When misconduct is suspected, what should we do first?

The first hours matter, and they should be run to a plan and not to a reflex. In order: accuse no one, and do not put the suspect on notice yet, or evidence may be destroyed. Then place the evidence under legal hold — suspend routine deletion and log rotation for e-mails, system and access logs, accounting records and physical documents. Keep the information inside a narrow circle on a need-to-know basis and, where there is a conflict of interest, appoint an impartial team to run the investigation. Only then commit the scope to a written plan covering which data will be examined and by whom, and the limits the data protection legislation sets. A process built early and correctly uncovers what happened, keeps the evidence usable, and protects the company against counterclaims.