Suspicious Activity on Employee Accounts

My CU would like to create a procedure that outlines what should be done if an employee suspects (or hears about) something is going on with another employee and their personal CU account.  We don't want branch managers (or any employee) doing their own "investigation".  It should be brought to IA's attention, then we would get Risk/Compliance and/or HR involved as appropriate.  Does anyone have a procedure that speaks to this?  Thank you!