Conducting Workplace Investigations – Best Practices and Trends

No two workplace investigations are exactly alike. Investigations are triggered by a wide range of issues – misconduct, performance, discrimination, harassment, health or safety concerns, or alleged criminal conduct, to name a few of the most common generators. Because of this variability, the best practices outlined herein are broad, rather than prescriptive. Effective investigations, regardless of the specific issue to be investigated, embody the core principles of fairness, thoroughness and impartiality – in turn, cloaking the investigation in legitimacy and providing the organisation with the objective data it needs to make an informed decision.

In the evolving landscape of workplace investigations, organisations are facing not only a surge in the number of complaints, but also a marked increase in their complexity. This change demands that employers allocate more resources and develop more sophisticated protocols to ensure their investigative processes meet contemporary challenges. For example, the widespread adoption of hybrid and remote work environments has significantly impacted how investigations are both initiated and conducted. Today, much of the evidence may be digital, ranging from screenshots and chat logs to emails and cloud-based documents. Consequently, investigators must now master new skills and leverage advanced tools to effectively gather and assess digital evidence and conduct remote interviews with professionalism and sensitivity.

Legal scrutiny of workplace investigations has also intensified. Courts and regulators often examine not just the outcome of an investigation, but the rigour and fairness of the process itself. Questions such as whether the investigation was objective, whether all relevant evidence was considered, whether the documentation supports the findings and whether every pertinent witness was interviewed all come under careful review. Prompt, impartial and well-documented investigations are now essential for reducing legal risk and demonstrating organisational integrity.

Additionally, the rapid evolution of employment laws, data privacy standards and regulatory enforcement has made compliance even more challenging. Staying updated with legal requirements is no longer optional – it is a necessity. As a result, organisations are increasingly seeking investigators who possess specialised skills, such as digital forensics expertise, cultural competence, trauma-informed interviewing techniques and a deep understanding of complex legal issues. The days when a single investigator could handle any workplace issue are fading, replaced by a growing emphasis on expertise and flexibility in response to the evolving demands of investigations. Organisations now recognise the importance of bringing in specialised skills and knowledge, and are incorporating expert support as needed to address increasingly complex situations.

Triggering events and threshold questions

Before initiating an investigation, an organisation must ask some threshold questions.

• Who is potentially involved, and to whom do they report?
• What workplace policies apply?
• What are the potential violations?
• What legal issues may be implicated?
• Is there a threat of harm/continuing harm to the complainant or others while the investigation is conducted?
• Is an investigation the next appropriate step?
• Is the employee being investigated a member of a unionised workforce? If so, make sure that you provide them their Weingarten rights (essentially, the right to have a union representative present when called into an investigatory meeting that may result in discipline) and that your methods meet all relevant procedural requirements, such as notification requirements and contractual time limitations.

Selecting the investigator

The cardinal rule is to execute a workplace investigation promptly, as well as thoroughly. There can sometimes be tension between those two elements. Delaying an investigation is never preferred, but better that an employer take heat for some delay than push ahead without a solid, respected investigator, capable of delivering a creditable investigative product, in place.

Selecting an appropriate investigator is critical for a workplace investigation, and the first step is resolving whether your investigator will be internal – an employee or known agent of your company – or external. If internal, the investigator should not have a direct or indirect reporting relationship to either the complainant or the individual being investigated. In some cases – for example, where the person being investigated is a high-ranking executive in the organisation – it may not be possible to identify an impartial investigator from within. In such cases, retaining an outside investigator is not only advisable, but necessary. Outside investigators may also be the inherently better choice in cases involving highly sensitive issues, public or notorious figures, potential criminal conduct or complex legal matters.

The organisation must also decide from the start whether it wishes for the results of the investigation to be protected by attorney–client privilege. If so, the investigation must be conducted under the auspices of legal counsel. While attorney–client privilege is often desirable, it may not be an appropriate buffer in some cases. For example, an organisation may wish to have the freedom to disclose an investigator’s report without risking a waiver of the privilege (such as when the organisation is preparing a response to a governmental investigation or legal proceeding).

The person or persons chosen to investigate must be committed to conducting a prompt, thorough investigation; must be impartial and objective (ie, no ‘stake’ in the outcome of the investigation); must have well-honed interviewing skills and experience; and must properly document the investigation – excellent witness interviews are of little value if their contents are not properly memorialised or recorded. In addition, you would be wise to select an investigator who you know to be well-organised and conscious of the need for, and the mechanics of, assembling a thoughtfully developed plan, and revising quickly, if necessary, similar to a lawyer cross-examining a key witness at trial. The investigator should be comfortable making recommendations on specific remedial action, if determined necessary to appropriately address any misconduct found.

The investigative plan

After the investigator is selected, the first order of business is to review the complaint and identify the issues to be investigated. The investigator should identify, secure and review all relevant documents (relevant workplace policies, memos, personnel files, timecards, emails and other communications, surveillance footage and other documentary evidence). This will be the initial list, with the potential for expansion as additional issues and documents are identified in the course of the investigation. The investigator should do the same with people, preparing an initial list of those required to be interviewed, with additional witnesses identified as applicable as the investigation proceeds.

The order of witness interviews is very important. As a general rule, it is usually best to start with the complainant, to ensure that the investigator has a full understanding of the allegations made. The complainant may identify other individuals with relevant information. Timing can be tricky – sometimes it can be a critical, or even a controlling consideration. Depending on factors as significant as witness availability or as mundane as the distance or direction of a witness in comparison to others, the investigator may determine to interview less central witnesses before meeting with key witnesses, or even the subject of the investigation. When determined necessary by the investigator to pin down or clarify key facts or information adduced later in the investigatory process, or witness credibility, the investigator should have the latitude – temporally, as well as financially – to conduct follow-up interviews as the investigator determines necessary.

Pre-interview considerations

The investigator should inform the parties, from the outset, that the process will be conducted as promptly as possible, thoroughly and impartially. If the investigator determines it is warranted, or necessary, the investigator should consider issuing communications that help build trust in the process, such as affirming the commitment to develop a full record, to hear from all witnesses proffered, or to take such corrective actions as are warranted by the ultimate findings of fact and legal or contractual conclusions.

The complainant and others should be assured that the investigation will be handled with discretion, taking all reasonable steps to minimise exposure of sensitive information. However, a promise of absolute confidentiality is most often unachievable and unrealistic. While workplace investigations are intended to be private, certain details must be shared in some fashion in order to conduct a comprehensive and fair inquiry. The investigator can and should communicate that private or confidential information will be disclosed strictly on a need-to-know basis, with those who are essential to the investigation. Taking such a direct, balanced and transparent approach – making every effort to burrow for the truth while respecting the privacy of those involved – helps support and build confidence in the integrity of the process.

Interview techniques

Begin with an introductory statement: thank the individual for meeting, explain the purpose of the meeting, and clarify the need-to-know basis for confidentiality.

Interviews should, with the rarest of exceptions (not further discussed or developed here), be conducted individually, not only to convey the appropriate respect to be accorded each witness, but also to assure them – and others – of the integrity of the investigatory process. Investigators should assure their witnesses and interviewees that they will make appropriate efforts to protect the privacy and the confidentiality of the facts and information they disclose, but must never promise absolute confidentiality for several reasons: (i) (most) investigation results must inevitably be shared with certain members of management – and, where applicable, a union – or, at times, a government agency, eg, where there is a parallel criminal investigation; (ii) court rules in subsequent litigation relating to the same issue(s) may require disclosure of all facts, including otherwise-confidential witness interviews adduced during internal investigations; and (iii) the organisation may need to disclose investigation results (or a summary of such results) for regulatory or other business purposes.

Investigators must always remain objective (even with witnesses or interviewees the investigator may find repugnant), be good listeners and take diligent, comprehensive notes. When conducting interviews, more open-ended questions should be utilised, when possible, to ensure that the majority of the conversation is driven by the witness, following the 80:20 principle (the witness should be speaking during 80% of the interview; the investigator during only 20% of the interview).

Specific questions, subjects, direction and/or areas of questioning will, of course, vary widely depending on any number of factors, most prominently the subjects being investigated and the witnesses (specific individuals, sometimes the type) being questioned. An investigator should generally go into each witness interview with a control list of thoughtfully prepared questions, subjects and even objectives – but their existence should not control the flow of the interview, or prevent the investigator from asking follow-up questions or from exploring new, previously unknown facts or events.

Effective interviewing relies on more than just questions asked; it also depends on how well the investigator listens and manages the flow of conversation. By using silence strategically, the interviewer can encourage a witness to share more details. A brief moment of quiet sometimes prompts the witness to continue speaking, which can provide additional information not revealed initially. Such a technique not only demonstrates patience and attentiveness, but also helps the investigator gather a more complete account, aligning with best practices for objective and thorough interviews.

As the interview progresses, the investigator must carefully assess whether the witness is fully answering the questions posed. If a response seems only partially responsive, the investigator should reflect: has the question truly been answered? If not, ask an appropriate follow-up question. This approach encourages the witness to provide a more detailed account, ensuring the conversation moves beyond surface-level answers and yields the comprehensive information necessary for a thorough investigation.

The investigator should pay attention to the use of adjectives and adverbs. For example, statements such as “I’m very concerned”, “We need to move quickly” or “Her conduct is way out of line” may signal that the witness has more to share. In these instances, the investigator should ask a relevant follow-up question, such as “What makes you feel that way?” Alternatively, the use of adjectives and adverbs may also indicate that someone is trying to steer the investigator to a desired conclusion. A witness who cannot answer a follow-up question with a reason for their strong feelings may lose credibility (more on that below).

Once the interview has progressed and the witness has had an opportunity to answer all questions, the investigator should take a moment to carefully review the witness’s responses, ensuring that each answer is both accurate and complete. If clarification is needed or information seems incomplete, the investigator should invite the witness to provide any additional details that might be relevant, encouraging openness and thoroughness in the account shared.

Credibility determinations

A solid, experienced investigator thinks quickly, exploring every opportunity presented by a witness or interviewee and their responses. Doubts about the truthfulness of a witness’s response, especially to an important question, can be dealt with by, in essence, repeating the same question or line of questions, but in the context of different wording or sequencing, to see if the witness’s responses are consistent. A seasoned investigator generally avoids confrontational or accusatory questions – contrary to your favourite legal TV show, these most often cause people to withdraw, become evasive or experience big memory lapses. A good investigator also pays close attention to a witness’s demeanour and body language – clues that often provide the investigator’s best, most reliable leads.

An investigation will often come down to credibility determinations – if two witnesses give mutually inconsistent accounts of an event, who do we believe and why? When making these determinations, consider the substance of each witness’s answers. Is the witness’s account consistent with other witness reports, any available surveillance footage and/or the outcome being investigated? Did the witness give straightforward answers when asked a question, or was the witness evasive? Does the witness have an interest in the outcome of the investigation? All of these points are relevant to determining credibility, but the list is not exclusive. Investigators may identify other testamentary or behavioural cues that impact a witness’s credibility.

As the conversation comes to a close, the investigator should deliver a closing statement that underscores the seriousness of the investigation and the organisation’s commitment to resolving the matter appropriately. The witness is reminded of the confidentiality of the process, with an explanation that while discretion will be maintained, certain information may need to be shared on a need-to-know basis to ensure a fair and effective inquiry. Finally, the investigator reiterates the company’s strict prohibition against retaliation, reassuring the witness that any concerns about reprisals for participating in the investigation will be taken seriously and addressed according to organisational policies. This concluding approach not only reinforces trust in the process, but also helps safeguard the integrity of the investigation, for all involved.

Issuing the report

At the conclusion of the investigation, the investigator should produce a written report. The length and structure of that report will vary, depending on the nature of the issues being investigated and the complexity of the investigation. Generally, the report should include a clear summary of the allegations, the relevant portions of applicable workplace policies, and a summary of the key points of each witness interview. If the investigator is sharing their opinion or impression of a witness, as opposed to a factual statement, that distinction should be very clear in the report. The investigator should then set forth such information in the investigator’s conclusions and explain the underlying reasoning. If the report is intended to be protected by attorney–client privilege, it should clearly be marked as an attorney–client privileged document.

In matters involving employee discipline, the investigator must be prepared, if necessary and where appropriate, to recommend specific remedial action (or a range of potential remedial actions) based upon the factual conclusions and application of company policies, or laws or regulations involved, to those factual conclusions. Note, however, that the investigator is not the final decision-maker – the final decision on discipline, and the implication of that discipline, will be up to the employer. If misconduct or policy violations are found, take appropriate disciplinary or corrective action according to company policies and procedures. This could include counselling, training, suspension, termination or other measures, as deemed necessary. In our experience, most employers will implement a remedial action recommended by the investigator. If the organisation chooses not to do so, the reasons for that decision should be documented, and filed alongside the investigator’s report.

Final considerations

Workplace investigations rarely proceed in a straight line. New allegations may surface, witnesses may provide unexpected information, or evidence may shift the direction of the inquiry. An effective investigator remains adaptable, adjusting the investigative plan as necessary, while maintaining procedural rigour.

At the conclusion of every investigation, organisations should take time to evaluate not only the findings, but also the investigative process itself. This includes reviewing whether timelines were met, whether communications were clear, whether confidentiality was appropriately maintained, and whether the investigative methods aligned with legal and policy expectations. Identifying gaps or challenges in these areas provides a valuable opportunity for continuous improvement.

Equally important is considering whether broader organisational actions are warranted. A single complaint may signal systemic issues – such as inadequate training, unclear policies, inconsistent supervision or cultural concerns – that call for remedial steps beyond addressing the specific matter at hand. Updating policies, enhancing management training, conducting additional training, improving reporting mechanisms, reinforcing anti-retaliation commitments, making operational changes or enhancing internal controls can greatly reduce the likelihood of future problems.

Ultimately, a well-executed investigation does more than resolve an immediate issue. It strengthens trust in the organisation, demonstrates a commitment to fairness and accountability, and reinforces a respectful and legally compliant workplace culture. By approaching each investigation with diligence, neutrality and integrity, organisations not only meet their obligations, but also foster an environment where employees feel safe, heard and supported.

Conclusion

The above summary seems clear, but a workplace investigation rarely goes as planned. In today’s environment, investigations have grown increasingly complex due to factors such as remote work arrangements, digital communications, evolving regulatory requirements and heightened employee expectations. Surprises will pop up, and are almost inevitable – new allegations may surface, evidence may shift, or a complainant might refuse to co-operate or change their account midway through the process. Investigators must be prepared to address issues like conflicting digital evidence, privacy concerns, social media implications and multi-jurisdictional challenges, all of which can complicate fact-finding and resolution. Additionally, heightened awareness regarding diversity, equity and inclusion means investigators must navigate nuanced interpersonal dynamics and potential cultural considerations.

Working with experienced legal counsel is crucial, not only to help the organisation navigate these surprises, but also to ensure that the investigation remains compliant with current laws and best practices, maintains procedural fairness and protects the rights of all parties involved. Proactive legal guidance can help mitigate risks, address emerging challenges, and ultimately support a thorough and credible investigation process that stands up to internal and external scrutiny.