How to run a workplace investigation: the process, step by step

Most HR teams think a workplace investigation goes wrong in the interview room.

It usually doesn’t.

It goes wrong in the first 48 hours, before anyone has been interviewed. That’s where:

• The question gets set, or doesn’t
• The evidence gets kept, or doesn’t
• The person at risk gets protected, or doesn’t

This guide walks through the workplace investigation process end to end, for HR professionals who have just had a formal complaint land on their desk. The process works the same way in most places. The law around it doesn’t, so the points that differ between Australia and the United States are in their own section near the end. It’s operational practice, not legal advice. Where the legal risks are high, most organisations bring in employment law advice early.

Picture a Tuesday

It’s 4.40pm. An email arrives from a team leader.

Two people in her team say a senior manager has been shouting at them in meetings. One says it has been going on for months. There’s a screenshot attached, and a line at the bottom: “They’ve asked me to keep this confidential.”

Nobody’s favourite email.

What you do next decides whether, in eight months, you can show anyone exactly what happened and why.

1. Is this a workplace investigation at all?

This is the front door. If your HR intake and triage is a shared inbox and a good memory, this is where things slip.

Not every complaint needs one. Most start as a workplace complaint or grievance, and some are better handled by a conversation or mediation. An internal investigation makes sense when the allegations are disputed, could amount to alleged misconduct or a policy violation, and could lead to disciplinary action. Allegations of workplace harassment, workplace discrimination, bullying or workplace violence usually call for one.

Write down why you decided either way. “We chose informal resolution because…” is a decision you can explain later. Silence isn’t.

One more check: is it a whistleblower report? Those can carry their own legal protections, so many organisations run them through a separate whistleblower and protected disclosure process.

Who should conduct a workplace investigation?

Decide who investigates and who will determine the outcome. Where you can, keep them separate. Internal investigators work when someone with the necessary skills for conducting investigations is available, impartial and outside the reporting line. For complex situations or a senior respondent, experienced investigators from outside are often the safer call.

Is anyone at risk right now?

If the allegations involve harassment, violence or a risk to someone’s health, think about interim measures now: changed reporting lines, separate rosters, or a period away from work for the respondent in serious cases. Say in writing that this is not a finding.

Then ask a second question. Not only “what happened?” but “what needs to change so it doesn’t keep happening?” A complaint is often the first sign of a wider problem.

2. Plan the workplace investigation process: terms of reference

The terms of reference are the most underrated document in any workplace investigation.

They answer one question: what, exactly, are we trying to determine?

A good set covers:

• The allegations, as specific, numbered statements. Not “inappropriate behaviour” but “On 14 August, in the team meeting, X shouted at Y and called her work ‘useless’.”
• The scope. Who and what is in, and what is out.
• The question. For each allegation: did the conduct happen, and does it breach company policies or the code of conduct?

Add the investigator, the decision maker and a target date. When new allegations surface, update the terms in writing and tell the respondent.

3. Evidence: collect it, log it, leave the rest alone

Evidence goes missing faster than you expect. CCTV gets overwritten. Messages get deleted.

So gather relevant documents early:

• Emails, messages and screenshots
• Rosters, timesheets, swipe records and CCTV
• Prior complaints, personnel files and the policies as they stood at the time

Log every item in an evidence register as it arrives: what it is, who provided it, when, and which allegation it relates to. That’s your chain of custody. It sounds like admin. It’s what lets you say, months later, that the screenshot you relied on is the one you were given.

What not to touch:

• Originals. Work from copies.
• Personal devices or private accounts, without legal advice first.
• Other evidence, in front of potential witnesses. Show witness A what witness B said and you end up with one story told three times.

4. Interviews: complainant, witnesses, respondent

Many investigators interview the complainant first, then interview witnesses, then the respondent. That way the respondent can answer everything at once.

Put the allegations in writing first. Give enough relevant information for a genuine response: what, when, where and who.

Be clear about who can attend. Whether someone can bring a support person or a representative depends on where you are and whether there’s a union. Check before the invitation goes out, not on the day.

Keep notes as if someone else will read them. Because someone will. Record who was present, the questions and the answers, in the person’s words where it matters.

Give a real chance to respond. Before anything is decided, not after. Going through the motions once the decision is made is the fastest way to lose a fair process.

Don’t promise confidentiality you can’t keep

Back to that Tuesday email. “They’ve asked me to keep this confidential.”

You can’t promise that. The respondent has to hear the allegations to respond, and that often identifies the complainant. What you can do is maintain confidentiality on a need to know basis, tell the complainant early what will be shared, and make it clear that nobody will be punished for raising a concern or taking part. Retaliation claims often start when someone feels treated differently after speaking up.

5. Reaching investigative findings

Here’s where a lot of investigations wobble.

Most workplace investigations use the civil standard: is it more likely than not that this happened? But the more serious the allegation, the more careful you need to be with the available evidence. Serious findings shouldn’t rest on thin or vague evidence.

Make a finding for each allegation:

• Substantiated: it more likely than not happened.
• Not substantiated: the evidence doesn’t support it.
• Inconclusive: not enough evidence to determine either way.

“Not substantiated” is not “it didn’t happen”. Explain that early.

Then show your credibility assessments. If two accounts conflict, say which you preferred and why: corroboration, consistency, records made at the time. “I found X more credible”, with no reasons, is the sentence that unravels a finding when it’s challenged.

6. The outcome, the investigation report and the record

The investigator finds facts. The decision maker decides the appropriate action.

Outcomes range from no action, through coaching or training, to warnings and termination. Good practice is that, before any disciplinary outcome, the respondent sees the findings that matter and can respond to what is proposed. A warning or performance plan then usually carries on as an employee relations case.

Then the part most teams rush: the final report and the record.

A file assembled afterwards from email threads is a jigsaw with the box lid missing. Everyone involved can roughly see the picture. Nobody else can.

An investigation report that may have to stand up later, sometimes in a legal proceeding, contains:

• The trail: complaint, terms of reference, evidence register, interview records
• The reasoning: investigative findings for each allegation, and why
• The follow-through: appropriate corrective action, who owns it, and proof it was done

Need a starting point without committing to new software? Our free workplace investigation report template is a 12-section Word document, with no sign-up needed.

Ordinary tools strain here. Shared folders and spreadsheets weren’t built to hold allegations, evidence, witnesses and findings with an audit trail and tight permissions. That’s the gap workplace investigation software closes: one secure matter per investigation, from intake to action plan, as part of one system for complex HR matters.

What changes in Australia and the United States

The steps above hold in both. The legal backdrop doesn’t. A few points worth knowing, with the official source for each.

Australia

• Fairness before dismissal. The Fair Work Commission looks at whether the employee had an opportunity to respond and whether there was an unreasonable refusal of a support person.
• Serious allegations, careful proof. The standard is the balance of probabilities, applied with more care as the allegation gets more serious. The Commission’s benchbook on conduct explains this, known as the Briginshaw principle.
• Prevention, not just response. Safe Work Australia’s model Code of Practice on psychosocial hazards treats complaints as a sign a hazard may not be controlled. For sexual and sex-based harassment, the Australian Human Rights Commission’s positive duty guidance sets out what it expects.

United States

• Representation. In a unionised workplace, an employee can ask for a union representative at an interview they reasonably believe could lead to discipline. The NLRB explains these Weingarten rights.
• Retaliation covers witnesses too. The EEOC lists answering questions in an employer’s harassment investigation as protected activity, not just making the complaint.
• State law varies. The usual standard is the preponderance of the evidence, the same “more likely than not” test. But many states add their own rules, so check the state the employee works in.

Three common workplace investigation mistakes

• Letting the scope drift without updating the terms of reference.
• Deciding before the respondent has responded. It looks like the outcome came first, because it did.
• Closing without follow-up. Corrective action nobody checks becomes the next complaint, and future liability.

The one-line test

If someone who wasn’t there picked up the file in eight months, could they see what was alleged, what you found, and exactly why?

If yes, you ran an effective workplace investigation, and you have a template for future investigations.

If not, fix it now, not when the lawyer’s letter arrives.

FAQs

How long should a workplace investigation take?

As long as it needs to be fair, and no longer. Set a target date and tell the involved parties when it moves.

Do you need a third-party workplace investigation?

Not always. Internal investigators suit straightforward workplace issues. A trained investigator from outside is common when the respondent is senior, the allegations are serious, or legal liability is a real prospect. They also deliver an investigative report the decision maker can rely on.

Can the respondent be suspended during a workplace investigation?

Some organisations direct the respondent not to attend work, on full pay, while the investigation runs, where there’s a risk to others or to the evidence. Check the employment contract, any union or enterprise agreement and your own policy first, and confirm in writing that it isn’t a finding.