Workplace Investigation Checklist: A Practical Guide for HR Teams

A workplace investigation often starts with incomplete information: an employee reports a comment, a supervisor flags possible misconduct, or an anonymous message describes a problem without naming witnesses. HR has to decide what needs immediate attention, what evidence to preserve, and how to establish what happened without reaching a conclusion too early.

A useful workplace investigation checklist covers eight stages: intake, immediate risk assessment, investigator selection, planning, evidence collection, interviews, findings, and closure with follow-up. Each stage should leave a record of what the team did, who was responsible, and what remains unresolved.

This guide provides a practical workflow for U.S. HR teams investigating harassment, discrimination, retaliation, and other potential policy violations. Adapt it to applicable law, collective bargaining agreements, and your organization’s procedures. Specialized matters, including workplace violence, criminal allegations, and public-sector investigations, may require additional steps.

Workplace investigation checklist at a glance

Use this list to track the case. Mark an item complete only when the supporting information is recorded; if it does not apply, document why.

• Record the report and identify the specific allegations.
• Assess immediate safety, retaliation, and evidence-loss risks.
• Assign an investigator and check for conflicts of interest.
• Define the scope, relevant policies, and decision-making responsibilities.
• Preserve relevant records before they are deleted or overwritten.
• Build an interview plan and accommodate participation needs.
• Interview the reporting employee, responding employee, and relevant witnesses.
• Follow up on material contradictions and new information.
• Evaluate the evidence and make a finding for each allegation.
• Document the analysis, limitations, and policy conclusions within the investigator’s assigned role.
• Decide and implement appropriate corrective or preventive action.
• Communicate closure, retain the records, and schedule follow-up.

The steps may overlap. Preserving a video recording should not wait until the investigation plan is finished. A new allegation may require another risk assessment halfway through the case.

1. Receive the report and clarify the allegations

Start by understanding what the employee is reporting. A label such as “bullying” or “retaliation” tells you how the employee interprets the situation, but it does not identify the conduct you need to investigate.

Ask for specific incidents: what happened, who was involved, when and where it occurred, and whether anyone else may have relevant information. Record exact language when the words themselves matter, distinguishing a direct quotation from a summary.

Intake checklist

• Record when and how the concern reached the organization, including any earlier reports.
• Identify the people, incidents, approximate dates, and available evidence.
• Ask about ongoing conduct, immediate concerns, and the outcome the employee is seeking.
• Explain the next steps, the limits of confidentiality, and how to report retaliation.

Useful opening questions include:

• “Please walk me through what happened.”
• “What did you personally see or hear?”
• “Who might have information about this, and what might they know?”
• “Are there messages, records, or other materials we should preserve?”
• “Is anything happening now that needs immediate attention?”

Do not make a written statement a prerequisite for assessing a concern. An employee may report verbally, have difficulty recalling dates, or describe conduct without knowing which policy applies. The EEOC recommends accessible complaint systems that respond to reports made by employees or others on their behalf. [1]

Record a request for a particular outcome without promising it. The employee’s preferences inform the response; the organization still needs to determine what action the facts and circumstances require.

2. Assess immediate risks and interim measures

Before scheduling interviews, ask what could happen while the investigation is underway. The urgent issue may be continued contact between the parties, a threat, possible witness pressure, or records scheduled for deletion.

Risk assessment checklist

• Identify immediate threats and activate emergency or security procedures when necessary.
• Assess continued exposure, potential retaliation, and access to evidence.
• Consider temporary measures and document their purpose, owner, and review date.
• Escalate legal, safety, privacy, or specialized issues to the appropriate people.

Potential interim measures include a temporary reporting change, an alternative contact for approvals, or adjustments that reduce direct interaction. Administrative leave may be appropriate in some cases, but evaluate it against the actual risk, applicable rules, and its effect on the employee.

Avoid treating an allegation as a completed finding. The EEOC’s recommended complaint practices include preventing premature assumptions of guilt and premature discipline. [1]

For example, if the reported conduct involves a supervisor approving the complainant’s overtime, HR might arrange another approver during the investigation. Record how the change addresses the identified concern and whether it affects hours, pay, or opportunities. Revisit it as the facts develop.

3. Choose the investigator and define responsibilities

The investigator needs enough independence to question the evidence and enough authority to obtain relevant information. Availability alone is not a sufficient selection criterion.

Assignment checklist

• Check for personal relationships, prior involvement, reporting conflicts, and other sources of bias.
• Confirm the investigator’s skills, capacity, and access to necessary resources.
• Identify who will receive findings, interpret policies, and decide corrective action.
• Decide whether an external investigator or counsel should be involved.

Consider external support when the concern involves senior leadership, an HR colleague, or facts that the proposed investigator previously handled. A small HR team may need outside help because no internal investigator can operate independently.

Write down the assignment. Is the investigator making factual findings only, determining policy violations as well, or recommending action? The Association of Workplace Investigators emphasizes establishing the investigation’s scope and documenting the process. [6]

If counsel is involved, clarify roles and the purpose of the work at the outset. Do not assume that copying an attorney or labeling a report “privileged” resolves questions about legal protection.

4. Build a plan around specific allegations

A complaint can contain several questions that require different evidence. Separate them before you start collecting everything associated with the employees involved.

Planning checklist

• Define each allegation and the relevant period, location, and policy.
• Identify likely records, witnesses, and questions that could change the finding.
• Set initial milestones and a communication schedule.
• Document how new allegations and changes to scope will be handled.

Consider this hypothetical complaint: an employee says a manager made inappropriate comments and then reduced the employee’s shifts after the employee objected.

The schedule may establish that hours declined without establishing why. The comments and the scheduling decision need separate findings.

Use the plan as a working document. If a witness identifies a relevant group chat, add it. If another allegation emerges, assess whether to expand the case or open a separate investigation and record the decision.

5. Preserve and collect relevant evidence

Identify records that may disappear first. Security footage, disappearing messages, and systems with short retention periods can create urgent preservation needs.

Evidence checklist

• Identify relevant systems, record holders, date ranges, and deletion schedules.
• Coordinate preservation with authorized IT, security, records, or legal personnel.
• Log each item’s source, collection date, and relevance.
• Preserve originals and restrict access to the investigation materials.
• Record missing evidence and reasonable attempts to obtain it.

Collect evidence that could support or contradict an allegation. A screenshot may capture a message while omitting the surrounding exchange. A badge record may establish entry into a building without showing what occurred inside it. Describe those limits in the analysis.

A simple evidence log can use identifiers such as E-01 and E-02. Interview notes and the report can then reference the same items, making the reasoning easier to follow.

Coordinate access to personal devices, accounts, or sensitive information through approved procedures. Relevance does not automatically authorize collection.

6. Conduct fair interviews and follow up

Plan an interview sequence that fits the case. Starting with the reporting employee often helps clarify the allegations, but an urgent preservation issue or an unavailable witness may change the order.

Interview checklist

• Explain the interview’s purpose, privacy limits, and anti-retaliation expectations.
• Address language, accessibility, scheduling, and applicable representation needs.
• Ask open questions before narrowing to dates, words, actions, and records.
• Distinguish firsthand observations from information learned from others.
• Give the responding employee enough detail to answer the allegations meaningfully.
• Follow up on material new evidence and conflicting accounts before finalizing findings.

For private-sector union-represented employees covered by the NLRA, Weingarten rights can apply when an employee requests representation during an investigatory interview they reasonably believe could lead to discipline. If an applicable request arises, stop and address it before continuing. Other laws or agreements may provide additional rights. [3]

Questions for the responding employee might include:

• “What is your response to the reported statement?”
• “What do you recall about that conversation?”
• “What information would help us evaluate your account?”
• “Who else should we speak with, and why?”

For witnesses, ask what they observed before describing other people’s versions in detail. “What did you hear during the meeting?” leaves more room for an independent account than “Did you hear the manager threaten her?”

If a new message materially contradicts an employee’s account, return to the employee with the relevant question. Document the explanation rather than treating the contradiction as self-explanatory.

Before recording interviews, confirm applicable consent requirements and organizational procedures. Keep contemporaneous notes distinguishable from later summaries and corrections.

7. Evaluate the evidence and document each finding

An investigation report should explain how the evidence supports the conclusion. A list of interviews followed by “substantiated” leaves the most important work invisible.

Findings checklist

• Identify the applicable standard of proof before reaching conclusions.
• Assess each allegation separately, including evidence that conflicts with the proposed finding.
• Explain material credibility assessments and unresolved gaps.
• Distinguish factual findings, policy conclusions, and legal questions.
• Confirm that the report accurately references the supporting records.

California’s Civil Rights Department recommends the preponderance-of-the-evidence standard for workplace harassment investigations: whether the alleged conduct more likely than not occurred. Confirm the standard applicable to your investigation rather than importing the criminal standard of proof. [4]

Evaluate credibility through the substance of an account: opportunity to observe, consistency on material points, plausibility, corroboration, and explanations for discrepancies. The California guide cautions against relying heavily on demeanor to assess truthfulness. [4]

For the hypothetical scheduling allegation, a report might explain that the employee’s shifts declined, who made the change, what explanation that person offered, and whether staffing records support it. The timing deserves examination, but the report should address the decision’s explanation and surrounding evidence too.

Use clear finding definitions. “Not substantiated” generally means the evidence did not establish the allegation under the applicable standard; it does not, by itself, establish that the employee knowingly made a false report.

A workable report structure includes the allegations, scope, methodology, evidence reviewed, analysis, findings, and limitations. Identify unavailable records or interviews and explain how those gaps affect the conclusions. Keep disciplinary decisions clearly identified, whether they appear in the report or a separate decision record.

8. Implement action and close the loop

Finishing the report does not complete the organization’s response. Someone needs to own the action, communication, and follow-up.

Closure checklist

• Identify the decision-maker and document the reasons for the selected response.
• Assign owners and deadlines for corrective or preventive measures.
• Communicate completion and appropriate outcome information to the parties.
• Reassess interim measures and explain ongoing expectations.
• Retain the records under applicable requirements and preservation instructions.
• Schedule follow-up and provide a direct route for reporting concerns.

When considering action, review the seriousness of the conduct, relevant policies, and comparable cases. Depending on the findings, the response might involve discipline, supervision changes, training, or a process correction. Record why it addresses the problem identified.

Tell the parties when the investigation is complete and provide appropriate information about the outcome. Determine what can be shared under applicable law and policy; avoid promising access to another employee’s confidential personnel information.

Set follow-up dates based on the case’s risks. Two weeks and six weeks after closure can be useful planning examples, but they are not universal legal deadlines. Ask concrete questions about assignments, hours, interactions, and continuing conduct.

The EEOC recommends proactive check-ins during EEO matters and review of employment actions for potential retaliation. [2] A new performance issue still needs attention, but HR should examine the evidence and consistency of a proposed action rather than assume it is unrelated to the report.

Retention also needs a deliberate decision. The EEOC imposes recordkeeping obligations on covered employers, including preserving relevant records until final disposition when a discrimination charge or specified action is pending. Other requirements or legal holds may extend retention. [5]

Frequently asked questions

How long should a workplace investigation take?

There is no single deadline that fits every internal investigation. Applicable law, agreements, and policies may impose requirements. Set milestones based on the allegations, evidence, and witness availability, proceed promptly, and document delays. The EEOC recommends prompt, thorough, impartial harassment investigations. [1]

Can HR promise confidentiality?

HR should explain that information will be handled carefully and shared as needed to investigate and respond. Absolute secrecy may be impossible. Before directing employees not to discuss a matter, obtain advice on applicable labor law and other protected rights.

What if there are no eyewitnesses?

The parties’ accounts are evidence. Examine them alongside messages, records, contemporaneous reports, and other relevant information. A lack of eyewitnesses does not automatically prevent a finding. [4]

What if the report is anonymous or withdrawn?

Assess the information and risk already available. For an anonymous report, look for enough detail to identify incidents, records, or people who may know more. If a reporting employee withdraws, ask why, including whether they fear retaliation. Document the assessment and the basis for the next steps rather than closing automatically.

What should HR keep in the investigation file?

Keep the intake record, scope and plan, evidence log and materials, interview records, analysis and findings, decision record, communications, and follow-up documentation. Apply access controls and retention requirements. Preserve corrections and additions in a way that keeps the original record understandable.

Put the checklist into practice

For each checklist item, record a status, owner, completion date, and supporting reference. An unchecked item should prompt a specific next step: obtain a schedule revision, clarify a contradiction, confirm an action was implemented, or document why the step does not apply.

Before closing, ask whether someone unfamiliar with the case could understand what was alleged, what HR examined, why it reached each finding, and what the organization did next. If the file cannot answer those questions, identify the missing work before treating the case as complete.

Explore Truett for workplace investigation resources and information about investigation case management.

Sources

1. U.S. Equal Employment Opportunity Commission, Promising Practices for Preventing Harassment. Recommended practices, rather than a standalone set of binding legal requirements.
2. U.S. Equal Employment Opportunity Commission, Enforcement Guidance on Retaliation and Related Issues.
3. National Labor Relations Board, Weingarten Rights.
4. California Civil Rights Department, Harassment Prevention Guide for Employers, March 2025. California guidance; confirm requirements applicable to your workplace.
5. U.S. Equal Employment Opportunity Commission, Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602.
6. Association of Workplace Investigators, Guiding Principles for Conducting Workplace Investigations.