Non-Witness Evidence in Workplace Investigations

Why Non-Witness Evidence Matters

Workplace investigations are often thought of primarily as processes of interviewing witnesses and assessing what people say. But in many of the most complex and consequential investigations, the outcome turns not on witness accounts but on documents, digital records, physical materials and open source information. Understanding how to identify, gather, assess and present non-witness evidence is an increasingly important investigative skill.

This chapter draws on The Workplace and Corporate Investigator’s Handbook to cover the main categories of non-witness evidence in workplace investigations: documents and records, physical and digital materials, open source intelligence and third-party sources. It also addresses how to assess the reliability of non-oral evidence and how to present it fairly within the investigation report.

If you need an experienced independent investigator see my independent workplace investigator page.

Documents, Records and Internal Data

Documents and internal records are among the most valuable evidence sources in workplace investigations because they are often contemporaneous, meaning they were created at or close to the time of the events under investigation, and therefore less susceptible to memory distortion or retrospective rationalisation than oral witness accounts.

Relevant documents and records include emails and message communications, meeting notes and minutes, employment contracts and HR records, performance reviews and correspondence, payroll and financial records, audit trails and system logs, and any policies, procedures or guidance documents that governed the conduct under investigation.

Documents can corroborate or challenge witness accounts, establish timelines, identify who knew what and when, and reveal patterns of behaviour over time. However, they must be interpreted with care. A document shows what was recorded, not necessarily what actually happened. It may omit important context, reflect the writer’s perspective, or have been created with the knowledge that it might later be scrutinised. The absence of a document does not automatically imply concealment. It may simply mean the event was not recorded because no one thought to record it.

Investigators must avoid reading too much into documentary evidence. Documents clarify timelines and communications but rarely explain motive or interpret behaviour. They should be used as part of a broader picture, balanced against witness accounts and other evidence.

Physical and Digital Materials

Physical and digital materials can provide context that witness accounts and documents cannot. CCTV footage, audio recordings and photographs can show events as they actually unfolded rather than as people later recall them. They may confirm timings, movements and interactions, and can help resolve disputes where witnesses strongly disagree about what happened.

However, recordings rarely tell the full story. Footage may lack sound, cover only part of a space, or miss the moments immediately before or after the incident. Photographs capture a single moment without context. Audio recordings may include background noise that obscures what was said. Investigators must therefore avoid interpreting recordings too literally or assuming they speak for themselves.

Digital files, timestamps and metadata can reveal information that is not apparent from the content of a document alone. When a document was created, edited or accessed, and by which account, may be directly relevant to the investigation. But metadata is not always straightforward. System clocks can drift. Files can be automatically saved by software. Metadata can be altered unintentionally through normal use. Investigators should treat metadata as an indicator rather than definitive proof, and should seek IT support if there is any risk that viewing or copying files may affect their evidential value.

Preserving the integrity of physical and digital evidence is essential. Investigators should work from copies where possible, store original items securely, avoid annotating originals, and log when and how evidence was obtained. Contamination does not always render material unusable, but it can undermine confidence and create avoidable challenges later.

Open Source Intelligence

Open Source Intelligence, or OSINT, refers to information that is publicly accessible without special permissions or covert methods. In workplace investigations, OSINT can provide useful context where allegations relate to an employee’s external activities, public statements, social media content or representations made outside work.

OSINT must be approached with great care. Not everything posted online is reliable, accurate or genuinely created by the individual concerned. The use of OSINT must remain proportionate: the fact that something is publicly available does not automatically justify collecting it. Privacy rights, fairness and relevance remain central considerations. Investigators should limit their enquiries to material that directly assists in understanding the allegation, and should avoid broad searches that explore an employee’s personal life unnecessarily.

OSINT is most effective when used to confirm facts, clarify timelines or identify inconsistencies, not to explore character or make moral judgements. When handled appropriately, it can supplement other evidence sources and strengthen the overall picture.

Third-Party and External Sources

In some investigations, relevant evidence exists outside the organisation. This may include records held by other organisations, information from regulatory bodies, communications with external parties, or evidence held by former employees. Obtaining third-party evidence requires careful thought about legal authority, privacy obligations and proportionality. Investigators should not seek third-party information simply because it might be useful. There must be a clear and direct connection to the allegations being investigated.

Technology-Assisted Evidence Gathering

Technology-assisted tools are increasingly used in workplace investigations to search large volumes of electronic communications, identify patterns across documents, build chronologies and manage evidence efficiently. These tools can significantly reduce the time required to review extensive documentary evidence and can surface patterns that might not be apparent from manual review.

However, technology-assisted gathering must be governed by clear protocols covering data protection, proportionality and confidentiality. The investigator remains responsible for assessing and interpreting the evidence that technology surfaces. Automated search results must be reviewed critically and must not be taken as definitive findings.

Assessing the Reliability of Non-Oral Evidence

Non-witness evidence is not automatically more reliable than witness evidence simply because it is documentary or digital. The reliability of any piece of evidence depends on when it was created, by whom, in what circumstances, and whether there are reasons to question its accuracy or completeness.

Contemporaneous records generally carry more weight than retrospective ones. System-generated audit logs that record events automatically are generally more reliable than records created by parties with a stake in the outcome. Documents that were created without knowledge that they might later be scrutinised tend to be more candid than those created in anticipation of investigation.

Presenting non-witness evidence fairly in the investigation report means explaining what each piece of evidence shows, what weight it carries and why, where its limitations lie, and how it fits with the witness accounts and other evidence. The same standards of transparency and reasoning that apply to credibility assessments apply to the assessment of documentary evidence.

Non-Witness Evidence in Workplace Investigations

Non-Witness Evidence in Workplace Investigations

Why Non-Witness Evidence Matters

Documents, Records and Internal Data

Physical and Digital Materials

Open Source Intelligence

Third-Party and External Sources

Technology-Assisted Evidence Gathering

Assessing the Reliability of Non-Oral Evidence

Further Reading