The quality of an employee misconduct investigation is rarely judged at the time it is conducted. It is judged later — when the subject appeals the outcome, when an employment tribunal reviews the process, when a regulator asks what steps the organisation took and why. At that point, the decisions made in the early stages of the investigation — about scope, about sequencing, about who conducted the interviews and how — become the substance of what the organisation has to defend.
I have seen misconduct investigations that were well-intentioned, conducted by experienced HR professionals, and still found wanting by an employment tribunal. Not because the underlying conduct was in doubt, but because the process had errors that could not be retrospectively corrected: a witness interviewed before the documentary record had been reviewed, an allegation put to the subject in terms that were leading rather than factual, a report that reached a disciplinary conclusion rather than a factual finding. Each of those errors is avoidable. They persist because the pressure to act quickly, and to reach a particular outcome, consistently overrides the discipline that a proper investigation requires.
This article sets out how a workplace misconduct investigation should be structured — from the decision to launch, through evidence gathering and interviews, to the production of a report that will hold up when tested. It is written for HR directors, in-house legal teams, and board members who are either managing a current concern or building the understanding of what a defensible process requires before they need to apply it under pressure.
What Constitutes Employee Misconduct?
Employee misconduct is conduct that falls below the standard the employer has a reasonable right to expect, in a way that warrants a formal response. It is a broad category, and its breadth is one of the reasons misconduct investigations are so frequently mishandled — the range of conduct involved, and the range of legal frameworks that may apply to it, requires more analytical care than a single standardised process can reliably provide.
The distinction between misconduct and gross misconduct is practically significant. Misconduct — a single instance of poor behaviour, a performance failure with a conduct dimension, a breach of policy that does not go to the root of the employment relationship — may warrant a formal warning but not dismissal at first instance. Gross misconduct — theft, fraud, violence, serious harassment, a deliberate breach of a fundamental obligation — may justify summary dismissal without notice. Getting that distinction right, in the specific circumstances of each case, is one of the most consequential analytical judgments in any misconduct process.
The categories of conduct that most commonly give rise to formal misconduct investigations include:
- Dishonesty and fraud: theft of company assets, falsification of expense claims, invoice fraud, payroll manipulation, or any other conduct involving deliberate dishonesty for financial gain.
- Harassment and discrimination: conduct that creates a hostile or degrading environment for a colleague on the basis of a protected characteristic under the Equality Act 2010, or that amounts to unwanted conduct of a sexual nature.
- Bullying and inappropriate behaviour: sustained or serious conduct that undermines a colleague’s dignity, whether or not it falls within a protected characteristic category.
- Breach of confidentiality: the misuse of confidential information, including client data, commercial information, or personal data held under a duty of confidence.
- Conflict of interest: the failure to disclose a material personal or commercial interest that bears on the employee’s duties, or the exploitation of a position for personal gain at the employer’s expense.
- Abuse of authority: the misuse of a management position to exploit, coerce, or disadvantage a subordinate employee.
- Policy and contractual breach: a serious or repeated failure to comply with the organisation’s policies, procedures, or the terms of the employment contract, where the breach has material consequences.
What these categories share is that they require investigation before any disciplinary decision is made. Employment tribunals consistently find in favour of employees where a dismissal or serious disciplinary outcome was imposed without a reasonable investigation into the alleged conduct. The investigation is not an optional precursor to the disciplinary process. It is the foundation on which the disciplinary decision’s legal defensibility rests.
When Should Employers Launch an Investigation?
The decision to launch a formal misconduct investigation should be made promptly once a concern reaches a threshold of credibility — that is, once there is a reasonable basis to believe that conduct has occurred that, if substantiated, would warrant a formal response. That threshold is deliberately low. The investigation is the mechanism for establishing whether the concern is substantiated, not the outcome of a prior judgment that it is.
The most common error at this stage is delay. Organisations that wait until they are certain something has happened before launching an investigation consistently produce worse outcomes: evidence is lost, witnesses’ recollections fade or are influenced by subsequent conversations, and the subject has more time to prepare their account. The investigation needs to begin when the concern first reaches credibility, not when internal consensus about what to do with it has been reached.
Equally common is the informal management of a concern that should have been formally investigated. A manager who handles a harassment complaint through a quiet conversation, a director who manages a fraud concern through a ‘performance process’, a board that delays commissioning an investigation into a senior employee because the timing is inconvenient — all of these approaches carry legal exposure that a properly structured investigation would have avoided. Employment tribunals and courts have little patience for informality in the management of serious allegations.
The decision to investigate also needs to address two threshold questions that shape everything that follows: who should conduct the investigation, and under what terms of reference.
Who conducts the investigation: the investigator must have no prior involvement in the matter and no relationship with the parties that could compromise their neutrality. Where the subject is a senior employee or director, where the allegation involves the investigating manager’s own function, or where the potential legal exposure is significant, external investigators provide a credibility that internal resource cannot.
Terms of reference: the investigation needs a clearly defined scope before it begins: what allegations it is asked to examine, who it covers, what evidence sources are within scope, and what it is not asked to decide. Unclear terms of reference are a consistent source of avoidable procedural error — either because the investigation is too narrow to address the full concern, or too broad to produce findings that are specific enough to act upon.
Preparing for the Investigation
The preparation stage is where the quality of the investigation is determined, even though it produces nothing visible. Decisions made here — about evidence preservation, witness sequencing, suspension, and information management — create the conditions in which the investigation either proceeds with integrity or is compromised from the outset.
Evidence Preservation
Before any interview takes place, the relevant evidence needs to be identified and preserved. In practice that means securing the documentary record — emails, messages, HR files, system access logs, expense records, contracts, or whatever material is relevant to the specific concern — before any step is taken that might result in its alteration, deletion, or removal.
This is a step that organisations consistently underestimate. In misconduct investigations involving digital communication, a simple instruction to IT to ‘pull the relevant emails’ without forensic protocols can alter metadata, miss deleted material, and produce a record that cannot be independently verified. In investigations involving a subject with system access, failing to restrict that access before they become aware of the investigation creates an obvious evidence risk. Preservation should happen before, not after, the investigation announces itself.
Suspension
Suspension pending investigation is not a disciplinary measure. It is a neutral act, taken to facilitate a fair investigation. It should be considered where the subject’s continued presence at work would create a risk to evidence, to other employees, or to the integrity of the investigation process. It should not be used as a signalling mechanism — to indicate that the outcome is predetermined — and it should not continue for longer than the investigation requires.
Where the subject is suspended, the rationale should be clearly documented, communicated to them in writing, and reviewed regularly. An extended suspension without genuine justification creates unfair dismissal and constructive dismissal exposure, and employment tribunals will look closely at both the decision to suspend and its duration.
Information Management
The investigation’s existence needs to be managed carefully before it becomes known to the parties involved. Who within the organisation knows an investigation is underway, what they are told, and when — these decisions affect both the integrity of the evidence and the fairness of the process. In serious misconduct cases, and in particular those involving a senior employee or allegations of a sensitive nature, information should be shared on a strictly need-to-know basis from the outset.
Gathering Evidence
Evidence gathering in a misconduct investigation is a discipline, not an administrative task. The objective is to assemble the most accurate and complete factual picture possible, using material that has been collected in a way that will withstand challenge. Evidence gathered carelessly does not simply weaken the investigation. In disciplinary proceedings and employment tribunal hearings, it actively damages the employer’s position.
Documentary evidence should be gathered and reviewed before witnesses are interviewed. This is a sequencing discipline with a specific purpose: interviews conducted in the context of a complete documentary record are more productive, more specific, and less susceptible to being shaped by the witness’s account than interviews conducted without it. The investigator who has already reviewed the relevant emails, system logs, and HR files is in a fundamentally stronger position in the interview room than one who is hearing the evidence for the first time.
The categories of evidence relevant to a misconduct investigation vary by the nature of the allegation, but typically include:
Communications data: email correspondence, messaging records, and any other digital communications relevant to the allegation. These are often the most direct evidence in harassment, discrimination, and dishonesty cases. Where communications have been deleted, recovery may be possible through IT forensics, provided the relevant systems are preserved before the investigation becomes visible to the subject.
HR and employment records: the employment contract, any relevant policies, previous disciplinary and performance records, training records, and any prior complaints or concerns involving the parties. These establish the framework within which the alleged conduct occurred and the obligations the subject was operating under.
Financial records: in misconduct cases with a financial dimension — expense fraud, asset misappropriation, conflict of interest — transaction records, approval logs, and accounting system data are primary evidence sources. A forensic review of financial data, conducted before interviews begin, typically produces a more specific and more reliable evidential picture than an account obtained through interview alone.
Access and system logs: in cases involving system misuse, data breach, or the alleged misuse of IT resources, system access logs establish who accessed what, when, and from which device. These records are objective and cannot be retroactively altered by the subject without leaving a further record of the change.
Third-party evidence: client correspondence, supplier records, or other external material that bears on the allegation. In conflict of interest and fraud cases in particular, information from third parties — counterparties to transactions, other businesses connected to the subject — is frequently essential to establishing the full picture.
All evidence should be retained securely throughout the investigation, with a clear record of when it was gathered, by whom, and from what source. The investigation record is itself evidence in any subsequent proceedings, and its integrity matters.
Interviewing Witnesses
Witness interviews are where the investigation’s analytical discipline is most directly tested. An investigator who understands what they are trying to establish, has reviewed the relevant evidence, and knows how to ask questions that are open and factual rather than leading and suggestive will consistently produce better, more reliable witness accounts than one who is conducting a conversation rather than an investigation.
The sequencing of witness interviews matters significantly. The general principle is to work from the outside in: interview those with the most indirect or peripheral knowledge first, those with more direct involvement later, and the subject of the allegation last. This approach builds the evidential picture progressively, reduces the risk that witnesses whose accounts are inconsistent can shape their evidence after hearing others, and means that by the time the principal subject is interviewed, the investigator has the full documentary and witness picture available to test their account against.
Every witness interview should:
- Be introduced with a clear explanation of the purpose of the interview, the subject’s right to be accompanied where applicable, and the fact that a record will be taken and shared with them for review.
- Be conducted by an investigator with no prior involvement in the matter and no relationship with the parties that could compromise the neutrality of the process.
- Use open questions that invite factual accounts rather than leading questions that suggest a preferred answer. The distinction matters legally and analytically — a witness who confirms a leading question has told you less than one who answers an open one.
- Produce a verbatim or near-verbatim record of what was said, shared with the witness for review and correction, and retained as part of the investigation record.
- Avoid placing information from other witnesses or from the documentary record before the witness in a way that allows them to align their account with what has already been established — unless the purpose is specifically to put a contradiction to them.
Where an allegation involves a protected disclosure, particular care is needed in how witnesses are approached, what information they are given about the disclosure, and how their accounts are recorded. Any step that could be interpreted as an attempt to identify or disadvantage the disclosing worker creates serious legal exposure under the Employment Rights Act 1996.
Interviewing the Employee Under Investigation
The interview with the subject of the investigation is the most legally sensitive stage of the process, and the one most frequently mishandled. The subject has the right to know the allegations against them, to be accompanied at a formal investigation meeting under the Employment Relations Act 1999, and to have a genuine opportunity to respond to the case before any decision is made. Each of these rights needs to be explicitly satisfied, and the investigation record needs to demonstrate that it was.
The subject should be notified in writing of the nature of the allegations, in sufficient detail that they can prepare a response, but without disclosing the full evidential picture in a way that allows them to tailor their account to what the investigation has already established. That balance — enough information to be fair, not so much as to undermine the investigation — requires judgment.
In the interview itself, the investigator’s role is to put the allegations factually and to listen to the response. It is not to argue the case, to express a view on credibility, or to reach findings in the room. The specific conduct alleged should be put to the subject clearly: not ‘we understand you may have done X’ but ‘on [date], [the following occurred]. Can you explain what happened.’ The subject’s response — and any documentation or witnesses they wish to rely upon — should be recorded accurately and considered in the analysis of findings.
Where the subject declines to engage, or provides an account that cannot be reconciled with the documentary and witness evidence, this is recorded and its implications addressed in the investigation report. A refusal to cooperate does not prevent the investigation from reaching findings, but it affects how those findings are reached and presented.
Producing an Investigation Report
The investigation report is the document that connects the evidence gathered to the disciplinary decision that follows. It is not a summary of the investigation’s activity. It is a structured, factual account of what the investigation found, how it found it, and what conclusions the evidence supports — written to be used in a disciplinary hearing, reviewed by the subject, and, if necessary, scrutinised by an employment tribunal.
A report that will hold up to challenge needs to do the following clearly and consistently:
- State the terms of reference: what the investigation was asked to determine, and what fell outside its scope.
- Describe the methodology: what evidence was gathered, from what sources, and how witness interviews were conducted and recorded.
- Set out the evidence: factually and chronologically, without editorial commentary. The evidence should be allowed to speak for itself. The report is not the place for the investigator’s impressions of witnesses or their views on what probably happened.
- Distinguish between findings and inference: what is established directly by the evidence, what follows by reasonable inference, and what remains unresolved or disputed.
- Apply the correct standard: the civil standard of balance of probabilities. Where the evidence supports a finding that the alleged conduct more probably occurred than not, that finding should be clearly stated. Where it does not, that should be equally clear.
- Address the subject’s response: whatever account the subject provided, and whatever evidence they relied upon, should be addressed specifically in the findings — not dismissed without explanation.
- Separate findings from recommendations: the investigation report establishes what happened. What should be done about it is a decision for the employer, taken in the disciplinary process. Mixing the two confuses the investigation’s role and creates procedural vulnerability.
The most common failing in investigation reports is overstating. A report that attributes conduct beyond what the evidence clearly establishes, or that uses language suggesting a predetermined conclusion, is the one that gets taken apart in tribunal. Precision and intellectual honesty — stating exactly what the evidence establishes and nothing more — are not timidity. They are the qualities that make a report genuinely useful and genuinely defensible.
Common Employer Mistakes in Misconduct Investigations
The following errors recur with remarkable consistency across the misconduct investigations I have reviewed, the employment tribunal decisions I have read, and the cases where I have been engaged to investigate because an internal process produced findings that were subsequently challenged. They are not complex failures. They are the predictable consequences of conducting an investigation under pressure, without the discipline the process requires.
Conducting the investigation without clear terms of reference: an investigation without defined scope will drift. Witnesses will be asked questions that are outside the relevant concern, evidence will be gathered that prejudices the subject without being specifically relevant to the allegation, and the report will address matters that were never properly within the investigation’s remit. The terms of reference define what the investigation is and is not, and they protect everyone involved.
Interviewing the subject before the evidence has been reviewed: this is the most consequential sequencing error in misconduct investigations. An investigator who interviews the subject before understanding the documentary record cannot ask specific questions about specific evidence, cannot test the subject’s account against what the documents show, and cannot conduct a genuinely investigative interview. The subject has a significant advantage in an interview conducted in this way.
Using leading questions: questions that contain the answer they are looking for — ‘you did make those payments, didn’t you’ rather than ‘can you explain what happened with the payments in March’ — produce unreliable evidence and create grounds for challenge. A witness whose account has been shaped by the questions they were asked has not independently confirmed anything.
Failing to put allegations clearly to the subject: the subject must have a genuine opportunity to respond to the specific conduct alleged against them, in sufficient detail to understand what case they are answering. A subject who was not clearly told what they were alleged to have done, and given a real opportunity to respond, has grounds to challenge the entire process regardless of how strong the substantive evidence is.
Allowing the investigation to take too long without justification: an extended investigation, without clear progress and without regular communication to the parties, creates its own legal risk. Employees suspended for lengthy periods without genuine justification have constructive dismissal claims. The investigation should proceed at a pace the subject matter warrants, with any significant delays clearly documented and justified.
Reaching disciplinary conclusions in the investigation report: the investigation report should establish what happened. The decision about what to do about it belongs to the employer in the disciplinary process, not to the investigator. A report that recommends dismissal, or that uses language indicating the subject is guilty rather than that the evidence supports a finding of the alleged conduct, has stepped outside its proper role and created a procedural vulnerability that may be difficult to cure.
Using an investigator who lacks genuine independence: an investigation conducted by someone with a prior relationship with the parties, a reporting line to the subject, or a personal stake in a particular outcome is not independent however carefully they approach the work. The independence needs to be structural, not just a matter of stated intent. In serious cases, that means external investigators.
When to Use External Investigators
Not every misconduct investigation requires external investigators. A straightforward conduct matter involving a junior employee, a limited evidence base, and no obvious conflict of interest can be appropriately handled by a well-trained internal HR professional applying the ACAS Code. The case for external investigators becomes compelling when the circumstances remove the internal option.
- The subject is a senior employee, director, or someone whose position creates an obvious conflict for any internal investigator — whether because of the reporting relationships involved, the subject’s authority over those who would conduct the investigation, or their relationship with the people who would make the disciplinary decision.
- The allegation involves conduct that carries significant legal complexity — harassment or discrimination under the Equality Act 2010, a protected disclosure, a financial fraud or dishonesty matter, or conduct with a potential criminal dimension — where the legal framework needs to be properly applied from the outset.
- The investigation may lead to dismissal or other serious disciplinary outcome where the risk of employment tribunal proceedings is real, and where the credibility and independence of the investigation will be directly scrutinised.
- The subject has signalled, or it is reasonably anticipated, that they will challenge the process — through a prior pattern of grievance use, legal representation, or the nature of the allegation itself.
- A previous internal investigation has been challenged, found to be flawed, or produced findings that were subsequently set aside, requiring an independent review or a fresh investigation.
- The allegation involves multiple parties, interconnected claims, or a multi-site or cross-jurisdictional dimension that exceeds the capacity or expertise of the internal HR function.
- The organisation’s HR function has a direct interest in the outcome of the investigation — for example, where the allegation involves conduct within or by the HR function itself.
Beyond the specific circumstances, the fundamental consideration is this: an investigation that cannot be challenged on independence grounds is an investigation whose findings can be relied upon. An internal process, however carefully conducted, will always be open to the question of whether the investigator was truly neutral. That question does not arise with the same force for an experienced external investigator with no prior relationship with the organisation or the parties involved.
The cost of a properly conducted external investigation is, in almost every case, lower than the cost of defending an employment tribunal claim that arises from a flawed internal one. That comparison is worth making clearly before the decision is taken.
Facing a misconduct investigation and unsure where to start? Request workplace investigation support from iSpy Detectives.