An internal report is not a finding of misconduct. The first step is to protect the records and limit access to people who need to review them, without turning a concern into a public allegation.
Record the concern
Note how and when the issue arose without treating an allegation as a finding.
Preserve relevant evidence
Keep original messages, contracts, payment records and access logs; restrict changes.
Set review roles
Identify who can investigate, who receives information and how conflicts are handled.
Decide next steps with counsel
Review reporting, employment and confidentiality duties before interviews or external statements.
If a payment looks unusual, retain the original authorization, invoice, contract and correspondence. Do not ask anyone to tidy up files or agree on a shared account of events.
General information only; a Kuwait-qualified lawyer and language reviewer should check the facts and current rules before use.