Workplace Investigations: A Quick Reference

1. When a complaint requires one

Investigate when a complaint, an observation, an anonymous tip, or an exit interview alleges conduct that — if true — would violate policy or law. Two traps at this stage: treating “I don’t want to make it formal” as permission to do nothing (the company knows now, and the duty doesn’t care about formality), and the quiet hallway chat that gets remembered later as “the company investigated and did nothing.” If it’s worth a conversation, it’s worth a file.

2. The first 48 hours

Decide interim measures before the first interview: schedule changes, remote work, paid administrative leave for the respondent where warranted. The cardinal rule is that interim measures never burden the complainant — moving the person who complained reads as punishment, and the law treats it that way. Preserve the obvious evidence now: messages, schedules, badge and system data, video before it cycles.

3. Choose the investigator deliberately — this is the privilege fork

Three options, three different futures for the file:

• HR investigates. Right answer for most matters. Fast, credible, knows the workplace. Assume everything created is discoverable — which is fine, if the investigation is good.
• Counsel directs the investigation. For matters with real litigation risk. Privilege can attach to communications, but it’s nuanced: facts are never privileged, and if you later rely on the investigation as a defense, you may waive protection over it. Decide with eyes open.
• Outside investigator. For allegations against executives, HR itself, or anyone the in-house team can’t credibly investigate. Independence is the product you’re buying; don’t undermine it with instructions.

4. Plan before the first interview

Map each allegation to the policy or legal element it implicates — that list is your evidence plan. Collect documents before interviews so you can ask about what exists rather than what people remember. Default interview order: complainant first, witnesses next, respondent last, so the respondent interview can address everything gathered. Depart from the order when there’s a reason; write the reason down.

5. In the interviews

• Open questions, then specifics. “Walk me through that shift” outperforms a checklist of yes/no questions.
• No promises of absolute confidentiality — promise discretion and need-to-know instead, because that’s what you can deliver.
• Tell every interviewee, plainly, that retaliation is prohibited and how to report it.
• In unionized workplaces, an employee is entitled on request to a representative in an investigatory interview that could lead to discipline. Plan for it rather than litigating it mid-interview.
• Notes record what was said, not the interviewer’s commentary. “Seemed evasive” in a margin becomes a deposition exhibit.

6. Findings worth signing

The standard is preponderance — more likely than not — not proof beyond doubt, and “inconclusive” is a finding only when the evidence genuinely balances, not a place to hide. Where accounts conflict, work the recognized credibility factors: inherent plausibility, corroboration, motive to fabricate, demeanor, and history. Find facts and policy violations; leave legal labels like “harassment” or “discrimination” to counsel, because those words in a findings memo write the other side’s brief.

7. Close the loop, then watch

Tell the complainant and the respondent that the investigation concluded and what happens next — at minimum “we investigated, we took appropriate action.” Silence convinces complainants nothing happened, and that belief files lawsuits. Then calendar retaliation check-ins with the complainant at 30, 60, and 90 days. Retaliation after a well-run investigation is the most common way a defensible matter becomes an indefensible one.

The file you should end with

• The complaint or intake notes, dated
• The investigation plan, including any interim measures and their rationale
• Interview notes or memos for every interview, dated and attributed
• The documents and data reviewed
• A findings memo: allegations, evidence, credibility analysis, conclusions
• The action taken and who approved it
• Closure communications and the follow-up calendar