Gathering evidence

This guide explains how employers can gather, preserve and assess evidence during workplace investigations. Covering documentary evidence, witness interviews, electronic records, CCTV footage and confidentiality considerations, the page provides practical advice for HR professionals and managers seeking to conduct fair, thorough and defensible investigations. It also highlights common pitfalls and explains how robust evidence gathering supports informed decision-making and reduces organisational risk.

Building a fair and defensible workplace investigation

Evidence sits at the heart of every workplace investigation.

Whether you’re investigating a grievance, misconduct allegation, bullying complaint, performance concern, or whistleblowing disclosure, the quality of your findings will depend on the quality of the evidence gathered.

A workplace investigation should seek to identify all relevant information, not simply evidence that supports a particular view. The purpose is to establish the facts fairly and objectively, allowing informed decisions to be made based on what is most likely to have happened.

A thorough evidence-gathering process helps employers make fair decisions, reduce risk, and demonstrate that a reasonable investigation has been conducted should those decisions later be challenged.


Why evidence matters

Workplace investigations often involve conflicting accounts of events.

One employee may say something happened, while another disputes it entirely. In these situations, evidence helps investigators move beyond opinion and establish what can be supported by facts.

Gathering evidence enables investigators to:

  • Establish a timeline of events
  • Corroborate witness accounts
  • Identify inconsistencies
  • Clarify disputed facts
  • Assess the reliability of information
  • Make evidence-based recommendations

A well-evidenced investigation report provides confidence that any subsequent decisions are fair, reasonable, and proportionate.


Planning your evidence gathering

Before collecting evidence, it is important to develop a clear investigation plan.

Consider:

  • What issues are being investigated?
  • What facts need to be established?
  • Who may hold relevant information?
  • What records or documents might exist?
  • Are there deadlines for securing evidence?

Early planning is essential because evidence can quickly become unavailable.

Witness memories fade, CCTV footage may be overwritten, emails may be deleted, and key individuals may leave the organisation or become unavailable.

Acting promptly helps preserve important information and supports a thorough investigation.


Documentary evidence

Documents often form the foundation of a workplace investigation.

The type of records required will depend on the nature of the allegations or concerns being examined.

Examples include:

Attendance concerns

Relevant evidence may include:

  • Absence records
  • Clocking-in records
  • Attendance reports
  • Absence management procedures
  • Previous correspondence

Performance issues

Evidence may include:

  • Appraisals
  • Performance targets
  • Sales figures
  • Customer feedback
  • Training records
  • Examples of work

Misconduct allegations

Potential evidence may include:

  • Complaint letters
  • Previous warnings
  • Investigation records
  • Incident reports
  • Relevant correspondence

Policy compliance

Where concerns relate to workplace rules or standards, investigators may need to review:

  • Policies and procedures
  • Employee handbooks
  • Previous decisions
  • Management communications

Investigators should ensure all relevant documents are gathered and reviewed rather than focusing solely on evidence that supports one version of events.


Witness evidence

Witness interviews are often one of the most valuable sources of information during an investigation.

Witnesses may:

  • Have first-hand knowledge of events
  • Provide important context
  • Confirm or challenge existing evidence
  • Identify additional sources of information

Interviewing witnesses requires careful preparation, impartial questioning, and a focus on establishing facts rather than opinions.

Witness evidence should be recorded accurately and witnesses should be given the opportunity to review and confirm their statements.


Electronic evidence

Most modern workplace investigations involve digital evidence.

This may include:

  • Emails
  • Instant messages
  • Teams or Slack communications
  • Website browsing records
  • Electronic documents
  • Telephone records

Where electronic evidence is reviewed, employers should ensure this is carried out in accordance with organisational policies and applicable data protection requirements.

Employees should generally be aware of monitoring arrangements and how workplace systems may be used and reviewed.


CCTV and video evidence

CCTV footage can provide important evidence in some investigations.

Examples include:

  • Alleged theft
  • Workplace violence
  • Health and safety incidents
  • Property damage
  • Unauthorised access

Because many CCTV systems automatically overwrite recordings after a set period, investigators should act quickly where footage may be relevant.

Where CCTV evidence is reviewed, organisations should ensure that its use complies with data protection requirements and internal policies.


Evidence held by employees

During an investigation, employees may hold documents, emails, or records that are relevant to the issues being examined.

While personal documents should not be compelled, work-related information belonging to the organisation may need to be disclosed as part of the investigation.

Where an employee refuses to provide relevant organisational records, investigators should:

  • Record the refusal
  • Explain why the information is relevant
  • Clarify how the refusal may affect the investigation
  • Consider what conclusions can reasonably be drawn from the evidence available

Investigators should always document attempts to obtain relevant information.


Gathering evidence from external sources

Not all evidence will come from within the organisation.

Relevant information may be held by:

  • Customers
  • Contractors
  • Suppliers
  • Business partners
  • Members of the public

In some cases, written statements, telephone interviews, or virtual meetings may be the most practical way of gathering information from external witnesses.

As with internal evidence, the focus should remain on obtaining reliable and relevant information.


Maintaining confidentiality

Evidence gathered during a workplace investigation should be handled carefully and confidentially.

Only those with a legitimate need to access the information should be involved in the process.

However, investigators should avoid making promises of absolute confidentiality.

Documents and witness statements may need to be disclosed in certain circumstances, including:

  • Internal appeals
  • Data protection requests
  • Employment Tribunal proceedings
  • Court proceedings

Being transparent about these limitations helps maintain trust in the process.


Assessing the evidence

Gathering evidence is only part of the investigator’s role.

The evidence must then be reviewed objectively.

When assessing information, investigators should consider:

  • Is the evidence reliable?
  • Is it supported by other evidence?
  • Are there inconsistencies?
  • Could a witness be mistaken?
  • Is there evidence that contradicts the account?
  • What is most likely to have happened?

Investigators should distinguish carefully between fact, opinion, assumption, and speculation.

Conclusions should be based on the balance of probabilities and supported by the evidence gathered.


Common mistakes when gathering evidence

Some of the most common investigation errors include:

  • Failing to act quickly
  • Overlooking relevant witnesses
  • Focusing only on evidence that supports one view
  • Ignoring contradictory information
  • Making assumptions before gathering all the facts
  • Poor record keeping
  • Failing to preserve digital evidence

A thorough and methodical approach helps ensure investigations remain fair, balanced, and defensible.


Why thorough evidence gathering matters

A workplace investigation can only be as strong as the evidence on which it is based.

Incomplete investigations increase organisational risk, undermine confidence in decision-making, and may be difficult to defend if challenged.

By gathering all relevant evidence, documenting findings carefully, and approaching every investigation with an open mind, employers can make informed decisions that are fair to everyone involved.


How we can help

At Kraft HR Investigations, we conduct independent workplace investigations and help organisations gather, assess, and present evidence professionally and objectively.

Our experienced investigators know how to identify relevant evidence, interview witnesses effectively, manage sensitive information, and produce clear investigation reports that support confident decision-making.

Whether you require a fully independent investigation or support for an internal investigation process, we can help ensure that all relevant evidence is identified and considered fairly.


Get expert support

If your organisation is dealing with a grievance, disciplinary matter, misconduct allegation, or other workplace concern, obtaining the right evidence is critical.

Contact Kraft HR Investigations to discuss how our experienced investigators can support your organisation with professional, independent workplace investigations.

Follow our practical guide

Writing the report

Learn about the importance and purpose of the investigation report including:

  • What it should include
  • Explaining findings of fact
  • Assessing the evidence
  • Recommendations versus decision making
  • Objectivity
About us

Workplace investigations from the experts

Our approachable experts support you with workplace investigations so that you can get on with business. Find out why our approach is different and how our dedicated experts save you time, stress and money.