Workplace investigations are among the most sensitive HR functions. Whether investigating misconduct allegations, harassment complaints, or policy breaches, the documentation you create during the process can make or break your ability to defend decisions later. Poor documentation undermines otherwise sound investigations, while thorough records protect both the organisation and the integrity of the process. Modern rostering and attendance data often plays a crucial role in these investigations.
The stakes are high. Unfair dismissal claims, general protections applications, discrimination complaints, and workers compensation disputes can all require employers to demonstrate that investigations were conducted fairly and conclusions were reasonably based on evidence. Without comprehensive records, these defences crumble. This guide explains what must be documented during HR investigations, how to maintain these records securely using HR software, and how long they should be retained.
Quick summary
- Document every stage from initial complaint through to outcome communication
- Retain investigation records for at least 7 years, longer for serious matters
- Store separately from general personnel files with strict access controls
- Incomplete records create significant legal risk if decisions are challenged
Essential documentation for every investigation
A complete investigation file should contain documentation covering each stage of the process:
Initial complaint or report
The starting point of every investigation should be documented in writing. If a complaint was made verbally, create a written record immediately. Include who made the complaint, when and how it was received, the nature of the allegations, and any immediate actions taken (such as separating parties). Have the complainant review and sign if possible.
Investigation plan and scope
Before commencing interviews, document the investigation scope—what specific allegations are being investigated, what is not being investigated, the methodology to be used, who will conduct the investigation, the expected timeline, and any interim measures. This prevents scope creep and establishes boundaries.
Notification to the subject
The person being investigated should be notified of the allegations in writing before being interviewed. Document what they were told, when, and how. Provide enough detail for them to respond meaningfully while protecting complainant confidentiality where appropriate. Keep a copy of the notification letter.
Interview records
Document all interviews including date, time, location, attendees (including support persons), and detailed notes of questions asked and answers given. Key statements should be recorded as close to verbatim as possible. Notes should be typed and offered to interviewees for review and signature.
Evidence collected
All documentary evidence should be catalogued with source, date obtained, and relevance noted. This includes emails, messages, CCTV footage, time records, policy documents, and any physical items. Maintain chain of custody documentation showing who handled evidence and when.
Investigation report and findings
The investigation should conclude with a written report setting out the allegations investigated, evidence considered, findings of fact, credibility assessments where relevant, conclusions on whether allegations are substantiated, and recommendations. The report should be objective and evidence-based.
Outcome communications
Document how findings were communicated to the complainant and the subject. Keep copies of outcome letters. If disciplinary action follows, that process has its own documentation requirements. Note any appeals or responses and how they were handled.
Evidence collection and standards
The quality of evidence collected directly affects the defensibility of investigation conclusions:
Documentary evidence
Emails, text messages, policy documents, and business records provide objective evidence. Preserve these in their original form where possible. Note metadata like sent dates and recipients. Screenshot messages if they might be deleted, and preserve the originals.
Time and attendance records
Clock records, roster data, and leave applications provide objective information about who was present when and where. These records often corroborate or contradict witness accounts. Export and preserve relevant timesheet data early in investigations.
CCTV and security footage
If relevant footage exists, secure it immediately—most systems overwrite after days or weeks. Document what the footage shows objectively. Note any gaps or limitations. CCTV can be powerful evidence but must be handled appropriately under privacy obligations.
Witness statements
Witness accounts are valuable but require careful documentation. Note the relationship of witnesses to the parties, any potential bias, and consistency between accounts. Corroboration from multiple witnesses strengthens findings. Document credibility assessments with reasoning.
Storage, security, and access controls
Investigation records require different handling than general HR files due to their sensitive nature. Proper HR onboarding systems establish secure document management from day one:
Separate storage
Investigation files should be stored separately from general personnel files. The personnel file should contain only a summary of any disciplinary outcomes, not the full investigation. This limits inadvertent disclosure and maintains confidentiality.
Restricted access
Access should be strictly limited to those with a legitimate need—HR personnel handling the matter, decision-makers, legal counsel if engaged. General managers should see only what they need to manage outcomes, not full investigation files.
Digital security
Electronic investigation files should be encrypted, password-protected, and stored in secure systems with access logging. Know who accessed what and when. Cloud storage should comply with Australian privacy requirements. Tools like staff communication platforms with audit trails help maintain proper records.
Access logging
Maintain records of who accesses investigation files and when. This provides accountability and helps identify any inappropriate access. Modern HR systems can automatically log all access to sensitive documents.
Physical security
Any physical documents should be stored in locked cabinets with access limited to authorised personnel. Original evidence items require chain of custody documentation showing who held them and when.
Retention schedule
Investigation files should be retained for at least 7 years from conclusion or employee departure, whichever is later. Serious matters involving discrimination, harassment, or potential litigation warrant longer retention of 10+ years.
Common documentation mistakes to avoid
Certain documentation failures appear repeatedly in challenged investigations:
Inadequate interview notes
Brief notes like "discussed incident" are useless. Notes should capture actual questions and answers, key statements in the interviewee's words, and demeanour observations where relevant. Inadequate notes leave findings vulnerable to challenge.
Missing contemporaneous records
Notes made weeks after interviews carry less weight than contemporaneous records. If you cannot create detailed notes during an interview, write them up immediately afterwards. Reconstructed notes should be labelled as such with the reconstruction date noted.
Conclusions without reasoning
Stating "allegation substantiated" without explaining why is insufficient. Investigation reports must show the reasoning connecting evidence to conclusions. How was conflicting evidence resolved? Why was one witness believed over another? Document the logic. Payroll records and timesheets can provide objective evidence to support findings.
Failure to document exculpatory evidence
Investigations must be objective. Evidence that supports the subject's position must be documented and considered, not ignored. If exculpatory evidence exists but was discounted, explain why. One-sided documentation suggests bias.
How RosterElf supports investigation documentation
RosterElf provides tools supporting comprehensive HR record management:
Secure document storage
Store investigation documents securely within employee records or in separate confidential folders. Documents are encrypted and access-controlled, with full audit logging of who viewed what and when.
Role-based access
Set permissions to restrict sensitive documents to authorised HR personnel only. Investigation files can be hidden from general managers while still being securely retained within the system.
Time and attendance export
Quickly export time records, roster data, and attendance patterns as evidence for investigations. These objective records can corroborate or contradict witness accounts.
Audit trail
Complete logging of all system activities provides an audit trail showing exactly what records existed, when they were created, and who accessed them. This supports defensibility if decisions are challenged.
Employee records integration
Disciplinary outcomes can be recorded in employee profiles with appropriate access controls, while full investigation files remain separately secured. Industries like hospitality with high staff turnover particularly benefit from integrated record management.
Retention management
Document retention can be managed systematically with reminders for review periods. This ensures investigation files are retained for the required duration and properly managed throughout their lifecycle.
Frequently asked questions
What must be documented during an HR investigation?
HR investigations should document the initial complaint or allegation in writing, investigation scope and methodology, names of all parties involved including investigators and witnesses, interview notes with dates and times, evidence gathered including documents, emails, and CCTV footage, findings of fact based on evidence, conclusions regarding whether allegations are substantiated, recommended actions, and final outcome communications.
How long must HR investigation records be retained?
HR investigation records should generally be retained for at least 7 years from the date of the investigation conclusion or the employee's departure, whichever is later. For investigations involving serious misconduct, discrimination, harassment, or potential litigation, longer retention of 10+ years is advisable. Workers compensation related investigations may need to be kept longer depending on state requirements.
Who should have access to investigation records?
Access should be strictly limited on a need-to-know basis. Typically only HR managers handling the case, senior management with decision-making authority, legal counsel when engaged, and external investigators if appointed should have access. General managers and supervisors should only see investigation findings relevant to managing outcomes, not full investigation files.
What evidence should be collected during investigations?
Evidence collection should include written statements from the complainant, the subject of the investigation, and all witnesses, relevant documents such as emails, messages, policies, and records, time and attendance data showing relevant attendance patterns, CCTV footage if applicable and available, performance records if relevant to the allegation, and any physical evidence. All evidence should be dated and its chain of custody documented.
Should interview notes be verbatim or summarised?
Best practice is to take detailed contemporaneous notes during interviews, capturing key statements as closely to verbatim as practical. After the interview, these notes should be typed and ideally reviewed by the interviewee for accuracy. If the interviewee declines to sign, note that refusal. Completely verbatim transcription is not required but important statements should be recorded exactly as stated.
Can employees access investigation files about them?
Employees generally have rights to access personal information held about them under privacy legislation. However, this can be limited where disclosure would breach another person's privacy, prejudice ongoing investigations, or reveal confidential deliberative processes. Employers should seek legal advice before refusing access requests and document the reasoning for any refusal. See Fair Work guidance for more information.
What happens if investigation records are incomplete?
Incomplete records create significant legal risk. If disciplinary action is challenged or a claim is made, employers bear the burden of demonstrating the investigation was fair and reasonable. Gaps in documentation allow employees to dispute findings and procedural fairness. Courts and tribunals look unfavourably on poor documentation and may draw adverse inferences from missing records.
Should investigation records be stored separately from personnel files?
Yes, investigation files should typically be stored separately from general personnel files due to their sensitive nature and different access requirements. The personnel file should contain only a summary of any disciplinary outcomes resulting from investigations. Full investigation files should be in secure, access-controlled storage with limited availability.
Related RosterElf features
Secure HR record management with RosterElf
Manage sensitive HR documentation securely with role-based access and complete audit trails.
- Secure document storage with access controls
- Complete audit trail of all document access
- Time and attendance records for investigation evidence
Disclaimer: This article provides general guidance only and does not constitute legal advice. Investigation requirements vary by jurisdiction and circumstance. Always seek qualified legal advice for specific investigation matters and verify current requirements using official Fair Work Ombudsman resources.
