Investigating Criminal Networks: When To Pull The Trigger On Discipline

Corruption rarely occurs in isolation. Major schemes are usually uncovered not through one decisive piece of evidence, but through the accumulation of small, seemingly unconnected facts. A single suspicious transaction or whistle-blower complaint often points to something larger: a network of relationships, transactions and actors working in concert. For organisations facing this pattern, the instinct to close out one incident quickly can mean missing the bigger picture entirely.

Looking beyond the initial allegation

Traditional investigations tend to focus narrowly on the allegation itself: who authorised the payment, who approved the invoice, who benefited. These questions matter, but the most valuable evidence often lies beyond the immediate incident.

Modern fraud and corruption schemes are often designed to compartmentalise knowledge and responsibility. No single transaction tells the whole story, but mapped relationships and combined data reveal patterns that would otherwise stay hidden. Recognising the traditional investigation’s design flaw is the starting point for any effective response to pervasive corruption.

Investigations need to shift from asking whether misconduct occurred to understanding how the network operates. Relationship mapping is one of the most effective tools available to uncover these networks. Rather than treating events in isolation, investigators examine the connections between people, entities, accounts, properties, devices, communications, suppliers and transactions, looking for patterns that are not visible when evidence is viewed one piece at a time.

The real dilemma: When and how to discipline

The recurring dilemma when investigating these schemes is not whether misconduct occurred, but when and how to discipline the employee involved while the wider network is still being unpacked.

Nothing precludes an employer from taking disciplinary action once it has enough evidence - even where the full scheme has not yet been mapped.

An employer has enough evidence once it can meet the balance of probabilities standard: is it more likely than not that the employee acted dishonestly or breached policy? That is a materially lower bar than the criminal standard of beyond reasonable doubt. An employer does not need to prove the entire scheme, and scheme and does not need to wait for the outcome of the investigation on the broader scheme, before acting.

Deciding when to discipline, if there is not yet a full picture, calls for weighing the risks and benefits of retaining the implicated employee. Retention of the employee can provide continued access that may expose other participants and reveal how the scheme operates. But it also carries real risk - evidence may be destroyed, witnesses influenced, losses may continue, and the eroded trust relationship may have broader unintended consequences on the employee relationships climate.

So, the answer to when to pull the proverbial trigger is not purely a legal question. It is a judgement call that draws on operational, evidentiary and reputational factors, including:

• The strength of the evidence against the individual, assessed independently of the wider scheme.
• The employee’s continued access to systems, records, people or funds.
• The risk that delay allows evidence to be destroyed or witnesses influenced.
• Whether continued monitoring offers a genuine investigative benefit, or is simply prolonging exposure.
• The message that action, or inaction, sends to the rest of the organisation.
• Any reputational, regulatory or contractual reporting obligations triggered by the conduct.

Getting this balance wrong carries a real cost: act too cautiously, and the network survives; act too hastily, and the wider scheme is never uncovered. Striking this balance is not a decision for one function alone. The best outcomes come from close coordination between investigation, legal and HR teams from the outset.

Handled well, the result is not a series of isolated dismissals, but a coordinated response that disrupts the network while it is still being understood. That requires organisations to resist the false choice between decisive action and thorough investigation - the two are not in tension if the underlying evidence and risk assessment are sound. The employers who get this right treat every allegation, however small, as an opportunity: to map the wider network, to act on individuals where the evidence justifies it, and to keep building the picture in parallel. Over time, this approach does more than resolve individual cases. It signals to the rest of the organisation that misconduct will be pursued rigorously, but fairly, and that decisions to act - or to hold - are made on the evidence, not on how complete the picture happens to be. The result is one that should make employees think twice about their roles, however small, in complex, coordinated criminal conduct.

*This conversation continues at the UJ Combating Corruption Summit 2026, where our experts will join other stakeholders to explore the challenges surrounding corruption, accountability and whistleblower protection in South Africa.