7 Internal Investigation Steps for U.S. HR Teams — EEOC, OSHA & Counsel
Follow this ordered sequence: intake, scope and investigator selection, evidence preservation with interim protections, interviews, analysis and root cause determination, written findings, then remediation and monitoring. Each step depends on the one before it, so skipping ahead (jumping straight to interviews before you’ve thought about scope, for instance) is how investigations fall apart later. The non-negotiables throughout are speed, neutrality, documentation, and interim protections for anyone who might be at risk. Decide early whether counsel needs to be involved, because that choice shapes privilege.
TL;DR:
Preserving digital evidence immediately with a preservation notice is crucial because data can be deleted or overwritten quickly, especially in digital environments.
Selecting an investigator without ties to the accused and documenting the legal purpose of the investigation helps maintain neutrality and safeguards attorney-client privilege.
Conducting separate, open-ended interviews with complainants, accused, and witnesses prevents contamination of accounts and supports credible credibility assessments.
Building a comprehensive, chronological evidence file and analyzing credibility factors such as corroboration and plausibility is essential for accurate findings.
Implementing targeted corrective actions and scheduled follow-ups protects against retaliation claims and ensures the investigation’s lessons lead to systemic improvements.
Chief Legal Officechieflegaloffice.comBring Structure to Complex InvestigationsChief Legal Office provides senior legal leadership and a dedicated team to help companies organize legal work and manage complex risks.Learn about our legal department
Table of Contents
A quick checklist you can act on right now
Step 1: Intake and triage, record the report and assess risk
Step 2: Define scope and choose an investigator
Step 3: Preserve evidence and put interim protections in place
Step 4: Interviewing, order, technique, and recording
Step 5: Assemble and analyze the evidence
Step 6: Write findings and reach a decision
Step 7: Corrective action, communication, and anti-retaliation monitoring
How counsel keeps the process defensible
Investigations exist to prevent harm, not assign blame
How we support HR teams through investigations
FAQ
Sources
A quick checklist you can act on right now
Once a report lands, the clock matters more than people realize. Here’s the order of operations:
Record the complaint in writing within hours, not days.
Loop in your HR lead and counsel immediately if there’s any hint of harassment, discrimination, safety risk, or potential litigation.
Notify IT to preserve relevant devices, emails, and logs before anyone has a chance to delete anything.
Assess immediate risk: does anyone need to be separated or protected today?
Assign an investigator who has no reporting relationship to the accused.
Step 1: Intake and triage, record the report and assess risk
The first conversation sets the tone for everything after it. Use a simple intake form that captures who is reporting, what happened, when and where, and who else was involved or witnessed it. Keep the original complaint, written or verbal notes taken verbatim where possible, because paraphrasing early reports is a common way investigations lose credibility later.
Triage for anything that demands same-day action:
Threats of violence or self-harm
Safety hazards that could hurt someone else before you’ve even opened a file
Signs that evidence (texts, files, security footage) might disappear if you wait
The EEOC’s own checklist calls for documentation from the very first contact through final resolution, which means your intake notes aren’t just a formality. They’re the first page of a file that may get read by a regulator someday. Limit who knows about the complaint to people with a genuine need to know, and write down exactly who received the report and when.
Step 2: Define scope and choose an investigator
Before anyone starts asking questions, write a short paragraph describing what you’re actually investigating: the alleged conduct, the relevant date range, and the witnesses who likely need to be checked. Scope creep (investigating everything the complainant has ever been unhappy about) wastes time and muddies your findings.
Picking the investigator matters as much as the scope itself:
No reporting relationship to the accused, direct or indirect
Enough training to assess credibility and ask neutral questions
No personal stake in the outcome
Pro Tip: If the accused is a senior leader, bring in an investigator from outside that person’s chain of command entirely, even if that means using outside counsel.
Whether to involve a lawyer from the start depends on litigation risk. Attorney-client privilege doesn’t attach automatically just because a lawyer is in the room. As Yale’s Office of General Counsel explains, the investigation’s purpose and how it’s handled determine whether privilege applies, so document the legal purpose clearly if you want that protection to hold up.
Step 3: Preserve evidence and put interim protections in place
Evidence has a shelf life, and digital evidence has the shortest one of all. The moment a complaint is serious enough to warrant investigation, send preservation notices for relevant devices, email accounts, chat logs, and access records. Don’t wait for the scope to be finalized. You can narrow later; you can’t recover deleted data later.
Issue a litigation hold or preservation notice to IT immediately
Capture security footage before automatic overwrite cycles erase it
Use a digital forensics partner for chain-of-custody handling when the evidence might end up in litigation
At the same time, think about interim protections that don’t punish the person who came forward. A schedule change, a temporary reporting line adjustment, or paid leave for the accused are common options. The goal is reducing harm without signaling guilt before you’ve gathered facts, and EEOC guidance is clear that these measures shouldn’t burden the complainant more than the accused.
Step 4: Interviewing, order, technique, and recording
Interview order matters more than most HR teams expect. Start with the complainant, then move to the accused, then witnesses, each interviewed separately so accounts aren’t contaminated by what someone else said in the hallway afterward.
Ask open questions (“Walk me through what happened”) rather than leading ones.
Avoid arguing with or challenging the person you’re interviewing, even when their account seems implausible.
Probe for corroboration: documents, texts, calendar entries, other witnesses who can confirm or contradict details.
Take contemporaneous notes rather than relying on memory afterward.
If recording, get documented consent first and check your state’s consent laws.
Pro Tip: If counsel is leading interviews that touch on potential litigation, standardize Upjohn warnings so every interviewee understands counsel represents the company, not them personally.
The American Bar Association’s guidance on avoiding the lawyer-witness problem makes a point worth repeating: if the investigating lawyer becomes the only person who can testify to what was said, that lawyer may have to step aside as a witness. A second interviewer or dedicated note-taker solves this before it becomes a problem.
Step 5: Assemble and analyze the evidence
Once interviews are done, lay everything out: timelines, documents, access logs, physical evidence, and interview notes, side by side. Build a single master timeline rather than keeping separate narratives for each witness. Inconsistencies jump out faster that way.
Credibility assessment comes down to a few repeatable factors:
Corroboration from independent sources
Plausibility given the physical facts
Motive to fabricate or exaggerate
Contemporaneous records versus reconstructed memory
For safety-related incidents, OSHA’s incident investigation framework recommends digging past the immediate cause to find the root cause, using tools like 5 Whys or event trees. The goal isn’t finding someone to blame. It’s finding the system gap that let the incident happen in the first place.
Step 6: Write findings and reach a decision
Your report should read clearly enough that someone outside HR, a judge, a regulator, a board member, could follow the logic without a translator. Structure it around four sections:
The specific allegation as originally reported
A summary of the evidence gathered
A credibility analysis explaining which accounts you found more reliable and why
The finding itself, stated against your policy’s standard of proof (usually a preponderance of the evidence) along with recommended corrective action
Name the decision-maker and the reasoning behind the call, not just the conclusion. A finding that says “substantiated” without explaining why is much harder to defend later than one that walks through the evidence. Retain the full file, notes included, well beyond the investigation’s close.
Step 7: Corrective action, communication, and anti-retaliation monitoring
The remedy should match what actually caused the problem. Individual discipline fits individual misconduct; a pattern across a team usually points to a system fix, like retraining, policy clarification, or management changes. Assign an owner and a deadline to each corrective action so it doesn’t quietly disappear.
Tell the complainant and the accused that the matter is resolved, with only as much detail as necessary
Avoid disclosing sensitive findings about other employees in that conversation
Schedule follow-up check-ins with the complainant at 30 and 90 days to watch for retaliation
Document those check-ins, because a monitoring record is often what protects you if a retaliation claim surfaces later
Keep in mind that an internal investigation, however well run, doesn’t pause the external clock. The EEOC’s charge-filing deadlines run on their own schedule regardless of where your internal process stands.
How counsel keeps the process defensible
Separate the fact-finder role from the legal-advice role wherever you can, and write down the legal purpose behind any investigation you want privilege to cover. Avoid letting one attorney both interview witnesses and advise leadership on the same matter. A second interviewer or dedicated note-taker protects against the lawyer-witness problem the ABA warns about. This kind of structure is exactly what a fractional in-house legal team is built to provide: enough bench strength that no single person is wearing every hat at once.
Investigations exist to prevent harm, not assign blame
The best investigations we have seen treat findings as a chance to fix systems, not just punish individuals. A company that investigates quickly and fairly protects itself, but it also learns something about where its own processes failed.
— Amy Natasha Osteen
How we support HR teams through investigations
Running a defensible investigation while also doing your actual job is a lot to ask of any HR team, which is why so many lean on outside structure for the parts that carry the most legal weight. Our Investigations & Litigation Support service gives you a senior attorney who can scope the inquiry, make the privilege call, and keep the file in shape from day one, backed by a team that handles the documentation and follow-up so nothing slips.
For companies that want this kind of judgment available on an ongoing basis, not just for one matter, our Fractional General Counsel service folds investigations into the broader legal function we run for you. Plans start at our Foundations tier, and the next step is simple: reach out for a scoped call so we can walk through what your situation actually needs.
FAQ
What are the steps involved in an internal investigation?
The core sequence is intake, scope and investigator selection, evidence preservation with interim protections, interviews, analysis, written findings, and corrective action with monitoring. The EEOC’s checklist expects each of these steps to be documented from first contact through resolution.
What are the 5 steps of the investigation process?
A common management summary breaks the process into intake, investigation design, fact gathering, findings and report, and corrective action with follow-up. It’s a useful way to think about structure, but the EEOC notes that actual scope and urgency still depend on the specific allegation and jurisdiction.
What are the 7 steps to incident investigation?
For safety-related incidents, OSHA’s framework centers on preserving the scene, collecting information, interviewing witnesses separately, determining immediate and root causes, implementing corrective actions, and verifying completion. The focus throughout is prevention rather than blame.
How does involving counsel affect privilege in an investigation?
Attorney-client privilege depends on the investigation’s purpose and how it’s handled, not simply on whether a lawyer is involved. Yale’s Office of General Counsel notes that labeling something privileged isn’t enough; the legal purpose needs to be documented and distribution limited to those with a genuine need to know.
What does Chief Legal Office charge for investigation support?
Pricing depends on scope, but our ongoing fractional legal plans start with Foundations at 1000 USD per month, with Embedded Access and Strategic Growth tiers available for companies that need more hands-on support. Investigations handled under our Investigations & Litigation Support service are scoped individually based on the matter.
Sources
Checklists for Employers | U.S. Equal Employment Opportunity Commission
Incident investigation | Occupational Safety and Health Administration
The lawyerly fine print: This article is for general information, not legal advice…
