When should a log line of enquiry stop?¶

It should stop when further work is unlikely to change a material decision, test a realistic alternative or add proportionate evidential value. Completion is judged against the investigative question, not the number of possible sources.

Define what remains unresolved¶

The question may concern occurrence, sequence, account use, device involvement, outcome or personal attribution. Review what current records establish, which uncertainties matter and whether another available source could realistically resolve them.

Work may reasonably end where the proposition is answered to the required level, data never existed or expired, acquisition is disproportionate, or the remaining uncertainty does not affect the decision.

Make closure reviewable and reversible¶

Balance seriousness, risk, legal requirements, cost, specialist capacity and the consequence of error. A minor unresolved offset differs from disputed attribution in a serious case.

Record sources examined, residual limits, reason for closure and a concrete trigger for reopening. Stopping does not claim certainty; it records that further enquiry is not presently justified by likely value.