Best Practices for Structuring Cases

Poorly structured cases can result in:

• Duplicate cases and records
• Information stored across disconnected locations
• Difficulty identifying relationships
• Incomplete investigation history
• Confusion over ownership and responsibility
• Missed tasks or follow-up actions
• Inconsistent reporting
• Limited collaboration
• Compliance and audit risks

Properly structuring a case helps investigators organize evidence, avoid duplicate records, improve collaboration, and simplify reporting. 

OWL provides a centralized Case Dossier where authorized users can organize and manage:

• Subjects
• Documents and media
• Forms
• Notes
• Tasks
• Tips and leads
• Reports
• Search results
• Imported records
• Monitoring activity
• Deconfliction results
• Collaboration
• Audit history
• Security and compliance settings

OWL also allows related cases to be associated without duplicating the same information.

Although the types of records captured may vary by industry, the overall case structure should remain consistent.

Business Value by Industry

Insurance Use Cases

OWL can help insurance organizations:

• Organize all records related to a claim investigation within one case.
• Connect claimants, insured parties, providers, vehicles, witnesses, and related entities.
• Keep claim documents, medical records, photographs, reports, and investigative notes together.
• Identify related or previous claims without creating duplicate records.
• Assign and monitor investigator tasks.
• Support collaboration among SIU, Claims, Legal, and Compliance teams.
• Maintain a complete audit history for regulatory and internal review.

Law Enforcement Use Cases

OWL can help law enforcement organizations:

• Organize suspects, victims, witnesses, vehicles, locations, and organizations under one investigation.
• Connect evidence, reports, photographs, videos, warrants, and interview notes.
• Associate related investigations without duplicating records.
• Assign investigative tasks to officers, analysts, and partner agencies.
• Support deconfliction and relationship analysis.
• Apply access restrictions, retention policies, and legal holds.
• Preserve a complete and defensible investigation history.

Government and Corporate Use Cases

OWL can help government and corporate organizations:

• Manage internal investigations, ethics matters, regulatory reviews, and security incidents.
• Coordinate work among Human Resources, Legal, Compliance, IT, and Corporate Security.
• Organize emails, system logs, interview notes, reports, and digital evidence.
• Restrict access to sensitive investigations.
• Maintain auditability and regulatory compliance.
• Associate related matters while keeping each investigation clearly defined.

General Best Practices

Follow these recommendations when creating and managing cases:

1. Create one case per investigation. Create a single case for the entire investigation rather than separate cases for each person, document, or incident.
2. Use Clear and meaningful case names. Choose clear, descriptive names that make cases easy to identify.
   • Vehicle Theft Investigation – July 2026
   • Insurance Fraud – Claim #45821
   • Confidential Data Leak Investigation
3. Use a Consistent Case Number Format. Follow the organization’s approved case-number convention. A case number may include:
   • Year
   • Department
   • Investigation type
   • Sequence number
   • Claim or incident reference

   • Do not create multiple case numbers for the same investigation unless organizational policy requires it.

4. Keep all related information together. Add all investigation records—including subjects, documents, reports, notes, tasks, forms, and tips—to the same case so investigators have a complete view of the investigation.

5. Structure Subjects Carefully. Create a Subject for each relevant person, organization, vehicle, location, asset, or other entity under review. 

   Before creating a new subject:

   • Search for an existing subject.
   • Review possible matching records.
   • Attach the existing subject when appropriate.
   • Create a new subject only when a valid record does not already exist.
   • Use subject types and attributes consistently so records can be searched and analyzed accurately.
6. Associate related cases instead of duplicating records. When investigations are connected, link the cases rather than recreating the same information.
7. Assign tasks to investigators. Use case tasks to track interviews, evidence reviews, document collection, and other investigative activities.
8. Keep the case updated. As the investigation progresses, add new evidence, notes, reports, and status updates to maintain an accurate investigation record.

9. Use Notes Consistently. Use configured Note Types, Subtypes, templates, and sensitivity settings. 

   Notes should:

   • Clearly describe the activity, observation, or finding.
   • Include relevant dates and context.
   • Avoid unsupported conclusions.
   • Be written professionally.
   • Follow organizational documentation policies.
   • Use the appropriate sensitivity classification.

   • Not be used as a replacement for formal reports when a report is required.

10. Use Templates and Forms. Apply Case Templates and Forms when available to standardize data collection.

    Templates help:

    • Ensure required information is captured.
    • Improve consistency across investigations.
    • Reduce incomplete records.
    • Support reporting and analytics.
    • Enforce organization-specific workflows.
11. Leverage collaboration. Share cases with authorized users, departments, or external agencies when multiple teams are involved.
    • The user has a valid business need. 
    • The correct access level is selected. 
    • Read-only collaborators cannot modify records. 
    • Full-access collaborators receive only the permissions required. 
    • External sharing complies with organizational policy. 
    • Expiration dates are applied when appropriate.
12. Apply Security and compliance settings appropriately. Configure retention policies, legal holds, access restrictions, and other compliance controls according to organizational requirements.
13. Review the Case Before Closing. Before closing a case, confirm that:
    • Required tasks are complete. 
    • Evidence and documents are attached. 
    • Reports are finalized. Notes are current. 
    • Subject information is accurate. 
    • Related cases are associated. 
    • Required approvals are complete. 
    • Outstanding monitoring or follow-up work has been addressed. 
    • Compliance and retention settings are correct. 
    • The final status reflects the investigation outcome.

Industry Examples

Law Enforcement Investigation

Scenario

A police department receives reports of several vehicles being stolen from different neighborhoods during the same week. During the investigation, officers determine that all thefts are connected to the same group of suspects.

Instead of creating separate investigations for each suspect or evidence item, investigators create a single case:

Case: Vehicle Theft Investigation

All investigation information is managed within this case.

Benefits

• Keeps related information in one location.
• Makes relationships between people, evidence, and cases easier to identify.
• Reduces duplicate records.
• Improves collaboration among investigators.
• Simplifies reporting and case review.

Insurance Fraud Investigation

Scenario

An insurance company receives a claim following a vehicle accident. During the investigation, the claims examiner discovers that the claimant has submitted similar claims previously.

A single investigation is created:

Case: Suspected Insurance Fraud – Claim #45821

The case contains:

• Claim details
• Policy information
• Claimant details
• Vehicle inspection reports
• Medical reports
• Accident photographs
• Previous claims
• Investigation notes
• Investigator tasks

Instead of creating separate cases for previous claims or supporting documents, all related records are linked to the same investigation.

Benefits

• Improves fraud-pattern identification. 
• Prevents duplicate investigations. 
• Keeps supporting documentation together. 
• Supports collaboration among SIU, Claims, and Legal teams. 
• Improves audit and regulatory readiness.

Corporate Investigation

Scenario

A company suspects that an employee has shared confidential business information with an external party.

A single investigation is created:

Case: Confidential Data Leak Investigation

The case includes:

• Employee information
• Email communications
• System access logs
• Security alerts
• Interview notes
• Human Resources records
• Digital evidence
• Investigation timeline

If another investigation involving the same employee already exists, it is associated with the current case instead of duplicating information.

Benefits

• Maintains a complete investigation history. 
• Supports collaboration among HR, Legal, Compliance, and IT Security. 
• Reduces duplicate records. 
• Preserves a comprehensive audit trail. 
• Protects sensitive information through controlled access.