target. On paper we did nothing wrong. Your task is to reconstruct this customer’s actual experience from the evidence, set it against the account our systems recorded, and give me the root cause I have to send.

From

Head of Information Security

To

Investigating team

Subject

Confirmed data breach: ICO notification in 72 hours

We have a confirmed breach involving client records and I have 72 hours to tell the ICO how it happened. Nobody attacked us. A password had been shared across a team for two years because changing it was inconvenient, a plausible email asked for a file and someone helpful sent it, a colleague noticed something odd and said nothing for nine days, and a contractor’s access was never revoked when their work ended. Your task is to establish the sequence, identify which control failed at each step, and tell me the single change that would have stopped it.

From

Director of Risk and Assurance

To

Investigating team

Subject

Internal Audit query: known risk, materialised

Internal Audit has asked me a question I cannot answer. The risk that materialised last month has been on our register since 2023, rated correctly, with a named owner. It was downgraded at a review that owner could not attend, deferred twice at board for time, and an escalation was drafted but never sent because its author assumed it had been raised elsewhere. Your task is to trace the decision trail through the register, the minutes and the correspondence, and tell me precisely where ownership of this risk disappeared.

From

Data Protection Officer

To

Investigating team

Subject

Subject access request: 18 days remaining

We have received a subject access request. The statutory clock is one month, twelve days have gone while we worked out whose job it was, and the search is surfacing more than anyone expected: this customer’s data in a marketing list with no recorded consent, call recordings held well past their retention date, and free-text account notes describing them in terms none of us would want disclosed. Your task is to decide what must be released, what an exemption genuinely covers, and where our retention practice has to change before the next one arrives.

From

Head of Governance

To

Investigating team

Subject

Audit Committee: supplier relationship flagged

Our auditors have flagged a supplier relationship and I have to respond to the Audit Committee on Thursday. Every individual step was done properly. The gift was declared and logged. The procurement exception was approved for a genuine deadline. The contract was renewed because switching looked expensive. And yes, a former colleague now works there. Your task is to put those decisions back into sequence and identify the point at which we lost the ability to say this contract was awarded on merit.

From

You

To

Cluecraft

Subject

The case that has not been written yet

This file is deliberately empty. The most useful investigation is usually the one nobody has written yet: the risk you are carrying, the incident you keep having to explain, or the behaviour you need to shift before it becomes a problem. You set the learning points, the policies people should know, and the values you want decisions weighed against. We build the story, the evidence and the reveal around them, in your language, with your roles and your systems in it. Your task is simply to tell us the case you want to make.