Proportionate Responses
The range is wider than the two options organisations actually use, and the middle is where most matters belong.
Disciplinary consequences
Unenforceable
As written
Breaches may result in disciplinary action in accordance with the company's disciplinary procedure.
What happens
Points at another document, which describes formal stages and nothing below them.
Between no action and a formal warning there is nothing written, so managers invent it or escalate.
The operative range is: say nothing, or start a process.
Most organisations have two responses available in practice: nothing, or the formal procedure. The useful responses are in between and are not written down anywhere.
The response process in “Proportionate Responses” needs evidence that can be checked without turning one signal into a conclusion. If ethical employee monitoring supports ethical employee monitoring, managers should validate the record with the person involved, preserve the correction history and distinguish an operational exception from deliberate misconduct before any consequential action.
The range
A conversation, unrecorded.
For a separate benchmark relevant to “Proportionate Responses”, consult the AuditBoard internal-investigation guide. Use it to test purpose, notice, permissions, retention and response procedures against the proposed operating model rather than treating a generic checklist as proof that the rule works.
A conversation with a note, so a pattern would be visible.
An instruction: stop doing this, here is the route instead.
Training or a briefing, where the finding was that the rule was not known.
A change to access or configuration, as a practical measure rather than a sanction.
The formal procedure, at whatever stages exist.
And in parallel with any of these: fixing the thing that caused it.
Matching response to grading
Did not know: communicate it, and fix the communication for everybody else.
Misunderstood: clarify, and consider whether the clause is badly drafted.
Workaround: fix the process, and address the behaviour where it carried real risk.
Carelessness: a conversation, with a note if it recurs.
Personal convenience: a conversation and a clear instruction, formal if repeated.
Deliberate harm: the formal procedure, with advice.
Factors that properly affect severity
What was actually at risk, rather than what was theoretically possible.
Whether there was concealment.
Whether they reported it themselves.
Whether the organisation's own arrangements contributed, which is the factor most often relevant and least often mentioned.
Factors that should not
Seniority, in either direction. An organisation visibly softer on senior people has told everybody what the policy is for.
How embarrassing it is.
How much effort the investigation consumed, which is a sunk cost and reliably inflates outcomes.
And whether an example is needed, which is a decision about other people made by sanctioning this one.
Who decides
Not whoever found it, who has formed a view.
For anything beyond a conversation, somebody who reads the file and was not involved in establishing it. The separation feels heavy and it is the main protection against a conclusion reached early.
Writing the range down
A short internal note for managers listing the options between nothing and the formal procedure.
Without it managers use the two they know about, which produces both under-response and over-response and no consistency between them.
The middle that is not written down
Between nothing and the formal procedure there are five responses and none appears in any document. Managers use the two they know about, which produces both under-response and over-response.
Who decides anything beyond a conversation
Somebody who reads the file and was not involved in establishing it. The separation feels heavy and it is the main protection against a conclusion reached in the first hour.
Factors that should not weigh
Seniority in either direction, embarrassment, the effort already spent, and the wish to set an example — which is a decision about other people made by sanctioning this one.
The range nobody lists
A conversation, a conversation with a note, an instruction, training, a configuration change, the formal procedure. Six options, and managers use two because the others were never written down.
Who should not decide
Whoever found it, who has formed a view. For anything beyond a conversation, somebody who reads the file and was not involved in establishing it.
Writing the range down for managers
A short internal note listing what sits between nothing and the formal procedure. Six options, none of which appears in any document, all of which managers would use if they knew they were available.
Without it they use the two they know about, which produces both under-response to things that needed addressing and over-response to things that did not, with no consistency between either.
Pairing the range with two or three worked examples does more than the list alone. Managers calibrate from cases rather than from categories, and the outcome log supplies the cases at no additional cost once it has been running a year.