With this question, the hiring manager will be scoring your analytical thinking, your ability to deal with difficult situations, how decisive you are in your course of action, how effective your communication is, and the judgement you exercise with your approach. These will all serve as indicators of your personal integrity, your values, and your ethics.

Obviously, this would be a serious situation that would require swift action and discretion. You want to support your management's ability to do their job while adhering to the standards and guidelines put out by HR whose conduct is often informed by their legal department. There are some situations where it would be deemed prudent to approach the at fault co-worker first. But in this scenario, damage control should take precedent, and giving the coworker a heads up could solely serve in giving them time to cover their tracks and dispose of valuable information needed to repair the situation. So the wisest course is to pull aside a lead manager, one you can trust to handle this situation appropriately and inform them clearly of all the facts you have gathered as objectively as possible, and ask if there was anything you could do to continue to be of help.