Investigation Reports

This is an Insight article, written by a selected partner as part of GIR's co-published content. Read more on Insight


Purpose of the investigation report

The primary purpose of the investigation report is to accurately document the investigation conducted and to provide decision-makers with the facts needed to decide on the matters under investigation. In the context of workplace investigations, the report will be relied upon to guide appropriate disciplinary action and as a means of establishing compliance mitigations or in some cases to progress contemplated litigation. As a result, it needs to be both accurate and persuasive to ensure that the reader reads all of it, agrees that the evidence based conclusions are sound and to help ensure that the findings and any recommendations are appropriately acted upon.

The investigation report is also a way of recording that there has been a fair and thorough investigation process which was conducted objectively, in a timely manner and in accordance with the principles of procedural fairness. It could be used in a number of settings including court and tribunal proceedings, if privilege does not apply, see section ‘A note on privilege’ below, and are not waived. The investigation report can also become an important tool to explain and defend the investigation you have conducted in the event it is subject to challenge and is a record of fact even after many years when memories have faded. For these reasons, great care should be taken to make sure that all relevant evidence is included and that you are able to demonstrate that the findings are based upon a well-balanced evidentiary analysis. Remember that your investigation is only as good as your report of it.

Key points

Writing style

An investigation report is an objective summary of the facts at issue and findings. It must inform decision makers with accuracy, impartiality and relevance.

The characteristics of a good investigation report are as follows: accuracy, clarity, impartiality and relevance. Consideration of the audience the investigators are writing for is key to a good investigation report. A report on the same subject matter can be written differently for different classes of reader. The investigator should adapt the style and the level of detail provided accordingly, if the report is to be sent to senior management or shared externally.

Most importantly the report should be organised so that it is easy to read, easy to understand and easy to find specific information e.g. by using clear signposting and internal referencing. The points in the report should be arranged with a logical sequence and framed around the rule or policy at issue. The report should state clearly how the investigators went about their work and their methodology. This transparency is key to demonstrating that the investigation was thorough and conducted with objectivity. The report should be concise and limited to the details necessary to adequately reflect the outcome of the investigation. The best report writers have the ability to summarise large amounts of evidence into the key essentials and identify the material evidence necessary for proving or disproving the facts being investigated. This balance between brevity and completeness is crucial to ensure that the report is fair and appeals to the intended audience.

The report should be written in a neutral and balanced tone. Report findings should be based upon your observations of the evidence only and you should therefore avoid any speculation, personal opinion, or the need for emphasis. To keep it objective and factual, use clear and concise language. Avoid using words like ‘maybe’, ‘presumably’, ‘possibly’ or ‘supposedly’ as such imprecise statements could potentially undermine the impact of the findings.

It is essential to write clearly and simply. If suitable, follow a chronological framework. Use headings and subheadings to break up the text. Write in the third person to make the record impersonal. Use words that the reader will understand, and that help communicate the issue in a way that will make sense to them. Avoid unnecessary adjectives. Use the same form of address for all people referenced and avoid nicknames or other jargon. If you need to use acronyms, make sure that you explain what it stands for the first time that you use it in the report. Always remember that the reader may not be familiar with the matters discussed in the report and so try to keep it simple wherever possible.

The language you use is vitally important. Great care should be taken to use unbiased descriptions when reporting your findings. It is crucial that you do not misinterpret evidence in order to support any inferences you may draw. For example, you should not emphasise certain evidence that suggests that a certain event occurred, but ignore other evidence that shows it to have been impossible. You should never omit significant evidence so that the findings are unbalanced. For example, if there is a known fact that undermines a witness’ testimony you must report this as otherwise you are giving an unfair impression of their credibility and the validity of their evidence.

Before any report is submitted, the investigator should re-read it several times to ensure that it makes sense and that the spelling and content is accurate. This in itself will add credibility and prevent errors arising further along the investigative process. A person who wants to be critical or undermine your investigation can take one small factual error and use it to undermine the integrity of the entire investigation process. Typographical errors, poor punctuation and grammatical mistakes could result in a reader questioning how much care the investigator took with the investigation. Your draft report should be peer reviewed and proofread before dissemination to the official reviewers. If possible, ask someone completely separate from the investigative work to do this, otherwise you can ask someone who helped with the investigation. Peer review can strengthen the objectivity of a report, ensure facts are accurately understood and reported and identify any gaps or errors. Investigators might also consider interim peer review of their findings at various stages of an investigation. Another useful exercise is to think about the questions a reader may have about the investigation when reading the report and ensure these questions are addressed in advance. This will increase the credibility of the report and help to ensure the correct message is delivered.

Weighing the evidence

Investigative reports must be able to withstand objective criticism and provide transparency that investigations are professional, fair and based upon sound evidentiary analysis.

The investigation report is, in essence, a document that outlines the basis upon which the investigator reaches the conclusions made. Just gathering information does not mark the end of the investigation. Investigators must be able to show why they accepted certain evidence and rejected other evidence, why they conducted certain enquiries and not others, and ultimately how they reached a certain conclusion. Indeed, the importance of following the rules of evidence cannot be understated and where criminal prosecution is a possibility, you should collect evidence to the standards a criminal investigator or prosecutor would expect, so as not to prejudice later criminal proceedings.

As regards the strength or otherwise of your evidence, if the investigation has relied upon evidence that is subsequently deemed to not have met the evidentiary threshold, this could result in adverse findings against the employer in either or both civil and criminal proceedings. Therefore, once you have collected all the relevant evidence, before documenting your findings in the investigation report, you must first evaluate the evidence gathered to determine how strong or weak it is and to see what, if any, conclusion can be drawn from it.

To support this process, an investigator must therefore have a thorough understanding of the weight and the impact of the evidence to ensure that their conclusions are based on valid information. Several factors affect the weight of evidence as follows:

Source of the evidence

This refers to the basis of a witness’ knowledge, how does he or she know what they are testifying to? Evidence that is based on first hand observations is considered to be more reliable than second-hand information or ‘hearsay’ which the witness only knows from being told by someone else, another secondary source or is based on speculation.

Direct and circumstantial evidence

Direct evidence is information that is based on personal knowledge or observation or otherwise proves a fact directly. It may also include documentary or electronic evidence such as an original contract or CCTV recording of an event. In the case of witness testimony, direct evidence would come from an eyewitness who actually experienced or witnessed the event in question. It directly proves or disproves a disputed fact without inference or presumption and, as such, is usually considered to be the strongest method of proof.

Circumstantial evidence is evidence that does not directly prove a factual assertion under investigation but is indicative or consistent with that assertion. Circumstantial evidence can be persuasive, particularly when there are several interconnected parts; for example, a person’s internet browser history showing how he or she searched for information about the tools used to commit the crime of which he or she is accused combined with online activity just a few days before the crime took place regarding the precise location of the crime. In order to be persuasive, circumstantial evidence must be logical and exclude all or most plausible innocent explanations. For example, in a corruption case, evidence that a person of interest has wealth over and above their means is only relevant if you can eliminate all other legitimate potential sources of income for the person’s wealth.

In general, the most persuasive cases are built on a combination of direct and circumstantial evidence.

Credibility of the witness

In the context of a witness’s evidence, the questions you must ask yourself as an investigator are as follows: How believable, probable and ultimately credible is the information they are providing? Are there gaps, inconsistencies or contradictions in the information they are providing? Vague or unclear testimony will normally be given less weight than a detailed account. Consider how plausible and inherently believable the witness statements are when compared with other evidence in the case. Assess whose version of the events is consistent with that of the evidence available. Look to see where the witness’ statement can be corroborated. For example, does their evidence match with other witness statements or contemporaneous documents? Did other witnesses see, hear or experience the same or similar things? If, for example, a witness admits he made an improper payment, perhaps ask for copies of the wire transfer receipts or other records of the payments such as invoices and bank account statements. In a sexual harassment case, ask for copies of any electronic communications or call logs. A refusal to provide such information which is within a witness’ control may reflect negatively on the credibility of their account.

Consider the consistency or inconsistencies of the witness’ current or prior statements. Is there evidence that they have changed specific parts of their account? While these sorts of inconsistencies are not conclusive evidence that the witness is not telling the truth, when combined with other evidence such as where a witness has known integrity issues, it could be considered relevant. Equally, consistencies across multiple witnesses’ accounts could be a sign of corroboration but could also point towards collusion between witnesses or that they have previously discussed the matter and contaminated their memory of the events under investigation. You could also consider where the witness has a personal interest in the outcome of the investigation and whether there is any motive for making a false complaint. Conversely, if the witness is making a statement that is actually contrary to their interests, this could be considered to be more credible.

This exercise of assessing a witness’s credibility can be particularly important when investigating ‘he-said, she-said’ matters such as sexual harassment cases where there are often no witnesses to the events under investigation. A credibility assessment of witnesses can be crucial to making robust and defensible findings. In general, you should avoid behavioural interpretations such as whether the person interviewed appeared nervous or avoided eye contact as this is subjective and open to interpretation.

This credibility assessment should not be limited to witness testimony alone but is also relevant to other types of evidence you gather during the course of the investigation such as digital, physical and documentary evidence. Here you should ask yourself the following questions:

  • Is it authentic?
  • Is there any indication it has been altered, tampered with or fabricated?
  • Is there a chain of custody?
  • How and when was it collected?
  • Is it supported by other sources, including witness evidence?

Ultimately, there are different ways an investigator can analyse the evidence obtained during the course of their investigation. One way is to consider if the evidence is exculpatory or inculpatory. If you think of the allegation in question, let us say sexual harassment in the workplace, we can begin to analyse the evidence in terms of those items that most likely indicate that the conduct occurred and those that point to the opposite conclusion.

Evidence that indicates or tends to indicate that something occurred is known as inculpatory evidence. Conversely, if evidence vindicates or tends to clear the alleged harasser of the wrongdoing, then this is known as exculpatory evidence. This formal approach to organising the evidence can assist in creating a logical report that withstands future scrutiny.

The report format

Investigation reports must have a clear, accessible structure which succinctly conveys the facts within the declared scope of the investigation.


Once the identification of the facts is completed, the report must emphasise the outcome of the investigation. It should provide the reader with a clear reading of the investigation’s different sections. Therefore, the format has a pivotal role in the understanding of the event.

The report must be written with a correct record of facts. The length will depend on how complex and involved the investigation is and the amount of material reviewed. Nevertheless, the Final Report will always align with the scope of the investigation. The scope will be clearly specified in the report as will the methodology applied. This will provide a clear understanding to anyone to whom the report is disclosed regarding the investigation’s remit and limitations.[1]

An efficient reporting structure could be set out as follows:

  • Cover page with case number, name and date of the report
  • Executive Summary
  • Description of the facts and allegations
  • Methodology
  • Findings
  • Conclusion
  • Recommendations
  • Appendix
  • Cover Page

The cover page is the reader’s first interaction with the report. It contains the organisation’s information regarding the investigation such as case number, confidentiality level, whether privilege is claimed, date of the report and the author’s name. Depending upon the sensitivity of the report, it may be prudent to keep the first page of the document relatively blank to maintain confidentiality over the subject of the report.

This should be followed by a contents page to help sign post the reader, along with a list of all definitions and acronyms used throughout the report

Executive summary

This is the central part of the report and should be considered mandatory for long and complex reports, or where otherwise requested or justified. Most readers of a report will not go further than the executive summary. Any relevant information supporting the senior management in their final decision must be stated here. It allows for an easy, high-level reading of the incident, reporting, investigation, and conclusion[2]. The section should give a concise overview of the allegations, methodology and key findings, conclusions and any recommendations. The executive summary, as its name suggests, is an extract from the whole report; thus, any information absent from the report should not be introduced here. It should not be longer than a page and should be directly accessible just after the cover page.

Description of the facts and allegations

This is the first detailed section of the report. This section should cover the allegations or key issues for investigation and the timeline, prior to exploring the investigation’s factual material.

This section must commence with the type of incident and the allegations. It should define if the case is related to corruption, human rights, harassment, fraud, or any other compliance infringements and, where relevant, identify contemplated proceedings or regulatory actions, which is relevant for claims of privilege. If there are victims of the event, the chapter will list their identities and backgrounds. For instance, in a harassment case, it might be introduced as “On 30 March 2020, the HR manager received a complaint from a finance team employee, reporting acts of moral harassment from her or his manager.” Going forwards, it is prudent to refer to the individuals by their initials or another abbreviation to afford some further privacy throughout the report document.

The employees, and their relationships, their departments and their managers are part of the relevant data listed. In case of any precedents affecting any of the staff involved, it will be easier to navigate the organisational structure to provide this context.

The company must assess the impact or impacts of direct allegations, e.g. safety, financial, business, legal, and reputational, on its activities and the staff members affected as well as the direct measures already taken to remediate immediate threats.

For instance, in the case of a potential harassment incident, the alleged perpetrator could already have been suspended since the enquiry’s beginning.

The report should include accurate timelines alongside the description of allegations to provide a simple chronology of events. Indeed, dates allow for context and a walkthrough of the case from start to completion.

The next step relates to the incident’s reporting phase. How was the incident raised to the investigators’ attention? What tool did the victim or witness/ or whistleblower use to report the incident? Who was the first point of contact of the victim or witness or whistleblower? Was any whistleblower or whistleblowers involved? Reference to the internal reporting procedure, including escalation, should be detailed through to the current status of the matter.

After the identification of the case background, the investigation plan introduces the findings.


This section states clearly how the investigators went about their work and their methodology. It could list the person or persons interviewed in connection with the investigation as well as set out what records were obtained and reviewed.


The investigation follows a specific plan. Clarity and correctness are mandatory in the presentation of the plan’s steps. The plan defines the scope and the expectation of the enquiry.

Based on the interviews, documents reviewed, and evidentiary analysis, the report introduces an elaborate version of the resulting actions taken. This section describes all the measures undertaken to identify potential misconduct which may be disputed. Analysis should be given, with reference to interviews conducted, so that the facts are thoroughly reviewed. For each fact analysed, the report must identify the following:

  • action with a brief description, e.g. interview, analysis of email, meeting and camera footage;
  • person completing the action; and
  • date and location of action completion.

Transcripts of interviews could be inserted into the appendix to provide the most accurate level of detail. Otherwise, the interviewer must draft a thorough report for each interview, e.g. date, locations, person present and subjects discussed. Only information relevant to assisting the investigation should go into the Findings section. When summarising what the interviewee has said, great care must be taken to ensure it is as accurate as possible. For particularly pertinent witness testimony, such as if the accused person confesses or admits to the matters under investigation, it may be appropriate to directly quote the interviewee’s answer into the investigation report.

The findings section must draw together the analysis of the evidence to logically describe how the evidence proves or disproves the allegations at hand. Consequently, if the author disputes the credibility of the source or sources of information, he or she should explain the reasons leading to the choice they made. The investigator must justify why a fact is or is not as pertinent for the conclusion. The author refers to the corresponding pieces of evidence each time he/she articulates a point of analysis. This reference is made through the document number; every supporting item or material used for the investigation is designated with a number. The material’s complete version is available in the appendix.

To assess the enquiry’s impartiality, every document, interview, and any pieces of evidence must be described and debated in the findings. It demonstrates the conclusion takes into consideration a holistic and un-biased approach to the many aspects of the investigation. To exclude any evidence without explanation ca, intentionally or otherwise, indicate a lack of thoroughness or even worse a prejudgement about a fact in issue or that the investigator is filtering evidence to suit their findings. Even if a piece of evidence is ultimately proven to be of little significance, this should be at least be acknowledged and noted. The general rule is: if in doubt, do not leave it out.


This section concludes the report by clearly articulating the findings reached. The author clearly defines, according to his/her analysis, if the facts brought to his or her attention violate the company guidelines or policies, in some specific case laws. The conclusion must include a definitive statement on each allegation that they are:

  • substantiated and supported by evidence;
  • not substantiated based on the evidence or if there is no evidence; or
  • inconclusive if there is some evidence, but not sufficient to make a conclusion therefore not substantiated, but with this qualification.

This section must tie in the allegations and new evidence should never be presented in this section. In case of a breach of the company regulations, the author refers precisely to the standards violated. Then, he or she explains why the behaviour is a violation of this standard. If the investigator considers the allegation not sustained, he or she justifies whether it is inconclusive demonstrating a breach. Therefore, the author proves that he or she considered all aspects of the allegations to draft the conclusions.

The investigation must establish a corresponding conclusion for each fact analysed. The standard of proof applied being the balance of probabilities. A fact is proven to be true on the balance of probabilities, if it appears to have most likely occurred, having regard to all of the evidence.

The order used to present the facts must be the same for the conclusions. Every conclusion must have the internal regulations and the confirmed facts of the case as a basis. The author cannot introduce one which has no material fact supporting it.

For instance, a conclusion can be drafted as follows:

Taking into account the findings described above, this investigation finds that there is insufficient evidence of harassment as:
  1. no pressure was exercised by the alleged perpetrator;
  2. all involved staff confirmed that the alleged perpetrator has always acted respectfully towards them; and
  3. all involved staff confirmed that it did not cause to them any sort of distress nor a risk to their person.

You should be mindful to avoid drawing legal conclusions and should instead leave that up to the appropriate authorities.


Whether a report contains recommendations is reliant upon organisational procedures and the aims of the entity where you work. The same applies for distribution lists and protective markings regarding confidentiality.

This section is not mandatory and depends on the company’s procedures and the aims of those instructing you. In some cases, senior employees enforcing the final decision might require the report’s author to provide recommendations or indeed to add sections, from internal or external legal counsel, setting out legal advice based on the facts you have found. Those can overlay different themes such as:

  • Disciplinary decision
  • Reach for external counsel
  • Report to law enforcement or responsible authority
  • Conduct internal audit
  • Change of process
  • Mitigation measures
  • Termination of commercial contracts

These recommendations are not compulsory to follow for the management but support the potential final decision. Thought should be given as to whether the recommendations can be listed in order of priority. It is not the investigator’s role to make the final decision and for some, ‘those steps are outside the scope of the investigation’ .[3] When it comes to potential disciplinary action of an employee or employees, the investigator should not offer an opinion on what, if any, action or sanction might be imposed. Best practice is for the investigator not to be involved in final decision as to whether disciplinary action will be taken or not as this could create the impression that the investigation was biased and should be avoided wherever possible.


This section is also not mandatory but helpful to include relevant reference material. If included, it is a list covering the pieces of evidence gathered during the investigation and referenced alongside the report. As mentioned, all supporting documents and materials are numbered. The numbers depend on the list’s articulation, for example: (1) a chronological list; or (2) by theme. With the former, the pieces of evidence are numbered following their appearance order in the report. The latter lists them in order of theme, then appearance (e.g. Appendix 1 to 5 for interviews reports, Appendix 6 to 8 for email exchanges, and Appendix 8 to 12 for CCTV footage. Again, this section depends on your organisation’s procedures. Some corporates will want the investigation report to be a stand-alone document and so would not want you to include an appendix within the report itself. In this case you should keep all documents and other evidence replied upon in a separate file to be provided to the final decision maker as needed but not as a part of the report itself.


Confidentiality obligations are at the core of the distribution scheme. The information registered in the report is sensitive and should be shared only on a strict need to know basis. Therefore, general staff are unlikely to be aware of the majority of information in the report. The material’s unfortunate release could provoke reputational incidents for the involved personal, along with legal issues such as the inadvertent waiver of privilege. In addition, an increasing number of countries have laws surrounding the protection of personal data appearing in the report. Therefore, the author must define the distribution list very carefully to avoid any data leak. ‘The distribution of investigation reports will be restricted to those with a legitimate need to know, balancing the need for confidentiality with the need for effective remedial action.’[4]

The first line of the introduction states the report’s confidentiality level. In most situations, the choices are (1) internal, (2) confidential, and (3) secret. The last two, due to the sensitivity of the compliance subjects, are the most common and will impact the number of recipients.

If the author dispatches the report in softcopy, always in PDF, it might be useful to password protect it. The email should be encrypted with no possibility of unwanted forward clearly announcing the confidentiality and the non-distribution rule of the email material. Regarding the hardcopies, they must have a number, be only printed if there are no other distribution options, and always under control to avoid unwanted reproduction, circulation or loss.

The investigator must remind every recipient of the absolute confidentiality of every piece of information shared. The company can decide potential retaliation measures against any offender.

The distribution’s audience might be divided into two main categories: internal and external.

Internally, the distribution list will depend on the type of incident but also the company organisation. The manager of the involved employees, the general counsel, the head of compliance, the human resources director and the CEO are likely to be de facto in the internal distribution list. These roles are responsible for the final decision to be taken but also in case of an internal audit and external investigation arising. In case the company has a compliance committee, a board of directors or an audit committee, they are likely to be eligible to receive the report. The report’s distribution outside the first layer cited above must still protect the privacy of the staff involved.

When the company belongs to a group, the compliance, legal and human resources group departments might require the entity to share the report. The entity, depending on the cases, will remove or redact the personnel’s’ identities.

The sharing of personal data within the same group should not pose an issue, according to the binding corporate rules ‘data protection policies adhered to by companies established in the EU for transfers of personal data outside the EU within a group of undertakings or enterprises.[5]

The report’s distribution outside the company may find that group boundaries will usually be problematic. In principle, the information in the investigation report should not be released to anyone outside the company, except when required by law, e.g. a court order or where it is necessary and confidentiality can be assured, for instance sharing the report with a joint venture party. In the case of law enforcement’s investigation on the same facts, the company might have to disclose all the material gathered, excluding documentation under legal privilege which can include interview notes in certain circumstances, to the external investigators. The company demonstrates through the report, a thorough understanding of the incident and the corresponding report. It proves that the company took appropriate measures to investigate, analyse and mitigate its consequences. The cooperation of the company at this stage will impact upon the conduct of the external investigation. For example, the SFO has provided guidance on effective co-operation.

The same logic will apply when a governmental authority or agency investigates the company. Even in the case of a company’s failure or failures in its process, the investigation report enables the company to demonstrate that it has addressed the incident and limited its liability through the investigation.

During the interactions with public counterparts, the company can require legal support from law firms. Therefore, the report will be valuable for the lawyers to advise the company and represent the company to the authorities.

Turning again to sharing reports with private external counterparts, the company might share the report with a business partner or a supplier on rare occasions, for instance if their voluntary co-operation is required to mitigate risk identified in the investigation, e.g. cancelling a joint commercial contract. Nevertheless, this will be unusual and for instance as regards external auditors, the principle is not to share investigative reports.

Besides, to respect strict confidentiality, the company will amend or redact, where necessary, the shared report to protect employees’ identities and sensitive information.[6]


Additional requirements can apply for investigation documents that seek protection from disclosure in court by virtue or legal privilege. Confidentiality remains a key requirement for such claims of privilege and a number of other factors including the existence of relevant contemplated litigation or regulatory proceedings.

Investigators should not shy away from considering whether legal privilege does or should apply to their most important investigations, i.e. privilege from court disclosure for the investigation documents they create during an investigations, including their emails, interview notes, investigation planning documents and of course their reports. Although a complex area of English law the principles are easy to understand and essentially where investigation documents are made for the primary purpose of contemplated proceedings, e.g. a Serious Fraud Office investigation or employment tribunal, they are likely to be protected by litigation privilege provided certain key rules are followed before further detailed and bespoke privilege legal advice is sought.

The client team

  • Confirm a list of individuals who make up the client team to oversee the investigation.
  • Client team to include only necessary decision-makers in relation to the management and oversight of investigation, including instructing external lawyers.
  • Retain and update a separate ‘need to know’ list for those who need more limited confidential information relating to the investigation.

Legal advice and investigation scope

  • Continue to engage regularly with internal and external legal advisors, including specialist legal advisors and update the investigation scope and plan periodically.
  • At significant points in the investigation or on a monthly basis review the privilege analysis.

Emails and other documents

  • All emails and documents created for this matter to be labelled ‘Privileged and Confidential’ in the subject line.
  • Avoid addressing unrelated matters in the investigation emails, one email chain per investigation and never mix commercial and investigation emails.
  • Investigation emails not to be distributed to persons outside the client team or need to know list as appropriate.

Document creation and storage

  • As a matter of good practice, limit the number of documents created in relation to your investigation to those that are necessary and fall clearly within the relevant investigation scope document.
  • Protect confidentiality of documents and data with careful investigation processes and internal data security measures.
  • Retain paper investigation documents in files clearly marked privileged and confidential.


  • Consider practicability of a lawyer taking notes and including their impressions and legal analysis for the most significant interviews.
  • Consider including an ‘Upjohn warning’ during interviews, i.e. as follows or some similar formulation:
    • the interview is confidential and should not be discussed with anyone else;
    • if relevant, the lawyer present at the interview acts for the company, not the individual; and
    • the interview is protected by legal privilege that belongs to the company.

Legally reviewed by Sam Tate and Kate Langley (RPC LLP).


Unlock unlimited access to all Global Investigations Review content