Summary. A workplace investigation is a legal proceeding conducted by non-lawyers under time pressure, and its quality determines whether an employer has a defense or a document that will be read to a jury. This guide covers the process end to end: what the Faragher-Ellerth defense actually requires, how to receive and triage a complaint, which interim measures create retaliation exposure, who should investigate and how privilege works, how to plan and conduct interviews, how to assess credibility and make findings, what belongs in a report, and how to close the loop. It also addresses the harder situations — anonymous complaints, executive respondents, potentially criminal conduct, and unionized workforces.

A manager receives an email from an employee describing three incidents with a senior colleague over four months. The manager forwards it to human resources with a note: "Can you look into this?"

What happens next determines whether the company has a defense.

Version one. An HR generalist calls the complainant, takes notes on a legal pad, calls the respondent, who denies everything, and closes the file with a note that the allegations "could not be substantiated." No witnesses are interviewed. No documents are collected. The complainant is not told the outcome. Three months later she resigns and sues.

At trial, the plaintiff's counsel establishes that the company interviewed two people about a four-month course of conduct, never asked the complainant for names of witnesses she had offered, never looked at the badge access records that would have confirmed one incident, and never followed up. The investigation itself becomes the evidence of the employer's indifference, and the Faragher-Ellerth defense fails.

Version two. The same facts. The complaint is logged and triaged within 24 hours. An investigator with no reporting relationship to either party is assigned. Interim measures separate the parties without moving the complainant. Eleven witnesses are interviewed, badge records and calendar entries are pulled, and prior complaints are checked. Credibility is assessed against specific criteria and documented. Findings are made on a preponderance standard, with reasoning. Discipline follows within a week. The complainant is told the outcome and is followed up with at 30, 60, and 90 days.

Same facts, same allegations, entirely different defense — and, more to the point, an entirely different workplace.

The investigation is not paperwork that follows the decision. It is the decision.

Why it matters legally

The affirmative defense. Under Faragher v. City of Boca Raton, 524 U.S. 775 (1998), and Burlington Industries, Inc. v. Ellerth, 524 U.S. 742 (1998), an employer is vicariously liable for a supervisor's harassment. Where the harassment culminated in a tangible employment action — discharge, demotion, or an undesirable reassignment — liability is strict, with no defense.

Where there was no tangible employment action, the employer may raise an affirmative defense by proving both:

  1. That it exercised reasonable care to prevent and promptly correct any harassing behavior; and
  2. That the employee unreasonably failed to take advantage of preventive or corrective opportunities the employer provided.

Prong one is the investigation. A published policy is necessary and not sufficient. What the employer must show is that the complaint process worked — that the complaint was received, investigated promptly and adequately, and that appropriate corrective action followed.

Who counts as a supervisor matters, and it is narrower than people assume. Under Vance v. Ball State University, 570 U.S. 421 (2013), a supervisor for vicarious liability purposes is someone empowered to take tangible employment actions against the victim. For coworker harassment, the standard is negligence: the employer is liable if it knew or should have known and failed to take prompt, appropriate corrective action. Either way, the investigation is the fulcrum.

Beyond Title VII. Many states impose broader obligations, several mandate harassment training, and some require specific investigation procedures. Contracts, collective bargaining agreements, and the company's own policy may impose obligations that exceed the legal minimum — and a company that fails to follow its own published procedure hands the plaintiff an argument regardless of what the law required.

Note also what the investigation is not. It is not a court proceeding. There is no discovery, no compelled testimony, no cross-examination, and no requirement of proof beyond a reasonable doubt. It is a reasonable, good-faith factual inquiry, and it is judged by whether it was reasonable — not by whether it reached the same conclusion a jury would.

Intake and triage

Receive complaints through multiple channels — a supervisor, human resources, a hotline, an ombudsperson, or a designated officer — and train managers that any report of harassment, however informal, triggers the obligation. A manager who receives a complaint and does nothing has given the company notice as a matter of law.

Log every complaint in a single, confidential tracking system: date received, complainant, respondent, allegations, who was assigned, key dates, outcome, and action taken. The log matters for pattern detection — a second complaint about the same person changes the analysis entirely — and its absence is a finding in litigation.

Triage within 24 to 48 hours. Assess:

  • Severity. Physical contact, threats, sexual assault, weapons, or conduct that may be criminal go to the top of the queue and may require immediate escalation to counsel and, in some cases, law enforcement.
  • Ongoing risk. Is the complainant still in contact with the respondent? Is anyone in danger?
  • Scope. One incident or a course of conduct? One respondent or several? Any prior complaints about this person?
  • Who must be involved. Legal, senior leadership, the board (if an executive is the respondent), and any regulator with a reporting obligation.
  • Whether an outside investigator is needed (below).
  • Whether an obligation to report externally exists — child or vulnerable adult abuse reporting, licensing board reporting, or securities disclosure obligations in some circumstances.

Acknowledge the complaint to the complainant promptly, explain the process and the timeline, explain the anti-retaliation policy, and give them a point of contact. Complainants who hear nothing for three weeks conclude — often correctly — that nothing is happening, and that conclusion drives them to counsel.

Interim measures

The goal is to stop any ongoing harm without penalizing the complainant.

Options: separating the parties by adjusting reporting lines, schedules, or work locations; a directive that the respondent have no contact with the complainant; paid administrative leave for the respondent pending the investigation; adjusting duties; and in serious cases, suspension.

The single most important rule: do not move, transfer, reassign, or reduce the hours of the complainant unless they request it and confirm the request in writing. Moving the complainant is an adverse action, it is the textbook retaliation claim, and it is common — because it is administratively easier than moving the respondent.

Document the reasoning for every interim measure, and frame them as neutral and temporary, without prejudging the outcome.

Communicate the anti-retaliation policy to the respondent and to every witness, explicitly, and document that you did.

The investigator

Who should investigate:

Internal HR or a compliance function — appropriate for most complaints. The investigator must be trained, must have no reporting relationship to either party, must have no personal involvement, and must be perceived as neutral by both.

In-house counsel — creates privilege complications discussed below, and makes the lawyer a potential witness.

An outside investigator — an employment lawyer or a professional investigator. Use one when: the respondent is a senior executive, an officer, or a board member; the allegations are severe or may be criminal; the complainant or the respondent is high-profile; the internal team lacks capacity or expertise; there is any question about internal neutrality; litigation is likely; or the board or a regulator will review the result.

The most common failure is assigning the investigation to someone who reports to the respondent. No amount of rigor overcomes that.

Privilege. Three points that are widely misunderstood:

An investigation is not privileged merely because a lawyer conducts it. The privilege attaches to communications made for the purpose of obtaining or providing legal advice. Under the Upjohn framework and its progeny, an internal investigation can be privileged where obtaining legal advice was a significant purpose, even if not the sole one — but the record must support that characterization, and it is built by an engagement letter directing the investigation for the purpose of legal advice, by counsel directing the work, and by treating the output as legal advice.

Asserting the Faragher-Ellerth defense generally waives the privilege as to the investigation. An employer that defends on the ground that it investigated adequately puts the adequacy of the investigation at issue, and courts routinely require production of the investigation file. Assume the entire investigation will be produced.

The practical consequence is that privilege should not be the organizing principle. Write the investigation as though a jury will read it — because if the defense is asserted, one will. Where a genuine legal analysis is needed, keep it in a separate, clearly privileged memorandum from counsel to the company, distinct from the factual investigation report.

Upjohn warnings. When counsel interviews an employee, the employee must be told: counsel represents the company, not the employee; the interview is privileged and the privilege belongs to the company, which may waive it and disclose the interview; and the employee should keep the discussion confidential. Give the warning, document that it was given, and do not soften it — an ambiguous warning creates a risk that the employee reasonably believed counsel represented them personally.

Planning

Before any interview, prepare a written plan:

Define the scope. What specific allegations will be investigated? Scope creep is the most common cause of investigations that take four months. If new allegations arise, decide deliberately whether to expand the scope or open a separate matter.

Identify the legal standards implicated — the company's policy, the applicable statutes, and any contractual obligations.

Build the witness list and the order. Generally: complainant first, then documentary evidence, then witnesses, then the respondent, then follow-up with anyone the respondent identified. Interviewing the respondent early, before the evidence is gathered, wastes the single best opportunity to test their account against known facts.

Identify and preserve evidence immediately:

  • Email, chat, and messaging platforms — with a litigation hold issued before any auto-deletion policy runs.
  • Personnel files for both parties, including prior discipline and prior complaints.
  • Text messages and personal devices, subject to what the company can lawfully access — which depends on the device policy and on state law.
  • Badge access, security video, phone records, calendar entries, and travel records, all of which can corroborate or contradict a timeline.
  • Performance reviews, particularly any that changed in timing or tone.
  • Any recordings, keeping in mind that state wiretapping laws may make a recording unlawful and that some states protect an employee's recording of a workplace conversation.

Set a timeline. Most investigations should be complete within two to four weeks. Complexity extends it, but a complainant who waits three months without communication has a retaliation narrative and a constructive discharge argument.

Decide the confidentiality instruction carefully. Employers historically told witnesses not to discuss the investigation with anyone. The National Labor Relations Board has treated blanket confidentiality directives as interfering with employees' § 7 right to discuss working conditions, and the governing framework has changed with successive Boards. The durable approach is to explain that the company requests confidentiality to protect the integrity of the investigation and the privacy of those involved, to give a specific justification where a directive is necessary (witness protection, evidence preservation, risk of fabrication), to limit any directive to the duration of the investigation, and to state expressly that employees may discuss their own terms and conditions of employment and may cooperate with government agencies.

Interviews

Setting. Private, uninterrupted, and neutral. Not the respondent's office, and not a glass conference room in the middle of the floor.

Two interviewers where practical — one asking, one taking notes — which produces a better record and gives the company a witness to what was said.

Recording. Generally avoid it. Recordings create a verbatim record that will be scrutinized, they inhibit candor, and consent requirements vary by state. Contemporaneous notes, typed up the same day, are better practice.

The complainant interview:

  • Explain the process, the timeline, the anti-retaliation policy, and the limits of confidentiality — specifically, that the company cannot promise complete confidentiality because it must investigate.
  • Get the complete account in the complainant's own words first, without interruption.
  • Then go through it again in detail: who, what, when, where, how often, who else was present, what was said, what was the effect.
  • Ask for witnesses and documents by name.
  • Ask about prior incidents and prior reports.
  • Ask what outcome they are seeking — this matters practically, and complainants are rarely asked.
  • Ask whether they have any concerns about retaliation, and address them specifically.
  • Do not promise a particular result.

The respondent interview:

  • Explain the process and the anti-retaliation policy — which protects the respondent too, and which must be stated because respondents retaliate against complainants more often than anyone else does.
  • Present the allegations with enough specificity to permit a meaningful response, without unnecessarily identifying the complainant if that can be avoided (frequently it cannot).
  • Get their complete account.
  • Ask about the specific incidents, one at a time.
  • Ask for witnesses and documents supporting their version.
  • Ask directly about any explanation or context.
  • Do not reveal the evidence prematurely — ask open questions first, then test the account against what you know.
  • Give them a genuine opportunity to respond to everything that will be relied on. An investigation that finds against a respondent on an allegation they were never asked about is procedurally defective, and in a unionized or contractual setting it may be reversible.

Witness interviews. Open-ended first, specific second. Ask what they observed personally, distinguishing observation from what they heard from others. Ask about the workplace culture and about anything similar involving either party. Ask who else might know.

Union settings. Under NLRB v. Weingarten, a unionized employee has the right, on request, to a union representative at an investigatory interview they reasonably believe may result in discipline. The employer may grant the request, discontinue the interview, or offer the employee the choice of continuing without representation. The right does not extend to a purely informational interview of a witness who is not at risk of discipline, and the representative may not obstruct the interview. Check the collective bargaining agreement, which frequently adds procedural requirements.

General interview practice: open questions before closed ones; one topic at a time; ask for specifics on every generality; ask "what else" repeatedly; do not argue; do not display disbelief; take notes on demeanor and inconsistencies as well as content; and close by asking whether there is anything else the person thinks you should know and whether they can identify anyone else to speak with.

Assessing credibility and making findings

Where accounts conflict, the investigator must decide. The EEOC's guidance identifies factors that courts and agencies find persuasive:

  • Inherent plausibility — is the account believable on its face?
  • Demeanor — used cautiously, because it is unreliable and because trauma, culture, and neurodivergence affect presentation in ways that are easily misread.
  • Motive to falsify — does either party have a reason to lie? Note that the absence of a motive to fabricate is far more probative than the presence of one.
  • Corroboration — witnesses, documents, contemporaneous complaints to friends or family, text messages, timing.
  • Past record — prior complaints or prior discipline for similar conduct.
  • Consistency — internal consistency of each account, and consistency over time.
  • Detail and specificity — accounts with peripheral detail tend to be more reliable.

The standard of proof is a preponderance of the evidence — more likely than not. It is not beyond a reasonable doubt, and it is not "conclusive proof." Investigators frequently apply a standard far higher than the law requires and reach "unsubstantiated" findings that the evidence did not support.

Possible findings: substantiated; not substantiated; inconclusive (used sparingly — an inconclusive finding on a two-person incident is sometimes honest, and is frequently a failure to make a decision); and policy violation short of unlawful harassment, which is an important and underused outcome. Conduct can violate a company's respectful workplace policy without meeting the severe-or-pervasive legal standard, and finding that is both accurate and useful.

Also make findings on collateral issues the investigation revealed: management failures, policy gaps, other misconduct, and — where warranted — whether the complaint was made in bad faith, which requires real evidence and should never be inferred from a finding of "not substantiated."

The report

Decide the format deliberately. A full written report is standard for significant matters. For minor matters, a memorandum to file may suffice. Some employers, on counsel's advice, deliver oral findings with a short summary — a defensible choice in narrow circumstances and a difficult one to explain later.

A written report should contain:

  1. The complaint and the allegations, stated specifically.
  2. The scope of the investigation and any limitations.
  3. The process — who investigated, who was interviewed and when, what documents were reviewed, and any witness who declined or was unavailable.
  4. The evidence, allegation by allegation, including evidence that cuts against the finding.
  5. Credibility assessments, with reasoning tied to specific factors.
  6. Findings of fact, allegation by allegation, on a preponderance standard.
  7. Whether the findings constitute a policy violation — with the legal conclusion about whether the law was violated generally left out of the factual report and, where needed, addressed in a separate privileged memorandum from counsel.
  8. Recommendations, if the investigator's role includes them.

Write it for a jury. Neutral tone. No characterizations of witnesses beyond what the credibility analysis supports. No speculation. No editorializing about the complainant's motives. Include the unfavorable evidence — a report that recites only the facts supporting its conclusion reads as advocacy and is treated as such.

Common defects: conclusions without supporting facts; failure to address contrary evidence; failure to interview witnesses the parties identified; a finding on an allegation the respondent was never asked about; legal conclusions the investigator is not qualified to reach; and delay.

Closing the loop

Decide on action promptly — within days of the report, not weeks. Corrective action must be reasonably calculated to end the harassment, and proportionality matters: verbal or written warning, training, coaching, removal of supervisory responsibility, transfer of the respondent, demotion, compensation consequences, or termination.

Consistency matters enormously. Compare the discipline to how the company treated similar conduct before. Disparate treatment on discipline is a discrimination claim on its own, and the comparison will be made in discovery.

Communicate with the complainant. Tell them the investigation is complete, that action was taken (the level of detail depends on privacy considerations and state law, but "we took appropriate action" without more frequently reads as nothing happened), that retaliation is prohibited, and how to report any further problem. Then follow up at 30, 60, and 90 days, in writing, and document the follow-up. This step is the difference between a company that corrected the problem and one that filed a report.

Communicate with the respondent — the findings, the consequences, expectations going forward, and the anti-retaliation prohibition.

Address systemic issues. If the investigation revealed a manager who ignored complaints, a policy gap, a training failure, or a pattern involving a department, fix it. The next plaintiff's lawyer will find the pattern in the complaint log.

Retain the file in a confidential location separate from personnel files — the investigation report, interview notes, documents collected, the decision, and the follow-up. Retention periods are governed by EEOC regulations (generally one year from the personnel action, extended while a charge is pending), state law, and the litigation hold.

Harder situations

Anonymous complaints must still be investigated to the extent possible. Assess what can be corroborated from documents and from witnesses who can be identified without the complainant.

The complainant who asks that nothing be done. Explain that the company has an independent obligation and cannot ignore a report of harassment, ask what specifically concerns them, and address it — but do not promise inaction. Document the conversation.

Executive and board respondents. Use an outside investigator reporting to the board or an independent committee, not to management. Consider disclosure obligations, and recognize that the company's regular employment counsel may have a conflict.

Potentially criminal conduct. Involve counsel immediately. Consider whether to report to law enforcement, whether the company's investigation should pause to avoid interfering with a criminal investigation (usually it should not stop entirely, because the employer's obligation to protect employees continues), and how to handle a respondent's Fifth Amendment concerns — noting that an employer may generally discipline an employee for refusing to cooperate, subject to constitutional limits for public employers.

Multiple complainants about the same respondent change the analysis substantially and should trigger a broader review.

Retaliation complaints during an investigation must be investigated separately and promptly. Retaliation claims are frequently easier to prove than the underlying claim, and they outnumber other charge types at the EEOC.

The respondent who resigns mid-investigation. Finish the investigation anyway. The findings matter for the complainant's remedy, for the personnel record, for reference requests, and for any later claim.

A short case study

A regional company receives a hotline report alleging that a director made repeated comments about a subordinate's appearance and touched her shoulders and back on several occasions.

Day 1. Logged and triaged. The complaint log shows a prior anonymous report about the same director eighteen months earlier that was closed without investigation — itself a finding. Outside counsel is engaged given the prior report and the director's seniority.

Day 2. Interim measures: the director is directed to have no contact and his reporting line to the complainant is temporarily reassigned. The complainant's role, location, and schedule are unchanged.

Days 3–5. A litigation hold is issued. Email, chat, calendar, and badge records are preserved.

Day 6. Complainant interview. She identifies four witnesses and produces contemporaneous texts to a friend describing two of the incidents on the dates they occurred.

Days 7–12. Nine witness interviews. Three corroborate comments; one observed a touch. Two witnesses volunteer similar experiences of their own, which expands the scope by written decision.

Day 13. Respondent interview, after the evidence is assembled. He denies the touching, admits the comments as "compliments," and identifies two witnesses, both of whom are interviewed on days 14 and 15.

Day 18. Report delivered. Findings: comments substantiated; touching substantiated as to two incidents on corroboration and contemporaneous texts; inconclusive as to a third. Credibility analysis relies on corroboration, contemporaneous reports, and the absence of any motive to fabricate, and notes that the respondent's account changed between the interview and his written response.

Day 21. Termination. The prior unactioned report and the additional complainants are material to the decision.

Day 22. The complainant is told the investigation is complete and that the respondent is no longer employed. Follow-up scheduled at 30, 60, and 90 days.

Systemic follow-up. The hotline intake process is revised so that anonymous reports are triaged rather than closed; two managers receive coaching; and harassment training is refreshed with scenarios drawn from the actual failure.

Elapsed time: three weeks. Cost: meaningful. Cost of version one, litigated: an order of magnitude more, plus the harm to the people involved.

Conclusion

Three points carry the most weight.

Promptness and thoroughness are the defense. Faragher-Ellerth asks whether the employer exercised reasonable care to prevent and promptly correct. That question is answered by the file — the intake date, the assignment date, the witnesses interviewed, the evidence collected, and the date action was taken.

Never move the complainant. It is the easiest interim measure and the most reliable way to convert a harassment claim into a retaliation claim, which is frequently the stronger case.

Write the report for a jury. Privilege will most likely be waived when the defense is asserted, so the report's audience is not the general counsel. Neutral tone, findings tied to evidence, contrary evidence addressed, and no speculation — that document is either the company's best exhibit or the plaintiff's.

Frequently asked questions

Do we have to investigate every complaint? Every complaint of harassment or discrimination, yes — including anonymous ones, informal ones, and ones the complainant asks you to drop. The scope and depth should be proportionate, but the decision not to investigate is itself a decision the company will have to defend.

Can we promise confidentiality? No. You can promise to share information only with those who need it, and you should. You cannot promise the respondent will never learn who complained, because a meaningful investigation usually requires it.

Can we tell witnesses not to discuss the investigation? Be careful. A blanket, indefinite gag directive risks interfering with employees' protected right to discuss working conditions. Request confidentiality, explain why, limit any directive to the investigation's duration and to a specific justification, and always make clear that employees may discuss their own terms of employment and may talk to government agencies.

How long should it take? Two to four weeks for most matters. Longer for complex ones, but with periodic updates to the complainant. Delay is the most damaging and least defensible failure.

What if the complainant refuses to participate? Investigate what you can from documents and other witnesses, document the complainant's position, and take whatever corrective action the available evidence supports. The employer's obligation does not depend on the complainant's cooperation.

What if the allegations are not substantiated? Say so, in a finding supported by the evidence, and tell both parties. Then continue to monitor, and be alert to retaliation, which is prohibited regardless of the outcome. A not-substantiated finding is not a finding that the complaint was false, and the communication should not suggest otherwise.

Should we use an outside investigator? For an executive respondent, severe or criminal allegations, likely litigation, board or regulator review, or any doubt about internal neutrality — yes. For routine matters with a trained, independent internal investigator — no.

Does the respondent get to see the report? Generally not the full report. They should be told the findings and the basis for them, and in a unionized or contractual setting the applicable agreement may require more. Provide enough that the decision is explicable.

Can we discipline someone for refusing to cooperate? In most private workplaces, yes — cooperation with an investigation is a legitimate job expectation. Public employers face constitutional constraints, and Garrity issues arise where criminal exposure exists. Involve counsel before disciplining a refusal that is grounded in a Fifth Amendment concern.

What if the complaint is about the CEO? The investigation reports to the board or an independent committee, uses outside counsel with no prior relationship to the CEO, and is scoped in writing by the committee. Management should not control any part of it.

Preparing before there is a complaint

The quality of an investigation is largely determined before anyone complains.

Train the investigators annually — on interviewing technique, on credibility assessment, on documentation, on the confidentiality rules, and on recognizing when to escalate to counsel or to an outside investigator. Untrained investigators produce the reports that lose cases.

Train managers on their one obligation: to route any report of harassment to the designated channel immediately, without evaluating it, without promising confidentiality, and without investigating themselves. Most notice failures happen at this step.

Maintain the complaint log and review it quarterly for patterns by respondent, by department, and by manager. Two unrelated complaints about the same person are only unrelated until someone looks.

Pre-select outside resources — an investigator, employment counsel, and a forensic vendor — before you need them. Retaining an investigator during a crisis takes a week you do not have.

Audit the policy annually against state mandates, which now include specific training requirements, posting requirements, and in several states prescribed complaint procedures and reporting timelines.

Test the hotline. Call it. See what happens. A meaningful number of hotlines route to voicemail nobody checks.

And review the last five closed investigations as though you were opposing counsel. Ask whether the witnesses the parties named were interviewed, whether the respondent was asked about every allegation found against him, whether contrary evidence appears in the report, whether the discipline was consistent with prior matters, and whether anyone followed up with the complainant. That exercise is uncomfortable and it is the single most useful thing a company can do to improve the next investigation.

Related articles

This guide is provided for general informational purposes and does not constitute legal advice. Investigation obligations, confidentiality rules, recording laws, and mandatory training and procedure requirements vary by state and by collective bargaining agreement. Consult qualified employment counsel before beginning an investigation involving serious allegations, a senior respondent, or potentially criminal conduct.