A Badge Entry, an HR Concern, a Security Alert: When Should the Teams Review Them Together?

Three Records That May Need a Shared Review

Consider a hypothetical situation. Physical security records an employee entering a building late at night. HR is handling a workplace concern involving the same employee. Cybersecurity receives an alert about files transferred to a personal cloud account.

Each team has information to assess within its own responsibilities. The late visit may be authorized. The HR matter may have no security relevance. The file transfer may have a legitimate explanation.

But if a concern warrants further investigation, how do the right people determine whether these records are related?

That is the practical challenge. An organization needs a defined way to bring relevant information into a shared review while protecting information that does not belong there.

Why HR, Physical Security and Cybersecurity Keep Separate Files

These teams collect information for different purposes.

HR needs to handle employee concerns with appropriate confidentiality. Physical security needs to manage access and safety. Cybersecurity needs to investigate activity involving systems and data.

Those responsibilities call for different access permissions and review processes. A security analyst should not need unrestricted access to an employee’s HR history to investigate a file transfer. An HR investigator may need a specific technical finding without access to every security log.

The question is how to request and share the information relevant to a particular concern.

A useful process makes that decision deliberate: why is a joint review needed, who should participate, and what does each person need to know?

What the Sources Support

Carnegie Mellon University’s Software Engineering Institute recommends a coordinated, organization-wide approach to insider risk. Its Common Sense Guide to Mitigating Insider Threats provides guidance for stakeholders including HR, legal counsel, physical security, IT, and information security.¹

That supports bringing different disciplines into the process. It does not mean every employee concern should become a security investigation or that every department needs access to the same records.

A case involving a former engineer at a technology company illustrates how digital activity and physical access records can become relevant to the same investigation.

In January 2026, the U.S. Department of Justice announced the engineer’s conviction for economic espionage and theft of confidential AI technology. An earlier DOJ announcement alleged that another employee used his access badge to make him appear present at a U.S. office while he was abroad.²³

The public announcements do not establish when the company connected these details or whether reviewing them together would have exposed the conduct sooner. They illustrate why investigators may need to examine information held by different teams to understand the same person’s activities.

Decide How a Concern Moves Between Teams

A team may resolve an issue within its own remit. It may also reach a point where another function’s expertise is needed.

For example, a cybersecurity investigator examining a file transfer may need to establish whether the employee was carrying out an approved assignment. Physical security may need help determining whether a badge event reflects the employee’s actual presence. HR may hold relevant context that it can provide through an authorized review.

Organizations should define how those requests are made and assessed. The process should identify who receives a referral, who decides whether a joint investigation is appropriate, and who coordinates the work.

A performance disagreement should not automatically become evidence of malicious intent. The reason for escalation should be specific enough for another reviewer to understand and challenge.

Bring Relevant Evidence Together With Clear Limits

Once a joint investigation is authorized, the team needs a coherent record of the concern and the evidence being examined.

That record should distinguish what each source actually shows. A badge event records the use of a credential. An HR note may contain someone’s account of a conversation. A security alert identifies activity requiring assessment. Each has limits.

A shared timeline can help investigators compare events, but events occurring close together do not establish motive or wrongdoing. The team still needs to verify identities, check authorization, consider alternative explanations, and document what remains uncertain.

Access should follow the purpose of the investigation. Where a verified fact or limited extract is sufficient, the wider source file can remain restricted. The record should make clear where information came from, who reviewed it, and how it informed a decision.

These are practical controls for making collaboration useful and accountable.

Where Technology Can Help

An investigative platform can help organize relevant records, connect them to the correct people and events, and preserve the reasoning behind decisions.

Its value depends on the workflow around it. The team still needs to decide when a case should be opened, what information may be included, and who is authorized to review it.

Hubstream supports investigations organized around entities, relationships, and case information. Its AI Investigation Assistant can help teams review material and explore possible connections, with investigators validating the findings.

For this type of work, the aim is a focused view of an authorized investigation. Relevant evidence should be accessible to the people who need it, with sensitive material subject to appropriate controls.

Questions Worth Asking

• Is there a clear route for HR, physical security, and cybersecurity to request a joint review?
• Who decides whether a concern warrants escalation, and is the reason recorded?
• Can the team share relevant findings without exposing entire source files?
• Can investigators distinguish observations, allegations, automated alerts, and verified facts?
• Who records the outcome and ensures that corrections reach the teams involved?

These questions help establish whether information can move responsibly from one team to another.

Return to the Badge, the File and the Alert

The records in the opening example may turn out to be unrelated. A joint review might establish that the activity was authorized, identify a policy issue, or uncover a concern requiring further investigation.

The outcome should depend on the evidence.

What matters is having a clear process for deciding when the teams should talk, what they may share, and how they will assess it. That gives the organization a better basis for action while preserving the boundaries that protect employees and sensitive information.