When a workplace investigation is challenged — at a tribunal, in court, or by a union — the challenge is rarely about the conclusion. It is about the process: the employee was not told the allegation, the investigator had a conflict, notes were written up a week later, evidence was not shared. Fairness is a sequence of steps, each of which leaves a record. Here is the sequence.
1. Decide whether an investigation is needed and who runs it
Record the trigger (the complaint, the incident, the report), the date, and the decision to investigate. Appoint an investigator with no involvement in the matter and no line relationship to the people concerned. Write down why they were chosen.
2. Define the scope
What exactly is being investigated — the allegation in one or two sentences — and what is not. Scope creep is the most common fairness failure: an investigation into lateness that becomes a review of someone's attitude.
3. Inform the people involved
The person under investigation is told what is alleged, in writing, in enough detail to respond. Witnesses are told what the process is and what happens to what they say. Letters are dated and kept.
4. Gather evidence before interviewing
Documents, emails, system logs, CCTV where lawful. Collect them into the investigation record with the date obtained and the source. Emails should be filed as received, with headers.
5. Interview, in order
Complainant, witnesses, then the person under investigation — so they can respond to everything. Notes taken during the interview, typed up promptly, offered to the interviewee to confirm. The right to be accompanied, where it applies, offered in writing beforehand.
6. Weigh and conclude
The report sets out the allegation, the evidence, what each person said, findings of fact on the balance of probabilities, and whether the allegation is upheld. It does not decide sanction — that is a separate step for a separate person.
7. Communicate and file
Outcome in writing to the person concerned, with the next step (no action, a hearing, an appeal route). The complete record — trigger, appointment, scope, letters, evidence, interview notes, report, outcome — kept together under the retention period for employment claims.
What "keeping the record" means
Every one of those steps is a dated document or a dated event. If they live in the investigator's inbox and a folder on their laptop, proving the sequence later means reconstructing it. If they live on one record — a case with the parties in roles, the letters generated from it, the emails filed to it, the interviews in a dated table, the report attached — the chronology is the timeline and the bundle is the export. We describe the structure in HR case files, and for the evidence-handling rules that apply, see the case timeline as evidence.
Confidentiality
The investigation file should be visible to the investigator, the decision-maker and HR — not to the rest of the department, and not to workspace administrators by default. Per-matter access with the option to hide the matter entirely is what makes that true rather than aspirational.
