Work Understanding: Suspicious work
Objective. Open the suspicious-work view, read a flag as a prioritised signal to investigate, and state out loud why it is never a verdict on a person.
This screen surfaces work patterns that deviate from the norm so an investigator knows where to look first. It answers 'where is the work behaving oddly and worth a human look?' - not 'who is cheating'.
See it in the demo
What this screen answers
The customer question is: across all this observed work, which patterns look unusual enough to warrant a human review before we trust them? A Sales or CSM person opens it when a prospect asks how Time Champ helps them find anomalies - duplicated steps, work that completed impossibly fast, out-of-sequence actions, or activity that does not match the expected process - without hand-auditing everything.
The honest framing to lead with: this is a triage queue of signals, built to concentrate reviewer attention where deviation is highest. It is the opposite of a surveillance verdict - it exists so a human looks at the right 2 percent instead of guessing.
The task
- Open the suspicious-work screen from the Work Understanding overview.
- Scope to a single process or team and a defined period so the flags are comparable - an anomaly only means something against a baseline of normal for that same work.
- Pick one flagged item and open its evidence: what observed pattern triggered it, and against what expected behaviour.
- Narrate the investigation, not a conclusion: 'this is flagged because X deviates from the norm - the next step is a human review of the actual case, not an action against a person.'
Do not read exact trigger thresholds or control labels aloud as product fact; describe the task at the level of scope, baseline and evidence.
How to read it
A flag is a ranked signal of deviation, not proof of wrongdoing. The classic misread is treating a flagged person or case as guilty - the number only says 'this departs from the pattern enough to look at'. Deviation has innocent causes: a genuinely complex case, a tooling change, a new joiner, a data gap, or a legitimate shortcut.
Read it against the right baseline: unusual compared to what, for which process, over what period. A flag with no comparable baseline is noise. And volume of flags is a property of the detector's sensitivity, not a measure of how much misconduct exists.
Honest limits
This screen does not prove intent, misconduct, or even an error - it proves a pattern differed from expectation with some confidence. It cannot by itself support a disciplinary decision; that needs human investigation of the underlying case and the customer's own HR and evidence process.
Confirm with product how suspicious patterns are detected for a given customer, what confidence and coverage apply, and what the customer's governance allows this data to be used for. Never position flags as an 'employee catching' tool - position them as reviewer triage that protects both quality and the employee from an unfounded assumption.
Use it in the field
When a prospect leans toward 'so this catches slackers', redirect to the defensible value: it finds work worth a second look, so reviewers spend time where it matters and good performers are not swept into blanket audits. Pair with a discovery question: 'today, how do you decide which cases to audit, and how much reviewer time does that cost?'
Interpretation check
A suspicious-work flag is a prioritised signal to investigate, never a verdict on a person. Deviation from the norm has many innocent causes; a flag only earns a human review, not an action.
In the field
In an RCM operation, a 'completed impossibly fast' flag on a claims step usually points to a data or mapping gap or a simplified case, not fraud - exactly the kind of thing a reviewer confirms before trusting a productivity number.
Practical task
On the demo suspicious-work screen, scope to one process and period, open a single flag, and write a two-line finding: what pattern deviated and against what baseline, then the next investigative step - phrased as a review to run, not a conclusion about a person.
Self-check
A prospect points at a flagged employee and says 'so they are the problem'. What is the correct response?
The flag only means this work deviated from the expected pattern enough to look at. It is a signal to investigate the actual case, not proof of wrongdoing or a verdict on the person. Innocent causes are common.
Why does a flag need a baseline before it means anything?
An anomaly is 'unusual compared to the norm for this same process, team and period'. Without a comparable baseline there is nothing for the deviation to be measured against, so the flag is noise.
Does a high number of flags mean there is a lot of misconduct?
No. Flag volume reflects the detector's sensitivity and the amount of normal variation, not the quantity of misconduct. It tells you how much to review, not how much is wrong.
What must happen before a flag could support any action against a person?
A human investigation of the underlying case, plus the customer's own evidence and HR governance. The screen never supports a disciplinary decision on its own; confirm permitted use with product and the customer.
Verified vs demo. Screen is live in the demo at /#/suspicious; exact controls, trigger logic and figures are SME-validation-pending, and detection method, confidence and permitted use must be confirmed with product and the customer.