A complaint about a manager’s conduct is received on a Friday afternoon. The HR team has an allegation, several informal messages, a possible witness list and a need to protect everyone involved. What it does not yet have is a case file that can withstand scrutiny. This HR investigation workflow example shows how to move from referral to recorded outcome without losing control of evidence, deadlines, confidentiality or procedural fairness.
The precise process will depend on the allegation, the organisation’s policies, contractual arrangements and whether a regulator, safeguarding lead or police involvement is relevant. The underlying discipline should remain consistent: define the issue, preserve the record, test the evidence fairly and document each decision.
HR investigation workflow example: the case scenario
Assume an employee alleges that their line manager made repeated inappropriate comments during team meetings and in private messages. The employee provides screenshots and names two colleagues who may have witnessed comments. The manager denies the allegation when first approached.
This is not a finding of misconduct. It is a referral requiring a structured assessment. At this stage, careless language can prejudge the case, while poor information handling can expose sensitive personal data. The workflow should therefore separate allegation, evidence, analysis and outcome from the outset.
1. Log the referral and complete an initial assessment
Create a case record as soon as the concern is received. Record who made the referral, when it was received, the exact allegation where possible, the people named, the immediate risks and any documents supplied. Do not rely on an inbox thread as the working case record. Emails can be forwarded, deleted or detached from the context in which decisions were made.
The initial assessment should decide whether the matter falls within an informal resolution route, a formal grievance, a disciplinary investigation, a safeguarding procedure or another policy pathway. It should also identify whether interim measures are necessary. These may include adjusted reporting lines, temporary changes to duties or instructions not to contact particular individuals. Such measures must be proportionate and should not be presented as a sanction before the facts have been established.
In the example, HR records the allegation as a potential breach of the dignity at work policy, acknowledges receipt, and assesses whether the employee needs immediate support or workplace adjustments. The case owner records why a formal investigation is appropriate and who has authority to appoint an investigator.
2. Set the scope before gathering evidence
A clear scope prevents an investigation from becoming either too narrow to answer the allegation or so broad that it becomes delayed and unfocused. The commissioning instruction should identify the allegations to be examined, the relevant time period, the policies in force, the expected outputs and the investigator’s remit.
For this case, the scope might ask the investigator to establish whether the manager made the alleged comments on specified dates, whether the messages are authentic and complete, whether the conduct breached policy, and whether any contextual evidence affects the assessment. It should not ask the investigator to decide the disciplinary sanction unless the organisation’s process expressly combines those functions.
A separate decision-maker is generally preferable for a disciplinary outcome, particularly where the facts are disputed. In smaller organisations, complete separation may not be possible. If roles overlap, document the reason and apply additional scrutiny to fairness, conflicts and the opportunity to respond.
3. Build an investigation plan and evidence register
The investigation plan translates the scope into practical work. It should set out witnesses, documents, likely interview order, target dates, responsibility for each action and any dependencies. The plan should be reviewed as new material emerges, but changes need a recorded rationale. Otherwise, it becomes difficult to show why one line of enquiry was pursued and another was not.
An evidence register is equally valuable. Each item should receive a unique reference, source, date received, description, relevance and access status. For digital material, retain the original where feasible and preserve sufficient context to understand it. A screenshot alone may not show the date, participants, surrounding conversation or whether messages were edited.
In the example, the investigator secures the original message export where available, retains the employee’s screenshots as supplied, obtains relevant meeting invitations and asks IT to preserve corporate chat records. The investigator records what cannot be recovered as well as what can. A defensible case file does not pretend missing evidence never existed.
4. Conduct interviews fairly and record them accurately
Interview preparation should be evidence-led. Begin with open questions, then test specific accounts and documents. The complainant should be able to explain the impact of the alleged conduct and identify supporting material. Witnesses should be asked what they personally saw or heard, rather than invited to repeat workplace rumour. The subject of the allegation must have a meaningful opportunity to respond to the case against them.
Interview notes should distinguish questions, answers and the investigator’s later analysis. Avoid presenting a paraphrase as a quotation. Provide the interviewee with a statement or note for review where this is part of the organisation’s procedure, and record any corrections, refusal to sign or disagreement about accuracy.
Confidentiality should be handled carefully. It is rarely appropriate to promise absolute secrecy, because relevant information may need to be disclosed to ensure a fair process. Instead, explain that information will be shared only with those who need it for the case and that participants should avoid discussing the matter more widely.
The manager in this example is given sufficient detail of the allegations to answer them, including the dates, nature of the comments and relevant messages. Redactions may be justified to protect unrelated personal data or a witness’s contact details, but they must not prevent a fair response.
5. Test accounts against the available record
The quality of an investigation depends less on the volume of material than on how it is assessed. The investigator should compare accounts against contemporaneous records, chronology, consistency, opportunity to observe and any reason a witness may have incomplete knowledge. Credibility is not determined by job title, confidence or the number of pages in a statement.
Create a chronology that links allegations, messages, meetings, witness evidence and procedural decisions. This makes gaps visible. If one witness recalls a comment at a meeting that calendar records show they did not attend, the discrepancy should be explored rather than quietly ignored.
For the example, the investigator finds that one colleague directly heard a comment in a team meeting, while the second only heard about it afterwards. The messages confirm some contact but not every phrase alleged. The report should state these distinctions plainly. Findings may be substantiated, not substantiated, or inconclusive according to the applicable standard of proof, commonly the balance of probabilities in workplace disciplinary processes.
6. Produce a reasoned report and prepare the hearing
The investigation report should be structured around the agreed allegations. For each allegation, set out the evidence considered, the competing accounts, relevant facts, analysis and finding. It should avoid advocacy. The report is not stronger because it reaches a particular outcome; it is stronger because a decision-maker can follow how the outcome was reached.
Where a disciplinary hearing is required, prepare a controlled bundle containing the allegation letter, investigation report, witness material, relevant policies, evidence references and any employee response. Pagination, version control and restricted access matter. A late change to one document can create confusion if multiple uncontrolled copies are circulating.
A single secure platform such as Endaxi Brief can maintain the full case lifecycle in one controlled record, from referral intake through evidence management, hearing bundle production and outcome recording. This is particularly useful where several case officers, advisers and panel members require role-based access without relying on unsecured email attachments or personal folders.
7. Record the outcome, rationale and follow-up actions
The final decision should identify who made it, what material was considered, the findings reached, the policy basis and the reasons for the outcome. If misconduct is found, the sanction decision should address proportionality, consistency with comparable cases where relevant, mitigation and any active warnings. The written outcome should also explain the appeal route and deadline.
Not every investigation ends with disciplinary action. The organisation may identify management training needs, weaknesses in team culture, policy ambiguity or a need for welfare support. These actions should be recorded separately from the confidential case evidence where appropriate, with clear ownership and dates for completion.
Retention is the final control. Set a retention period that reflects the nature of the case, legal obligations, limitation considerations and internal policy. Restrict access throughout that period, retain the audit trail and dispose of material securely when it is no longer justified.
A well-run process does not guarantee that every participant will agree with the outcome. It gives the organisation something more durable: a clear record showing that it acted promptly, listened fairly, protected sensitive information and made its decision on evidence rather than assumption.