The HR Investigation Process, Step by Step

Why a Fixed Process Matters

Under federal harassment law, an employer's liability often turns on its response. For supervisor hostile-environment claims, the employer must show it exercised reasonable care to prevent and promptly correct the behavior (Faragher v. City of Boca Raton, 1998). For coworker and third-party harassment, the EEOC states that the employer is liable if it knew or should have known and failed to take prompt and appropriate corrective action. Some states go further. California's regulations, for example, require a complaint process that provides impartial and timely investigations by qualified personnel.

A consistent process is how you show "prompt," "impartial," and "appropriate" after the fact. It also protects the accused from a conclusion reached on instinct.

The HR Investigation Process at a Glance

Step 1: Receive and Document the Complaint

Take the complaint in whatever form it comes: written, verbal, through a supervisor, through a hotline. Thank the employee, listen, and capture the basics: who, what, when, where, who saw it, and what evidence exists. Ask what outcome they are looking for, without promising one.

Tell the complainant three things: the company takes the concern seriously and will look into it, the matter will be kept confidential to the extent possible (not absolutely), and retaliation is prohibited and should be reported immediately.

Record the complaint in the complainant's own words, and use the investigation plan and complaint intake form article.

Step 2: Triage and Decide Whether to Investigate

Not every concern needs a formal investigation, but every concern needs a documented decision. Ask whether the alleged conduct, if true, would violate policy or law; whether safety is at issue; whether the facts are disputed; and whether discipline could follow. Allegations of harassment, discrimination, retaliation, violence, or dishonesty generally call for a formal process, even when the employee asks you not to act.

Step 3: Take Interim Measures and Preserve Evidence

Before planning interviews, deal with two things that cannot wait.

Protect people. If there is a safety risk, a risk of continued harassment, or a risk of witness intimidation, separate the parties. Options include changed reporting lines, schedule or location changes, remote work, or leave. Burden the accused rather than the complainant; an involuntary transfer of the person who complained can itself be retaliation. The pay rules are covered in administrative leave pending investigation.

Protect evidence. Ask IT the same day to preserve email, chat, badge records, and video that would otherwise be overwritten. Secure physical items. Start a chronology of every action you take, with dates.

Step 4: Choose the Investigator and Settle Legal Preliminaries

Who investigates

The investigator must be impartial and seen to be impartial, trained, and available. Do not assign someone who reports to the accused, is a friend of either party, or is a witness. Consider an outside investigator when the accused is a senior leader or a member of HR, when the allegations are widespread, or when internal capacity is lacking.

If you retain an outside investigator, ask counsel about the Fair Credit Reporting Act. The statute excludes certain communications made to an employer in connection with an investigation of suspected employment misconduct from the definition of a consumer report, but if the employer takes adverse action based on such a communication, it must give the employee a summary of the nature and substance of the communication.

Privilege

Decide with counsel, before interviews begin, whether the investigation will be an HR-led process whose file may be disclosed, or a counsel-directed process intended to be privileged. The decision affects who interviews, what witnesses are told, and how the report is written. See Upjohn warnings in internal investigations.

Union representation

If the workforce is represented, union employees have the right to request a representative in an investigatory interview they reasonably believe could lead to discipline. Under current NLRB law, that right applies only to union-represented employees. Know the three lawful responses before you start. See Weingarten rights.

Confidentiality instructions

Asking witnesses to keep the investigation confidential protects its integrity, but blanket gag rules can conflict with employees' rights under the National Labor Relations Act to discuss working conditions. Under the NLRB's Stericycle decision (2023), work rules are evaluated case by case. [VERIFY: confirm the current Board standard and have counsel approve your wording.] A request limited to the active investigation and tied to a stated reason is easier to defend than a permanent prohibition.

Step 5: Write the Investigation Plan

A plan of one or two pages keeps the investigation on scope and on schedule. It should list:

• Each allegation, stated neutrally and specifically
• The policies that may be implicated
• The questions the investigation must answer
• Witnesses, in interview order, and why each is relevant
• Documents and data to collect, and from whom
• Interim measures in place
• Target dates

The usual interview order is complainant first, then witnesses, then the respondent, with follow-ups as needed. Some investigators interview the respondent earlier when evidence could be lost or when a quick admission is likely. Either order is acceptable if you record why you chose it.

A fillable plan template is in our investigation plan and complaint intake form article.

Step 6: Gather Documents and Physical Evidence

Collect what exists independently of anyone's memory: emails and messages, time and attendance records, expense and transaction records, video, access logs, prior complaints, personnel files, and the policies and training records that show what the respondent was told.

Review documents before the key interviews so you can ask about them. Log each item: what it is, where it came from, who collected it, and when. For anything that may matter in a later proceeding, keep a chain of custody. See evidence collection and storage in investigations.

Stay within your policies and the law when searching devices, accounts, or personal property. If the conduct may be criminal, speak with counsel before proceeding.

Step 7: Conduct Interviews

Prepare

Write an outline for each interview: the topics to cover, the documents to show, and the specific allegations to put to the witness. Arrange a private location and enough time. A second person as note-taker is helpful.

Open

Begin every interview with the same points, in your own words:

• Your role: you are gathering facts for the company; you are not anyone's advocate
• The purpose, described generally
• The expectation of truthful and complete answers
• Confidentiality to the extent possible, and the request you have approved with counsel
• The prohibition on retaliation, and how to report it

Ask

Start with open questions ("Tell me what happened on the 12th") and move to specifics. Ask for facts, not conclusions: what was said, by whom, where, who else was present, what happened next. Ask every witness, "Is there anyone else I should talk to?" and "Is there anything I haven't asked that I should know?"

The respondent must be told the allegations in enough detail to respond and must be given a real chance to do so, including the chance to name witnesses and provide documents. An investigation that never puts the specifics to the accused is neither fair nor complete.

Record

Take detailed notes during or immediately after each interview. Record what the witness said, not your impressions of their character. Some employers have witnesses review and sign a summary. If you plan to audio-record, check state law on consent first. [VERIFY: recording-consent law for the state where each participant is located.]

Technique is covered in depth in workplace investigation interview questions and technique.

Step 8: Assess Credibility and Make Findings

Line up the evidence allegation by allegation. Where accounts agree, the fact is established. Where they conflict, you must decide which account is more likely true and explain why.

Common credibility factors include:

• Corroboration: do documents or other witnesses support the account?
• Plausibility: does the account make sense on its own terms?
• Consistency: has the person told it the same way each time, and does it match their earlier statements?
• Motive: does anyone have a reason to shade the truth?
• Opportunity to observe: was the witness in a position to know?
• Past record: is there a documented history of similar conduct?

Be careful with demeanor. Nervousness in an HR interview tells you little.

Most employers decide internal investigations on a preponderance of the evidence, meaning more likely than not. [VERIFY: confirm with counsel and check any contract or policy that sets a different standard.] Reach one of three conclusions on each allegation: substantiated, not substantiated, or inconclusive. "He said, she said" does not automatically mean inconclusive. If one account is corroborated and more plausible, you can make a finding.

Make findings of fact and policy, not law. "Mr. Doe's comments violated the Respectful Workplace Policy" is a finding HR can make. "Mr. Doe committed unlawful sexual harassment" is a legal conclusion for counsel.

See credibility assessment in workplace investigations for a fuller treatment.

Step 9: Write the Report

The report should let a reader who was not involved understand what was alleged, what you did, what you found, and why. A standard structure:

1. Summary of the complaint and the conclusion
2. Scope and allegations
3. Process: who was interviewed, when, and what documents were reviewed
4. Evidence on each allegation
5. Credibility analysis
6. Findings on each allegation
7. Policies applied
8. Attachments

Write in plain, factual language. Leave out speculation and adjectives. Whether the investigator recommends discipline or leaves that to a separate decision-maker depends on your policy; many employers separate fact-finding from the penalty decision.

A full template and a worked example are in our investigation report template and worked sample.

Step 10: Decide, Communicate, and Follow Up

Corrective action

If a violation is substantiated, the response must be reasonably calculated to stop the conduct and proportionate to its seriousness. Check how similar violations were handled in the past. If the allegation is not substantiated, there may still be work to do: clarifying a policy, coaching a manager, or re-communicating expectations to a team.

Closing with the parties

Tell the complainant that the investigation is complete, whether the concern was substantiated in general terms, and that appropriate action has been taken, without disclosing confidential personnel details about someone else's discipline. Tell the respondent the outcome and any consequences. Remind both that retaliation is prohibited.

Retaliation monitoring

Retaliation claims frequently arise after the investigation closes. Under Burlington Northern v. White (2006), an action is retaliatory if it might well dissuade a reasonable worker from making or supporting a charge of discrimination. Check in with the complainant and key witnesses over the following weeks and months, and review any proposed adverse action against them before it happens. See workplace retaliation prevention and documentation.

Records

Keep the investigation file separate from the personnel file, with access limited to those who need it. Federal regulations require employers to preserve personnel and employment records for one year from the date the record was made or the personnel action involved, whichever is later, and, once a discrimination charge is filed, to preserve all relevant records until final disposition of the charge or action (29 CFR 1602.14). Many employers keep investigation files considerably longer, and state law may require it. [VERIFY: state retention periods.]

Common Mistakes

• Starting late, or stopping for weeks without explanation
• Assigning an investigator with a stake in the outcome
• Promising complete confidentiality
• Failing to give the respondent the specifics
• Interviewing only the witnesses the complainant named
• Deciding the outcome first and writing the report to match
• Finding a violation and taking no meaningful action
• Closing the file and never checking for retaliation

Building the Skill

Reading a process is not the same as running one under pressure with a hostile witness in the room. The Internal Investigations Certificate Program is a three-day program, offered in person and by video conference, that teaches a step-by-step process through interactive exercises based on realistic workplace scenarios: evaluating complaints, interviewing complainants and witnesses, collecting and preserving evidence, and writing the report.

Participants receive a workbook, sample investigation forms and templates, witness interview guides, and chain-of-custody forms. It is a certificate program that documents completion of training, not a license.

All of the related articles are collected in the Workplace Investigations Guide.

Frequently Asked Questions

The Bottom Line

A defensible investigation is prompt, impartial, thorough, and documented, and it ends with action that fits the findings. Follow the same ten steps every time, adjust the scale to the seriousness of the allegation, and bring counsel in early on privilege, union, and high-risk matters.