What are the steps that must be taken in order to finalize an internal investigation into a violation

What are the steps that must be taken in order to finalize an internal investigation into a violation, regardless of the person involved; who must sign-off on the review, and who is responsible for any administrative or legal actions?

As a follow on to my previous question, at what is a decision made to disclose the results of the investigation to a government agency such as HHS or DOJ, and what criteria is used to determine the notifications being made to a government agency? Any thoughts?