An internal investigation form template is the structured document an organization uses to capture a workplace complaint, track the fact-finding, and record the outcome in a single defensible file. Filling it out well means completing each section in real time, grounding every entry in observable facts, attaching preserved evidence, giving participants the required notices, and routing the finished package through a formal channel that creates a dated record of receipt. Done poorly, the form becomes the first exhibit against the employer if the matter reaches the EEOC or a courtroom.
Sections the Form Must Contain
A workable template walks the investigator through each phase of the process. The specific fields vary, but these appear in nearly every effective version:
- Complaint intake: full name and job title of the person filing the complaint, the date and time it was received, and the name of the person who took the report.
- Subject identification: full name, job title, department, and reporting relationship of each person accused. Multiple subjects get separate entries.
- Incident details: date, time, and location of each alleged incident, with recurring behavior listed occurrence by occurrence rather than summarized.
- Policy or law at issue: the specific handbook section, code of conduct provision, or legal prohibition the conduct allegedly violates. Vague references like “unprofessional behavior” create problems later. Name the rule.
- Narrative description: a factual, chronological account drawn from the complainant’s own words.
- Witness list: names, job titles, and contact information for anyone who observed the conduct or has relevant knowledge.
- Evidence log: an inventory of all documents, files, photographs, or physical items attached.
- Investigation findings: the investigator’s factual conclusions after reviewing evidence and completing interviews.
- Recommended corrective action: what the organization plans to do, from additional training to termination.
- Signatures and dates: the investigator, the reviewing manager or compliance officer, and where applicable the complainant each sign and date the completed form.
Leaving any of these sections blank, or filling them in weeks later from memory, undermines the entire document. Complete the form in real time as information comes in.
Writing the Narrative Section
The narrative is where most investigation forms go wrong. The goal is a factual, chronological account that reads like a police report, not an opinion piece. Stick to what the complainant said, what witnesses observed, and what the evidence shows. Conclusions and characterizations belong in the findings section, not the narrative.
Use direct quotes when possible and attribute every statement to its source. “On March 12, 2026, J. Martinez stated that she observed R. Thompson remove three boxes of inventory from the warehouse without a requisition form” is far more useful than “R. Thompson was seen stealing.” The first version is a documented observation. The second is an accusation baked into the record before the investigation has even started.
Where behavior is recurring, document each instance separately with its own date, location, and description. A pattern of conduct is more persuasive when it is built from individually documented incidents than when it is summarized as “this has been going on for months.”
Cite the specific policy violation by its exact handbook section number. “Violation of Section 4.3(b) of the Employee Code of Conduct — Unauthorized Removal of Company Property” gives the finding legal teeth. “Broke the rules” does not.
Gathering and Attaching Evidence
Every factual claim on the form should be backed by something other than one person’s word. Collect digital records like email threads, text messages, instant message logs, calendar entries, access badge data, and security camera footage. Photograph and catalog physical evidence such as signed documents, damaged property, or handwritten notes before storing it.
Organize evidence chronologically so it mirrors the narrative section. Label each item with a reference number that matches the evidence log on the form. Someone reviewing the file six months later should be able to trace any narrative claim directly to its supporting document without guessing.
Preserving Digital Evidence
Digital files are easy to alter, so preservation steps matter. Save documents in read-only formats like PDF, and note the date and time each file was captured. For email or messaging evidence, export the full message including headers and metadata rather than taking screenshots, which can be challenged as incomplete. If the organization uses forensic tools, record the cryptographic hash value of each file at the time of collection. That creates a mathematical fingerprint proving the file has not been modified since capture.
Maintain a custody log for every piece of evidence. The log should show who collected the item, when and where it was collected, where it has been stored, and who has accessed it since. Each transfer between people gets its own dated entry. A broken chain of custody can make otherwise strong evidence useless in a legal proceeding.
Keep Medical Information Separate
If the investigation involves medical records, disability-related information, or the results of a medical examination, federal law requires that this material be kept on separate forms and stored in separate confidential medical files. It does not go into the general investigation file or the employee’s personnel folder.
The ADA limits who can see this information: supervisors and managers may be told about necessary work restrictions or accommodations, first aid personnel may be informed if a disability could require emergency treatment, and government officials investigating compliance may request access.1Office of the Law Revision Counsel. 42 U.S.C. 12112 – Discrimination Any medical evidence relevant to the investigation can be referenced in the main form by a note pointing to the separate confidential file, but the medical details themselves should never appear in the primary investigation document.
Documenting Witness Interviews and Credibility
For each witness, record the person’s full name, job title, department, relationship to the complainant and the subject, and how they were identified as a potential witness. Schedule and document interviews individually. Never interview witnesses as a group, which lets one person’s account contaminate another’s.
After conducting interviews, assess each person’s credibility. The EEOC’s guidance on harassment investigations identifies five factors that matter most:
- Inherent plausibility: does the testimony make sense on its face?
- Demeanor: did the person appear to be telling the truth?
- Motive to falsify: does the person have a reason to lie?
- Corroboration: is there witness testimony or physical evidence that supports the account?
- Past record: does the accused have a documented history of similar behavior?
Record your assessment of each factor for every key witness directly on the form or in an attached interview summary. These notes demonstrate that the investigation was thorough and impartial rather than a rubber stamp. Base credibility assessments on observable facts. “The witness’s account matched the timeline in three separate emails” works. Gut feelings do not.
Anti-Retaliation Notice
Every internal investigation form should include a written anti-retaliation statement. Retaliation claims are now the single most common charge filed with the EEOC, so this is not boilerplate. The form or its cover sheet should state clearly that participating in the investigation, whether as the complainant, a witness, or anyone providing information, is protected activity, and that the organization prohibits any adverse action against participants.
The EEOC’s enforcement guidance defines protected activity broadly. It covers filing or threatening to file a complaint, providing information during an internal investigation, refusing to obey an order reasonably believed to be discriminatory, and requesting a reasonable accommodation for a disability or religious practice.2U.S. Equal Employment Opportunity Commission. Enforcement Guidance on Retaliation and Related Issues Retaliation does not have to mean termination. It includes any action that would discourage a reasonable person from participating, such as a demotion, a negative performance review, a schedule change, or social ostracism encouraged by management.
Include a signature line where each interview subject acknowledges reading the anti-retaliation notice. That creates a contemporaneous record that the organization took its obligations seriously, which matters if the investigation itself later becomes the subject of a retaliation claim.
Confidentiality and the Upjohn Warning
The form should include a confidentiality statement instructing all participants not to discuss the investigation with anyone outside the process. Both the complainant and each witness should sign an acknowledgment that they understand the expectation.
If an attorney is directing the investigation, common when the allegations carry litigation risk, the form needs an additional disclosure known as an Upjohn warning. Before each interview begins, the interviewee must be told:
- The attorney represents the company, not the individual employee.
- The conversation is privileged, but the privilege belongs to the company and the company may choose to waive it.
- If the company plans to share the interviewee’s statements with a government agency, the interviewee must be told.
- The interviewee should treat the conversation as confidential and not share what was discussed.
Include a field on the form confirming the warning was given before the interview started and that the interviewee acknowledged understanding it. Skipping this step can jeopardize attorney-client privilege for the entire investigation. If the interviewee later claims they thought the attorney was representing them personally, the organization has a bigger problem on its hands.
Documenting the Timeline
No single federal statute prescribes a universal deadline for completing a workplace investigation, but the standard across EEOC guidance and court decisions is that the employer must act promptly. In the federal sector, the EEOC recommends beginning investigations within ten calendar days of receiving the allegations and taking corrective action within sixty calendar days if harassment is confirmed, though many situations demand faster interim action while the investigation is still pending.3U.S. Equal Employment Opportunity Commission. Promising Practices for Preventing Harassment in the Federal Sector
Private-sector employers face a similar expectation. An employer can avoid liability for a hostile work environment created by a supervisor only by proving it reasonably tried to prevent and promptly correct the harassing behavior.4U.S. Equal Employment Opportunity Commission. Harassment An investigation that drags on for months without explanation is unlikely to satisfy that standard. Document the timeline directly on the form: when the complaint was received, when the investigation began, when each interview was conducted, and when findings were delivered. If delays occur, note the reason for each one.
Submitting the Completed Form
Once the form is complete and all evidence is attached, submit the package through whatever formal channel the organization has established. That typically means delivery to a designated compliance officer or HR director, or a secure upload to a restricted portal. Many organizations assign a unique tracking number at this stage and provide the reporting party with written confirmation of receipt. If your organization does not do this automatically, request one. A confirmation with a date and tracking number is the simplest proof that the complaint was received and entered into the system.
The form and its attachments should go only to the people who need to see them. Do not copy the complainant’s direct supervisor unless that person is part of the formal review process, and never place investigation documents in a general personnel folder where they could be accessed during routine HR activities. Encryption and access restrictions on digital files are standard precautions.
Retaining the Completed File
How long you keep the completed investigation file depends on what the investigation involved and which federal regulations apply. The baseline under EEOC regulations is one year from the date the record was made or the personnel action was taken, whichever is later.5eCFR. 29 CFR Part 1602 – Recordkeeping and Reporting Requirements Under Title VII, the ADA, and GINA If a formal charge of discrimination has been filed with the EEOC or a lawsuit has been brought, the organization must retain all records related to that charge until final disposition, which could take years.6U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602
State and local government employers face a longer baseline: two years from the date of the record or personnel action. Federal grant recipients must retain financial records for three years from the date of their final expenditure report.7eCFR. 2 CFR 200.334 – Record Retention Requirements Investigations touching employee benefit plans fall under ERISA, which requires supporting records to be kept for at least six years.
Given this patchwork, many organizations adopt a blanket retention policy of six or seven years for investigation files, which covers the longest federal requirement and provides a buffer for state laws that may impose additional obligations. Whatever period your organization selects, apply it consistently. Selectively destroying investigation files is one of the worst facts an employer can face in litigation.
Mistakes That Sink the Form
Any one of these errors can turn a defensible investigation into a liability:
- Waiting to document. Filling in the form days or weeks after interviews happen, relying on memory instead of contemporaneous notes. Courts and agencies give far more weight to records made at the time of the events they describe.
- Editorializing in the narrative. Using words like “clearly,” “obviously,” or “the complainant seemed upset” instead of recording what was actually said and observed. Subjective language suggests the investigator reached a conclusion before finishing the review.
- Skipping the policy citation. Describing the conduct in general terms without tying it to a specific rule makes the investigation look like a personal judgment call rather than enforcement of established standards.
- Incomplete witness records. Listing witnesses by first name only, or noting that “several people saw it” without identifying anyone. Every witness needs full contact information recorded at the time of the interview.
- No anti-retaliation notice. Running an entire investigation without documenting that participants were told about retaliation protections. The absence of this notice is the first thing a plaintiff’s attorney looks for.
- Mixing medical records into the main file. Including disability information, medical test results, or accommodation details in the general investigation file rather than the separate confidential medical file required by the ADA.
The form itself is the organization’s best evidence that it took a complaint seriously, investigated it fairly, and responded appropriately. Treating it as a bureaucratic chore rather than a legal document is the mistake that makes every other mistake worse.