Employee Relations Investigations: The 8-Step Process, 4 Outcomes, and 5 Common Mistakes

employee relations

October 21, 2026

All employee relations investigations are read twice.

First by you, when you reach a finding. Then by an arbitrator, agency investigator, or opposing counsel who wasn’t part of the case and only has access to your file.

The second reader goes through a short checklist, including the inconsistency between the complaint and first interview, whether what you investigated matched the scope, what the interview notes say, and the written reason you agreed with one account over another. Those answers are either within the file or open to interpretation.

This guide covers the full process, step by step, including the outcomes, examples, and mistakes behind an employee relations investigation.

What is an Employee Relations Investigation?

An employee relations investigation is the formal fact-finding process an employer runs to determine what happened, whether a policy was violated, and what to do about it.

It is also called an HR investigation, workplace investigation, employment investigation, or employee investigation.

Three things separate it from other ways a workplace issue is addressed:

It reaches a conclusion on whether something happened, and that conclusion is stored & recorded.
It builds a file others will review. Notes, evidence, and reasoning behind the finding are compiled because an external authority may read them.
It carries obligations to the people in it. The complainant, respondent, and witnesses have rights during the process, and failing to meet them exposes the employer regardless of the finding.

Note: Investigations are tracked separately from the surrounding processes. For example: a union grievance follows the timeline in the collective agreement & a safety incident follows a reporting and corrective-action workflow. An ER investigation, however, runs on its own record and its own standard of proof, even if it is triggered by the same event.

Who’s Involved in an Employee Relations Investigation?

HR Investigations typically go wrong at the handoffs between the following roles.

Role	What they do	What they are entitled to	Common employer mistake
Complainant	They report the issue and give the first account.	To have the report acted on, freedom from retaliation, and notice that the matter is closed.	Promising confidentiality the process cannot deliver. For example, telling her nobody will know she reported it, then having to identify her so the respondent can answer the allegation.
Respondent	They respond to the allegation.	Enough detail about the allegation to answer it, and the chance to give their side before a decision.	Taking the interview after the outcome is already settled. For example, interviewing him after the termination letter is already drafted, so the interview changes nothing.
Witness	They give their neutral observations.	Freedom from retaliation.	Giving a witness more case detail than his account requires. For example, naming the respondent and the allegation when the only question was what he saw on the dock that Tuesday.
Investigator	They set the scope, take interviews, gather evidence, and write the findings.	Access to the records and people in scope.	Putting them in charge of the discipline alongside the fact-finding.
Decision Maker	They apply the outcome.	The finding and the reasoning behind it.	Disagreeing with the investigator’s conclusion and rewriting the facts to match. For example, changing “the witness confirmed the remark” to “the witness was unclear” because she personally doubts him.
Union representative	They attend the investigatory interview when the employee requests one.	Weingarten applies in union settings (see step 5).	Treating a representation request as negotiable. For example, finishing the last two questions after the employee has asked for a steward.
Legal counsel	They advise on risk, privilege, and exposure.	Involvement early enough to influence the record.	Involving counsel only when the file is built. For example, first legal review happens after the report is finalized, when the options are to defend it or start over.

When Should HR Conduct an Employee Relations Investigation?

No law requires a formal HR investigation for every complaint.

The duty comes from what happens when an employer receives notice of an alleged harassment, discrimination, or retaliation. Once received, the organization must take prompt corrective action, and if the matter reaches litigation, the question asked is whether its response was reasonable. Employers answer that question usually through an investigation. Many states go further and write the standard into regulation, requiring investigations to be impartial, timely, conducted by qualified persons, and documented until resolution.

One rule is strictly maintained, however: do not maintain complete confidentiality.

It can be protected as far as the process allows, but the respondent has to learn enough about the allegation to answer it.

Note: Not every report requires the full process; three tiers cover the realistic range.

Trigger	Tier	Why	Risk if you pick the wrong tier
Harassment or discrimination related to a protected characteristic.	Formal.	Notice starts the clock on the employer’s duty to act.	She files with the EEOC six months later. Your only record of her first report is a manager’s “catch up w/Dana.” Nothing shows what was alleged or what anyone did about it.
Alleged retaliation following an earlier complaint.	Formal.	Retaliation claims often outlive the original allegation.	Her March complaint got a formal investigation. Her June complaint about her manager’s reaction got a hallway conversation. Her lawyer puts the two side by side.
Threat, violence or a safety risk.	Formal.	People need to be separated before facts are established.	A supervisor’s note says “spoke with Rob about the argument.” Eight weeks later Rob shoves a coworker in the parking lot, and nothing on file shows anyone assessed whether he was a risk.
Theft, fraud, or falsified records.	Formal.	The finding will support discipline and may end up in front of police or auditors.	You terminate on a manager’s account of the numbers. At arbitration, there are no interview notes, no documents, or written finding. The arbitrator orders reinstatement with back pay.
Serious allegation with unclear facts.	Inquiry first.	The scope cannot be set until you have an idea of what is alleged.	You scope it as a harassment investigation. Three interviews later, it turns out to be a scheduling dispute between two supervisors, and you now hold a formal harassment file on someone nobody accused of harassment.
Anonymous report with no detail.	Inquiry first.	There may be nothing to investigate or a great deal of it.	The same tip arrives one year later with names attached. There is no record anyone looked at the first one, so the timeline reads as twelve months of ignoring it.
Policy violation, agreed facts, limited harm.	Documented conversation.	No dispute hence no finding to reach.	He admitted the expense coding error the day you asked. You run three weeks of interviews regardless, and the finding stays in his file for something a ten-minute conversation would have closed.
Interpersonal conflict with no policy at stake.	Documented conversation.	Investigations do not resolve conflict, but they do establish facts.	Two people who already dislike each other spend two weeks being interviewed about each other. The finding is that neither broke a policy but now they believe the other person tried to get them fired.

The Employee Relations Investigation Process in 8 Steps

The HR investigation process below comes into play when you decide a formal investigation is appropriate.

Each one covers what happens, who’s involved, what goes in the file, and a failure at that stage.

1. Receive and Assess the Complaint

What happens. A report arrives through a manager, hotline, email or conversation. You quickly establish what’s alleged, against whom, when it happened, and whether anyone is at risk. You do not test whether the allegation is true yet. You establish what it is, which is often NOT what the first telling suggests. The date you receive the report is the date everything later is checked against.

What to document. Data and channel received. The allegation in the exact words of the complainant. The policies potentially at issue. Your assessment decisions and the reason behind it, including a decision not to investigate.

Where it goes wrong. The report may get logged as a topic rather than what it is: an allegation. The file may say “concerns about Marcus’s management style,” so four months later nobody knows whether it was about rudeness or, in fact, a comment about their accent.

2. Take Immediate Action and Set Interim Measures

What happens. You must decide if anything needs to change today before the workplace investigation process moves to fact-finding. Options include separating the two people’s schedules, moving reporting lines temporarily, restricting site or system access, or paid suspension. Interim measures are sometimes necessary to hold the situation in place while the facts get established. They are not discipline and should not be described as such to anyone involved. When the measure involves a shift change, a different workspace, or time away, it may overlap with adjustments the employee is already entitled to, so the two should be handled together.

What to document. What you put in place, the date, who decided it, and the reason. Note explicitly that the measure is precautionary and not a finding.

Where it goes wrong. The complainant is moved. She reported her supervisor, and by Monday she ends up on a different floor, on a different shift, while he keeps his desk. Every later conversation about retaliation starts here.

3. Assign an Impartial Investigator

What happens. You pick someone with no stake in the outcome and no reporting relationship to either party. An investigator may be capable but if they are part of the respondent’s chain of command, their defensible report can look compromised from the outside. In a high-risk HR investigation, if the allegation involves a senior leader, the employee relations function, the termination of a long-tenured employee, or litigation, it is best to go external.

What to document. Who was assigned, when, and the basis for treating them as impartial. If anyone was considered and ruled out, record why.

Where it goes wrong. The HRBP who hired the respondent and has been coaching him for a year oversees the investigation. Her finding may be legitimate, but it reads as a defense of her own judgment, and that is how opposing counsel will present it.

4. Define Scope and Build the Investigation Plan

What happens. You write down what you are investigating before asking any questions. The scope statement names the specific allegations, the policies they engage, the time period covered, and the people involved. It also names what is out of scope, a good reminder to not get carried away, which is the half most people skip.

The plan sets out who gets interviewed and in what order, what documents and records to pull, and a target date for completion. Complainant first, then witnesses, then the respondent is a common sequence, but the allegation sometimes dictates otherwise.

Scope changes during many investigations. That’s normal. But you should amend it in writing, including the date and reason, instead of letting it change by itself. A case file including the plan, amendments, and evidence together is what makes that possible.

What to document. The scope statement, the interview order, the evidence list, the target date, and every amendment with its reason.

Where it goes wrong. The investigation starts with a complaint about how a manager runs team meetings. A witness mentions his expense reports. Three weeks later, you are auditing two years of receipts, nobody has resolved the original complaint, and his lawyer starts inquiring why a conduct issue became a financial audit.

5. Conduct the investigation interviews

Interviews give birth to the employee investigations file. Whatever a reviewer later reads is what someone wrote down in these rooms.

Start the interview properly

Open every interview the same way:

Why they are there, in general terms
That you need honesty and sincerity
That the organization prohibits retaliation against anyone who participates
What happens next and roughly when.

Witnesses get the subject of the inquiry and none of the allegation’s details.

The respondent gets enough detail to answer the allegation, which means more than you give anyone else. Confidentiality is protected as far as the process allows and saying more than that creates a promise you will end up breaking.

Ask the same questions of everyone involved so the record shows consistent treatment.

Interviewing a union employee: Weingarten rights

Weingarten applies when an employee suspects or reasonably believes the interview could lead to a discipline. Per the NLRB, the employee has to ask for their right to qualify.

The employer is under no obligation to tell them the right exists, and a third party, including the union, cannot make the request for them.

Once a request is made, however, the employer is left with three options:

grant it and wait for a representative
deny it and end the interview
let the employee choose between continuing without representation or ending the interview.

Note: Employers should know that continuing to question the employee after denying their request can be an unfair labor practice.

When a witness refuses to participate

Policy should clearly say that participation is expected and not optional.

Find out what the refusal is about instead of assuming it’s due to insubordination. Fear of retaliation or loyalty to a colleague require different responses.

Record the refusal, the date, what you told them, and how you proceeded without them.

An investigation can reach a finding with no witness, but it cannot survive a file that shows someone declined to participate and it went unnoticed.

Take notes that hold up in litigation

Write during the interview and do not rely on recalling events or statements from memory.

You must capture events as asked and answers as given, including marking your own impressions as impressions.

You should:

Date and sign the notes.
Keep the original even after a cleaner version is written down (you will be questioned on missing a first draft).

6. Gather and Weigh the Evidence

In an HR investigation, evidence establishes what can be verified independently and tests the accounts people give.

Types of evidence and what each one proves

Note: Compile documents early before anyone can delete or tamper with them.

Evidence	What it proves	What it does not prove
Records (badge swiped, system logs, timestamps, schedules, call logs)	That someone was somewhere at a given time.	Intent, tone, or what was actually said.
Documents (emails, chat, texts)	The exact wording and tone, without relying on recollection.	That the conversation was the entire exchange.
Witness accounts	What happened and how it landed.	Anything a reviewer will accept without testing credibility.
Physical and video evidence	That an event occurred within the frame it captured.	Context outside the frame or what preceded it.
Prior complaints	Pattern, and whether this is the first time.	That the current allegation is true.

The 5 EEOC credibility factors

Note: The EEOC published these factors in a 1999 guidance that was superseded in April 2024. The 2024 replacement was rescinded in January 2026, and the Commission has not issued its replacement. The factors are still what investigators and courts look at since they come from the law of evidence. Treat them as the working standard and keep your own investigation protocol so you can point to it while federal guidance is unsettled.

Factor	The question to ask	Where it misleads
Inherent plausibility	Is the account believable at face value, given what is established?	Unusual conduct is not implausible. Rare things can happen.
Demeanor	How did the person present while giving the account?	Nervousness reads as deception. So does being autistic, traumatized, or interviewed in a second language. Never let this one decide the outcome.
Motive to falsify	Does either person have a reason to color the account?	The respondent always has a motive to deny so it carries little weight against him on its own.
Corroboration	Does anything independent support the account?	Absence of corroboration isn’t evidence against. Most misconduct occurs without witnesses present.
Past record	Has the respondent done something substantially similar before?	A past finding does not establish the current one.

When two accounts directly conflict

A case is hard when two people describe the same event differently and nobody saw it.

What to do. Start with parts of each account you can verify, especially ones that no one argues about. Say she reports a comment made in the break room just after 2 PM. Nobody heard it, but his badge record shows him entering the break room at 2:04. And he told you he was not in that part of the building that afternoon. The badge record does not prove the comment was made, but it does show her account of the surrounding facts was accurate and his wasn’t.

That gives weight to you crediting the parts you cannot verify.

When nothing independent exists. Work through the 5 EEOC factors and write down the ones you relied on and why.

If you still cannot establish it. Then say so. Inconclusive means you could not establish the allegation so you shouldn’t feel entitled or pressured to make up a conclusion. Inconclusive doesn’t mean that you decided it was false either. Those are different findings with different consequences, and the file has to show which one you reached.

7. Reach a Finding and Document it

The finding of an employee relations investigation is what stays established after interviews are forgotten and people leave.

Preponderance of the evidence

The civil standard is whether the allegation is more likely than not to have happened; it is lower than the criminal one. You are not looking for certainty or proof beyond doubt.

The allegation must clearly pass that line.

If the evidence leaves you genuinely balanced between the two accounts, the finding becomes unsubstantiated. One credible account against one denial can pass that line if you can explain why you credited one over the other.

Writing the rationale

What to include. State the allegation, what you established, what you could not establish, and why you reached your specific conclusion.

You must name the evidence you relied on and set aside, and the reason for not considering it.

Why it matters. The rationale separates a finding from the allegation.

“The allegation is substantiated” doesn’t tell anyone much.

However, “the allegation was substantiated because the complainant’s account was consistent in two interviews, the badge record contradicts the respondent’s account of his location, and two witnesses describe similar conduct in the same period” …

… can be tested by someone who wasn’t present.

Write the report assuming it will be read in discovery

If the employer later defends itself by pointing to the quality of its workplace investigation, courts have treated that as putting the investigation at issue and waiving privilege over the file.

A defendant cannot use the investigation as both a shield and a sword.

What that means in practice. Write every report as a discoverable document. Keep legal advice in a separate channel from the fact-finding, so that advice stays privileged whether or not the investigation file does. Do not include anything in a report you would not want to be read aloud.

8. Communicate Outcomes and Follow Up

What happens. Each party gets told something different.

Respondent. Receives the finding and the consequence.
Complainant. Gets told the matter was investigated, whether the allegation was substantiated, & that “action was taken” (without specifics of anyone’s discipline).
Witnesses. Are told the matter has closed and the ban on retaliation is applicable.

When the finding leads to a warning, demotion, or termination, the outcome and reasoning are tracked together, so whoever applies the consequence relies on the finding rather than their own judgment.

Aftercare usually continues after the closing conversation. You can check back in with the complainant and the respondent after a month and again a few months later. Retaliation typically occurs much later than the file’s closure.

What to document. Who was told what, by whom, and on what date, including the follow-up contacts and anything raised in them.

Where it goes wrong. The case closes and nobody updates the complainant regarding the outcome. She assumes the report didn’t progress, and the next version of her complaint comes through an agency instead of by her directly.

4 Employee Relations Investigation Outcomes and What They Mean

Each employee relations investigation closes in one of four ways, and most case files do not reflect the differences between them.

HR investigation outcomes recorded loosely create problems later, such as when someone reads the file without the context you had at the time.

Outcome	What it means	What the file has to show	Common error
Substantiated	The evidence established the conduct occurred and breached policy.	Which specific allegations were established and the evidence behind them.	Attaching a consequence to the seriousness of the original allegation rather than to what was actually established.
Partially substantiated	Some allegations held, others did not.	Each allegation listed separately with its own finding.	Recording the whole complaint as substantiated when only two out of four incidents were established.
Unsubstantiated	The evidence did not establish that the conduct occurred.	That the allegation wasn’t established and that the complaint was made in good faith.	Writing it as though the complainant lied, which creates a different kind of exposure.
Inconclusive	You couldn’t establish what happened either way.	That the evidence was considered and why it was not enough to decide the outcome.	Recording it as unsubstantiated instead because inconclusive might reflect poorly or look like failure.

Consistency in similar cases. Whatever the outcome, the consequence should align with how similar cases are handled before.

If a supervisor was suspended last year for conduct resembling what a manager faces for termination now, the difference needs to be explained in a way that isn’t related to “personality” or “seniority.”

Tracking substantiation rates and outcomes by case type is how most ER teams catch these differences before someone outside the organization clocks it.

12 Types of Employee Relations Investigations and What Makes Them Different

A lot of workplace investigation scenarios fall into one of these 12 types and the differences between them are procedural, not behavioral, since the underlying behavior can be the same.

What changes is the evidence available, who else gets involved, and what runs alongside the investigation.

Investigation type	What you have to establish	What complicates it
1. Sexual harassment	Whether the conduct occurred, whether it was unwelcome, and whether it was severe or pervasive enough to breach policy.	Most incidents do not have witnesses, so the file depends on credibility and pattern instead of direct evidence.
2. Discrimination	Whether someone was treated differently, and whether a protected characteristic explains the difference.	Comparison affects the finding, so you end up also investigating how other employees were treated in similar cases as well as this one.
3. Retaliation	Whether an adverse action followed a protected report and whether the two are linked in any way.	The decision maker usually denies knowledge about the original complaint, so timing, and who knew what, is an essential part of the case.
4. Bullying or hostile work environment	Whether a pattern of conduct occurred and if it crosses beyond poor management into a flat out policy breach.	No single incident looks serious if looked at individually and the complaint is usually received after the pattern is established.
5. Threats or workplace violence	What was said or done and whether risk still exists.	The risk assessment cannot wait for the finding so protective steps are executed despite facts remaining unclear.
6. Fraud or embezzlement	Whether the transactions occurred and whether they were authorized.	Records allow the facts to be checked, so the scope gets stretched, and auditors or law enforcement may need the file to be intact.
7. Time and attendance falsification	Whether hours claimed align with hours worked and if anyone approved the gap.	Supervisors are often implicated with the employee, complicating who can credibly investigate the situation.
8. Theft of property or data	Whether the asset or data is gone and whether the employee was responsible.	System logs and access records hold the case and preserving them before anything is deleted is more important than interview sequences.
9. Substance use	That the employee was impaired at work and if any policies or safety rules were breached.	Testing rules vary by state and role, and a condition under treatment may trigger accommodation obligations instead of a discipline.
10. Safety breach with a conduct element	If any rules were broken or if pressure or instructions from higher up influenced it in any way.	A separate incident investigation runs on its own timeline, and the two findings answer different questions.
11. Social media or off-duty conduct	That the conduct occurred and if it has a genuine connection to the workplace.	Some posts about pay or working conditions are protected activity under the NLRA, so discipline creates separate exposure.
12. Bargaining-unit misconduct	That the conduct occurred to the standard the collective agreement requires.	Weingarten applies to the interview; a grievance may run in parallel and just cause sets a higher bar than workplace policy.

5 Common Employee Relations Investigation Mistakes

These are the failures that exist within the whole employee relations investigation instead of within any one step, which is why they can “survive a checklist.”

Not investigating because the complainant asked you not to. She reports a serious allegation and then says she does not want anything to be done about it. Honoring that request may feel respectful, but it is a common way an employer ends up on notice with no record of taking action. Once you know, the obligation becomes yours rather than hers. You can narrow what you do and how visibly you do it, but the investigation decision is not the complainant’s to make.
Letting the investigation lag between steps. Investigations are often “paused.” Many factors contribute to this, such as someone taking a leave, a hard to schedule witness, a holiday period, or weeks passing without adding anything to the file. If a reviewer notices this gap, it looks much worse than a slow investigation that documents why it’s being held up.
Running HR investigations differently. Without a written protocol, investigators are left relying on their own habits, meaning there is no consistency between how cases are handled and no standard to rely on.
Investigating the allegation as framed instead of what it is. There is nuance involved in allegations. For example, a complaint regarding a schedule change may in fact be about what happened after someone raised a safety concern. Taking a stated allegation at face value is a common mistake in an HR investigation that can lead to questions about retaliation not being raised. It will eventually surface with the investigation itself as part of the evidence.
Treating company policy as the only standard worth following. Policy defines the floor, but a collective agreement may need just cause, a state law may have its own requirements for timelines or investigator qualification, and a regulated role may have its own reporting obligations. It is worth noting, then, that a policy breach isn’t the same as meeting the standard that applies to the situation.

See How Sodales Runs Employee Relations Investigations

Sodales is the system of record for all employee investigations.

Intake, interim measures, interviews, evidence, findings, and outcomes exist on one case file.

Complaint intake → complaint management captures the date, the channel, and the complainant’s own words at the point of report.
Interim measures → the separation, schedule change, or suspension are executed before the finding is recorded against the case with its date and reason.
Scope and evidence → one case record has the plan, amendment, interview notes, and documents.
Past record → complete employee history so prior complaints and corrective actions are visible before the interview process.
Findings and discipline → discipline management connects the consequences to what the finding established.
Union investigations → grievance tracking keeps the grievance and its deadlines in the same place as the investigation.

Let us show you how Sodales keeps every employee relations or HR investigation defensible.

Book a demo.