Employment Law Investigations: A Guide for UK Employers

The short answer

Employment law in the UK protects both employers and employees. When you suspect workplace misconduct, theft, fraud, policy breaches, discrimination claims, or harassment, your obligations as an employer do not disappear because the situation is difficult. You must investigate. How you investigate determines whether your findings hold up in a tribunal, and whether your business is protected or exposed.

This article explains when employers should investigate, how to conduct a proper workplace investigation, the legal requirements that govern the process, and when bringing in external investigators makes the difference between a clean outcome and an expensive tribunal defeat.

Your legal duty to investigate

Under UK employment law, employers have a duty to conduct a reasonable investigation before taking disciplinary action. This obligation comes from section 98 of the Employment Rights Act 1996, which governs unfair dismissal claims. If you dismiss an employee without a proper investigation, the dismissal is likely to be found unfair – regardless of whether the employee was actually responsible for the misconduct.

The standard is set by the ACAS Code of Practice on Disciplinary and Grievance Procedures. Tribunals are required to consider whether the employer followed this code when assessing the fairness of a dismissal. Failure to follow the code can result in compensation being increased by up to 25 per cent.

The test is not whether you reached the correct conclusion. It is whether the investigation was reasonable, whether there were reasonable grounds for the belief that the employee carried out the misconduct, and whether the decision to dismiss fell within the range of reasonable responses available to a reasonable employer. This is known as the Burchell test, established in British Home Stores v Burchell [1978].

When you need a workplace investigation

Misconduct allegations

Theft, fraud, violence, harassment, discrimination, bullying, substance misuse, and breach of company policies all require investigation before any disciplinary action. The seriousness of the allegation determines the depth of investigation required. A minor timekeeping issue needs a different level of inquiry than an allegation of sexual harassment.

Grievance complaints

When an employee raises a formal grievance, you must investigate the complaint properly. This includes gathering evidence, interviewing relevant parties, and reaching a conclusion based on the facts. Dismissing a grievance without investigation is a common route to constructive dismissal claims.

Whistleblowing disclosures

Protected disclosures under the Public Interest Disclosure Act 1998 (commonly called whistleblowing) require careful handling. The person making the disclosure has legal protection against detriment and dismissal. If they report criminal activity, health and safety dangers, environmental damage, or breaches of legal obligations, you must investigate the substance of their disclosure. Ignoring it or retaliating against the whistleblower compounds the original problem with additional legal liability.

Performance concerns

While performance management follows a different process from disciplinary action, persistent performance failures may require investigation to determine whether the root cause is incapability, lack of training, a medical condition, or deliberate neglect. The investigation informs which process to follow.

Data protection breaches

If an employee is suspected of misusing personal data, breaching data protection policies, or accessing information they are not authorised to see, the investigation has dual purposes: addressing the employment matter and meeting your obligations under UK GDPR. The Information Commissioner’s Office expects organisations to investigate data breaches and take appropriate action.

How to conduct a workplace investigation

Step 1: Define the scope

Before speaking to anyone, define what you are investigating. Write down the specific allegations or concerns. Identify what evidence you need to gather and who you need to speak to. Appoint an investigating officer who is not involved in the matter and has no reporting relationship with the people involved.

This last point matters more than many employers realise. An investigation conducted by the complainant’s direct manager, or by someone who socialises with the accused, is open to challenge on grounds of bias. The investigating officer must be, and must be seen to be, impartial.

Step 2: Gather documentary evidence

Before conducting interviews, collect relevant documents: emails, system logs, CCTV footage, attendance records, financial records, policy documents, previous warnings, and any written complaints. This gives you a factual foundation before speaking to witnesses, and prevents your questions being shaped by incomplete information.

When accessing employee emails and computer files, ensure you have lawful grounds under UK GDPR. Most employment contracts include provisions allowing the employer to monitor company systems, but these provisions must be proportionate and the employee should have been informed (typically through an IT acceptable use policy).

Step 3: Conduct investigation interviews

Interview the complainant (if there is one), the accused employee, and any witnesses. Key rules for investigation interviews:

Give the interviewee reasonable notice and tell them the purpose of the meeting. At this stage, the accused is not entitled to be accompanied (that right applies to disciplinary hearings, not investigation meetings), but many employers allow it as good practice. Ask open questions: what happened, when, where, who else was present. Do not lead witnesses toward a conclusion.

Take detailed notes, ideally verbatim. Have a note-taker present. Ask the interviewee to review and sign the notes. If they disagree with something recorded, note their disagreement rather than changing the record.

Step 4: Assess the evidence

Weigh the evidence objectively. Employment investigations use the civil standard of proof: the balance of probabilities (more likely than not). You do not need to prove guilt beyond reasonable doubt. But you do need to show that you considered all relevant evidence, including evidence that supports the accused employee’s version of events.

Common mistakes at this stage include giving disproportionate weight to one witness, ignoring evidence that contradicts the initial suspicion, and failing to investigate alternative explanations offered by the accused.

Step 5: Produce an investigation report

The report should set out the allegations, the evidence gathered, the findings of fact, and a recommendation on whether there is a disciplinary case to answer. The report is not a decision on guilt or innocence. Its purpose is to inform the decision-maker (who should be a different person from the investigating officer) whether to proceed to a disciplinary hearing.

A well-written investigation report demonstrates that the employer acted reasonably, followed a fair process, and based its decisions on evidence. This document becomes the employer’s primary defence if the matter reaches an employment tribunal.

Suspension during investigation

Suspension is not a punishment. It is a precautionary measure used when the employee’s continued presence at work could compromise the investigation, pose a risk to other employees, or interfere with evidence. Suspension should be on full pay and for the shortest period possible.

Automatic suspension for every allegation is poor practice and can form part of a constructive dismissal claim. Reserve suspension for cases where there is a genuine risk: serious fraud, violence, safeguarding concerns, or where the accused employee has access to evidence they might destroy.

If you do suspend, confirm it in writing, explain the reasons (without prejudging the outcome), and make clear that suspension is not a disciplinary sanction. Review the suspension regularly and end it as soon as the reason for it no longer applies.

When to use external investigators

Internal investigations are appropriate for straightforward cases with clear evidence and junior employees. External investigators become necessary when:

The accused is a senior manager or director. Internal investigators may feel unable to investigate their own superiors freely. The allegation involves the person who would normally conduct the investigation. The matter is complex, involving financial fraud, cyber security breaches, or cross-border elements. The employer lacks staff with investigation experience. The case is likely to result in litigation, and independently gathered evidence will carry more weight. There are multiple complainants or accused parties, creating conflicts of interest that an internal investigator cannot manage.

External investigators bring independence that is difficult to replicate internally. They have no pre-existing relationships with the parties involved, no stake in the outcome, and no organisational politics to manage. Their findings are harder to challenge on grounds of bias.

Common investigation mistakes

Failing to investigate at all

Some employers respond to allegations by immediately dismissing the accused employee (“we know they did it”) or by ignoring the complaint (“we don’t want to rock the boat”). Both approaches create serious legal exposure. Immediate dismissal without investigation is almost certainly unfair. Ignoring complaints can lead to constructive dismissal claims from the complainant, regulatory action, or ongoing harm to other employees.

Pre-judging the outcome

Starting an investigation having already decided the employee is guilty is not an investigation. It is a process designed to confirm a decision already made. Tribunals are experienced at identifying sham investigations, and they are not sympathetic to employers who go through the motions.

Unreasonable delay

Investigations should be concluded within a reasonable timeframe. What is reasonable depends on complexity, but a straightforward case should not take months. Delay causes stress for all parties, can result in witnesses forgetting details, and may itself become grounds for a grievance or constructive dismissal claim.

Breaching confidentiality

Investigation details should be shared only with those who need to know. If the allegation becomes office gossip because the investigating officer discussed it with colleagues, the employer has failed in its duty of care to both the complainant and the accused.

Ignoring the accused employee’s evidence

The accused employee has a right to respond to the allegations and present their version of events. If they provide an explanation, you must investigate that explanation. If they identify witnesses who can support their account, you must speak to those witnesses. Dismissing their evidence without consideration is a failure of process that tribunals will identify.

Surveillance as part of employment investigations

In some cases, surveillance is appropriate as part of a workplace investigation. Common scenarios include suspected theft from premises, employees working elsewhere while claiming to be on sick leave, and breach of non-compete or non-solicitation clauses.

Surveillance must be proportionate and comply with the Regulation of Investigatory Powers Act 2000 (RIPA) for public authorities, or common law and data protection principles for private employers. Covert surveillance should only be used when overt monitoring would defeat the purpose, and only for the minimum period necessary.

Evidence obtained through lawful surveillance is admissible in tribunal proceedings. Evidence obtained through unlawful surveillance may be excluded, and the employer may face separate legal action for the surveillance itself. Professional investigators understand these boundaries. Managers with smartphone cameras do not.

Digital evidence in employment cases

Most modern employment investigations involve digital evidence: emails, instant messages, browser history, file access logs, USB device connections, and cloud storage activity. Digital forensics techniques can recover deleted files, establish timelines, and demonstrate patterns of behaviour that are not visible from surface-level system checks.

The key requirement is preserving the integrity of digital evidence. If you suspect an employee has been copying confidential files to a USB drive, do not hand their laptop to your IT department and ask them to “have a look.” IT staff may inadvertently alter metadata, access timestamps, or delete relevant files during their examination. A forensic examination creates an exact copy of the storage device (a forensic image) and works from that copy, preserving the original evidence in its unaltered state.

This level of care matters if the case progresses to tribunal or criminal proceedings. The opposing side will challenge the evidence, and if the chain of custody is broken, the evidence loses its value.

The link between investigation and disciplinary process

The investigation and the disciplinary hearing must be separate processes conducted by different people. The investigating officer gathers evidence and produces findings. The disciplinary decision-maker considers those findings, hears the employee’s response, and decides on the outcome.

This separation is required by the ACAS Code and reflects basic principles of fairness. If the person who investigated the case also makes the disciplinary decision, the process lacks the objectivity that tribunals expect. The employee should feel that the person deciding their fate has approached the evidence with a fresh perspective, not having spent weeks building a case against them.

Post-investigation actions

If the investigation finds evidence of misconduct, the disciplinary process follows. But investigation results are not limited to disciplinary action. The investigation may reveal systemic weaknesses in company processes that need addressing. It may identify training needs. It may show that a policy was unclear and that the employee’s behaviour, while problematic, was understandable given the ambiguity.

If the investigation finds no evidence of misconduct, communicate this clearly to the accused employee and the complainant. The accused employee should not return to work under a cloud of unresolved suspicion. The complainant should understand the reasons for the finding and be assured that their complaint was taken seriously and investigated thoroughly.

Employment investigations and data protection

Workplace investigations involve processing personal data: interview notes, emails, system logs, health records (in some cases), and potentially special category data such as information about a person’s race, religion, sexual orientation, or political opinions. All of this processing must comply with UK GDPR.

The lawful basis for processing personal data during an employment investigation is typically legitimate interests (Article 6(1)(f)) or legal obligation (Article 6(1)(c)). For special category data, the lawful basis is usually that processing is necessary for the establishment, exercise, or defence of legal claims.

You must also comply with the transparency principle. In practice, this means your privacy notice should inform employees that their data may be processed for investigation purposes. You do not need to notify the accused employee that you are investigating them before you have gathered evidence, this would defeat the purpose of the investigation, but you must inform them at the point where they are formally notified of the allegations.

Cost of getting it wrong

Unfair dismissal compensation can reach £115,115 (the current statutory cap), and if the dismissal is automatically unfair (for example, connected to a protected disclosure), there is no cap. Discrimination claims are also uncapped.

Beyond direct compensation, a tribunal claim costs management time, legal fees, and reputational damage. A public judgment criticising your investigation process is available for future employees, customers, and competitors to read.

External investigation services for a straightforward employment case typically cost between £2,000 and £10,000. A complex fraud or employee investigation involving multiple subjects and digital forensics may cost more, but the expense is proportionate to the risk being managed.

Getting professional support

UKPI has conducted hundreds of employment investigations for UK businesses since 1997. Our investigators gather evidence to tribunal-admissible standards, conduct interviews with impartial professionalism, and produce reports that withstand legal scrutiny. We work alongside your legal team or HR advisors to ensure the investigation supports the wider employment process.

If you are facing a workplace situation that requires investigation, or you are unsure whether your concerns warrant formal action, call 0800 043 1754 for a confidential discussion. Early advice often prevents small problems from becoming tribunal claims. You can also contact us online to arrange a consultation.