A variety of circumstances could give rise to internal investigations being opened. The most common are complaints made by individuals who experience some sort of workplace misconduct, by someone who directly witnessed such misconduct, or by a manager or supervisor who became aware of misconduct. Activity that could result in the opening of an investigation could include, among other things, allegations of discrimination (based on protected classes such as race, colour, national origin, religion or sex), harassment, workplace violence, or a violation of other law or a workplace policy. Each instance is fact-dependent, however, and any potential misconduct brought to the attention of supervisors, managers or other employer leadership should be taken seriously and considered for further investigation.

Supervisors, managers and HR personnel, particularly those on the front lines of HR complaints, should be trained to issue-spot and recognise misconduct. They should also be equipped to examine whether an investigation is necessary, even if only to provide counsel to employees. Furthermore, HR should make the decision whether to open an investigation into a matter. This should not be a decision put upon the employee or any other person who brings allegations of misconduct to HR’s attention.

In the United States, there are a variety of laws that could impact whether an HR internal investigation must be carried out, including federal, state and local laws. Judicial opinions and regulatory guidance, from both federal and state-level entities, could also create obligations for employers to open internal investigations.

Generally, employers are required to investigate allegations of workplace harassment, including sexual harassment, discrimination, retaliation, hostile work environment, or safety concerns under federal and corresponding state laws, including the following:

• Title VII of the Civil Rights Act of 1964 (Title VII): Prohibits employment discrimination based on race, colour, religion, sex (including pregnancy, sexual orientation and gender identity) and national origin.
• The Americans with Disabilities Act (ADA): Prohibits discrimination against individuals with disabilities in various aspects of public life, ensuring equal opportunities and access (employment, public services, public accommodation, telecommunications, etc).
• The Age Discrimination in Employment Act of 1967 (ADEA): Prohibits discrimination against persons 40 years of age and older in areas including, but not limited to, hiring, benefits plans and promotions.
• Occupational Safety and Health Act (OSH Act): Requires employers to provide a safe and healthy workplace by setting and enforcing safety standards, and by giving employees the right to training, information, and protection from workplace hazards.

A variety of state and local laws also address harassment and discrimination, workplace safety, wage-and-hour protections and whistle-blower protections. Given the various federal, state and local laws that cover this context across the United States, employers should be familiar with the laws applicable in their specific locations.

There are also a number of other laws and agencies that employers should be aware of when conducting workplace investigations. These include the following:

• Equal Employment Opportunity Commission (EEOC): A federal agency responsible for administering and enforcing civil rights laws prohibiting employment discrimination. The EEOC issues various opinions and decisions that provide guidance on the application of federal laws and which may serve as legal precedents.
• National Labor Relations Act (NLRA): Guarantees the rights of employees to form, join or assist labour organisations; to bargain collectively through representatives of their own choosing; and to engage in other concerted activities for the purposes of collective bargaining or other mutual aid or protection. It also prohibits employers from interfering with such rights and outlines various unfair labour practices.
• National Labor Relations Board (NLRB): A federal agency that investigates claims of unfair labour practices, adjudicates disputes and issues decisions involving labour relations matters, especially those that arise under the NLRA.
• Occupational Safety and Health Administration (OSHA): A federal agency responsible for ensuring safe and healthy working conditions, especially as outlined in the OSH Act. It sets and enforces workplace safety standards, provides training and education, and investigates workplace hazards to reduce injuries, illnesses and death.
• Family and Medical Leave Act (FMLA): Entitles eligible employees of covered employers to take unpaid, job-protected leave for specified family and medical reasons.

Thorough and well-conducted investigations, even if not strictly required, can also ensure that employers have access to certain legal defences in the event that they take adverse employment actions against an employee for misconduct. For example, in the event that an employee who is a member of a protected class brings a claim of discrimination and bases it on having suffered an adverse employment action, a well-conducted investigation can support the employer’s legitimate, non-discriminatory reason for the employment action. The employer will need such a non-discriminatory rationale to prevail in any potential litigation.

Typically, there is discretion given to employers on the types of channels they can provide to employees for reporting misconduct, although this could vary by jurisdiction, with some state or local laws requiring specific procedures in certain instances. It is best practice for employers to establish clear guidelines and mechanisms for reporting misconduct or other concerns to ensure timely reporting and effective investigations that comply with applicable laws. Employers should also follow applicable state laws and recommendations from relevant state and federal entities such as the EEOC, by having clear written policies defining prohibited conduct and the complaint process, providing accessible ways for employees to complain to the employer, and maintaining confidentiality to the greatest extent possible.

Examples of channels for employees to report misconduct include:

• a company-managed employee hotline;
• an online complaint form;
• reporting to a direct supervisor or manager;
• a formal report to HR; or
• a report to a legal or compliance department.

The complaint process is not required to be anonymous, but employers should strive to maintain confidentiality as much as possible and should have procedures in place to ensure such confidentiality.

There is no particular law defining specifically who must conduct HR internal investigations, but state laws, federal regulations, EEOC guidance, case law and risk management best practices provide guidelines on the requirements for investigators. Generally, investigators should be trained in investigatory procedures and be able to perform investigations competently. Additionally, investigators should be as impartial as possible and able to investigate without bias. Investigators should further be able to conduct investigations promptly and provide documentation of the process and corrective action. It is often best practice for employers to designate particular individuals to investigate complaints to provide uniformity to the investigation and potential disciplinary process.

Employers should consider whether it is appropriate to engage external counsel. In most instances, investigations regarding complaints of misconduct can be conducted internally. However, engaging external counsel is preferable if the complaint involves upper management or leadership, if there is an enhanced need to maintain neutrality in the investigatory process, if there is a high likelihood of litigation, or if the particular issue is too complex or outside the scope of what internal investigators are equipped to handle. Ideally, external counsel would be brought into an investigation from the beginning, if the particular need for them is known, but that may not be practicable. Employers should be cognisant that external counsel may need to be brought into an investigation at any point during an investigation, depending on the circumstances.

Certain circumstances require that an HR investigation be conducted. There are myriad local, state and federal laws, for example, that require workplace investigations, either by statute or through case law (although they need not necessarily be “internal”). Either by statute or case law, employers are generally required to investigate allegations of workplace harassment (sexual or other), discrimination, retaliation or hostile work environment concerns under federal laws, such as Title VII, the ADA, the ADEA and corresponding state laws. Employers also have a duty to investigate claims involving workplace safety, wage-and-hour disputes and whistle-blowing under such acts as the OSH Act.

There are generally no prohibitions on an employer carrying out workplace investigations. However, employers should assess whether an investigation is appropriate if it is not required by law, as noted in 1.7 Other Cases.

Employers should always conduct an investigation if it involves a possible legal violation or any matter for which they could potentially be sued. Employers should also consider how particular complaints relate generally to the workplace environment or morale issues. Investigations can often uncover systemic or widespread issues that can be addressed to create better morale or more productivity. Additionally, if there is a potential for reputational harm, an employer should take steps to investigate and address any issues to protect itself.

The individual who makes a complaint or report is often referred to as the “complainant” or the “reporter”, and the subject of the complaint is known as the “respondent”. There are not usually explicit requirements that private employers provide notice to a reporter or respondent of an investigation (although government or public employers may require such notice). Even so, notifying parties is often a necessary step for an employer to show compliance with the requirements of certain laws that require investigations (by statute or through case law) or to help show that they are not engaging in retaliation should discipline be necessary.

As a best practice, investigators should inform the reporter that their complaint has been received and that an investigation is being opened. Employers should also disclose the investigation to the respondent, as well as the purpose of the investigation and whether the investigator is internal to the employer or is external counsel.

Investigating attorneys must also disclose to the parties involved and any witnesses interviewed who their client is (usually the employer) and that they do not represent the employees involved or interviewed. This is especially true if the employer’s interests may be at odds with those of interviewees or if there is any possibility of reasonable confusion (see ABA model rule 1.13(f)).

Before the start of any interview, investigators should provide what is called an “Upjohn admonition” to the interviewee, which is discussed in more detail in 3.7 Information.

Private employers typically have no affirmative duty to report most workplace misconduct; however, there are numerous laws that do require reporting. The OSH Act, for example, requires employers to report some safety matters to OSHA, such as work-related deaths or certain hospitalisations of employees due to work-related injuries.

Various laws also require the reporting of certain crimes, such as those involving abuse of children or vulnerable adults, particularly if certain employers or employees are classified as mandated reporters under applicable law. Private sector employees who contract with government entities should also be cognisant of heightened reporting requirements when utilising government grants or working pursuant to a government contract. There may be instances in which employers report misconduct, for example if criminal allegations are alleged, and the employer continues with an internal investigation at the same time.

As discussed previously, there are numerous requirements for employers to conduct thorough investigations, whether a parallel investigation by another authority is happening or not. In those instances, employers can conduct their investigation while continuing to co-operate with the outside investigation, unless authorities conducting the outside investigation request that the employer stop or pause the internal investigations.

Each situation is fact-dependent and could be impacted by differing state and federal laws. Employers should assess each situation individually and consult with legal counsel if there is any question about the need to report particular misconduct.

Whether confidentiality agreements and/or NDAs can be used in the context of an HR internal investigation is a fact-dependent inquiry that will also likely depend on which federal or state laws are applicable. In some instances, such agreements could be used by employers to protect sensitive data or information during an investigation, such as trade secrets. Federal laws such as the NLRA and numerous state laws, however, may limit how confidentiality in the context of workplace investigations is imposed. Due to the evolution of decisions by the NLRB regarding employment rights and the scope of employees’ discussions of workplace conditions, the use of NDAs in internal investigations is not a typical practice.

There is particularly more regulation of NDAs in relation to sexual harassment and assault claims, especially before complaints are resolved. For example, the federal Speak Out Act bars the use of pre-emptive NDAs in cases of workplace sexual harassment and assault. Workers cannot sign away their right to discuss sexual misconduct in the workplace upon onboarding, for instance, or during the course of an investigation, but they may opt to sign a confidentiality agreement as part of a resolution process.

Further, the Ending Forced Arbitration of Sexual Assault and Sexual Harassment Act (EFAA) prohibits arbitration clauses in cases involving sexual harassment and sexual assault that are signed prior to the resolution of a dispute. In other words, workers cannot covenant away their constitutional right to pursue action in a court of law in favour of arbitrating their disputes. The EFAA applies to claims that “relate to” sexual assault or sexual harassment, so it might even extend to related complaints such as wrongful termination, misclassification, or intentional infliction of emotional distress.

If NDAs are used, they cannot prohibit employees from reporting misconduct to authorities, including government agencies, and cannot silence employees about harassment or discrimination that they experienced in the context of their employment. Such agreements must include carve-outs for employees to participate in government investigations and allow employees to report any illegal conduct by their employer.

Whether a preliminary investigation can or should be conducted is dependent upon the facts of each potential complaint or allegation. As discussed in 1.2 Bases, there are numerous instances in which employers are required to conduct thorough and timely investigations. In those instances, employers should begin the full investigation as soon as possible. In instances in which there is uncertainty as to a particular allegation or if an investigation would not necessarily be required (potentially in one of the instances discussed in 1.7 Other Cases), a preliminary investigation could be appropriate, although it is not typical. Employers should be aware that a preliminary investigation could delay what is actually a required or necessary investigation, or may impact the availability of future legal defences in the event that a full investigation is not conducted.

The scope of an investigation, including the number and types of witnesses interviewed, will vary significantly and depend heavily upon the specific facts of each allegation. Employers should typically interview the person alleging the misconduct, the subject of the misconduct, and any other individuals with relevant information regarding the allegation. Often that will include supervisors and direct co-workers of those parties involved in the allegation, but others may also have pertinent information to provide. Employers should ensure that enough individuals are interviewed in order to reach a determination as to the likelihood that the reported conduct occurred and that allows them to assess the credibility of witnesses. Ideally, employers should be able to corroborate witness testimony through other witnesses or evidence.

Employers should have written policies in place that require employees’ participation in workplace investigations. As discussed above, employers are obliged by law to conduct investigations to address Title VII violations (and EEOC guidance), to respond to violations of other laws, to ensure safety (OSHA), to correct misconduct, and to manage risks to the employer (negligence law). It is therefore important that all employees participate fully in any internal investigation.

When a Respondent Refuses to Participate

If a respondent refuses to participate, the employer can respond in various ways. Investigators may proceed without the respondent’s input. If so, the investigator should document the respondent’s declination to participate and draw conclusions based on available evidence, including considering the refusal when assessing credibility. An employer may also impose discipline for failure to co-operate. Many employer policies explicitly classify obstruction, dishonesty and the refusal to participate as misconduct. This could include termination if the refusal constitutes insubordination, a violation of policy or a violation of compliance obligations. Courts have routinely upheld termination for refusing to participate in investigations, especially when the refusal prevents the employer from fulfilling legal obligations. Employers should also take interim protective measures, such as considering paid suspension of the respondent, establishing no-contact orders, limiting respondent access to confidential data, and potentially reassigning the respondent to protect any witnesses or others involved. Additionally, whistle-blower and other laws protect reporting employees. Employers should therefore take pains not to retaliate against a reporter for refusing to participate fully in an investigation. Determining the line between lawful discipline and illegal retaliation should be discussed with competent counsel.

When a Reporter Refuses to Participate

If a reporter refuses to participate, an employer should nevertheless take steps to prevent recurrence of the allegation, even in the absence of complete information. The employer must conduct the investigation, which includes continuing to collect and review documents, continuing to gather available evidence and interviewing additional witnesses.

When a Witness Refuses to Participate

If a witness refuses to participate in an interview, the employer may document the refusal, proceed based on available information, consider the witness’s role and credibility, and in some instances even discipline them if the witness’s co-operation is required by employer policy. Some employers require co-operation in investigations, audits and other compliance functions. Employers should consider having clear written policies documenting the obligations of employees to participate in such processes.

There are exceptions, however, that employers should be aware of. If the witness is exercising rights pursuant to the NLRA (eg, refusing to answer questions about protected concerted activity), then discipline may be unlawful. Certain employees may also have certain rights under a variety of other laws, such as the need for an alternative format or communication due to a disability pursuant to the ADA, or the right to have a union representative present pursuant to collective bargaining units. Employers should therefore assess each situation to determine whether there is a risk of liability for the employer when considering disciplining an employee for failing to co-operate.

There are typically no requirements that interviews be carried out in a certain manner, but investigators should consider multiple factors when assessing the most appropriate method. While there is a fairly common belief that physical demeanour can be used to assess a witness’s credibility, it has been found to be inherently unreliable. Investigators should therefore not necessarily rely on an in-person or video-based interview for that purpose. However, in-person and video-based interviews can be helpful to ensure that interviews are confidential and to help build rapport with the interviewee. Telephonic interviews can be appropriate as well, depending on the circumstances. Sometimes it makes sense to prioritise conducting an interview quickly or at the convenience of the witness in order to obtain information that can assist in corroboration.

While there are no specific rules regarding the demographics of interviewers, they should be objective and neutral to ensure that a witness is comfortable and will disclose information. Investigators should therefore not have any particular involvement or interest in the matter being investigated or in its outcome. Interviewers should also be trained in conducting interviews, documenting interviews and collecting evidence. Furthermore, particularly in sensitive investigations involving sexual harassment or other serious claims, employers should consider utilising investigators trained in trauma-informed interviewing techniques.

The number of interviewers will likely depend on the scope of the investigation and the number of witnesses. More witnesses may require more investigators. In an effort to maintain confidentiality and preserve information collected, employers should attempt to limit the number of individuals involved in an investigation to the greatest extent possible. Employers should also consider the comfort of a witness when selecting interviewers.

Workplace investigators should generally consider whether a third party’s presence during an interview would assist in creating an environment to foster the sharing of information from witnesses. While typically investigators will want to limit the number of individuals present to preserve as much confidentiality as possible, there are instances in which third parties should or must be present. For example, to assist with communication and allowing a witness to be more comfortable answering questions, investigators may want to have an interpreter to allow a witness to speak in their native language. Additionally, support persons under the ADA may be required for individuals with disabilities. Circumstances may also vary state to state, with various labour and employment laws and potential labour union collective bargaining agreements requiring the presence of certain third parties. Employers should therefore be cognisant of relevant local, state and federal laws, and balance the need for confidentiality with the need of a third party.

While there is generally no automatic right to a support person or lawyer being present in HR internal investigation interviews, this could vary depending upon employer policy, the terms of an employment agreement or collective bargaining agreement, specific applicable laws, and potential disability needs. Employees may generally choose to retain counsel, particularly if they are the subject of an investigation or could be subject to liability.

Unless a contract or agreement provides otherwise, there is no information that must be given to an interviewee at the outset or at the conclusion of an interview. However, best practices dictate that certain key information should be communicated to interviewees.

At the Start of an Interview and Confidentiality Obligations

An interviewer should explain the purpose of the interview, namely that it is part of an internal investigation into a workplace concern, such as alleged misconduct or a policy violation.

Further, interviewers should inform employees that the interview is confidential and that the investigators will do their best to maintain that confidentiality. However, confidentiality cannot be uniformly and completely guaranteed, and it is important that an interviewee understand that there may be situations in which shared information must be disclosed to the employer or even to other authorities (such as law enforcement), and that such disclosure could reveal the interviewee’s identity.

Moreover, investigators should ask whether the interviewee agrees to maintain confidentiality during the investigation for the purposes of preserving the integrity and objectivity of the investigation and to minimise potential risks to workplace morale (from gossiping or creating an atmosphere of fear, for instance). Investigators must be careful about requiring that employees maintain confidentiality, as doing so could run afoul of certain employee rights, such as those contained in the NLRA’s protections for “concerted activity”.

Investigations and Attorney–Client Privilege

If an investigation is led by the organisation’s legal counsel or is being conducted at counsel’s direction, investigators should deliver an “Upjohn admonition”, which makes clear to an employee that the attorney represents the employer and not the employee. The US Supreme Court case Upjohn Co. v United States, 449 U.S. 383 (1981) held that communications between the attorney for a company and the company’s employees can be protected by attorney–client privilege, but that the privilege belongs to the corporation and not to the individual employee. The admonition should therefore ensure the following:

• that employees understand that the investigating attorney represents the company, not the individual employee;
• that any attorney–client privilege arising from the conversation belongs to the company; and
• that the company has the right to waive this privilege and disclose information shared during the interview to third parties.

Interviewers should make sure to clearly document that they provided this warning to each interviewee.

At the Conclusion of an Interview

At the end of the interview, the interviewer should:

• offer the interviewee an opportunity to share any additional information, to identify any other potential witnesses or to submit any relevant documents;
• advise the interviewee that they may be contacted for follow-up if necessary;
• inform the interviewee that retaliation for participating in the investigation is strictly prohibited and encourage the interviewee to report any concerns of retaliatory treatment if they arise; and
• thank the interviewee for their participation and invite them to share any other relevant information regarding the subject matter that they may remember or receive.

If an interviewee requests to stop the interview, the interview should be stopped. The investigator should determine whether the employee is seeking a break or to end the interview. The interviewer should provide reasonable breaks to the interviewee during the course of the conversation, but should also note the time the interview stopped, the reason for the stop, and when the interview resumed.

If the interviewee seeks to end the interview completely, the interviewer should avoid pressuring the individual to continue but offer to reschedule or revisit the conversation later. The investigator should also assess whether the interviewee’s request to cease the interview stems from emotional distress, a need for a support person, or a disability-related accommodation, in which case pausing the interview and offering support resources (such as EAP or HR involvement) may be appropriate. Regardless of the interviewee’s role in the investigation, it is good practice to reiterate the employer’s expectations regarding confidentiality and the prohibition on retaliation before ending the session.

If the interviewee takes excessive breaks and the interviewer has concerns about the confidentiality or integrity of the investigation as a result, or if the interviewee attempts to stop an interview altogether, the interviewer may take the steps outlined in 3.2 Participation.

There are no specific requirements for note-taking during an interview, but adequate documentation is crucial to an effective investigation. Employers should ensure that interviewers are capable of taking thorough and detailed notes during interviews and can consider having interviews transcribed or, as discussed below, recorded. There is typically no requirement that interviewees be allowed to review and/or sign the minutes or notes. Various laws and collective bargaining agreements, however, may dictate specific procedures. While an external party is not required to take minutes, any external party investigating on behalf of a company should take notes in a manner that effectively documents the interview and could help the external party provide a thorough accounting of the interview to the company if needed.

Interviews can typically be recorded, but various state and local laws may place restrictions on interviewers. For example, some states require all parties to consent to recordings of interviews and conversations, while others allow employers to record without notification. Employers should also consider any ethical implications of recording interviews and weigh the costs and benefits of recording interviews if an interviewee is uncomfortable. If conducting interviews remotely, employers should utilise software that makes clear to all participants when recording is in progress. Interviewers should also notify interviewees at the start if they are being recorded.

Employers can and should engage in substantial additional fact-finding besides interviews. Typically, all communications on company property are the property of the employer. Employers should also have written workplace policies detailing the lack of privacy in communications on workplace devices. Employers can therefore obtain relevant communications such as email communications and other messages on company devices or software. Employers can also obtain other relevant documents that are created in the context of an employee’s employment or contained on company devices or software.

Employers can typically search their own workplaces and computer systems. While a variety of state and federal personal privacy laws may address the rights of employees, searches of an employer’s workspace and devices are generally not protected by such laws as these spaces and devices are considered property of the employer. Additionally, if employees use personal devices to store employment-related data, employers can usually obtain that data. In that instance, however, employers should take caution to not collect an employee’s personal data. Employers should develop written policies to notify employees regarding their privacy rights, or lack thereof, as it relates to company property.

Employers are generally required to assess threats to physical safety, protect employees’ physical safety to the extent it is possible, and protect against continued harassment and any threats of retaliation. A variety of laws require these protections, including federal workplace safety laws such as the OSH Act, state and federal laws prohibiting retaliation and protecting whistle-blowers, and laws that require employers to protect employees from continued harassment or discrimination.

Employers may therefore employ protections on an as-needed basis and should assess the particular facts surrounding each allegation. More egregious allegations, including those involving personal safety, could be appropriate situations for suspending the respondent pending the outcome of the investigation or instituting temporary changes such as remote work. Employers should be careful, however, when taking action that impacts a reporter, so they do not engage in illegal retaliation against the reporter, whether intentionally or unintentionally. For example, it could be seen as retaliation to require a reporter to work remotely, when a more appropriate action may be to require the subject of the allegations to work remotely or to be temporarily suspended.

While there are no specific rights enumerated for respondents in the context of a workplace investigation, employers should take actions to ensure fairness during the process. Respondents should be informed that an investigation is taking place and be advised of what entity will be conducting the investigation. While there are no blanket confidentiality requirements, employers should take every effort to preserve confidentiality. At the same time, employers should be up front with parties involved that total confidentiality cannot be guaranteed. Employers should also be cognisant of potential defamation-related claims, particularly when sharing information with third parties. To minimise the risk, employers should assess what information needs to be shared on an individual basis and attempt to limit the number of people involved in the investigation, while still achieving a thorough investigation.

As noted above, there are a number of state and federal laws that place ongoing obligations on the employer to protect employees, particularly as it relates to harassment, discrimination and retaliation. These obligations continue to pertain to respondents even during the course of an investigation. Employers should therefore be careful to ensure that a respondent is protected in accordance with such state and federal laws during the investigation process.

Public employees who are the subject of investigations may have additional protections, such as due process guarantees. In those instances, respondents may need to be provided with notice of the allegations at a particular time, and be afforded both an opportunity to respond and a more robust right to legal representation.

As noted above, there may be situations in which a respondent must be placed on administrative leave or directed to work remotely during an investigation. To minimise potential claims by a respondent, such as defamation, retaliation or breach of contract, such actions should be framed as non-disciplinary and interim in nature, pending the conclusion of the internal investigation. Employers should assess the facts of each individual allegation to determine the appropriateness of these actions. Overall, an employer should prioritise stopping harm to employees and ensuring workplace safety upon receipt of a report of misconduct.

Sometimes, the best practice will be to remove the respondent until conclusion of the investigation to prevent perpetuating the harm or potential new harm to others. This also may be necessary to preserve evidence and maintain objectivity of witnesses throughout the investigation.

Failure to protect employees in the workplace could cause the employer to be subject to liability for violation of a variety of laws related to workplace safety, discrimination or harassment.

While employers are not required to wait until the conclusion of an investigation to act, they must carefully calibrate any interim measures to ensure they are justified, non-retaliatory and proportionate to avoid legal exposure and protect all parties involved.

As discussed previously, employers must take steps to protect employees from workplace violence or credible threats, harassment or discrimination, retaliation, hostile work environments, unsafe conditions, and known misconduct. Various state and federal laws require protection of employees in these situations, including under federal and state laws such as Title VII, the ADA, the ADEA, the OSH Act, and corresponding state human-rights and tort laws.

Similar to the situations discussed above, employers should assess whether actions should be taken to protect other employees in the workplace in order to comply with applicable laws. Doing so could potentially require removal of the accused person during the course of an investigation.

Under US law, there is no single statutory framework that mandates specific procedural guarantees for internal workplace investigations in the private sector. Instead, the required steps depend largely on employer policies, contractual obligations and specific regulatory requirements. Unless an employer’s own policies, a collective bargaining agreement or an employment contract imposes procedural requirements, employers have significant discretion in how they conduct internal investigations. However, several important legal principles still shape best practices and can create legal exposure if ignored.

Employer Policies and Contracts

If an employer has adopted written investigation procedures (through a handbook, code of conduct or internal policy), it must follow them consistently. Failure to do so can expose the employer to claims of discriminatory/retaliatory treatment, breach of contract, or pretext in a discrimination or retaliation case.

Unionised Employees (Weingarten Rights)

In a unionised workplace, employees may be entitled to have a union representative present during interviews that have the potential to lead to discipline. Failure to honour this right may constitute an unfair labour practice under the NLRA.

ADA-Related Requirements and Accommodations

Employees with disabilities may require accommodations to participate effectively in an investigation, such as a support person for communication-related disabilities, adaptive technology, modified interview formats, or additional time for responses. Failure to provide reasonable accommodations may expose the employer to liability under the ADA.

Language Access and Interpretation

Although not mandated by a single federal statute, providing interpreters for employees with limited English proficiency is often necessary to ensure fairness and to prevent miscommunication. Courts look unfavourably on investigations during which an employee could not meaningfully understand or respond to questions due to language barriers.

Required Documentation and Record-Keeping

While the investigation process itself is not dictated by law, record retention is. Employers must preserve documentation for specific statutory periods, such as:

• EEOC: at least one year after the conclusion of an investigation or personnel action;
• OSHA: injury- or illness–related records for five years;
• State laws: often one to three years for personnel or investigative files;
• Litigation hold: indefinitely, once the employer reasonably anticipates litigation.

Many states, such as Illinois and New York, permit employees to obtain copies of their personnel records. These records often must include investigative reports if information contained in those reports was used as a basis for an employment-related decision.

Confidentiality and NLRA Limitations

Employers may request confidentiality during an investigation only if justified by a legitimate business reason (eg, protecting evidence or preventing retaliation). Under the NLRA, employers may not impose blanket confidentiality rules that prohibit employees from discussing workplace concerns, discipline or investigations. Failure to comply can result in unfair labour practice charges.

Anti-Retaliation Protections

Employers must ensure that employees who participate in investigations are protected from retaliation under federal statutes such as Title VII, the ADA, the ADEA, the FMLA, the OSHA and various whistle-blower laws. If an employer fails to institute or enforce anti-retaliation safeguards, it may face significant liability.

Potential Consequences of Failing to Follow Appropriate Procedures

Failure to observe the principles above can lead to substantial risk for employers, including but not limited to the following:

• Compromised credibility of the investigation, which may be used as evidence of pretext in discrimination or retaliation litigation.
• Unlawful discrimination or retaliation claims if inconsistencies in process suggest unequal treatment.
• Unfair labour practice charges (NLRA) for violating Weingarten rights or imposing overly broad confidentiality rules.
• ADA violations if the employer fails to provide reasonable accommodations during the investigative process.
• Evidentiary sanctions or adverse inferences if the employer fails to preserve investigative records subject to litigation holds.
• Loss of defences in harassment cases, as poor investigative practices can undermine the employer’s ability to rely on the Faragher/Ellerth affirmative defence. (This defence is a legal doctrine developed by the US Supreme Court in two companion cases: Faragher v City of Boca Raton and Burlington Industries, Inc. v Ellerth. It is applicable in Title VII harassment cases where a supervisor is alleged to have created a hostile work environment, but no tangible employment action (such as firing, demotion or a pay cut) was taken against the employee. Through this defence, an employer can avoid liability if it can demonstrate that it took reasonable care to prevent (eg, through relevant anti-harassment policies) and promptly correct any harassing behaviour, and that the employee unreasonably failed to report the behaviours or utilise internal complaint procedures. A prompt, neutral and well-documented investigation is the primary mechanism for proving the “reasonable care” necessary to satisfy this legal standard.)
• Reputational risk and diminished employee trust, which can weaken reporting cultures and increase the likelihood that misconduct goes unreported.

Employers may adopt internal investigation procedures that go beyond what the law requires. Although these policies do not, by themselves, create new legal obligations, failure to follow them can still create significant risk.

Inconsistent application of established procedures can call the fairness and reliability of the investigation into question and may be used as evidence of discrimination, retaliation or pretext if a matter progresses to litigation. In some cases – such as when policies are written in mandatory terms or incorporated into a collective bargaining agreement – deviations may also create contract-related issues. For these reasons, employers should strive to apply their internal procedures consistently, even when those procedures exceed baseline legal requirements.

In internal investigations in private workplaces in the United States, there is generally no formal legal burden of proof placed on either the employer or the employee. Instead, the employer is responsible for evaluating the available evidence and reaching a reasonable, good-faith determination.

Most employers (and most legal and regulatory bodies) apply the “preponderance of the evidence” standard, which asks whether it is more likely than not that the alleged conduct occurred. This standard is recommended by the EEOC, used in Title VII civil cases, required in Title IX investigations in educational settings, and applied by most federal agencies. Courts also reference this standard when assessing the adequacy of employer investigations, including in the context of the Faragher/Ellerth defence (see 5.1 Requirements), constructive discharge claims and punitive damages analyses.

There are no specific US laws that dictate when an internal HR investigation must be ended. Instead, an investigation should be concluded once it has been conducted in a reasonably thorough, impartial and complete manner, meaning that relevant evidence has been reviewed, necessary witnesses have been interviewed, reasonable credibility assessments have been made, and the employer is able to reach well-supported conclusions.

Ending an investigation prematurely can create significant risk: courts may view an incomplete investigation as evidence of pretext, retaliation or inadequate corrective action; it may also weaken the employer’s ability to rely on defences such as the Faragher/Ellerth affirmative defence (see 5.1 Requirements) or the “honest belief” defence. (The “honest belief” defence is available to employers defending discrimination claims involving discipline or termination, and allows an employer to defend its action by demonstrating that it was based on an honest and reasonable belief – even if that belief later proves to be mistaken. For this defence, an employer must show it conducted a good-faith investigation and made its decision based on facts reasonably known at the time, rather than on discriminatory motives or assumptions.) For these reasons, employers should ensure that investigations are allowed to run their full course before closing them.

In the United States, there are no statutory procedures that private employers must follow when closing an internal investigation. However, certain steps are considered best practices. When an investigation is completed, employers should document the findings and rationale, communicate the outcome to the complainant and respondent in a limited and appropriate manner, implement any corrective actions, and ensure all records are preserved in line with retention requirements – especially if litigation is possible.

If an investigation is ended early or not fully pursued (for example, due to insufficient information or a withdrawn complaint), the employer should document why it was closed and what steps had been taken up to that point. Even if a complaint is withdrawn, the employer may still need to investigate if the allegations raise legal or safety concerns.

Regardless of whether the investigation is concluded or ended early, clear documentation and good-faith reasoning are critical to avoiding claims of retaliation, negligence or pretext.

There are generally no US laws requiring a specific form for the conclusion of a private employer’s workplace investigation; employers may choose whether to document findings orally or in writing. However, it is considered best practice to prepare at least some written record of the conclusions, as this can be important for defending the investigation and resulting decisions if they are subsequently challenged. Employers may use an abbreviated format, such as an executive summary, or a more detailed report outlining the methodology employed, evidence reviewed, witness statements, credibility analyses, findings and, potentially, recommendations for action. The appropriate format typically depends on the organisation’s practices, needs and risk tolerance.

There are generally no legal requirements dictating what must be included in a written investigation report for a private employer, but certain elements have become standard practice. The scope and depth of the report are usually determined in advance by applicable policies, or among HR, counsel and the organisation, either formally or informally.

Most reports include the purpose of the investigation, a description of the investigative process (such as documents reviewed and witnesses interviewed), key findings and credibility assessments, and the investigator’s conclusions regarding whether the allegations are substantiated. Whether recommendations for future action are included varies: some investigators provide suggested next steps for individuals, teams or the organisation as a whole, while others intentionally avoid recommendations and leave that role to other HR personnel or management. The format ultimately depends on the organisation’s preferences and the intended use of the report.

In the United States, there is no general legal right for employees at private employers to receive the full outcome of an internal HR investigation or to access written investigation reports. Neither the complainant nor the respondent is entitled by law to a copy of the report in the private sector.

However, both parties are typically informed of the overall outcome: whether the allegations were substantiated and whether appropriate corrective action will be taken, without disclosing confidential details, witness identities (unless necessary) or sensitive personnel information.

Respondents and complainants do not ordinarily receive written reports, as providing them may create unnecessary legal risk, expose confidential information or implicate privacy rights of other employees. Instead, employers usually communicate the outcome verbally or through a brief written summary that confirms the conclusion but omits detailed findings.

There are limited exceptions:

• Unionised employees may have access to certain investigation information under a collective bargaining agreement.
• Title IX investigations in educational settings require written reports and offer parties access to evidence.
• State personnel file laws (eg, in California, Illinois and Massachusetts) may allow employees to inspect their personnel files if the findings were placed there.

In practice, employers strike a balance between transparency and confidentiality by notifying each party of the result and confirming that appropriate action has been taken, while keeping investigative documents internal to HR and legal counsel.

In the United States, employers generally do not have to report the conclusions of an internal HR investigation to government authorities, unless responding to a legal process (eg, a subpoena) or an inquiry by an agency (eg, the EEOC or a state fair employment practice agency). However, reporting is required in certain situations, such as when the investigation reveals conduct that triggers a mandatory reporting obligation in regulated industries (eg, banking, securities, healthcare), when an investigation reveals suspected child abuse or elder abuse, or when certain workplace injuries or fatalities are reportable to OSHA. In these cases, only the relevant information is disclosed to the appropriate agency.

Outside of mandated contexts, employers may choose – but are generally not required – to report findings to authorities when the investigation uncovers potential criminal conduct (such as assault, threats, theft or embezzlement) or significant safety risks. Typically, only the underlying conduct is reported, not the full results of the investigation. In most workplace matters involving interpersonal conflict, harassment, discrimination or policy violations, employers do not report conclusions to authorities, and findings remain internal unless employers are otherwise legally compelled to disclose the information.

Beyond the complainant and respondent, information about the conclusion of an investigation is typically shared on a limited, need-to-know basis. Leadership or the HR personnel who oversaw an investigation – and, in some cases, additional executives or the board of trustees or directors – are informed of the findings and any recommended actions. Managers of the individuals involved may also be notified if they need to implement corrective measures.

All participants, including witnesses, are generally thanked for their co-operation and informed that the investigation has concluded and appropriate action has been taken, without disclosing confidential details. The complainant may receive slightly more information about whether appropriate action was taken, but employers must still protect the privacy of the respondent and others involved.

If allegations are substantiated, employers may use a range of disciplinary measures, depending on the severity of the conduct, the employee’s prior history, organisational policy and any contractual obligations. Common options include:

• Spoken or written warnings: Used for lower-level or first-time misconduct; typically documented in the personnel file.
• Mandatory training, coaching or counselling: Often applied in cases involving conduct, communication or judgement concerns.
• Changes to duties, reporting relationships or work environment: May involve reassignment, closer supervision, or limiting contact with the reporting party.
• Performance improvement plans (PIPs): Appropriate when the misconduct overlaps with performance or behavioural issues.
• Suspension (paid or unpaid): Used when the conduct is serious or when the employer needs to reinforce the gravity of the violation.
• Final written warning: Typically used before termination when the employer is giving a final opportunity to correct behaviour.
• Termination of employment: Applied in cases of severe misconduct, repeated violations, or conduct that compromises safety, integrity or legal compliance.

Additional Considerations

• Timeliness: Employers are expected to act promptly once findings are reached to demonstrate that the matter is taken seriously and to mitigate risk of ongoing harm, retaliation or future allegations.
• Consistency: Discipline should align with past practice and company policy; inconsistent treatment can lead to claims of discrimination or pretext.
• Proportionality: The disciplinary action should correspond to the severity of the misconduct and any mitigating or aggravating factors.
• Counter-allegations: If the respondent raises new claims or evidence, the employer may need to conduct a limited follow-up investigation before imposing discipline.
• Documentation: All decisions and the rationale behind them should be fully documented to support the employer’s actions if later challenged.

It is common for employers to take additional measures to improve the workplace after an investigation, regardless of whether the allegations are substantiated. The approach varies widely by organisation, but many employers use the conclusion of an investigation as an opportunity to strengthen culture, communication or team dynamics. Typical actions include team-building activities, mediation between employees, providing training on policies, or broader organisational initiatives aimed at improving culture.

When allegations are not substantiated, employers must take care not to implement measures in a way that suggests blame or implies that misconduct occurred. In investigations that result in unsubstantiated allegations, broad-based interventions such as general training or team-wide communication efforts are often preferred over individual actions.

In the United States, employers are generally permitted to collect and use personal data as reasonably necessary to conduct an internal HR investigation, provided that the collection is job-related, consistent with business necessity and limited in scope. Employers should collect only information that is relevant to the specific allegations or issues under review and should safeguard the data against unauthorised access or disclosure. Information obtained during investigations – particularly sensitive information – should typically be maintained confidentially and, when appropriate, kept separate from general personnel files.

However, several important limitations apply. Federal and state laws impose heightened protections on certain categories of data, including medical and mental health information (subject to the ADA and HIPAA’s minimum necessary standard), genetic information (GINA), biometric data (such as fingerprints or facial recognition, regulated under laws such as Illinois’s Biometric Information Privacy Act (BIPA) and similar statutes in Texas and other states), and information involving minors.

Employers must also be mindful of evolving state privacy laws – such as those in California, Colorado, Connecticut, Texas, Utah and Virginia – that grant to employees workplace rights related to notice, purpose limitation and data security.

Additionally, investigations involving third-party background or investigative reports (FCRA), workplace injuries (OSHA) or recorded interviews must comply with applicable consent and wiretapping laws, including two-party consent requirements in certain states. Careful, trauma-informed handling is especially important when investigations involve allegations of harassment or violence.

When collecting and processing personal data in connection with an internal HR investigation, employers should maintain clear procedural safeguards to ensure the data is handled lawfully and appropriately. At the federal level, certain categories of information are subject to heightened protections. For example, under the ADA, any medical or mental health information obtained during an investigation must be maintained in separate, confidential files and shared only on a strict need-to-know basis. Employers should also ensure that data collection is limited to what is relevant to the investigation, used only for legitimate investigatory purposes, and retained no longer than necessary to resolve the matter or meet legal obligations.

In addition, a growing number of state privacy laws impose obligations that may apply, at least in part, to HR investigations. These laws can require employers to provide notice of data collection, respect employees’ rights to understand or limit how their personal data is used, implement reasonable security measures, and avoid secondary or unrelated uses of investigation data. While many state statutes include partial exemptions for employment-related data, those exemptions are narrowing and often do not eliminate core duties such as transparency, purpose limitation and data security. Notably, California significantly curtailed its employer exemption in 2023, making compliance with these principles increasingly important in internal investigations nationwide.

In the United States, parties to an internal HR investigation generally have limited and context-specific rights to access personal data collected during the investigation. There is no broad federal right for employees to access investigation files in the private sector, but certain state laws provide targeted access. For example, under Illinois’s Personnel Record Review Act (PRRA), employees may request access to materials that were relied upon in making an employment decision, which can include investigation summaries or findings, though not necessarily all underlying notes or witness statements. In addition, under emerging state privacy laws (such as California’s CPRA), employees may have a right to know which categories of personal data were collected and how they were used, subject to significant limitations in the investigatory context.

Employers may invoke several important exceptions to limit access. Attorney–client privilege and attorney work product protections generally allow employers to withhold privileged investigation materials, including legal analyses, attorney-directed interviews and draft reports. Employers may also restrict access to protect confidentiality, witness privacy, trade secrets and the integrity of the investigation, particularly where disclosure could chill participation, expose witnesses to retaliation, or compromise ongoing or future investigations. Many state privacy statutes expressly recognise exceptions for internal investigations, legal compliance or anticipated litigation, even when employment-data exemptions are otherwise narrowed. As a result, while limited access rights may exist – particularly where an employment action is taken – employers retain substantial discretion to withhold sensitive investigation materials when legally justified.

Artificial intelligence (AI) is increasingly used as a supporting tool, but not as a primary decision-maker, in internal HR investigations. Common uses include assisting investigators in developing or refining interview questions, organising timelines, summarising large volumes of documents or communications, and transcribing interviews (subject to applicable consent and wiretapping laws). AI tools may also be used to help draft portions of investigation reports or executive summaries, provided that a human investigator independently evaluate the facts, credibility, conclusions and final language of the report.

As a general matter, employers should avoid the use of AI systems that conduct interviews autonomously or interact directly with witnesses in a manner that could undermine trust, accuracy or legal defensibility.

The use of AI in investigations raises important data protection and risk considerations, including concerns related to implicit bias. AI systems may reflect or amplify historical biases embedded in the data used to train programs or underlying algorithms, which can create disparate impacts or distort credibility assessments if not carefully constrained. Employers must also take care not to input sensitive personal data – such as medical information, biometric data or legally privileged communications – into generative AI tools without appropriate safeguards.

Additional risks include confidentiality breaches, data retention and secondary use by vendors, and potential waiver of attorney–client privilege. Emerging state privacy laws and AI-related regulations further underscore the need for transparency, purpose limitation and meaningful human oversight. Accordingly, best practice is to treat AI as an assistive tool only. The gold standard for maintaining fairness, making reliable credibility assessments and ensuring legal compliance remains using trained human investigators to make all final investigative judgments, findings and conclusions.

Whistle-blower protections in the United States exist at both the federal and state levels, and they vary significantly by jurisdiction. Federally, multiple statutes protect individuals who report or oppose unlawful conduct, including laws enforced through agencies such as OSHA and statutes such as Sarbanes-Oxley, which cover reporting of fraud, securities violations and certain financial misconduct. These laws generally prohibit retaliation against employees who engage in protected activity, which may include reporting suspected violations internally or to government agencies or, in some cases, refusing to participate in illegal conduct.

At the state level, whistle-blower protections are highly specific to jurisdiction and may arise from statute, common law, or both. States differ in how whistle-blowing is defined, who is protected, and what conduct is covered. Some laws protect only reports made to government or law enforcement agencies, while others also protect internal complaints to managers or compliance personnel.

Certain jurisdictions require that the employee reasonably believe the conduct violates a law or regulation; others also protect employees who refuse to engage in unlawful activity. Many states – including Illinois, which recently broadened its statutory definition – extend protections beyond classic fraud or criminal conduct to include violations of laws, rules, or regulations more generally. Additional protections typically include anti-retaliation remedies such as reinstatement, back pay, compensatory damages and, in some cases, statutory penalties or attorneys’ fees.

In the United States, allegations concerning sexual harassment and sexual violence are subject to specific and heightened legal protections at both the federal and state levels. Federally, Title VII of the Civil Rights Act prohibits sexual harassment as a form of sex discrimination and protects employees and applicants from retaliation for reporting or participating in investigations. Sexual harassment is broadly defined to include unwelcome conduct based on sex that either becomes a condition of employment or creates a hostile work environment. Sexual violence, including sexual assault, may also implicate criminal law, federal civil rights protections and workplace safety obligations. Many states have adopted broader statutory definitions than federal law, explicitly covering harassment based on gender identity, gender expression or sexual orientation, and extending protections beyond traditional employees.

At the state level, protections have expanded significantly in recent years. States such as California, Illinois, New Jersey, New York and Washington cover wider categories of workers, including independent contractors, interns, volunteers (in certain contexts), domestic workers, gig workers and, in some settings, students.

Many jurisdictions have enacted laws modelled on violence-related protections (such as Illinois’s Victims’ Economic Security and Safety Act) that provide job-protected leave, accommodation rights and anti-retaliation safeguards for individuals affected by sexual or gender-based violence. Additional protections commonly include mandatory harassment training, extended statutes of limitations, restrictions on confidentiality provisions and NDAs, and limitations on mandatory arbitration, most notably under the federal Ending Forced Arbitration of Sexual Assault and Sexual Harassment Act. Over the past year, the trend has continued towards expanded coverage, reduced procedural barriers and increased employer obligations, particularly with respect to confidentiality, training and access to remedies.

Generally, American law does not recognise bullying, mobbing or “abusive conduct” as stand-alone unlawful conduct in the private sector unless it is tied to a protected characteristic. At the federal level and in most states, harassment or bullying becomes legally actionable only when it rises to the level of a hostile work environment based on a protected trait such as sex, race, age, disability, religion, or other characteristics protected by statute. Accordingly, generalised bullying, incivility and unfair treatment, while often inappropriate and harmful, do not typically give rise to liability in the absence of a discriminatory nexus.

That said, a limited number of states have enacted laws or regulations that reference “abusive conduct” or workplace bullying, primarily in the context of training or policy requirements rather than substantive prohibitions. For example, California requires employers to include training on “abusive conduct” as part of mandated harassment training, and states such as Connecticut and Washington have adopted similar concepts in guidance or policy frameworks. These laws generally do not create a private right of action for employees. Other jurisdictions, including Illinois, Nevada, New Hampshire, Tennessee and Utah, have adopted anti-bullying or “healthy workplace” provisions largely applicable to public-sector employers, often requiring agencies to adopt policies or even providing immunity to employers if certain model policies are shown to have been implemented. Municipalities (such as Chicago) may have their own requirements for private employers to provide anti-bullying-related training to employees. Over the past year, the trend has continued to favour preventive measures such as training, policies and awareness rather than expanding legal liability for bullying as an independent cause of action, particularly in the private employment context.

When an allegation raised in an internal HR investigation may also constitute criminal conduct, employers should follow additional procedural safeguards. As an initial step, employers should conduct a risk assessment to address immediate employee safety concerns and determine whether interim measures, such as administrative leave or workplace restrictions, are appropriate.

The potential criminal nature of an allegation does not eliminate the employer’s obligation to conduct a workplace investigation, particularly when the conduct may violate company policy. However, employers should co-ordinate closely with counsel to determine the appropriate scope and timing of the internal investigation, to assess whether and when communication with law enforcement or other authorities is required, and to address whether an employer’s investigation is subject to relevant legal privileges and thus protected from disclosure to third parties, including law enforcement.

Employers should also be mindful that internal investigations may generate evidence relevant to a criminal proceeding, which can affect witness participation, document preservation and interview strategy. In many cases, employers should avoid interfering with or undermining government investigations and may need to defer certain investigatory steps to federal, state or local authorities. Separate considerations include whether the alleged conduct triggers mandatory reporting obligations under applicable law and whether criminal charges or outcomes could impact employment decisions under “cause” provisions in employment agreements, incentive plans or policies. Employers should avoid providing legal advice to employees and should carefully manage confidentiality, retaliation risk and due process concerns throughout the investigation, particularly if criminal charges are filed. To the extent that any law enforcement agencies request or subpoena records generated during an employer’s investigation, employers should rely upon advice of counsel as to whether and what materials to produce or withhold on the basis of such requests.

In multi-jurisdictional internal investigations, employers should take additional steps to identify and comply with all applicable local laws governing employee rights, privacy, data protection and investigatory procedures. This includes understanding jurisdiction-specific requirements related to employee notice, interview practices, data collection and retention, recording consent, and protections for whistle-blowers or complainants. Employers should conduct a threshold legal assessment at the outset to determine which jurisdictions’ laws apply, based on employee location, where the conduct occurred, and where data is stored. Co-ordinating the investigation through experienced counsel is critical to ensure consistency while allowing for necessary local adaptations.

Cross-border investigations raise further considerations, particularly with respect to data transfers, attorney–client privilege and regulatory authority. Foreign employers conducting investigations involving US employees must comply with US federal and state employment and privacy laws, and US employers investigating conduct abroad may be subject to foreign labour laws, works council requirements or data export restrictions, especially in the European Union.

Employers should also be mindful of potential unauthorised practice of law concerns, particularly in jurisdictions such as California, when non-lawyers or foreign counsel are directing or conducting investigations that involve legal judgment. Best practice is to structure multi-jurisdictional investigations with centralised oversight, clearly defined roles and local legal input, and to rely on established professional resources and guidelines for cross-border investigations to mitigate legal and operational risk.