A Workplace Investigation Framework for small HR teams

When a complaint lands on your desk and you're the entire HR department — or one of two — you don't have time to figure out the process from scratch. Here's the framework, step by step.

Workplace complaints are one of the highest-stakes situations a small HR team will ever handle. Harassment claims, discrimination concerns, retaliation allegations, hostile work environment reports — get the response right and you protect your people and your organization. Get it wrong and you face EEOC charges, lawsuits, regulatory penalties, and the kind of internal damage that takes years to repair.

The good news: a defensible investigation doesn't require a law firm on retainer or a team of specialists. It requires a clear framework, applied consistently, with the right documentation at each step. This guide walks you through the seven stages of a workplace investigation built specifically for HR teams that don't have unlimited resources — but absolutely need to get this right.

1. Intake — Capture Everything in the First Conversation

The intake conversation is the most important conversation in the entire investigation. It's where you establish the scope of the concern, capture the complainant's account while it's freshest, and decide what comes next. Skim this step and the whole investigation suffers.

Treat intake as a structured interview, not a casual chat. Sit down, take notes (or get permission to record if your state allows), and ask open-ended questions. Resist the urge to interrupt, comfort, or promise outcomes. Your job here is to listen and document.

What to capture during intake

• Who — the complainant, the subject(s) of the complaint, and any witnesses they identify
• What — specific behaviors, statements, actions, with as much detail as the complainant can provide
• When — dates, times, frequency, whether it's ongoing
• Where — physical locations, virtual environments (Slack, email, video calls), public or private settings
• Impact — how it has affected the complainant's work, wellbeing, or employment
• Evidence — texts, emails, voicemails, recordings, documents the complainant has access to
• Prior reports — has the complainant raised this before? With whom? What was the response?
• Desired outcome — what is the complainant hoping happens (this informs but does not control your response)

2. Triage — Decide What This Actually Is

Not every complaint requires a formal investigation. Some are interpersonal conflicts better resolved through coaching or facilitated conversation. Others are clear-cut policy violations that need formal investigation immediately. The triage step is where you make that call — and you need to make it within hours of intake, not days.

Triage runs three assessments in parallel: legal risk, severity, and the nature of the conduct alleged.

Legal risk assessment

• Does the alleged conduct involve a protected class (race, sex, age, disability, religion, national origin, pregnancy, sexual orientation, gender identity, or any state-protected category)?
• Is retaliation alleged or possible if the complaint becomes known?
• Are there mandatory reporting obligations triggered (e.g., child abuse, sexual assault under state law, workplace violence)?
• Could the conduct support an EEOC charge, state agency complaint, or civil claim?

Severity assessment

• Is the alleged conduct ongoing or imminent?
• Is there risk of physical harm or workplace violence?
• Is the complainant or any witness in a vulnerable position (subordinate, probationary, on leave, recent hire)?
• Could the response need to include interim separation, leave, or schedule changes to protect the complainant during the investigation?

If the matter involves a protected class, possible retaliation, or any safety concern, you are running a formal investigation. If it's a workplace friction issue with no protected-class element and no safety concern, you may be able to resolve it through coaching, mediation, or a structured conversation — but document that decision and the reasoning.

3. Investigation Plan — Decide Who, What, and How Fast

Before you interview a single witness, write the plan down. This is the document that protects you if your process is later challenged — and it forces you to think the investigation through before you start collecting evidence.

4. Interviews — Structured, Documented, Defensible

Witness interviews are where investigations succeed or fall apart. Run them in a structured way and you build a clear record. Run them casually and you get inconsistent recollections, missed details, and a record that won't hold up if challenged.

Interview structure that works

1. Open — explain the purpose of the interview, the confidentiality framework, the no-retaliation policy, and that the conversation is being documented
2. Background — establish the witness's role, relationship to the parties, and relevant context
3. Open-ended account — ask the witness to describe what they know or observed in their own words, without interruption
4. Targeted follow-up — clarify specifics: who said what, when, where, who else was present
5. Evidence review — show relevant documents or messages and ask the witness to confirm, contextualize, or add
6. Additional witnesses or evidence — ask if there's anyone else you should talk to or anything else you should see
7. Close — remind about no-retaliation, confidentiality, and how to follow up if they remember anything later

Documentation rules for every interview

• Write notes during the interview, not from memory afterward
• Use the witness's own words wherever possible — quote, don't paraphrase
• Capture demeanor only where it's relevant and observable (e.g., "became visibly upset when describing X"), not your interpretation of motive
• Distinguish between what the witness observed firsthand and what they heard from others
• Have the witness review and sign the notes when possible, or send a summary for confirmation

5. Findings — Reach a Conclusion You Can Defend

After interviews and evidence review, you need to reach findings. This is not a courtroom — you are not applying "beyond a reasonable doubt." The standard for workplace investigations is the preponderance of the evidence: based on everything you have, is it more likely than not that the alleged conduct occurred?

Document your findings in writing, with the reasoning. For each allegation, state:

• The specific allegation as framed in the investigation plan
• Whether it is substantiated, unsubstantiated, or inconclusive
• The key evidence supporting the conclusion
• Credibility assessments where they were relevant (and why)
• Any policy violations identified

"Unsubstantiated" is not the same as "didn't happen" — it means the evidence available does not support the allegation by a preponderance. "Inconclusive" means you cannot reach a determination either way. Both are valid outcomes when properly supported.

6. Resolution and Corrective Action

Once findings are documented, resolution decisions follow. Corrective action should be proportionate to the substantiated conduct and consistent with how similar conduct has been addressed in the past.

Resolution options range across a spectrum

• Coaching conversation, with documented expectations going forward
• Written warning or formal performance documentation
• Mandatory training (anti-harassment, anti-discrimination, leadership)
• Role change, reporting structure change, or schedule change
• Final warning
• Suspension
• Termination

Whichever path you choose, document the reasoning, the corrective action taken, and the expectations communicated. Communicate findings to the complainant and to the subject of the complaint in separate, structured conversations — sharing the conclusion and the action taken, without breaching the confidentiality of witnesses or other employees.

7. Follow-Up — Don't Skip This Step

The investigation isn't over when corrective action is delivered. Retaliation claims are one of the most common — and most expensive — outcomes of mishandled investigations, and they almost always arise from what happens after the formal investigation concludes.

Follow-up tasks for every investigation

• Check in with the complainant at 30, 60, and 90 days to assess whether the conduct has stopped and whether they've experienced any retaliation
• Monitor for changes in performance ratings, work assignments, schedule, or access for the complainant — any of which could be the basis of a retaliation claim
• Document each follow-up touchpoint, including the date and any concerns raised
• If the corrective action was training or coaching, verify completion
• If the investigation surfaced systemic issues — a manager pattern, a policy gap, a culture concern — escalate to leadership with a recommendation

The Documentation Trail That Protects You

If your investigation is ever challenged — by an EEOC investigator, a plaintiff's attorney, an internal auditor, or a state agency — the documentation is what protects the organization. The investigation file should include:

Store the file securely, with restricted access. Retain it according to your record retention policy — for harassment and discrimination investigations, most employment attorneys recommend retention of at least the statute of limitations period plus a buffer, which generally means a minimum of three to four years from the conclusion of the investigation.

One Last Thing

The framework above gives you the structure. What it cannot give you, in a single article, is the templates, the state-specific guidance, the legal risk triage logic, or the language to use in those high-stakes resolution conversations. That's where having a tool that walks you through each step — with the documentation built in — changes how confident you can be that you've handled it right.

Workplace investigations are not the place to wing it. They are also not the place to spend $400 an hour on outside counsel for every complaint that lands on your desk. There is a middle path, and it starts with a framework you trust.