Resources / Organizations
Organizations / Investigations

Is Your Investigation File Defensible? A 12-Point Review

An internal investigation is judged later by people who were not in the room. The file is all they will see.

The short answer

A defensible investigation file shows a neutral, trained investigator, a scope that matches the allegations, prompt action, interviews of the relevant witnesses, collected documents, reasoned credibility findings, a conclusion that follows from the evidence under a stated standard, proportionate corrective action, and protection against retaliation. If any of those are missing, a judge, jury, or agency may conclude the process was a formality.

Why the file matters more than the finding

When a complaint turns into a charge or a lawsuit, the investigation becomes evidence. A careful process can support the company's defense even if the finding is disputed. A careless one can become the plaintiff's best exhibit. In December 2025, a federal jury awarded $11.5 million against the Society for Human Resource Management in a race discrimination and retaliation case. Coverage of the trial focused on an internal investigator who had never conducted a discrimination investigation before. The lesson applies to every employer: who investigates, and how, is part of the case.

The 12-point review

  • 1. Investigator neutrality. No reporting relationship to the parties, no stake in the outcome, and no prior involvement in the dispute.
  • 2. Investigator competence. Training and experience that fit the seriousness of the allegations. Senior leaders and owners usually call for an outside investigator.
  • 3. Timeliness. Intake, interim measures, interviews, and closure within a reasonable period, with any delays explained.
  • 4. Scope. Every allegation in the complaint identified and addressed, including any retaliation concern raised along the way.
  • 5. Interim measures. Steps to protect the complainant during the investigation that did not penalize the complainant.
  • 6. Witness coverage. The complainant, the respondent, and witnesses each side identified, or a documented reason for not interviewing someone.
  • 7. Documentary evidence. Emails, messages, schedules, and records collected and preserved, not just described.
  • 8. Interview documentation. Contemporaneous notes or summaries, dated, that record questions as well as answers.
  • 9. Credibility analysis. Explained reasoning for whom the investigator believed and why: corroboration, consistency, plausibility, and motive.
  • 10. Standard and conclusion. A stated standard, usually preponderance of the evidence, and findings on each allegation that follow from the evidence.
  • 11. Remediation. Corrective action proportionate to the findings and consistent with how similar conduct was handled before.
  • 12. Closure and retaliation safeguards. Both parties told the outcome at an appropriate level of detail, a retaliation reminder given, a follow-up check scheduled, and the file retained.

The patterns that fail most often

  • The investigator reported to the person accused, or to someone who already decided the outcome.
  • Only the complainant and respondent were interviewed.
  • The report states a conclusion without explaining why one account was credited over another.
  • The complainant's schedule, role, or reviews changed soon after the complaint.
  • Discipline did not match what the company did in similar past cases.

When to review a file

Review before discipline or termination is finalized, when a charge or demand letter arrives, and periodically across a sample of closed files. A periodic review finds process gaps while they are still lessons rather than exhibits. See handling a complaint without HR and the first 90 days after an EEOC charge.

"An investigation is not finished when you reach a conclusion. It is finished when someone who was not there can read the file and reach the same one."

Noël Tarquinii, SHRM-SCP
Key data points
$11.5M

Federal jury award against SHRM (D. Colo., December 2025) in a race discrimination and retaliation case.

HR Brew
47.8%

Of FY2024 EEOC charges alleged retaliation, the most common basis for 17 straight years.

EEOC FY2024 enforcement statistics
12

Points a reviewer tests, from investigator neutrality to closure and retaliation safeguards.

Workplace Intelligence review framework

Common questions

Who should conduct a workplace investigation?

Someone neutral and trained, with no reporting relationship to the parties. For allegations against senior leaders or owners, or where litigation looks likely, an outside investigator is usually the better choice.

What standard of proof applies to an internal investigation?

Most employers use preponderance of the evidence: whether it is more likely than not that the conduct occurred. The standard should be stated in the report.

How long should an investigation take?

It depends on complexity, but it should begin promptly and move without unexplained gaps. Many straightforward investigations close within a few weeks.

Should the complainant see the investigation report?

Usually not the full report. Both parties should be told the outcome at an appropriate level of detail and reminded that retaliation is prohibited.

What is an investigation file review?

An independent check of a completed or in-progress investigation against a defensibility standard, identifying gaps before a decision is finalized or before the file becomes evidence.

When to bring in counsel

Involve employment counsel when an investigation concerns a senior leader or owner, when a charge or demand letter has arrived, or when you want the review conducted under privilege. Workplace Intelligence reviews investigation process and documentation; it does not provide legal advice.

For employers

Find the exposure before a claim does.

The Organizational Risk Diagnostic reviews your documentation, complaint handling, investigations, and terminations, and delivers a written report in 10 business days. From $15,000, fully credited toward a build or advisory engagement within 30 days.