Investigations
Structured investigation of alerts, referrals and concerns
A defined, repeatable process for investigating alerts, referrals and concerns — establishing scope, gathering evidence, linking entities, testing hypotheses and documenting findings — so every investigation is consistent, owned and defensible from intake to decision. Where Case Management is the container, Investigations is the discipline that runs inside it: a method that turns a raw signal into a reasoned conclusion, with the analytical steps, the evidence considered and the judgement reached all recorded as the work happens rather than reconstructed afterwards.
How it works, visually
Alert, triage, investigate, decide, report — with clear ownership and a defensible trail at every stage.
The problems this module solves
The operational realities that make this hard for compliance and risk teams today.
Investigations depend on who picks them up
Two analysts handed the same alert investigate it differently — one pulls three data sources, another pulls seven; one documents a rationale, another closes on instinct. Without a defined method, quality is a function of the individual, and the firm cannot show a supervisor that concerns are investigated to a consistent standard.
Evidence is gathered but not connected
Analysts collect documents, transaction extracts and screening results, but they sit as loose attachments with no relationship to the finding they support. When a conclusion is challenged, no one can point to the specific evidence that grounds it, and the reasoning has to be rebuilt from memory.
The analytical trail disappears
The hypotheses tested, the lines of enquiry ruled out, and the reasoning that led to a disposition are the heart of an investigation — and they are exactly what informal processes fail to capture. What survives is the outcome, not the thinking, which is the part an examiner most wants to see.
Concerns stall without ownership or deadlines
A referral raised on a Friday can sit for weeks because no one is clearly accountable for it and no clock is running. Ageing investigations are a supervisory red flag, and informal tracking makes them invisible until they are already overdue.
Findings don't drive action
An investigation concludes that a control failed or a relationship should be exited, but the finding lives in a report that no one is obliged to act on. The link between what was found and what was done next is broken, so the same issues recur.
How OnyxOne addresses it
A consistent investigation method
Every investigation follows a defined path — scope, evidence, analysis, finding, disposition — with the same structure regardless of who runs it. Consistency is what lets the firm demonstrate that concerns are investigated to a standard, not to a mood.
Evidence tied to findings
Documents, records and screening results are attached and explicitly linked to the finding they support, so each conclusion points to the evidence that grounds it. A challenged conclusion is answered by retrieval, not reconstruction.
The reasoning captured as it forms
Hypotheses, lines of enquiry, notes and the rationale for the disposition are recorded on the investigation as the analyst works. The analytical trail — including what was considered and ruled out — is preserved, which is precisely what a defensible investigation requires.
Ownership, deadlines and escalation
Each investigation has a clear owner, a due date and an escalation path from the moment it opens. Ageing and overdue work is visible, so nothing sits unowned, and supervisors can see the state of the queue at a glance.
Findings that create follow-through
A finding can raise a linked action, a control weakness or an escalation to a financial-crime case, so the conclusion drives the next step rather than ending in a filed report. The loop between finding and action is closed and evidenced.
What's in the module
Turn on what you need and add more as your programme scales.
Investigation intake
Open investigations from alerts, referrals, concerns and internal escalations with a defined scope and subject.
Structured method
Move each investigation through consistent stages — scope, evidence, analysis, finding — regardless of who runs it.
Evidence gathering & linking
Attach documents, records and screening results and link each to the finding it supports.
Entity & relationship mapping
Connect the people, organisations and events involved to reveal how a concern fits a wider picture.
Hypothesis & line-of-enquiry tracking
Record the theories tested and the enquiries pursued or ruled out, preserving the analytical trail.
Findings & disposition
Document the conclusion and its rationale, with the evidence that grounds it, before an investigation closes.
Ownership & SLAs
Assign an owner, due date and escalation path so investigations are accountable and time-bound.
Escalation to cases
Escalate an investigation into a full financial-crime or conduct case with its evidence and reasoning intact.
Follow-up actions
Raise linked actions, control weaknesses or referrals so a finding drives the next step.
Immutable investigation record
Every note, hypothesis, evidence item and disposition is written to an append-only trail.
The views your team works from
Purpose-built dashboards and views, each answering a question a specific role needs to act on.
A representative layout of the KPI tiles and charts these dashboards present. Figures shown are illustrative examples, not real data.
Investigation queue
Open investigations prioritised by risk and age, with owner, due date and SLA status against each one.
Ageing monitor
Investigations approaching or past their due date, so supervisors act before ageing becomes a finding.
Outcome analytics
The mix of dispositions and finding types over time, highlighting where concerns cluster.
Evidence coverage
Investigations where findings are or are not yet supported by linked evidence, flagging thin conclusions before close.
Escalation view
Investigations escalated into cases or referred onward, with the reasoning and evidence that travelled with them.
What the platform automates
Rules, workflows, alerts and scheduling that run the routine so your team works the exceptions.
Alert-to-investigation intake
Alerts and referrals from screening and monitoring open investigations automatically with scope, subject and owner.
SLA & ageing alerts
Investigations approaching or breaching their due date are escalated automatically along the defined path.
Evidence reminders
Findings recorded without linked evidence prompt the analyst before the investigation can be closed.
Finding-driven actions
A material finding automatically raises a linked follow-up action, control weakness or case escalation.
Review routing
Completed investigations route automatically to the appropriate reviewer where four-eyes sign-off is required.
Where AI helps the analyst
Assistive, decision-support features that speed up the work on the record. Suggestions are always reviewable, and a person stays in control of every decision.
Evidence summarisation
Summarises attached documents and records so the analyst can grasp the material quickly, then verify it before relying on it.
Line-of-enquiry suggestion
Suggests lines of enquiry and related records worth considering based on the concern, which the analyst chooses whether to pursue.
Finding-draft assistance
Drafts a first version of the finding from the recorded evidence and notes for the analyst to edit, correct and own.
The enterprise workflow
A defined, end-to-end process with clear ownership at every stage.
Every result, decision and override is captured against the record it belongs to.
Open & scope
An alert, referral or concern is opened as an investigation with a defined scope, subject and owner, and a due date from the outset.
Gather evidence
The analyst collects documents, records and screening results, attaching each and linking it to the point it addresses.
Analyse
Hypotheses are tested and lines of enquiry pursued or ruled out, with entities and events mapped and the reasoning recorded as it forms.
Reach a finding
The conclusion is documented with its rationale and the evidence that grounds it, ready for review where policy requires it.
Decide & act
A disposition is recorded and any follow-up — an action, a control weakness, or escalation to a case — is raised so the finding drives the next step.
Close & preserve
The investigation closes with its evidence, analysis and outcome preserved on an immutable trail for audit and examination.
What your team gains
Investigated to a standard
A defined method means concerns are investigated the same way whoever runs them, so the firm can demonstrate consistency rather than hope for it.
Reasoning preserved, not reconstructed
Hypotheses, evidence links and rationale are captured as work happens, so a conclusion questioned later is already fully accounted for.
Nothing sits unowned
Clear ownership, due dates and escalation make ageing investigations visible before they become a supervisory finding.
Findings drive action
A conclusion can raise a linked action, control weakness or case, so investigations change what happens next instead of ending in a report.
The full analytical trail
What was considered and ruled out is preserved alongside the outcome — the part of an investigation examiners most want to see.
Faster examination response
Because the method, evidence and reasoning are all on the record, showing how a concern was investigated is retrieval, not a scramble.
Industries it serves
Works with your existing systems
Described as capabilities — OnyxOne connects to the systems your deployment requires, configured per implementation.
- Opens investigations from alerts raised by your screening, monitoring and AML modules
- Connects to your existing customer and entity systems so analysts investigate from the authoritative record
- Pulls and preserves supporting evidence from your existing document repositories
- Escalates investigations into full cases with evidence and reasoning carried across
- Routes assignments, reviews and escalations through your existing email and messaging channels
Security, compliance & reporting
Security & data handling
- Investigation records, evidence and findings are encrypted in transit and at rest.
- Role-based access controls who can open, work, review and close an investigation, with need-to-know restrictions on sensitive matters.
- Segregation of duties can separate the analyst who investigates from the reviewer who signs a finding off, where policy requires it.
- Every note, hypothesis, evidence item and disposition is written to an append-only audit trail.
- Evidence is preserved with a record of what was added and when, protecting the integrity of the investigation file.
- Data residency and retention for investigation records are configurable to your regulatory obligations.
Compliance support
- Supports investigation and record-keeping expectations under AML/CFT regimes
- Underpins suspicious-activity investigation and escalation workflows
- Provides documented, timestamped reasoning for internal audit and regulatory examination
- Supports conduct, complaint and internal-referral investigation obligations
- Evidences a consistent, repeatable investigation standard across the team
Reports & exports
- Investigation status, ageing and SLA-adherence reports
- Finding and disposition reports with linked evidence
- Analyst and team workload reports
- Escalation and review reports
- Full investigation files with analysis and evidence for audit or regulatory request
- Management information on investigation volumes, outcomes and trends
How to get the most from it
Scope before you dig
Define what the investigation is trying to establish at the outset. A clear scope keeps the work focused and makes it obvious when the question has been answered.
Link evidence to the point it proves
Attach evidence against the specific finding it supports, not as a loose pile. A conclusion that points to its evidence is defensible; one that does not is an opinion.
Record what you ruled out
The lines of enquiry you dismissed are part of the reasoning. Capturing them shows an investigation was thorough, not just that it reached an answer.
Turn findings into actions
Close the loop by raising a linked action or escalation from every material finding, so the investigation changes something rather than being filed and forgotten.
Questions, answered
How is an investigation different from a case?
A case is the container that holds the record, ownership and workflow; an investigation is the analytical discipline that runs inside it — scope, evidence, hypotheses, findings. In practice they work together: an investigation can be run within a case, and a serious investigation can be escalated into one.
Can we define our own investigation method?
Yes. The stages, the points at which review or four-eyes sign-off is required, the SLAs and the escalation paths are configurable, so the method reflects your policy and operating model rather than a fixed template.
How is the analyst's reasoning captured?
Hypotheses, lines of enquiry, notes and the rationale for the disposition are recorded on the investigation as the analyst works, and each is written to an append-only trail — so the thinking, not just the outcome, is preserved.
What happens to a finding when the investigation closes?
A finding can raise a linked follow-up action, log a control weakness, or escalate into a financial-crime or conduct case, so the conclusion drives the next step. The full file is then preserved for audit and examination.
Is OnyxOne making the investigative judgement?
No. The platform structures the investigation, organises the evidence and can surface signals to consider, but the analyst forms the hypotheses and owns the finding. OnyxOne is decision-support software, not a substitute for the investigator's judgement.
Related modules
See Investigations in your programme
Book a walkthrough and we'll show how this module fits your policy, workflows and obligations — then scope an implementation.