Internal Investigations 101

What HR Should Document First 

Internal concerns can show up in many forms: a harassment complaint, missing inventory, suspected time theft, expense irregularities, data access concerns, a fraudulent hire, or a workplace conflict that feels like it’s escalating.

When something happens inside a company, the biggest challenge usually isn’t deciding whether to investigate,  it’s knowing how to start in a way that is organized, fair, and defensible.

This guide is a practical, HR-focused overview of what to document first, what mistakes to avoid, and when it makes sense to bring in a neutral third party.

(This article is general information and not legal advice. For legal guidance, consult counsel in your jurisdiction.)

Why documentation matters more than instincts

Many internal issues begin as a feeling: “Something’s off.”

That instinct can be valid, but in business settings, decisions should be guided by facts, consistency, and good process. Clear documentation helps you:

• identify whether you’re dealing with a one-time incident or a pattern
• protect the organization from claims of unfairness or bias
• preserve key information before it disappears (intentionally or not)
• support HR, compliance, and legal teams if the situation escalates

Step 1: Define the “objective” (before collecting everything)

Before you gather documents, get clear on what you’re trying to determine.

A strong objective looks like:

• “Verify whether policy X was violated between these dates.”
• “Determine whether company funds were misused in these transactions.”
• “Clarify what occurred during the incident on [date], and who was present.”
• “Assess whether the complaint includes a safety risk or ongoing exposure.”

Avoid vague objectives like:

• “Find out what’s going on.”
• “Prove they’re lying.”

Those goals often lead to unfocused investigations, inconsistent documentation, and wasted time.

Step 2: Document the basics first (the “case header”)

Start a simple internal record with these basics:

• Date the concern was reported
• Who reported it (name, role, contact info)
• Who received it (HR, manager, hotline, etc.)
• Type of concern (harassment, theft, safety, policy violation, fraud, etc.)
• People involved (names, roles, departments)
• Location(s) (office, job site, remote)
• Known dates/time windows connected to the allegation
• Immediate risk level
• Is anyone unsafe? Is there an ongoing issue that needs immediate action?

Step 3: Capture the complaint in the reporter’s own words

One of the most important early steps: preserve the initial report accurately.

Best practices:

• Document what was reported as close to verbatim as possible
• Capture who, what, when, where
• Separate facts from interpretations 
• Ask: “How do you know that?” and “Was anyone else present?”

Avoid rewriting the story in your own language. Your job is to preserve what was said.. not “clean it up.”

Step 4: Build a simple timeline

Timelines reduce confusion. They also reveal whether this is isolated or repeated.

Start with:

• key dates and times
• incidents that relate directly to the allegation
• policy-relevant events (warnings, schedule changes, access changes, approvals, etc.)

Keep it simple. You can refine as more information comes in.

Step 5: Preserve relevant records

Gather what’s relevant to the objective,  not everything.

Examples of commonly useful records:

• schedules, timecards, PTO requests
• badge access logs (if applicable)
• device access / login records (as available and lawful)
• relevant emails and work messages
• expense reports, receipts, approvals
• invoices, vendor changes, purchase orders
• incident reports and safety documentation
• HR files tied to the issue (prior complaints, prior discipline, policies)

Tip: Preserve records early. In internal matters, delays often mean lost data.

Step 6: Track consistency: who knew what, and when?

A major issue in internal investigations is inconsistent handling.

Document:

• when management or HR became aware
• what actions were taken immediately (if any)
• who was notified
• whether a policy requires specific steps (reporting escalation, safety action, etc.)

This protects the organization if questions arise later about fairness or timeliness.

Step 7: Keep interview notes neutral and structured

If you interview employees, the quality of notes matters.

Use a consistent format:

• date/time/location (or remote platform)
• who was present
• what questions were asked
• the response (as close to exact words as possible)
• any documents referenced

Avoid inserting conclusions into notes (“She was clearly lying”).

Instead, document observable facts (“Employee paused, said ‘I don’t remember,’ and corrected timeline twice”).

What to avoid 

Here are some pitfalls we see repeatedly:

1) Starting with conclusions

If you begin with “we know who did it,” your process can become biased.

2) Over-sharing internally

Limit case details to those who need to know. Gossip destroys trust and can create liability.

3) Inconsistent documentation

If one employee is documented thoroughly and another is not, it can look unfair — even if that wasn’t the intent.

4) Emotional language in notes

“Hostile,” “crazy,” “lazy,” “dramatic,” “untrustworthy” are not facts. They weaken credibility.

5) Delaying preservation

Waiting days or weeks to pull records can result in missing messages, altered logs, or lost evidence.

When a third-party investigator makes sense

Not every issue requires an outside investigator, but certain situations benefit from neutrality.

Consider a third party when:

• leadership or HR may have a perceived conflict of interest
• allegations involve management or executives
• emotions are high and trust is low
• the matter may lead to litigation
• you need additional capacity, speed, or specialized documentation
• you want an unbiased process that protects all parties involved

A neutral investigator can help the process stay focused on facts, reduce internal tension, and produce clear documentation for decision-makers.

A simple “first 24 hours” checklist (for HR)

If you’re not sure where to start, start here:

✅ define the objective in one sentence

✅ document the initial report (who/what/when/where)

✅ identify immediate safety risks

✅ begin a timeline

✅ preserve key records tied to the allegation

✅ limit sharing to need-to-know

✅ keep notes factual and consistent

Final thought

Internal investigations are most effective when they’re handled with clarity, fairness, and structure. The goal is to reduce risk, protect employees, and make informed decisions based on documented facts.

If your organization is dealing with a sensitive internal concern and needs a neutral, discreet approach, a confidential consultation can help clarify next steps.