False Statements to Investigators

A subject knowingly provides materially false factual statements during an internal or external inquiry concerning the subject's activity or relevant evidence. The statements may be made to insider threat investigators, incident responders, auditors, Human Resources, Legal, regulators, or law enforcement. They may concern actions performed, access exercised, instructions received, communications exchanged, information retained, or the existence and location of relevant artifacts. The defining behavior is an affirmative factual representation that the subject knows is false and supplies to mislead the inquiry.

The false statement may deny an action, invent authorization, misrepresent the purpose of a transfer, or provide a false explanation for possession of information or use of a service. It may be provided verbally, in a written response, or through a record submitted for investigative review. Investigators should distinguish a demonstrably false statement from an unsupported statement, an incomplete recollection, or an account that changes following clarification. Establishing that a statement conflicts with a record is a starting point, classification also requires evidence that the subject knew the statement was false when it was made.