The investigation report is the document through which everything the investigation has gathered is transformed into a form the organisation can act upon. It is also the document that will be scrutinised most carefully if the investigation’s findings are subsequently challenged: by the subject, by employment lawyers, by an employment tribunal, or by a regulator. Its quality determines not just the credibility of the findings but the legal defensibility of everything that follows from them.
In my experience, investigation reports fail in one of two ways. The first is structural: the report does not have a clear enough framework to allow a reader to understand what the investigation was asked to determine, what it found, and why. The second is analytical: the report reaches conclusions that the evidence does not support, or fails to address evidence that is inconvenient for its preferred finding. Both failures are avoidable and both have direct consequences in proceedings.
This article sets out what an investigation report needs to contain, how it should be structured, and where the most common drafting errors occur.
Purpose of an Investigation Report
An investigation report serves several distinct functions simultaneously, and understanding each of them shapes how it should be written.
Its primary function is to establish the facts — to set out, based on the evidence gathered, what the investigation found to have occurred. This is a factual exercise, not a legal one. The report establishes what happened on the balance of probabilities. It does not determine what should be done about it. That distinction is not technical. It is fundamental to the fairness of the process that follows, and its absence is one of the most consistent sources of procedural error in workplace investigations.
Its secondary function is to provide the evidential foundation for the disciplinary or grievance decision that follows. The decision-maker needs to be able to understand what the investigation established, on what basis, and with what degree of certainty. A report that is unclear, that buries its findings in narrative, or that reaches different conclusions in different sections creates a foundation that the decision-maker cannot reliably build on.
Its tertiary function is to demonstrate that the investigation was conducted fairly and to a professional standard. This is the function that matters most if the matter proceeds to tribunal. The report is the primary evidence of how the investigation was conducted, what it examined, and how it reached its conclusions. A report that demonstrates methodological rigour, procedural fairness, and analytical honesty is the strongest protection an organisation has against a procedural unfair dismissal finding.
Report Structure
A well-structured investigation report follows a consistent format that allows any reader — whether the decision-maker, the subject, an employment lawyer, or a tribunal — to understand the investigation and its findings without difficulty. The following structure is the one I apply to the reports I produce, and it reflects the requirements of the ACAS Code and the expectations of employment tribunal proceedings.
Introduction: a brief statement of who commissioned the investigation, who conducted it, and when. This section establishes the governance of the investigation and the independence of the investigator.
Terms of reference: a precise statement of what the investigation was asked to determine, and what fell outside its scope. The terms of reference define the investigation’s evidential remit and protect both parties by making clear what questions were and were not examined.
Methodology: a description of the evidence gathered, the sources accessed, and the interviews conducted. This section demonstrates that the investigation was thorough and that its approach was consistent with the ACAS Code’s requirement for a reasonable investigation.
Summary of evidence: a factual and chronological account of the evidence reviewed, presented without editorial commentary. The evidence section is the foundation on which the findings rest, and it needs to be accurate, complete, and clearly organised.
Findings: the investigation’s conclusions on each specific allegation, applying the balance of probabilities standard, with the reasoning clearly set out. This is the analytical core of the report.
Limitations: an honest account of what the investigation could not establish, what evidence was unavailable, and where the picture remains incomplete. A report that acknowledges its limitations is more credible, not less, than one that presents its findings as more certain than the evidence warrants.
Appendices: the supporting documents relied upon in the analysis, the interview records, and any other material that the findings are based on. The report should be capable of being read and understood without the appendices, but the appendices should be available to support specific findings.
Evidence Summary
The evidence section of the report performs a specific function: it presents the factual record on which the analysis of findings will be based. It is not the place for the investigator’s views, interpretations, or assessments of credibility. Those belong in the findings section. The evidence section should be factual, chronological, and complete.
Where the evidence includes accounts from different witnesses that are inconsistent with each other, those inconsistencies should be noted in the evidence section without being resolved there. The resolution — which account is preferred and why — is the function of the findings section. A report that resolves factual disputes in the evidence section has conflated two analytically distinct stages of the process.
Documentary evidence should be summarised accurately and referenced specifically, so that the reader can locate the underlying document in the appendices. Quotations from documents should be used sparingly and accurately — where the exact wording matters to the finding, quote it precisely; where the substance is what matters, summarise it clearly. Paraphrasing that changes the meaning of a document, or that omits qualifications that would affect the finding, is an analytical error with legal consequences.
Findings
The findings section is the analytical heart of the investigation report. It is where the investigator applies the balance of probabilities standard to the evidence gathered, reaches conclusions on each specific allegation, and explains the reasoning behind those conclusions. It is the section that employment tribunals examine most carefully, and the one where most analytical failures occur.
Address each allegation separately: the report must make a specific finding on each specific allegation examined. A single omnibus conclusion — ‘on the balance of probabilities, the subject engaged in misconduct’ — does not address the individual allegations and does not give the subject, the decision-maker, or a tribunal a clear account of what was found.
State the standard: findings should be expressed in terms that make clear that the balance of probabilities standard has been applied: ‘on the balance of the evidence, I find that…’, or ‘the evidence is sufficient to support a finding, on the balance of probabilities, that…’. Certainty should not be overstated, and ambiguity should not be hidden.
Explain conflicting accounts: where the accounts of the complainant and the subject are directly contradictory, the report must explain why one account is preferred over the other. The explanation should be based on specific features of the evidence: the internal consistency of each account, its consistency with the documentary record, the quality of the corroborating witness evidence, and any other features that bear on its reliability. ‘I preferred the complainant’s account’ without further explanation is not a finding.
Do not reach further than the evidence: this is the most important analytical discipline in report writing. A finding that is expressed more confidently than the evidence supports will be identified and challenged. A finding that is honest about the degree of certainty the evidence warrants is more credible and more defensible, even if it is less satisfying. The evidence does the work; the report records what it establishes.
Recommendations
The question of whether an investigation report should include recommendations is one that HR and legal practitioners disagree on, and the answer depends on what kind of recommendations are being considered.
An investigation report should not recommend sanction. The investigation’s role is to establish the facts. The decision about what to do with those facts — whether to proceed to a disciplinary hearing, what sanction is appropriate, whether to uphold or reject a grievance — belongs to the employer in the disciplinary process. A report that recommends dismissal, or that uses language that effectively prejudges the disciplinary outcome, has overstepped the investigation’s proper function and created a procedural vulnerability that may be difficult to cure.
A report may appropriately include observations about the organisational conditions or control failures that the investigation has identified as relevant context — not as recommendations for sanction, but as matters that the organisation may wish to consider in its broader response to the findings. These should be clearly separated from the factual findings and identified as observations rather than conclusions. A board or audit committee that receives a well-structured investigation report with specific control improvement observations is better placed to address the underlying risk than one that receives only the findings on individual conduct.
Common Reporting Errors
Conflating findings with recommendations: the report’s role is to establish facts. The disciplinary decision’s role is to determine consequences. A report that crosses from the first into the second has undermined the process separation that the ACAS Code requires.
Failing to address all the allegations: an investigation report that addresses some allegations but not others, or that makes a general finding without addressing specific claims, has not completed its function. The subject is entitled to know, specifically, which allegations were found proved and which were not.
Using language that overstates certainty: findings expressed in absolute terms — ‘the subject committed fraud’ rather than ‘the evidence supports a finding, on the balance of probabilities, that the subject…’ — are analytically dishonest and will be challenged. The balance of probabilities standard does not require certainty. The report should not claim it.
Omitting inconvenient evidence: a findings report that presents only the evidence that supports its preferred conclusion and ignores evidence that points the other way is not an investigation report. It is advocacy. Employment tribunals will identify the omission and draw adverse inferences from it.
Writing for the instructing party rather than the evidence: the report must reflect what the investigation found, not what the organisation hoped it would find. An investigator who feels pressure to reach a particular conclusion and allows that pressure to shape the report has produced a document that may satisfy the immediate need but will not withstand the scrutiny that follows.
Producing the report without contemporaneous notes: a findings report that is not supported by contemporaneous interview records, a documented evidence log, and a clear record of the investigation’s methodology is significantly more vulnerable to challenge than one that is. The report is built on those records; without them, its findings have no documented foundation.
Need support producing a legally defensible investigation report? Contact iSpy Detectives.