Writing the Investigation Report and Creating the Evidence Bundle

Why the Report Is the Investigation

An investigation that has been thoroughly planned, carefully conducted and analytically rigorous can still fail if the report that documents it is unclear, poorly structured or inadequately reasoned. The investigation report is the primary output of the entire process. It is the document on which the disciplinary decision-maker relies, on which appeal panels assess whether the original process was sound, and on which employment tribunals evaluate whether the investigation met the required standard. In a very real sense, the investigation is the report. What cannot be seen in the report cannot be verified, defended or relied on.

This chapter covers the full process of producing a clear, well-reasoned and defensible investigation report, and the related task of creating the evidence bundle or data room that supports it. The two are closely connected: a well-organised evidence bundle makes the report easier to write, easier to navigate, and more credible to anyone reading it alongside the underlying material.

This chapter is part of the Workplace and Corporate Investigations Knowledge Guide. If you need an independent investigator whose reports are quality assured by a Crown Court Judge see my independent workplace investigator page.

The Purpose and Audience of the Investigation Report

Before writing the report the investigator must be clear about its purpose and who will read it. The primary audience is typically the disciplinary decision-maker or the person responsible for considering the grievance outcome. But the report may also be read by the subject and their representative, by an appeal panel, by HR, by the organisation’s legal advisers, and potentially by an employment tribunal. Each of these readers will approach the report with different questions, and the report must be capable of satisfying all of them.

The disciplinary decision-maker needs a report that clearly sets out what happened, what was established on the evidence, and how conflicting accounts were resolved, so that they can make an informed decision about outcome. The subject and their representative need a report that transparently explains the findings and the reasoning so that they can identify any errors or unfairness and pursue an appeal if appropriate. An employment tribunal needs a report that demonstrates that the investigation was reasonable, impartial and properly conducted, and that the conclusions were grounded in evidence rather than assumption.

Understanding this range of readers shapes every decision about how the report is written: its structure, its language, the depth of its reasoning, and the care with which it distinguishes between what was established and what remains uncertain.

Structure of the Investigation Report

A well-structured investigation report makes the investigator’s reasoning easy to follow and the findings easy to locate. While the precise structure will vary depending on the nature and complexity of the investigation, most investigation reports benefit from covering the following elements in a logical sequence.

An introduction setting out the background to the investigation, the matters being investigated, who appointed the investigator and on what basis, and the scope of the investigation as defined by the terms of reference. A methodology section explaining how the investigation was conducted, including who was interviewed, what documents were reviewed, and how the evidence was gathered and assessed. A summary of the evidence, setting out the main accounts given by each witness and the key documents reviewed, clearly distinguishing between what each source says rather than blending accounts together in a way that makes it impossible to identify the basis for individual findings. A findings section addressing each allegation in turn, setting out the evidence relevant to that allegation, assessing the competing accounts and evidence, and reaching a clear finding on whether the allegation is established on the balance of probabilities. A conclusion drawing together the overall findings and any recommendations arising from them.

Some investigations will also include a section on recommendations for organisational learning, addressing any systemic issues or process failures identified during the investigation that go beyond the immediate allegations. For detailed guidance on this see the chapter on lessons learned and organisational improvement.

Clear, Accessible and Neutral Language

The language of an investigation report must be clear, accessible and neutral. Clear means that a reader without detailed knowledge of the case can follow the reasoning without having to infer what the investigator meant. Accessible means that the report does not rely on technical or legal terminology that the parties and decision-maker cannot readily understand. Neutral means that the language does not reveal the investigator’s conclusions before they have been properly established through reasoning, and does not use emotionally loaded or judgmental terms that go beyond what the evidence supports.

Neutral language is particularly important in the description of the events and conduct under investigation. The report should describe what happened in factual terms, not in terms that embed conclusions. “The subject raised his voice and said the following words” is neutral. “The subject aggressively berated his colleague” is not, because it embeds a conclusion about the nature and intent of the conduct that has not yet been established through the evidential analysis.

The report should also avoid advocacy. The investigator’s role is to find facts, not to argue a case for one party or another. A report that reads as a prosecution document rather than an impartial analysis of the evidence is likely to be criticised as biased, even where the underlying findings are correct.

Linking Findings to Evidence

Every finding must be linked clearly to the evidence that supports it. It is not sufficient to state a conclusion and leave the reader to infer how the investigator arrived at it. The report must show its working: which evidence was considered, what weight was given to it and why, how conflicting evidence was resolved, and why the conclusion follows from the evidence as assessed.

Specific references to the evidence bundle, using pagination or document references that allow the reader to locate the underlying material, strengthen the report significantly. A finding that says “as set out in the email at page 47 of the evidence bundle, the subject was aware of the policy requirement on 14 March” is far more credible than one that simply asserts the subject was aware of the requirement without identifying the evidential basis.

Where the investigator is relying on a specific passage in a witness’s interview transcript, that passage should be quoted directly rather than paraphrased. Direct quotation is more accurate, more credible, and harder to dispute than the investigator’s summary of what a witness said.

Setting Out Reasoning Transparently

Transparency of reasoning is the single most important quality of a good investigation report. It is also the quality most frequently absent from poor ones. Transparent reasoning means showing the reader not just what was decided but why: how the investigator approached the evidence, what they made of each piece of it, how they resolved conflicts between competing accounts, and how they arrived at the overall conclusion.

Where a credibility assessment has been made, the report must explain the basis for it using the recognised criteria: consistency of the account over time, internal coherence, plausibility given the established facts, corroboration by other evidence, and the presence or absence of any obvious motivation to present the evidence in a particular way. A credibility assessment that simply states “I found witness A to be more credible than witness B” without explaining why is not transparent reasoning. It is an assertion that cannot be scrutinised, challenged or defended.

Where the evidence is genuinely balanced and the investigator cannot reach a confident finding on the balance of probabilities, the report must say so honestly. A finding of “not proven” or “inconclusive” is a legitimate and sometimes necessary outcome. Forcing a finding that the evidence does not support is worse than acknowledging uncertainty, because it produces a conclusion that is inherently unreliable and that will not withstand scrutiny.

Handling Conflicting Evidence

Conflicting evidence is the norm rather than the exception in workplace investigations. Where witnesses give different accounts of the same events, or where witness accounts conflict with documentary evidence, the investigator must engage with those conflicts directly rather than ignoring them, glossing over them or resolving them by simply preferring one account without explanation.

Each significant conflict should be identified, the nature of the conflict explained, and the investigator’s assessment of how to resolve it set out with clear reasoning. Where documentary evidence conflicts with a witness account, the report should explain whether the documentary evidence is more reliable and why, or whether the document is itself unreliable for reasons that are explained. Where two witnesses give directly conflicting accounts, the report should assess the credibility and reliability of each using the structured criteria described in the chapter on evidence, credibility and decision-making.

Integrating Chronology

Many workplace investigations involve a sequence of events that spans a significant period of time. A clear chronology, either as a standalone document in the evidence bundle or integrated into the narrative of the report, significantly improves the clarity of the analysis and the readability of the report. A chronology allows the reader to follow the sequence of events without having to reconstruct it from the narrative, and helps identify inconsistencies in witness accounts about the timing or sequence of events.

Where the chronology is central to the findings, for example where the timing of a disclosure, a deletion or a communication is critical to the analysis, the report should walk through the chronology in detail and explain the significance of the timing to the conclusions reached.

Using AI Tools in Drafting

AI tools can assist with some aspects of report drafting, including structuring the document, improving the clarity and consistency of the language, and identifying internal inconsistencies in the draft. Used appropriately, they can reduce the time required to produce a well-structured report and improve its readability.

However, AI must not be used to reach the investigative conclusions themselves, to assess credibility, to determine the weight of evidence or to substitute for the investigator’s own reasoning. The conclusions and the reasoning that supports them must be the investigator’s own. An AI-drafted report that presents conclusions the investigator has not independently reached through their own analysis of the evidence is not a genuine investigation report. For a full treatment of AI in investigations see the chapter on AI in modern workplace investigations.

Reviewing and Quality Checking the Report

Before the report is delivered, it should be reviewed carefully to ensure that each finding is supported by the evidence cited, that the reasoning is consistent throughout, that the language is neutral and accessible, that the conclusions are proportionate to the strength of the evidence, and that there are no internal contradictions between different sections.

In my own practice, investigation reports are quality assured by a Crown Court Judge before delivery. This is an unusual step that provides an additional layer of assurance that the analysis is sound, the reasoning is clear, and the conclusions are properly supported by the evidence. It reflects the importance I place on the quality of the final product and gives commissioning organisations confidence that the report will withstand scrutiny.

Creating the Evidence Bundle or Data Room

The evidence bundle is the collection of documents, records and other materials gathered during the investigation and relied on in the report. A well-organised evidence bundle makes the report credible, makes the decision-maker’s task significantly easier, and provides a reliable record that can be referred to if the matter is challenged.

The bundle should include all documents and records reviewed during the investigation, interview transcripts, any physical or digital materials relevant to the findings, and a comprehensive index that allows the reader to locate any item quickly. Documents should be paginated sequentially and referenced by page number in the report, so that every evidential reference in the report can be verified against the underlying material.

Document control and version management are important. Where documents have been updated or corrected during the investigation, version history should be maintained. Access to the bundle should be controlled to protect the confidentiality of the investigation, and data protection obligations must be considered when deciding what is included and how it is stored and shared.

Increasingly, evidence bundles are managed in digital data rooms rather than as physical or PDF documents. Digital data rooms allow hyperlinking between the report and the underlying evidence, facilitate collaborative review, and provide access controls and audit trails that enhance security and confidentiality. For detailed guidance on software options and data room management see The Workplace and Corporate Investigator’s Handbook.

Published Resources

My book The Workplace and Corporate Investigator’s Handbook covers both chapters of this topic in full, including a model of an excellent investigation report applied to the Meadowbrook Care Home scenario, a model of a poor investigation report showing the most common failures and their consequences, practical guidance on evidence bundle creation and management, and real case studies from investigations I have conducted involving report writing challenges of various kinds.

See all books.

Frequently Asked Questions

How long should an investigation report be?

The right length depends entirely on the complexity of the investigation and the number of allegations being addressed. A straightforward single-allegation investigation may require a report of ten to twenty pages. A complex multi-allegation investigation involving multiple witnesses and significant documentary evidence may require a report of one hundred pages or more, with an evidence bundle running to many hundreds of additional pages. Length is not a virtue in itself: the report should be as long as the evidence and the reasoning require, and no longer.

Should the investigation report make recommendations about sanction?

No. The investigator’s role is to establish the facts, not to determine the disciplinary outcome or recommend a sanction. Making findings of fact and assessing whether those facts amount to a breach of policy is within scope. Recommending what sanction should follow is not. The disciplinary decision-maker retains that responsibility independently. An investigator who recommends a sanction risks appearing to have pre-judged the hearing outcome.

Should the subject of the investigation see the report before the disciplinary hearing?

Generally yes. The subject must be given the evidence relied on before the hearing in sufficient time to prepare their response. This normally includes the investigation report. There may be limited, specific redactions where disclosure would reveal the identity of confidential witnesses or prejudice ongoing proceedings, but these should be narrow exceptions carefully considered with legal advice rather than a general practice of withholding the report.

What should the investigator do if they realise after completing the report that they missed something?

The investigator should address it before the report is finalised and delivered. Where the omission is significant, it may be necessary to conduct further interviews or gather additional evidence before completing the report. Where the report has already been delivered, the investigator should notify the commissioning organisation immediately and advise on whether and how the additional evidence can be incorporated, whether through a supplementary report or an amendment to the main report.

Who should have access to the evidence bundle?

Access should be limited to those who genuinely need it for the purposes of the investigation and any subsequent proceedings: the investigator, the commissioning organisation, the decision-maker, the parties and their representatives, and legal advisers. Wider disclosure should be carefully considered in light of data protection obligations and the confidentiality of the investigation. Where the bundle contains particularly sensitive personal information, additional access controls may be required.

Get in Touch

If you need an independent investigator, an independent hearing chair, or training for your HR team, I would be glad to discuss your requirements.

Call 020 4538 0246, use the contact form below, or book a call directly.

Important disclaimer: This page is provided for general information and educational purposes only and does not constitute legal advice. The content may not be legally accurate for your specific situation. You must not rely on anything on this page in respect of your legal rights or obligations. Always seek independent legal advice before taking or refraining from taking any action. The author accepts no responsibility for any decisions made or outcomes arising from use of this material. If you would like specific advice, contact me here.

Investigation reports and evidence management