How to conduct a workplace investigation

A workplace investigation is the fact-finding your organization runs after someone reports a grievance, a harassment complaint, a conduct issue, or any other employee relations concern. Some teams call it the HR investigation process. The label does not change the mechanics: establish what happened, decide whether it broke policy or law, and act on that finding in a way that holds up if someone challenges it later.

This guide is written for US employers, so the standards below are the US ones: EEOC expectations on timing, federal antidiscrimination law, and the preponderance of the evidence test rather than a criminal one. The workplace investigation process itself holds for any case type. A discrimination complaint and a timekeeping dispute need the same structure. What changes is who you interview and which policy you are testing the facts against.

Who should lead the investigation

Pick an investigator with no stake in the outcome. The person under investigation should not supervise the investigator, directly or indirectly, and the investigator should not report to anyone with a personal interest in a particular result. Smaller teams often have no internal option, which means bringing in outside counsel or a third-party investigator.

Beyond impartiality, the investigator needs two skills: structured interviewing and credibility assessment. Most workplace misconduct happens without witnesses, so the case usually comes down to conflicting accounts. Someone untrained in weighing those accounts will struggle to reach a conclusion that survives scrutiny.

Record the appointment in the case file along with the reason this person has no conflict. It takes one line, and it answers the first question any outside reviewer asks.

The workplace investigation process, step by step

These workplace investigation steps apply regardless of case type, though the detail shifts with the allegation.

Before the interviews

• Act fast. Open the investigation as soon as the complaint lands. The EEOC expects employers to take prompt and appropriate corrective action once they know about a problem. If the report involves harassment, how you respond in the first few days shapes the rest of the case. Waiting weeks without a documented reason is itself a risk.
• Plan the scope. Write down which allegations you are investigating, which policies apply, and who you need to talk to. Scope creep is what turns a two-week investigation into a three-month one.
• Decide on interim measures. If there is a credible risk of further misconduct, intimidation, or evidence disappearing, separate the parties while you work. Keep the measure neutral: moving the complainant to a different shift looks like punishment and can become a retaliation claim on its own. A paid suspension, a temporary reporting-line change, or restricted system access for the respondent usually sits better.
• Secure the evidence. Emails, chat logs, schedules, access records, security footage, prior complaints about the same person. Collect it before anyone has a reason to delete it.

The interviews

• Interview the complainant first. Take their full account in their own words before you speak to anyone else, and ask what outcome they are looking for. It will not decide the finding, but it tells you what resolution actually resolves anything.
• Interview the respondent. Put the specific allegations to them and give them a real chance to answer, including the chance to name witnesses of their own. Procedural fairness here is what makes the eventual finding defensible.
• Interview witnesses. Talk to anyone who may have relevant information, not only the people the complainant and respondent nominate.
• Be clear about confidentiality. Tell every participant what you can and cannot promise before the interview starts, rather than after they have asked for something you cannot give.

After the interviews

• Weigh the evidence. Compare accounts against documents and timelines, and work out who is more credible where the stories conflict.
• Reach a finding. Decide whether the conduct more likely than not occurred, using the standard below.
• Write the report. Do it while memories are fresh and before anyone has revised their version of events.
• Communicate the outcome. Tell the complainant and the respondent the result, without handing either of them detail the other is entitled to keep private.
• Act, then follow up. Match the corrective action to the severity of the finding, then check back weeks later to confirm the conduct stopped and nobody has been punished for taking part.

The standard of proof: preponderance of the evidence

Workplace investigations do not use the criminal standard of beyond a reasonable doubt. They use preponderance of the evidence: more likely than not, or just over 50%.

That bar sits lower than most people expect from the word "investigation." It exists because misconduct rarely happens in front of witnesses, and a stricter standard would make almost every finding impossible. Lower does not mean looser. The investigator still has to weigh the evidence, explain why one account is more credible than another, and reach a conclusion a reasonable person could arrive at from the same facts. Speculation is not evidence, and an investigator who claims false certainty causes as much trouble as one who refuses to conclude anything.

What you can and cannot promise about confidentiality

Participants almost always ask whether what they say stays private, and the honest answer has limits. You can restrict the case file to the people working on it, keep names out of wider communications, and ask participants not to discuss their interview while the case is open. You cannot promise the respondent will never work out who complained, because answering an allegation requires knowing what was alleged and when it happened.

Standing instructions that forbid employees from ever discussing an investigation have drawn scrutiny from the National Labor Relations Board, so run any blanket confidentiality rule past employment counsel before you make it policy. Saying this plainly at the start of an interview costs you nothing. Promising total secrecy and then breaking it costs you the witness.

Protecting against retaliation during the investigation

Anyone who takes part in an investigation, whether as complainant, witness, or the respondent answering questions, is protected from retaliation for that participation. The protection holds even if the original complaint turns out to be unfounded, as long as the person did not act in bad faith. A written non-retaliation policy gives your team a standard to point to before a case ever tests it.

In practice that means watching how the organization behaves while the case runs. A manager who quietly reassigns a witness, drops them from a project, or cools on them after they gave a statement creates a second case. Retaliation claims tied to how an investigation was handled are common, and they can turn a defensible finding on the original complaint into a harder problem than the one you started with.

What a workplace investigation report should include

A usable report answers five questions: what was alleged, what evidence you gathered, what each party said, what the investigator concluded and why, and what happened next. Cut the parts that read like a transcript. Keep the parts that show your reasoning, which accounts you found credible, what evidence supported that, and how you handled the places where the evidence pointed both ways.

Neither party is entitled to the full report or to every witness statement. What they get is the outcome and, where appropriate, the general basis for it. Retain the file under your organization's record-keeping policy once the case closes, and keep everything untouched if a charge or lawsuit follows.

Where investigations fit in your wider case load

One investigation done well proves nothing on its own. The pattern across a year is what tells you whether the process is working: how long cases take, which teams generate them, how often findings are upheld on appeal. That view only exists if every case runs the same way and lands in the same place, which is the job of employee relations case management. If grievances make up most of your volume, HR grievance software handles that intake and resolution path specifically.

FAQ

How do you conduct a workplace investigation?

Assign an impartial investigator, plan the scope, secure the evidence, then interview the complainant, the respondent, and relevant witnesses. Weigh what you have against the preponderance standard, document the finding and the reasoning behind it, communicate the outcome to both parties, and take corrective action.

Who should lead an HR investigation?

Someone with no personal stake in the outcome and no reporting relationship to the person under investigation. For smaller organizations that is often outside counsel or a third-party investigator rather than an internal manager.

How long should a workplace investigation take?

There is no fixed statutory deadline for most US cases. The standard is a prompt investigation, so what protects you is a documented reason for any delay: a witness on leave, a device still being imaged, counsel reviewing a privileged question.

What should a workplace investigation report include?

The allegation, the evidence gathered, each party's account, the investigator's conclusion and reasoning, and the outcome. It should show how the investigator weighed the evidence rather than only stating a conclusion.