The Process Is the Product
Published 2026-09-04 · EuroQuest International
Quick Summary
- You are testing an allegation, not building a case. An investigation establishes what more likely than not happened. It does not decide the sanction, and the person who investigates should not be the person who decides.
- Scope in writing, before the first interview. An investigation without written terms of reference expands until it collapses, and every finding it reaches becomes arguable.
- The interview order matters. Complainant first, then witnesses, then the person accused, with the allegations put to them in enough detail to answer.
- Delay is the most common defect. Memories fade, people leave, and a slow process reads as an unfair one whatever the finding.
- The external cost is real. Britain's employment tribunals ended the last quarter with 531,000 open claims, and regulators in the United States and Australia each recovered hundreds of millions for workers in a single year.
Most workplace investigations do not fail on the facts. They fail on the process: a scope nobody wrote down, an investigator who had already formed a view, notes that were never agreed, an accused employee who was not told clearly what they were answering, or a delay long enough that the outcome no longer looked like justice. The findings may even have been correct. It stops mattering once the process cannot be defended.
This guide sets out how to run one properly: what an investigation is actually for, who should and should not conduct it, how to write terms of reference before starting, how to handle evidence and interviews without contaminating them, and how to reach a finding that a reviewer, a tribunal or a regulator can follow. One caveat before any of it. Employment obligations differ substantially between countries, and nothing here is legal advice. Treat it as a process framework and check the specific duties that apply where the employee works.
On this page
- What is a workplace investigation actually for?
- Who should investigate, and who should not?
- How do you set the scope before you start?
- What counts as evidence, and how should it be handled?
- How do you interview without contaminating the account?
- How do you reach and record a finding?
- Frequently asked questions
What Is a Workplace Investigation Actually For?
An investigation exists to establish, on the evidence available, what more likely than not happened. That is the whole job. It is not a trial, it does not require proof beyond reasonable doubt, and it does not decide what should happen to anyone afterwards. Confusing those boundaries is where most flawed investigations begin.
The separation that matters most is between finding and sanction. The investigator gathers evidence and reaches findings of fact. A different person, usually the line manager or a panel, decides what those findings mean and what follows. When one person does both, the decision looks predetermined, and it usually was. Keeping the two apart is the first structural test of a defensible process and the core of any credible approach to employee relations and workplace investigations.
Not Every Complaint Needs a Full Investigation
Proportionality is a real principle, not an excuse. A disagreement about tone in a meeting, raised informally and capable of being resolved by a conversation, does not need terms of reference and a witness schedule. Escalating it manufactures a formal dispute out of a manageable one and teaches people that raising anything triggers a machine.
The reverse error is more dangerous. Allegations involving safety, discrimination, harassment, dishonesty, or anything a regulator could later ask about should go formal immediately, whatever the informal instinct in the room. If there is genuine doubt, treat the seriousness of the allegation rather than the seniority of the people involved as the deciding factor.
Key terms, used precisely
- Terms of reference. The written scope: the allegations to be investigated, what is excluded, who commissioned it, and by when.
- Balance of probabilities. The civil standard applied in most workplace processes: more likely than not, rather than certainty.
- Finding of fact. A conclusion that something did or did not happen. Distinct from a conclusion about whether it breached a policy, and distinct again from the sanction.
- Contamination. Any influence that shapes an account before it is given, from leading questions to letting witnesses discuss the matter with each other.
- Suspension as a neutral act. Removing someone from the workplace while facts are established, without implying guilt. It is a decision that needs its own justification and a review date.
Who Should Investigate, and Who Should Not?
The investigator needs three things: no stake in the outcome, no line relationship to the people involved, and enough seniority that the finding will be taken seriously. Those requirements exclude more people than organizations expect, and in a small team they may exclude everyone available.
That is a reason to look outside, not a reason to compromise. An investigator who manages the accused, who is close to the complainant, or whose department is implicated has a conflict that will surface at exactly the worst moment. Where the allegation reaches senior leadership or touches the function that would normally investigate, an external investigator is usually the only credible option, and knowing when to make that call is a large part of employment law for HR professionals.
The Role HR Should and Should Not Play
HR commonly runs the process, advises on procedure, and ensures consistency with how comparable matters were handled. That is legitimate. What HR should not do is steer the finding. Guidance on process is proper; guidance that nudges an investigator toward a conclusion is the defect that turns a sound investigation into an unsafe one, and it is visible in the paper trail afterwards.
A practical safeguard is to keep procedural advice in writing and separate from the evidence file. If the advice would embarrass the organization when read aloud, it was not procedural advice.
How Do You Set the Scope Before You Start?
Write terms of reference and have the commissioning manager approve them before the first interview. They should state each allegation in specific terms, name what is deliberately out of scope, identify who commissioned the investigation and who will receive the report, and set a target date. Two paragraphs is usually enough. What matters is that it exists and predates the evidence.
Vague allegations are the most common scoping failure. "Concerns about conduct" cannot be investigated, because nobody can prove or disprove it and the accused cannot meaningfully respond. Convert it: on what date, involving whom, what was said or done, and which policy or standard is said to have been breached. If the complaint cannot be reduced to specifics, that itself is a finding worth recording.
When New Allegations Surface Mid-Investigation
They usually do. The correct response is not to absorb them silently, which quietly widens the scope and denies the accused fair notice of what they now face. Go back to the commissioning manager, agree a written variation to the terms of reference, and put the new allegation to the accused separately and explicitly.
The alternative, discovered later, looks like an investigation that went looking for something. That perception is very difficult to recover from even when the underlying finding was sound.
Choosing the Right Process for the Complaint
Different complaint types carry different procedural obligations, and running the wrong one is a defect in itself. The table below sets out how the common routes differ in practice.
| Route | Who raises it | What is being tested | Distinctive obligation |
|---|---|---|---|
| Grievance | An employee about their own treatment | Whether the treatment complained of occurred and was reasonable | The complainant usually has a right of appeal against the outcome |
| Disciplinary | The employer against an employee | Whether specified misconduct occurred | The accused must know the allegations and see the evidence before responding |
| Harassment or discrimination complaint | An employee, or a third party | Conduct plus its effect, judged partly from the recipient's perspective | Protection from retaliation for raising it, and heightened confidentiality |
| Whistleblowing disclosure | Anyone, sometimes anonymously | The substance of the disclosure, not the motive of the discloser | Specific legal protections in many countries, and often a separate channel |
One complaint can trigger more than one route at once. A grievance alleging bullying by a manager is simultaneously a grievance for the complainant and potentially a disciplinary matter for the manager, and each person is entitled to the protections of their own process. Running them as a single undifferentiated inquiry is a frequent and expensive mistake, which is why workplace legalities belong in the planning stage rather than the review stage.
What Counts as Evidence, and How Should It Be Handled?
Evidence is anything that helps establish whether the allegation happened: witness accounts, messages, rosters, access logs, CCTV, expense records, calendar entries. Collect it early, because systems overwrite and people delete. Record where each item came from and when it was obtained, so the file can be followed by someone who was not there.
Two constraints apply throughout. Collect only what is relevant to the scope, because an investigation is not a license to trawl an employee's history. And handle personal data lawfully, which in many jurisdictions means the employee may later be entitled to see much of what was written about them, including the investigator's notes. Writing every note as though it will be read by the person it concerns is both good discipline and good practice, and it sits squarely within compliance and employee rights.
Covert Evidence and Recordings
Employees increasingly arrive with recordings made without consent. Rules on admissibility vary widely by country, and a recording that is lawful in one place may be inadmissible or even criminal in another. Do not decide this alone. Equally, resist the instinct to dismiss such material simply because it is uncomfortable; if it is relevant and its use is lawful where you operate, excluding it is its own defect.
Remote and distributed teams complicate this further, because so much of the conduct in question happens in chat threads and video calls that are retained by default. Knowing what your own systems keep, and for how long, is now part of running a credible process, and it is one reason managing remote and hybrid workforces has become an employee relations subject rather than a purely operational one.
How Do You Interview Without Contaminating the Account?
Order matters. Interview the complainant first to establish the allegation in detail, then the witnesses, then the person accused, so that the allegations can be put to them fully rather than in fragments. Interviewing the accused first, before the account is understood, produces a response to a question nobody has properly framed.
Ask open questions and let people answer them. "Tell me what happened, from the beginning" produces evidence; "You were upset when he said that, weren't you" produces an answer you wrote yourself. Take notes, read them back at the end, and offer the interviewee the chance to correct and sign them. A note the interviewee has agreed is worth far more later than a perfect transcript they have never seen.
What the Accused Is Entitled To
At a minimum: to know what is alleged in enough detail to answer it, to see the evidence relied on, to have time to prepare, to put their own account and name their own witnesses, and in many jurisdictions to be accompanied at a formal meeting. Rights vary, and this is one of the places where local requirements genuinely differ, but the underlying principle does not: nobody can defend an allegation they have not been told.
Confidentiality should be requested of everyone and promised to nobody absolutely. An investigator who guarantees a witness that their account will never be shared has made a promise the process cannot keep, because the accused will usually need to see the substance of what is said against them.
Looking After the People Involved
Investigations are stressful for everyone in them, including witnesses who did not ask to be involved and including the accused, whose position is unresolved for as long as the process runs. Signpost support, keep people informed of timing even when there is nothing else to report, and do not let silence do the communicating. Organizations that treat this as a welfare matter as well as a procedural one, which is the practical content of organizational health and employee wellbeing, get better evidence and fewer secondary complaints.
How Do You Reach and Record a Finding?
Take each allegation in turn. Set out the evidence for and against, resolve the conflicts explicitly, and state whether the allegation is upheld, not upheld, or cannot be determined on the available evidence. That third option is legitimate and under-used; an honest inconclusive finding is stronger than a manufactured one.
Where accounts conflict and there is no independent evidence, say how you resolved it and why: consistency over time, corroboration by a document, plausibility against agreed facts. A reviewer does not need to agree with the conclusion. They need to be able to follow how it was reached.
The test that matters: hand the report to someone with no knowledge of the case and no stake in it. If they can follow how each finding was reached without asking you a question, the process will survive review. If they cannot, no amount of confidence in the conclusion will save it.
What the Report Should Not Contain
Keep recommendations on sanction out of it. The investigator establishes facts; the decision-maker decides consequences, and a report that recommends dismissal has made that decision for them. Keep speculation out, keep character assessments out, and keep out anything gathered outside the agreed scope. Each of those is a line a representative will read back in a hearing.
Before the report leaves your hands
- Terms of reference exist, are dated before the first interview, and any variation is recorded.
- The investigator has no line relationship to the parties and no stake in the outcome.
- Every allegation was put to the accused in specific terms, with time to respond.
- Interview notes were read back and, where possible, agreed by the interviewee.
- Each allegation has its own finding, including any that could not be determined.
- Conflicts in the evidence are resolved on the page, not left to the reader.
- No recommendation on sanction, no speculation, nothing outside the scope.
- Personal data collected is limited to the scope and handled in line with local rules.
Finally, close the loop. Tell the complainant the outcome at the level of detail you are able to share, tell the accused in writing, and record what was decided and why. Investigations that reach a sound finding and then simply stop generate the same distrust as investigations that get it wrong, and the pattern across a year of them is worth reviewing deliberately as part of employment law and HR compliance rather than case by case.
Where Teams Build the Capability
Investigation skill is built by practice and critique rather than by reading a policy, and it transfers badly from one legal system to another. Practitioners take this work in Istanbul, London, Amman, Barcelona and Kuala Lumpur, and the full range sits under human resources management and training.
Frequently Asked Questions
What standard of proof applies to a workplace investigation?
In most workplace processes the standard is the balance of probabilities: whether the allegation is more likely than not to have happened. It is not the criminal standard, and an investigator who waits for certainty will return an inconclusive finding on almost everything. That said, the more serious the allegation and the more severe its consequences, the more careful the evidence gathering should be. The standard does not rise, but the expectation that you looked properly does.
Can the same person investigate and decide the outcome?
They should not. The investigator establishes findings of fact; a separate decision-maker determines what those findings mean and what sanction, if any, follows. Combining the roles makes the outcome look predetermined and is one of the most common procedural defects found on review. In a very small organization it may be genuinely difficult to separate them, and the answer there is to bring in an external investigator rather than to accept the overlap and hope it is not noticed.
How long should an investigation take?
As short as thoroughness allows, and the target should be set in the terms of reference rather than discovered afterwards. Most straightforward matters can be completed in two to four weeks; complex ones with many witnesses take longer and should say so in writing. Delay is the defect most often criticized on review, because evidence degrades, people leave, and a slow process reads as an unfair one regardless of the finding. If a deadline slips, tell the parties why and give them a new one.
Does the accused employee get to see the evidence?
In substance, yes. Nobody can answer an allegation they have not been shown, so the accused should know what is alleged in specific terms and see the evidence relied on before responding. Identities of witnesses can sometimes be protected where there is a genuine risk of retaliation, but the substance of what is said against the person normally has to be disclosed. Promising a witness absolute confidentiality is therefore a promise the process usually cannot keep, and it should not be given.
Who should attend workplace investigation training?
HR business partners and employee relations specialists who run or advise on these processes, line and functional managers who are asked to investigate matters in other teams, compliance and internal audit staff who handle whistleblowing disclosures, and legal counsel who review the resulting reports. Senior leaders benefit from the decision-maker's half of the process, since they are the ones who receive findings and must act on them without having formed a view in advance.
Build the capability before the next complaint lands
EuroQuest International runs practitioner training in employee relations and workplace investigations, employment law for HR, and compliance across Europe, the Gulf and Asia.