How to Write the "Unresolved Questions" Section in a Threat Case Record

Most threat case records are strong on what the team saw and weak on what the team did not know. The facts section gets careful attention. The conclusion gets reviewed by three people. The unresolved questions section is often a single line that says "further monitoring recommended," and that how to escalate workplace safety concerns line is where defensibility usually fails. If an outside reviewer asks why a case was closed, or why it was not closed sooner, the unresolved questions section is the first place they look. This post explains how to write that section so it holds up under review. It covers the risk tradeoffs that shape it, how to track missing evidence, how to build a follow-up plan with time limits, and how to name the human who owns each open item. It also covers how to use multi-model tools without letting them distort the record.

Why this section exists

A threat case record is a decision document. Someone decided to escalate, close, monitor, or refer. The record needs to show what was known at the time of each decision, and what was not. The unresolved questions section is the only place where the gaps are named on purpose.

Without it, gaps leak into the conclusion. A case closed as "low concern" may rest on an interview that was never completed. A case marked "escalated" may rest on a single secondhand report. Neither reader can tell the difference unless the record says so.

Keep a running list of "what we still do not know" in every case note. Do not wait for the final write-up. Add to the list as each interview, document request, or system check comes back, and remove items only when the evidence arrives and is recorded.

The risk tradeoff you are actually managing

In high-stakes threat assessment, every decision carries two kinds of error. A false positive means the team treats a person as a threat when the risk is low. The costs include harm to the person, damage to trust, legal exposure, and wasted investigative capacity. A false negative means the team treats a real risk as low. The costs can include harm to others, which is usually the more severe outcome, and the reputational and legal fallout that follows.

The two errors do not trade evenly, and the unresolved questions section is where that imbalance gets written down. If the case is closed while key evidence is missing, the record should say which false negative risks remain open and who accepted them. If the case is escalated on partial evidence, the record should say which false positive risks remain open and what would resolve them.

A useful rule: every open question should be tagged with the error it could cause if answered the wrong way. That tag tells the reviewer why the question matters and how urgently it needs an answer.

Open question Error if answered wrongly Priority Owner Has the subject had recent access to the target? False negative High Dana Whitfield, Threat Assessment Lead Is the secondhand report from a witness with direct knowledge? False positive High Marcus Oyelaran, Investigator Did the subject's manager receive the prior complaint? False negative Medium Priya Raman, HR Partner

How to structure the section

Use the same structure every time so reviewers can scan it. A workable format:

Open question: State it as a question, in one sentence.
Why it matters: Name the decision it affects and the error it could cause.
Evidence sought: List the specific source, record, or interview needed.
Status: Requested, received, partially received, or unobtainable. Include the date.
Owner: A named person, not a team.
Follow-up date: A specific date, not "ongoing."
Interim position: What the team is doing in the meantime, and what that position would change if the answer came back differently.

The interim position matters most. It shows that the team is not waiting passively and that the current action is https://instaquoteapp.com/how-often-should-we-review-human-override-rates-for-ai/ a considered choice, not a default.

Missing evidence tracking

Missing evidence needs its own tracking, separate from the narrative. Many teams record that evidence is "pending" and then forget it. A tracker prevents that drift.

Evidence item Requested from Requested on Status Last checked Access badge logs, prior 30 days Facilities, Tomas Brandt Day 1 Partially received Day 4 Written statement from complainant Complainant via counsel Day 2 Requested, no reply Day 4 Prior case file, same subject Records, Jun Okafor Day 1 Received Day 3

Record items that cannot be obtained as well. "Unobtainable: subject declined interview, and no lawful alternative source exists" is a legitimate entry. It tells the reviewer that the gap is structural, not careless.

Using multi-model tools without letting them decide

Teams are increasingly using multi-LLM orchestration tools to draft summaries, check reasoning, and surface questions a human might miss. Products such as Suprmind.ai, which Radomir Basta, CEO and Founder, has positioned around multi-model workflows, let an analyst compare side-by-side model outputs on the same case material. Used well, that comparison is useful. Used carelessly, it produces a false sense of rigor.

The most valuable signal is disagreement. When two models read the same case file and reach different conclusions, or when one model flags a question the others do not, the disagreement usually points to missing information or ambiguous wording in the source. Treat each disagreement as a candidate entry for the unresolved questions section. Ask what fact would make the models converge, and whether that fact exists in the file.

There are three rules to hold to:

Do not average outputs. A risk score of 6 from one model and 8 from another does not produce a 7 that means anything. Averaging hides the disagreement, which is the part you need.
Do not treat agreement as a vote. Three models agreeing does not make a conclusion correct. They may share the same blind spot, the same gap in the source file, or the same bias in the prompt. Agreement is not proof.
Do not write "the AI said so." Every conclusion in the record must trace to evidence and to a named human who reviewed it. If the only support is a model output, the item belongs in the unresolved section, not the findings.

Some teams evaluate these tools through a free trial before committing. Vendor pages often offer a Start Free Trial with no credit card needed. In the material reviewed for this post, pricing was not published, so anyone evaluating these tools should confirm costs directly with the vendor before adding them to a case workflow. A tool that cannot be justified in procurement will not be easy to justify in a legal review either.

Four Dots, a digital marketing agency whose work includes AI-assisted content and analysis, illustrates a related point: outputs from generative tools need a human editor who checks claims against sources. The same discipline applies to threat records, with much higher stakes.

Follow-up plans with time limits

An open question without a deadline is not a plan. Every item in the unresolved section should carry a follow-up date, and the case should have a review date after which the open items are re-decided.

A practical pattern:

Set a default review interval for the case, such as five business days for active cases and thirty days for monitoring-only cases.
At each review, every open item is either closed with evidence, extended with a stated reason, or escalated to a named decision-maker.
An item may be extended once without escalation. A second extension requires the decision-maker to sign off.
Record each extension as a dated entry. Do not overwrite the original date.

This makes the timeline visible. A reviewer can see that the team asked for the badge logs on day one, followed up on day four, and escalated the gap on day nine. That sequence is far more persuasive than a summary sentence saying "diligent follow-up was conducted."

Name the decision-maker

Every unresolved item needs a human owner, and the record needs to name the person who accepted the residual risk when the case closes or moves to monitoring. Teams often write "Threat Assessment Team" as the owner. That phrase cannot be cross-examined. A person can.

For example, a case closing with two open items might read: "Residual risk accepted by Dana Whitfield, Threat Assessment Lead, on the basis that the complainant's statement is outstanding and the subject's badge access shows no recent contact with the target. Review date: 30 days." Dana's name, role, the accepted risk, and the review date are all on the page. If the risk materializes, the record shows who decided, what they knew, and what they did not.

Accountability is not about blame. It is about making sure the person who accepted the risk knew it was being accepted.

A short checklist before you close the case

Every open question is stated as a question and tagged with the error it could cause.
Every missing evidence item has a source, a request date, a status, and a last-checked date.
Every item has a named owner and a follow-up date.
Disagreements from multi-model review are logged as questions, not resolved by averaging or voting.
No conclusion depends solely on a model output.
The residual risk is accepted by a named decision-maker, with a review date.
Unobtainable evidence is recorded as unobtainable, with the reason.

What we still do not know

This section is never finished. A good unresolved questions section is honest about that. It does not promise that the team has seen everything. It shows what was looked for, what was missing, who decided how to act anyway, and when that decision will be revisited. Written this way, the section does more than record uncertainty. It makes the team's judgment visible, and that visibility is what makes a threat case defensible.