An HR investigation record is the complete written file documenting a workplace investigation — the initial complaint, the investigation plan and scope, notification to the person being investigated, interview notes, evidence gathered, findings of fact, the reasoning behind each conclusion, and the outcome communicated to each party. In Australia you must document every stage because if a decision is later challenged — through an unfair dismissal claim, general protections application, or discrimination complaint — the employer carries the burden of proving the process was fair and the findings were reasonably based on evidence. Records are generally retained for at least seven years, and stored separately from the general personnel file with strict access controls.
Workplace investigations are among the most sensitive HR functions. Whether you are investigating misconduct allegations, harassment complaints, or policy breaches, the documentation you create during the process can make or break your ability to defend decisions later. Poor documentation undermines otherwise sound investigations, while thorough records protect both the organisation and the integrity of the process. This guide explains what must be documented at each stage, the standard of proof and procedural fairness your file must demonstrate, how to store records securely using HR software, and how long to keep them. Modern rostering and attendance data often plays a crucial role as objective evidence.
Quick summary
- Document every stage:
From the initial complaint through to the outcome communicated to each party
- The standard:
Findings are made on the balance of probabilities — what is more likely than not on the evidence
- Retention:
Keep investigation records at least 7 years, longer for serious or litigation-prone matters
- Storage:
Store separately from the personnel file with strict, logged access controls
Essential documentation for every investigation
A complete investigation file should contain documentation covering each stage of the process. The seven records below form the backbone of a defensible file:
1. Initial complaint or report
The starting point of every investigation should be documented in writing. If a complaint was made verbally, create a written record immediately. Include who made the complaint, when and how it was received, the nature of the allegations, and any immediate actions taken (such as separating parties). Have the complainant review and sign if possible.
2. Investigation plan and scope
Before commencing interviews, document the investigation scope — what specific allegations are being investigated, what is not, the methodology, who will conduct it, the expected timeline, and any interim measures. Framing each allegation as a clear question (“Did the employee misuse the company card on 3 June?”) keeps the inquiry measurable and prevents scope creep.
3. Notification to the subject
The person being investigated should be notified of the allegations in writing before being interviewed. Document what they were told, when, and how. Provide enough detail for them to respond meaningfully while protecting complainant confidentiality where appropriate. Keep a copy of the notification letter.
4. Interview records
Document all interviews including date, time, location, attendees (including support persons), and detailed notes of questions asked and answers given. Key statements should be recorded as close to verbatim as possible. Notes should be typed and offered to interviewees for review and signature.
5. Evidence collected
All documentary evidence should be catalogued with source, date obtained, and relevance noted. This includes emails, messages, CCTV footage, time records, policy documents, and any physical items. Maintain chain of custody documentation showing who handled evidence and when.
6. Investigation report and findings
The investigation should conclude with a written report setting out the allegations investigated, evidence considered, findings of fact, credibility assessments where relevant, conclusions on whether allegations are substantiated, and recommendations. Keep the findings separate from the recommended actions, and keep the language objective and evidence-based.
7. Outcome communications
Document how findings were communicated to the complainant and the subject. Keep copies of outcome letters. If disciplinary action follows, that process has its own documentation requirements. Note any appeals or responses and how they were handled.
The standard of proof and procedural fairness
Two concepts determine whether your findings will hold up if challenged, and both must be visible in the record. The first is the standard of proof. Workplace investigations are not criminal matters, so you are not proving anything “beyond reasonable doubt”. Findings are made on the balance of probabilities — whether, on the evidence gathered, an allegation is more likely than not to have occurred. Your report should state this standard explicitly and show how the evidence met it for each finding.
The second is procedural fairness (natural justice). A finding can be entirely correct on the facts and still be overturned if the process denied the subject a fair hearing. Your file should demonstrate each of the elements below.
Procedural fairness elements to evidence in the file
- Right to respond:
The subject was told the specific allegations and given a genuine opportunity to respond before any finding was made.
- Impartial investigator:
The person investigating had no conflict of interest and no predetermined view — for sensitive matters this may mean a senior HR lead or an external investigator.
- No retaliation:
The complainant and witnesses were protected from victimisation, and that assurance was recorded.
- Confidentiality (with limits):
Information was shared strictly on a need-to-know basis, while acknowledging absolute confidentiality cannot be promised.
Courts and tribunals look for both. A well-documented file that shows the allegations were put to the subject, that they were given a chance to respond, and that findings were reached on the balance of probabilities is far harder to disturb than a bare conclusion. This is the same principle that underpins fair process in terminating an employee — the decision is only as defensible as the record behind it.
Evidence collection and standards
The quality of evidence collected directly affects the defensibility of investigation conclusions. Four categories carry most investigations:
Documentary evidence
Emails, text messages, policy documents, and business records provide objective evidence. Preserve these in their original form where possible and note metadata like sent dates and recipients. Screenshot messages if they might be deleted, and preserve the originals.
Time and attendance records
Clock records, roster data, and leave applications provide objective information about who was present when and where. These records often corroborate or contradict witness accounts. Export and preserve relevant timesheet data early in investigations.
CCTV and security footage
If relevant footage exists, secure it immediately — most systems overwrite after days or weeks. Document what the footage shows objectively and note any gaps or limitations. CCTV can be powerful evidence but must be handled appropriately under privacy obligations.
Witness statements
Witness accounts are valuable but require careful documentation. Note the relationship of witnesses to the parties, any potential bias, and consistency between accounts. Corroboration from multiple witnesses strengthens findings. Document credibility assessments with reasoning.
Assessing witness credibility
When accounts conflict, your report should explain why one was preferred. The factors a tribunal expects to see weighed are the plausibility of the account, its consistency over time and with other evidence, the presence of corroboration, the witness’s demeanour during the interview, and any motive to shade the truth. Recording this reasoning is what separates a defensible finding from an assertion.
Storage, security, and access controls
Investigation records require different handling than general HR files due to their sensitive nature. Centralised digital HR records establish secure document management from day one:
Separate storage
Investigation files should be stored separately from general personnel files. The personnel file should contain only a summary of any disciplinary outcomes, not the full investigation. This limits inadvertent disclosure and maintains confidentiality.
Restricted access
Access should be strictly limited to those with a legitimate need — HR personnel handling the matter, decision-makers, legal counsel if engaged. General managers should see only what they need to manage outcomes, not full investigation files.
Digital security
Electronic investigation files should be encrypted, password-protected, and stored in secure systems with access logging. Cloud storage should comply with Australian privacy requirements. Tools like staff communication platforms with audit trails help maintain proper records.
Access logging
Maintain records of who accesses investigation files and when. This provides accountability and helps identify any inappropriate access. Modern HR systems can automatically log all access to sensitive documents.
Physical security
Any physical documents should be stored in locked cabinets with access limited to authorised personnel. Original evidence items require chain of custody documentation showing who held them and when.
Retention schedule
Investigation files should be retained for at least 7 years from conclusion or employee departure, whichever is later. Serious matters involving discrimination, harassment, or potential litigation warrant longer retention of 10+ years.
Common documentation mistakes to avoid
Certain documentation failures appear repeatedly in challenged investigations:
Inadequate interview notes
Brief notes like “discussed incident” are useless. Notes should capture actual questions and answers, key statements in the interviewee’s words, and demeanour observations where relevant. Inadequate notes leave findings vulnerable to challenge.
Missing contemporaneous records
Notes made weeks after interviews carry less weight than contemporaneous records. If you cannot create detailed notes during an interview, write them up immediately afterwards. Reconstructed notes should be labelled as such with the reconstruction date noted.
Conclusions without reasoning
Stating “allegation substantiated” without explaining why is insufficient. Investigation reports must show the reasoning connecting evidence to conclusions. How was conflicting evidence resolved? Why was one witness believed over another? Payroll records and timesheets can provide objective evidence to support findings.
Failure to document exculpatory evidence
Investigations must be objective. Evidence that supports the subject’s position must be documented and considered, not ignored. If exculpatory evidence exists but was discounted, explain why. One-sided documentation suggests bias.
How RosterElf supports investigation documentation
RosterElf provides tools supporting comprehensive HR record management:
Secure document storage
Store investigation documents securely within employee records or in separate confidential folders. Documents are encrypted and access-controlled, with full audit logging of who viewed what and when.
Role-based access
Set permissions to restrict sensitive documents to authorised HR personnel only. Investigation files can be hidden from general managers while still being securely retained within the system.
Time and attendance export
Quickly export time records, roster data, and attendance patterns as evidence for investigations. These objective records can corroborate or contradict witness accounts.
Audit trail
Complete logging of all system activities provides an audit trail showing exactly what records existed, when they were created, and who accessed them. This supports defensibility if decisions are challenged.
Employee records integration
Disciplinary outcomes can be recorded in employee profiles with appropriate access controls, while full investigation files remain separately secured. Industries like hospitality with high staff turnover particularly benefit from integrated record management.
Retention management
Document retention can be managed systematically with reminders for review periods. This ensures investigation files are retained for the required duration and properly managed throughout their lifecycle.
Related RosterElf features
Secure HR record management with RosterElf. Manage sensitive investigation documentation with role-based access, complete audit trails, and one-click export of time and attendance evidence — all in a system built for Australian workplaces.
Disclaimer
This article provides general guidance only and does not constitute legal advice. Investigation requirements vary by jurisdiction and circumstance. Always seek qualified legal advice for specific investigation matters and verify current requirements using official Fair Work Ombudsman resources.
Frequently asked questions
What must be documented during an HR investigation?
HR investigations should document the initial complaint or allegation in writing, investigation scope and methodology, names of all parties involved including investigators and witnesses, interview notes with dates and times, evidence gathered including documents, emails, and CCTV footage, findings of fact based on evidence, conclusions regarding whether allegations are substantiated, recommended actions, and final outcome communications.
What standard of proof applies to a workplace investigation?
Workplace investigations use the civil standard — the balance of probabilities, meaning a finding is made where an allegation is more likely than not to have occurred on the available evidence. This is a lower bar than the criminal “beyond reasonable doubt” standard. Your investigation report should state the standard applied and show how the evidence met it for each finding, which is central to defending a decision in an unfair dismissal claim.
Who should conduct a workplace investigation?
The investigator must be impartial, with no conflict of interest and no predetermined view of the outcome. For minor matters an experienced HR manager is usually appropriate, but for serious allegations — harassment, discrimination, or matters likely to end in dismissal — a senior HR lead or an external investigator reduces the risk of a perceived bias claim. Document who was appointed and why, and keep their findings separate from the decision-maker who acts on them.
How long must HR investigation records be retained?
HR investigation records should generally be retained for at least 7 years from the date of the investigation conclusion or the employee’s departure, whichever is later. For investigations involving serious misconduct, discrimination, harassment, or potential litigation, longer retention of 10+ years is advisable. Workers compensation related investigations may need to be kept longer depending on state requirements. See our guide on HR record retention rules in Australia for the full picture.
Who should have access to investigation records?
Access should be strictly limited on a need-to-know basis. Typically only HR managers handling the case, senior management with decision-making authority, legal counsel when engaged, and external investigators if appointed should have access. General managers and supervisors should only see investigation findings relevant to managing outcomes, not full investigation files. Storing files in digital HR records with role-based access makes this enforceable.
What evidence should be collected during investigations?
Evidence collection should include written statements from the complainant, the subject of the investigation, and all witnesses, relevant documents such as emails, messages, policies, and records, time and attendance data showing relevant attendance patterns, CCTV footage if applicable and available, performance records if relevant to the allegation, and any physical evidence. All evidence should be dated and its chain of custody documented.
Should interview notes be verbatim or summarised?
Best practice is to take detailed contemporaneous notes during interviews, capturing key statements as closely to verbatim as practical. After the interview, these notes should be typed and ideally reviewed by the interviewee for accuracy. If the interviewee declines to sign, note that refusal. Completely verbatim transcription is not required but important statements should be recorded exactly as stated.
Can employees access investigation files about them?
Employees generally have rights to access personal information held about them under privacy legislation. However, this can be limited where disclosure would breach another person’s privacy, prejudice ongoing investigations, or reveal confidential deliberative processes. Employers should seek legal advice before refusing access requests and document the reasoning for any refusal. See Fair Work guidance for more information.
What happens if investigation records are incomplete?
Incomplete records create significant legal risk. If disciplinary action is challenged or a claim is made, employers bear the burden of demonstrating the investigation was fair and reasonable. Gaps in documentation allow employees to dispute findings and procedural fairness. Courts and tribunals look unfavourably on poor documentation and may draw adverse inferences from missing records.
Should investigation records be stored separately from personnel files?
Yes, investigation files should typically be stored separately from general personnel files due to their sensitive nature and different access requirements. The personnel file should contain only a summary of any disciplinary outcomes resulting from investigations. Full investigation files should be in secure, access-controlled storage with limited availability.
