Documenting Evidence in a Workplace Investigation

11/8/2025

Documenting evidence in a workplace investigation means recording what you collected, where it came from, who handled it and what it shows, in a file that someone unfamiliar with the case could follow months or years later. Good investigation documentation is factual, complete, secured apart from personnel files and free of opinion or speculation. It is also the record a court, agency or arbitrator will use to judge whether the investigation was fair.

What Counts as Evidence

Most workplace investigations draw on four kinds of evidence:

• Testimonial: accounts from the complainant, the accused and witnesses, captured in interview notes or signed statements.
• Documentary: policies, work product, performance reviews, work schedules, time cards, reports and spreadsheets.
• Electronic: email, chat and text messages, system access logs, badge and security logs, call records and social media posts.
• Physical: notes, damaged property, items found at the scene, and photographs of locations.

Collect early. Security video, access logs and chat histories are often overwritten on a routine schedule, so ask the relevant department in writing to preserve them as soon as the complaint arrives. The volume adds up quickly, which is exactly why the next step matters. Our guide to digital evidence in workplace investigations covers electronic sources in more depth.

Keep an Evidence Log

An evidence log is a running table that accounts for every item in the file. For each item, record:

• An item number and a short description
• The source (the person, system or location it came from)
• The date and time it was obtained, and by whom
• How it was obtained (provided voluntarily, exported from a system, photographed)
• Where it is stored, and every later transfer of custody

The log is what proves the chain of custody: that the item in the file is the item that was collected and has not been altered. That matters most for electronic and physical evidence. Keep originals untouched and work from copies. Export messages in their native format with metadata where possible, and make sure screenshots show the date, time and sender. Where a device needs to be examined, involve IT or a forensic specialist rather than scrolling through it yourself, and check your policies and with counsel before accessing any employee's personal device.

Interview Notes

Interview notes are usually the heart of the file, and the part most often attacked later. For each interview:

• Record the date, time, location and everyone present, and the instructions given, such as the expectation of honesty, confidentiality to the extent possible, and the prohibition on retaliation.
• Write down questions as well as answers, so a reader can see nothing was led.
• Quote key statements verbatim and mark them as quotes.
• Describe demeanor only as observable fact ("paused and looked at her manager before answering"), not conclusions ("was clearly lying").
• Note any refusal to answer, documents the witness offered, and people they said you should speak to.
• Type up a summary promptly while memory is fresh, and consider asking the witness to review it for accuracy and sign it.

In unionized workplaces, an employee may be entitled to a representative in an investigatory interview that could lead to discipline; note any request and how it was handled. For technique, see our guide to witness interviews.

What to Keep Out of the File

A practical test: write every note as though the person it describes will read it, because in litigation they may. Leave out:

• Personal opinions about the people involved ("he has always been difficult").
• Rumor presented as fact. If a witness repeats something they heard, record it as secondhand and note the original source.
• Legal conclusions. Findings should say whether company policy was violated, not whether "harassment under Title VII" or "discrimination" occurred. That is a legal judgment for counsel.
• Unrelated personnel history that has no bearing on the allegations.
• Medical information unless it is genuinely necessary; where it is, keep it in a separate confidential medical file.
• Side commentary: margin jokes, speculation in email chains among colleagues, and early drafts that argue with the evidence.
• Promises of absolute confidentiality. Record what you actually told witnesses, which should be confidentiality to the extent the investigation allows.

Securing the Investigation File

A common mistake is storing investigation files in the same cabinet or shared drive as personnel files, where any HR or administrative staff member can see them. That is a confidentiality breach waiting to happen.

• Separate, locked storage for paper files, with access limited to the investigators and those with a genuine need to know.
• Access-controlled electronic storage, with strong passwords and automated backups, so a power failure or system update does not destroy case files.
• Limits on IT access. IT staff may need to reset passwords or restore systems, but they should not be able to open investigative files. Where they have technical access, a written confidentiality commitment and clear consequences for misuse are sensible.
• External protection. Confirm with IT that the storage location is protected against outside intrusion.

More on this in our guide to workplace investigation confidentiality rules.

Retention, Legal Holds and Privilege

Retention should be set in a written policy with counsel. Some organizations keep investigation files for the length of the employee's employment plus several years; the right period depends on the federal and state recordkeeping rules and the limitation periods that apply where you operate.

Legal holds override the schedule. Once a charge of discrimination has been filed, EEOC rules require the employer to keep relevant records until the matter is finally resolved, and once litigation is reasonably anticipated, routine destruction must stop.

Privilege has to be planned at the outset. If counsel directs the investigation, some materials may be protected as attorney-client communications or work product. Handing a completed HR investigation file to counsel afterward does not make it privileged, and if the employer later relies on the investigation as its defense, privilege over it may be waived. Decide the structure before the first interview.

From Evidence to Findings

The evidence file supports the report, not the other way round. Each finding should point to the specific items and interview statements that support it. Where the investigation touches on retaliation, the timeline in your evidence log is often decisive; see what counts as workplace retaliation. And where the complainant has a documented performance history, keep that file separate from this one, as explained in our guide to investigating a complaint from a poor performer. For writing it up, see our investigation report guide.

Frequently Asked Questions

Should witnesses sign their statements?

It is good practice to ask. A witness who has reviewed and signed a summary finds it harder to dispute later. If a witness refuses, note the refusal and any corrections they requested.

Can we record investigation interviews?

State recording laws differ, and some require the consent of everyone in the conversation. Check the law where each participant is located, and your own policy, before recording.

Can the employee get a copy of the investigation file?

Some states give employees a right to inspect their personnel files, and whether an investigation file falls within that right varies. Keeping investigation files separate, and taking advice before releasing anything, avoids accidental disclosure.

Should we keep handwritten notes after typing them up?

Follow a consistent written policy set with counsel. Never destroy notes once a complaint, charge or lawsuit is pending or reasonably anticipated.

Related Reading and Training

• Internal Investigations Certificate Program
• Advanced Internal Investigations Certificate Program
• HR investigations documentation best practices
• Glossary of workplace investigation terms