Prompt Pack Workplace Investigation Plan

Workplace Investigation Plan

When to use this

Use this skill at the outset of a workplace investigation — before any interviews are conducted — to produce a structured plan that will guide the investigation from initiation to report. A written investigation plan serves three functions: (1) it ensures the investigation is thorough and procedurally fair; (2) it documents that the company followed a reasonable process (important if the matter later becomes litigation or regulatory); (3) it allocates responsibility between HR, legal, and management.

Typical triggers:

• An employee files a formal complaint of harassment, discrimination, bullying, or sexual misconduct
• A whistleblower report through the speak-up hotline alleges fraud, corruption, or serious policy violation
• Management discovers evidence of suspected theft, data breach, or abuse of authority
• A customer or supplier alleges misconduct by a company employee
• A regulatory body inquires about a specific incident involving company personnel

Important: The investigation plan must be completed and approved before the first witness interview. Starting interviews before agreeing on scope and methodology risks bias challenges and evidence contamination.

Required inputs

Optional inputs

• Prior complaints or incidents involving the same individuals (informs scope and pattern analysis)
• Interim measures already taken (suspension, separation) — affects witness access
• Legal hold requirements — if the matter has litigation potential, a legal hold must be issued before the plan is finalized
• Regulatory notification obligations — some sectors require reporting an investigation to regulators (DFSA, FSRA, SCA) even before conclusions are reached
• Union or employee representative involvement — if applicable in the jurisdiction
• Cross-border dimension — if the conduct spans multiple countries, document which law applies

Investigation plan structure

The plan should be a written internal document, typically 3–8 pages, signed off by the investigation lead and relevant oversight (General Counsel, CHRO, or Audit Committee depending on seniority of the respondent).

1. Investigation reference and classification

2. Scope of investigation

Define:

• What is being investigated: the specific allegations (quote the complaint or summarize with precision); do not investigate broader matters not covered by the complaint unless new facts emerge
• What is not in scope: related grievances or historical matters that are not part of this complaint (prevents scope creep)
• Applicable time period: the date range of the alleged conduct
• Standard of proof: balance of probabilities (on the evidence, is it more likely than not that the alleged conduct occurred?) — this is the standard in employment investigations across most jurisdictions, not the criminal "beyond reasonable doubt" standard

3. Investigator and conflict check

• Identify the lead investigator and any assisting investigator
• Document why the investigator is independent of both complainant and respondent
• If the respondent is a senior executive, consider whether an external independent investigator (law firm, forensic HR specialist) should be appointed to avoid actual or perceived bias
• Document that the investigator has completed relevant training (ACAS, CIPDH, or equivalent; HR investigation certification)

4. Interim measures

Before the investigation begins, consider whether interim measures are required:

• Suspension with pay: appropriate if the respondent's continued presence could intimidate witnesses or interfere with evidence; must be framed as a neutral administrative step, not a disciplinary measure (this is critical in UAE, KSA, and Lebanon where premature disciplinary characterization affects procedural fairness rights)
• Physical separation: if suspension is disproportionate, separate workspaces or remote work
• System access restriction: particularly in fraud or data-related matters
• Communication restrictions: no contact between respondent and complainant or key witnesses during the investigation

Jurisdiction note: In UAE (Federal Decree-Law 33/2021 on Labour), suspension with pay during investigation is permissible; indefinite suspension without due process risks a wrongful dismissal claim. KSA Labour Law (Royal Decree M/51/2005) — suspension permitted for investigation purposes. DIFC / ADGM — DIFC Employment Law 2019: employer has broad authority to suspend pending investigation; DIFC Court will scrutinize whether the investigation was genuinely independent.

5. Witness list

• List all potential witnesses; rank by relevance
• Include any witnesses the respondent identifies as relevant (fairness obligation — respondent must have an opportunity to provide their account and suggest witnesses)
• Document why any potential witness has been excluded from the list

6. Interview questions framework

Complainant interview questions (adapt to allegations):

• Describe the incident(s) in your own words. When and where did each incident occur?
• Who was present at the time?
• How did the conduct affect you?
• Have you previously reported this conduct? To whom, and what was the response?
• Are there any witnesses who can corroborate your account?
• Are there any relevant documents, messages, or emails you can provide?
• Is there anything else you believe is relevant to this investigation?

Respondent interview questions (adapt to allegations):

• You have been provided with a summary of the allegations. [Read / give summary.] What is your response?
• Please describe your recollection of [the specific incident(s)].
• Were there any witnesses present?
• Do you have any documents, messages, or emails that support your account?
• Is there any reason why the complainant would make a false complaint against you?
• Are there any other people you think the investigator should speak to?

Witness interview questions (general):

• What is your professional relationship to [complainant] / [respondent]?
• Did you witness any of the following events? [List specific events.]
• What did you observe? Describe in your own words.
• Did you discuss this with any colleagues?
• Have you previously been asked to comment on this matter?

7. Evidence preservation

Before interviewing any witnesses:

• Issue a legal hold notice to IT, HR, and relevant managers: preserve all emails, messages (WhatsApp, Teams, Signal), call logs, access logs, CCTV footage, and physical documents relating to the complainant, respondent, and the period under investigation
• Instruct IT to suspend any automatic deletion policies for the covered accounts / time period
• Collect and secure physical documents (if applicable)
• Document the chain of custody for any evidence collected

8. Confidentiality protocol

• All parties to the investigation (complainant, respondent, witnesses, investigators) must be instructed to maintain confidentiality
• Disclosure limited to those with a need to know
• No discussion of the investigation on internal messaging platforms or by email (use encrypted channel or in-person)
• Document all persons who received information about the investigation
• Address the risk of counter-claims: if the respondent discloses the complaint to colleagues in retaliation, this itself may constitute a policy violation

9. Timeline

Note: UAE and DIFC labor law do not specify investigation timelines, but unreasonable delay (> 3 months without explanation) can expose the employer to a procedural unfairness claim. EU Whistleblower Directive requires feedback to the reporter within 3 months.

10. Reporting chain and escalation

• Day-to-day oversight: [HR Director / General Counsel]
• Escalation for conflicts of interest or senior executives: [CEO / Audit Committee Chair]
• Legal privilege: [Name of outside counsel] advising on the investigation; communications should be clearly marked as protected by legal professional privilege
• Board notification threshold: if the allegation implicates a C-suite executive, board or audit committee must be notified before interviews commence

Jurisdictional notes

Related skills

• [[prompt-pack-workplace-investigation-report]]
• [[prompt-pack-whistleblower-policy]]
• [[prompt-pack-employment-termination-letter]]
• [[kb-employment-mena]]
• [[heuristic-always-state-jurisdiction-first]]