Home / Blog / How to Conduct a Workplace Investigation in 2026
LEGAL · HR · 2026 EDITION

How to Conduct a Workplace Investigation in 2026

A defensible-report operator's guide. Post-Stericycle, post-McLaren Macomb, post-EEOC-rescission. Privilege posture, Upjohn warnings, Weingarten, Garrity, narrow confidentiality, Faragher/Ellerth, Nassar timeline, credibility, findings framework, SB 553, AB 2188, retention.

By Derek Giordano · Published April 16, 2026 · ~22 min read · Current through April 17, 2026

Workplace investigations are high-stakes documents masquerading as HR processes. In any Title VII, FEHA, or parallel-state harassment or discrimination lawsuit that reaches discovery, the investigation report is produced, studied, and cross-examined. It is the single most important piece of the Faragher v. City of Boca Raton (524 U.S. 775, 1998) and Burlington Industries, Inc. v. Ellerth (524 U.S. 742, 1998) affirmative defense — the employer's proof that it exercised reasonable care to promptly correct any harassing behavior. A complete, well-documented report sustains the defense. A sloppy or incomplete one undermines it.

This guide is a 2026-current operator's manual for conducting investigations that survive discovery and cross-examination. It reflects the post-Stericycle confidentiality landscape, the post-McLaren Macomb severance-language rules, the January 2026 EEOC rescission of the 2024 harassment guidance, California SB 553 workplace-violence integration, California AB 2188 cannabis limits, the twelve all-party recording-consent jurisdictions, and the established federal doctrines (Upjohn, Weingarten, Garrity, Nassar) that frame the actual conduct of interviews and the structure of the written report.

Generate a 2026-compliant investigation report in your browser
4 variants · 50-state scoring · 24 compliance checks · privilege-posture gating · Upjohn/Weingarten/Garrity · Nassar timeline · 6 export formats · free, no signup
Open Generator →

1. The Report Is the Evidence, Not Just a Summary

Three structural failures recur in workplace investigation reports that fail in litigation. First, the investigator overreaches into legal conclusions the investigator is not qualified or authorized to make — writing "the respondent harassed the complainant" instead of finding that specific conduct occurred. Second, the report is late: the lag between complaint receipt and investigation start, or between investigation start and written report, exceeds what a jury will treat as prompt. Third, the report is inconsistent with the interview notes: the summary adds or omits facts from what the interviews actually captured. All three are avoidable with discipline.

The first rule of drafting is to assume the report will be read by opposing counsel, a plaintiff, a jury, the EEOC, and a judge — because it will be. Every sentence should be defensible on the evidence in the file. Conclusions should be supported by specific testimony or documents, with citations in the notes. Credibility determinations should rest on more than "demeanor." And the report should never decide the ultimate legal question — that is the role of HR, legal, or the designated decisionmaker applying policy and law to the investigator's factual findings.

2. Privilege Posture Is the First Structural Decision

Before any interviews happen, the employer must decide: who conducts the investigation, and what privilege posture attaches. The four options have sharply different consequences.

In-house HR (no privilege)

An investigation conducted by HR without any involvement of counsel has no attorney-client privilege. Every draft, note, email, and the final report are discoverable in litigation. The HR investigator may be called as a witness, and the entire file is subject to production. This is appropriate for straightforward matters with low litigation risk, where the employer wants the transparency of a fully-discoverable process and trusts HR's training. It is not appropriate for matters involving C-suite respondents, matters with parallel litigation, or matters where privilege would be strategically useful.

In-house counsel (Upjohn with waiver risk)

An investigation conducted or directed by in-house counsel may be privileged under Upjohn Co. v. United States (449 U.S. 383, 1981), but only if the D.C. Circuit's significant-purpose test from In re Kellogg Brown and Root (756 F.3d 754, 2014) is satisfied. That test asks whether obtaining or providing legal advice was one of the significant purposes of the investigation — not the only purpose, but a real one. A dual-purpose HR-and-legal investigation generally qualifies if counsel is directing the work and the investigation is structured to produce legal advice, not merely to label HR work as legal.

The risk with in-house counsel is that the in-house lawyer is often also a business-side adviser, and the line between the lawyer's legal advice and the lawyer's business judgment can get blurry. Courts will sometimes find that privilege does not attach to the business-judgment part. If the in-house counsel investigator is likely to be called as a fact witness at trial, privilege over the investigation may be waived as a matter of subject-matter consistency.

Outside counsel (strongest privilege)

Outside counsel conducting the investigation at the employer's direction has the strongest privilege posture. The attorney-client relationship is clear, the interviews can be privileged communications (with Upjohn warnings properly delivered), and the work product is protected under Federal Rule of Civil Procedure 26(b)(3). This is the default choice for high-stakes matters — C-suite respondents, matters with parallel litigation or agency proceedings, and matters where the employer anticipates asserting Faragher/Ellerth and may selectively disclose portions of the report in that defense.

The cost of outside counsel is real. For routine matters, outside counsel is overkill. The privilege is also not absolute — selective disclosure in defense of a Faragher/Ellerth claim can waive privilege over the entire subject matter, which creates strategic tension.

Third-party non-attorney investigator

A licensed private investigator or a trained workplace-investigations consultant retained directly by HR receives no attorney-client privilege. Work-product protection may apply under Rule 26(b)(3) if the investigator is retained by counsel in anticipation of litigation, but not if retained directly by HR. In California, Business and Professions Code Section 7520 requires a PI license for non-attorney external investigators conducting paid investigations, with an attorney-as-attorney exception. A non-attorney third-party retained to conduct a California workplace investigation without a PI license is likely operating unlawfully, and any report produced is vulnerable to exclusion.

3. Upjohn Warnings: The Scripted Notice That Preserves Privilege

Where privilege is claimed, the Upjohn warning is the scripted notice given to the employee-interviewee at the start of the interview. Four elements must be covered:

Without the warning, the employee may later credibly claim they believed the attorney represented them personally, creating a joint-privilege problem that often forecloses unilateral company waiver. Omitting Upjohn warnings is the single most common way in-house investigations destroy their own privilege — the warnings are easy to deliver, take less than two minutes, and their absence is catastrophic.

The warning is required only where privilege is being claimed. An in-house HR investigator who is not an attorney gives no Upjohn warning because no attorney-client privilege attaches to begin with. Giving an Upjohn warning when no attorney is involved is worse than not giving it — it creates a false impression of privilege that can be impeached in discovery.

4. Weingarten and Garrity: When Representation Matters

Weingarten rights in unionized workplaces

In a unionized workplace, NLRB v. J. Weingarten, Inc. (420 U.S. 251, 1975) gives the employee the right to a union representative in an investigatory interview that the employee reasonably believes may result in discipline. The right belongs to the employee and must be requested — the employer is not required to notify the employee of the right in advance.

When the employee makes the request, the employer has three choices: (a) grant the request and proceed with the representative present; (b) end the interview; or (c) give the employee the choice between proceeding without a representative or foregoing the interview. Denying a requested representative and proceeding anyway is an unfair labor practice under Section 8(a)(1).

Weingarten rights currently apply only to unionized workforces. The NLRB briefly extended Weingarten to non-union employees in Epilepsy Foundation (331 NLRB 676, 2000), but reversed that extension in IBM Corp. (341 NLRB 1288, 2004). The 2026 Board composition (2-1 Republican majority with Prouty's term expiring August 2026) makes re-extension unlikely in the near term.

Garrity warnings for public-sector misconduct

For public-sector employees, Garrity v. New Jersey (385 U.S. 493, 1967) governs compelled statements in misconduct investigations. Where the public employer requires the employee to answer on threat of termination, the answers and any evidence derived from them are immunized from use in a subsequent criminal prosecution.

The practical consequence is a forced choice. The employer can compel the employee to answer — and accept that the answers are inadmissible in any criminal prosecution, along with any fruits of those answers. Or the employer can preserve criminal admissibility by not compelling the employee to answer — but then lose the ability to conduct a full internal investigation. For serious public-sector misconduct that may also be criminal (theft, excessive force, fraud), the decision is typically made in coordination with the prosecutor's office. Garrity does not apply to private-sector employees because there is no state action.

5. Stericycle and McLaren Macomb: The Narrow-Confidentiality Rule Still Controls

The NLRB's August 2, 2023 decision in Stericycle, Inc. (372 NLRB No. 113) overruled Boeing and the Apogee Retail rule that had treated investigation-confidentiality instructions as categorically lawful. Under Stericycle, a workplace rule is presumptively unlawful if a reasonable employee subject to the rule and economically dependent on the employer could interpret it as chilling Section 7 rights. The employer may rebut by proving the rule advances a legitimate and substantial business interest that cannot be served by a more narrowly tailored rule.

A blanket "keep this investigation confidential" instruction will almost always fail Stericycle. The permissible instruction has three features:

McLaren Macomb (372 NLRB No. 58, February 21, 2023) reached parallel conclusions for severance-agreement confidentiality and non-disparagement clauses. The Sixth Circuit affirmed the core McLaren Macomb holding on September 18, 2024. The Trump administration rescinded General Counsel Memorandum 23-05 (which had expansively interpreted McLaren Macomb) in early 2025, and the broader set of Biden-era GC memos followed. But the Board decisions themselves remain good law as of April 2026. NLRB tradition requires three Board votes to overturn precedent, and the Board reconstituted December 18, 2025 has only a 2-1 Republican majority (Chairman Murphy and Member Mayer versus Democrat Member Prouty). Prouty's term expires August 2026; after that, a full-quorum Republican Board could revisit Stericycle, but as of this writing the law is unchanged.

A December 2025 NLRB ALJ decision applied Stericycle against Amazon's confidentiality agreements, ordering Amazon to rescind the unlawful provisions and notify all U.S. employees. The case confirms that regional offices continue enforcing the Stericycle standard. Employers drafting investigation reports today must assume Stericycle is the operative standard and draft narrow-confidentiality instructions accordingly.

6. The EEOC 2024 Harassment Guidance Was Rescinded — But Bostock Still Controls

The EEOC's April 29, 2024 Enforcement Guidance on Harassment in the Workplace was the first comprehensive update in 25 years. It addressed virtual harassment, LGBTQ+ protections post-Bostock v. Clayton County, pregnancy-related sexual harassment, and roughly 70 illustrative examples. On January 22, 2026, the EEOC voted 2-1 to rescind the entire 2024 Guidance. Chair Andrea Lucas moved the rescission with a second from Commissioner Brittany Panuccio; Commissioner Kotagal dissented on procedural grounds. A May 2025 federal district court decision had already vacated portions of the Guidance related to sexual orientation and gender identity on statutory-authority grounds — the court held that the EEOC had exceeded its authority in defining harassment to include misgendering and bathroom-access restrictions.

The rescission does not change the underlying statutes or Supreme Court precedent. Bostock v. Clayton County (590 U.S. 644, 2020) is still controlling: Title VII's prohibition on sex discrimination includes discrimination on the basis of sexual orientation and gender identity. A harassment investigation must still address LGBTQ+-directed harassment as sex harassment. What has changed is the EEOC's interpretive overlay — the 2024 Guidance's specific examples involving misgendering, deadnaming, bathroom access, and similar conduct no longer have the Guidance's imprimatur as per-se unlawful conduct.

Practical implication: investigators should continue to treat such conduct as potentially unlawful on the facts of a specific matter while understanding that the EEOC is currently not offering pattern guidance. State and local jurisdictions (California, New York, Washington, and many municipalities) have parallel protections that go beyond the federal floor and are unaffected by the federal rescission.

7. Retaliation Temporal-Proximity Analysis Under Nassar But-For Causation

Retaliation is now the largest EEOC charge category, appearing in roughly 60 percent of charges filed. It has distinct causation rules. University of Texas Southwestern Medical Center v. Nassar (570 U.S. 338, 2013) holds that Title VII retaliation plaintiffs must prove but-for causation — the adverse action would not have occurred but for the protected activity — rather than the motivating-factor standard applicable to some Title VII discrimination claims.

Temporal proximity between protected activity and adverse action is the most commonly-pleaded circumstantial evidence of but-for causation. The Supreme Court has not set a hard days-threshold, but circuit courts have developed rough ranges:

Employer knowledge of the protected activity is a separate causation predicate. No knowledge means no retaliation, regardless of the time gap. A respondent who demonstrably did not know about the protected activity cannot have retaliated for it. The investigator must establish when the respondent or decisionmaker learned of the protected activity, as distinct from when the protected activity occurred.

A defensible retaliation investigation report includes an explicit four-date timeline: (1) date of protected activity; (2) date the respondent or decisionmaker learned of the protected activity; (3) date of the adverse employment action; (4) days elapsed between employer knowledge and adverse action. The investigator's analysis of whether the temporal proximity is consistent or inconsistent with the respondent's stated legitimate non-retaliatory reason goes in the narrative findings. This structure applies whether the finding is substantiated, unsubstantiated, or inconclusive.

8. The Five-Factor Credibility Matrix

Where the investigation is a credibility contest — the complainant says one thing, the respondent says another, and the witnesses are divided or unavailable — the investigator must make a credibility determination per witness and document the basis. The conventional five-factor framework tracks long-established employment-law practice and mirrors the factors administrative law judges and the EEOC use internally.

Plausibility

Does the account make sense on its face, given what else is known about the workplace, the timeline, and the physical or technological realities? An account that requires multiple unlikely events to be true is weaker than one that fits naturally into known context. Plausibility is not the same as corroboration — an account can be plausible without being corroborated, and implausible accounts have occasionally turned out to be true.

Demeanor

How did the witness present during the interview — calm, agitated, cooperative, evasive, consistent, contradicting themselves? Demeanor is the weakest of the five factors and should never be the primary basis for a credibility determination. Courts have repeatedly cautioned against over-reliance on demeanor, and plaintiffs' counsel cross-examine demeanor-based determinations aggressively. Include demeanor observations, but weight them low.

Corroboration

What other evidence supports or contradicts the account? Documents, emails, chats, text messages, other witnesses, physical evidence, building-access logs, CCTV, and similar objective records are the strongest corroborators. Corroboration is the most important of the five factors in most cases. An account with documentary corroboration is substantially stronger than an account without, regardless of demeanor.

Motive to fabricate

Does the witness have a reason to lie in either direction? Pending performance issues, personal animus, impending termination, romantic relationships, financial disputes, or similar dynamics can create motives. Identifying a motive does not mean the witness is lying — many witnesses with motives tell the truth — but the motive is a fact to be weighed with the other four factors.

Past record

Does the witness have a history of truthful or untruthful statements, disciplinary history, or prior complaints (as either complainant or respondent)? Prior findings of dishonesty are particularly weighty. A clean record supports credibility; a record of prior dishonesty cuts against it.

Each witness gets a line in the credibility matrix with a brief justification for each factor and an overall determination (credited / partially credited / not credited). The investigator's credibility determination is the factual basis for the substantiated / unsubstantiated / inconclusive finding, and the determinations should be consistent with the findings. Inconsistencies between credibility and findings are a common cross-examination target.

9. Substantiated, Unsubstantiated, Inconclusive — Not Legal Conclusions

Findings should be factual, not legal. For each discrete allegation, the investigator reaches one of three findings:

"Substantiated" means the specific conduct occurred, not that it was unlawful. Writing "the respondent harassed the complainant" or "the respondent retaliated against the complainant" confuses factual findings with legal conclusions and puts the investigator into the role of applying the law — which is not the investigator's job and which opposing counsel will exploit.

HR, legal, or the decisionmaker reaches the legal conclusion by applying the company's policy and the relevant statute to the investigator's factual findings. That separation is important in litigation. When the investigator is called as a witness, the investigator testifies to what they found happened, and a separate policy-application witness testifies to the disciplinary decision. Collapsing the two undermines the defense and creates unnecessary exposure for both witnesses.

The inconclusive finding is underused and important. Where the evidence is a true he-said-she-said with no corroboration either way, inconclusive is the honest answer. Pushing to substantiated or unsubstantiated in those cases requires picking a side without adequate evidentiary basis, which is visible on the face of the report and undermines credibility in litigation. An inconclusive finding with a narrative explanation of why corroboration was unavailable is more defensible than a forced substantiated-or-unsubstantiated finding.

10. Recording Consent: Twelve All-Party States and How They Change Interview Practice

Twelve states require all-party consent for recording a private conversation: California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, and Washington. Michigan's status is contested — the literal statute requires all-party consent, but Sullivan v. Gray (1982) held that a party to the conversation may record it, and the law has not been definitively resolved. Nevada's wiretap statute is literally one-party, but the Nevada Supreme Court in Lane v. Allstate (1998) interpreted it as all-party for in-person recordings. The conservative practice is to treat both Michigan and Nevada as all-party.

If the investigation interview is being recorded — audio or video, by human or by AI meeting transcription — every participant in an all-party state must consent before recording begins. Recording without consent in an all-party state can be criminal. Illinois eavesdropping is a Class 4 felony. California Penal Code Section 632 carries up to a year in jail and a $2,500 fine for a first offense. Pennsylvania's penalty goes up to seven years.

In hybrid meetings where participants are in different states, the conservative rule is to apply the strictest standard among the participants. If even one interviewee or investigator is in an all-party state, all participants must consent.

For workplace investigations, the common practice in all-party states is to request consent on the record at the start of the interview, log the consent, and proceed. If the interviewee declines, the investigator conducts the interview unrecorded and takes contemporaneous notes. The NLRB has held in some cases that employee covert recording is protected concerted activity under Section 7, which complicates employer discipline for employee secret recordings — but does not affect employer-side recording, which still requires consent under state law.

AI meeting assistants (Otter, Fireflies, Zoom AI companion, Microsoft Copilot) are treated as recordings under all-party law regardless of who or what is doing the recording. California SB 1130 (introduced February 2026) specifically addresses wearable recording devices and AI transcription in workplaces.

11. California SB 553 Workplace-Violence-Prevention Plan Integration

California Senate Bill 553 (Labor Code Section 6401.9, effective July 1, 2024) requires every covered California employer to establish, implement, and maintain a written Workplace Violence Prevention Plan (WVPP), to log every incident of workplace violence in a Violent Incident Log, and to train employees on the plan. Investigations conducted under the WVPP must be documented, and the documentation must be retained for five years — longer than the FEHA four-year floor.

The Violent Incident Log must capture, for each incident, the date and time, location (specific work area), violence type (Type 1 stranger, Type 2 customer-client, Type 3 worker-on-worker, Type 4 personal-relationship), weapons if any, consequences including law-enforcement contact, and corrective measures. A workplace investigation that includes any workplace-violence component — a physical altercation, a threat, a weapons incident, a sexual assault at work — must feed into the WVPP log in addition to the standard harassment or misconduct report. Cal/OSHA is required to adopt a permanent general-industry standard no later than December 31, 2026.

Exemptions include healthcare facilities already subject to California Code of Regulations Title 8 Section 3342 (healthcare workplace violence prevention), POST-participating law enforcement, employees working remotely, and worksites with fewer than 10 employees and no public access.

12. California AB 2188: Off-Duty Cannabis and the Drug-Test Problem

California AB 2188 (Government Code Section 12954, effective January 1, 2024) prohibits discrimination in hiring, termination, or any term or condition of employment based on (a) off-duty cannabis use away from the workplace, or (b) an employer-required drug screening test showing only non-psychoactive cannabis metabolites in the applicant's or employee's bodily fluids or hair. The law addresses a specific scientific reality: most conventional urine-based drug tests for cannabis detect non-psychoactive metabolites that remain in the body for days or weeks after use, long after any impairment has ended. A positive urine test for cannabis metabolites does not establish current impairment and, under AB 2188, cannot serve as the sole basis for discipline.

The law does not protect on-the-job impairment. Employers may still discipline employees who are observably impaired at work, who use cannabis during work hours, or who bring cannabis to the workplace. Employers may use drug tests that detect active THC (saliva-based or blood-based, which have shorter detection windows and better correlate with current impairment) rather than metabolite-based urine tests. SB 700 (effective January 1, 2024) complements AB 2188 by prohibiting employers from asking applicants about past cannabis use on job applications.

Exemptions include employees in the building and construction trades, applicants and employees hired for positions requiring a federal government background investigation or security clearance, DOT-regulated positions (pilots, truckers, and similar safety-sensitive transportation roles), and employers required by federal contract to maintain a drug-free workplace under the Drug-Free Workplace Act.

For investigation reports, AB 2188 means that a misconduct investigation premised in any part on an off-duty positive drug test must honor the AB 2188 limits. The investigator cannot treat the metabolite test alone as substantiating impairment or misconduct. Findings relating to on-the-job impairment must rest on evidence of current impairment at work — observed conduct, scientifically valid tests detecting psychoactive THC, or equivalent.

13. Record Retention, Final Write-Up, and Corrective-Action Recommendation

Retention periods

Retention is set by multiple overlapping rules. The EEOC minimum under 29 C.F.R. Section 1602.14 is one year from creation or the date of the personnel action involved, whichever is later, tolled during any open charge. California Government Code Section 12946 requires four years for FEHA-covered records. New York practice is six years, coordinated with NY Department of Labor audit windows. California SB 553 separately requires five years for violent-incident investigations. ADA-related medical records must be kept in a separate, confidential file for the duration of employment plus one year. FMLA records are three years.

Active litigation-hold memos toll all of these minimums until resolution. An EEOC charge, a state fair-employment charge, an NLRB charge, an OSHA complaint, an OFCCP audit, or any civil litigation arising from or touching the investigation's subject matter requires preservation of the full investigation file until resolution. Destruction during a pending matter is sanctionable.

Final write-up structure

A defensible report is organized as: preamble and scope, investigator qualifications and privilege posture, methodology (interviews conducted, evidence reviewed, recording status, representation present, Upjohn/Weingarten/Garrity warnings), allegations matrix, confidentiality and retaliation-protection notices, credibility analysis, factual findings per allegation, retaliation timeline (retaliation variant), Faragher/Ellerth compliance record (harassment variant), corrective-action recommendation, SB 553 Violent Incident Log addendum (California workplace-violence cases), AB 2188 notice (California cannabis cases), record retention, and investigator attestation.

The generator produces all of these sections automatically, calibrated to the selected variant and jurisdiction. Section numbering shifts based on which conditional sections are active.

Corrective-action recommendation

The corrective-action recommendation is calibrated to the severity and pattern of the substantiated findings. A first substantiated finding of moderate misconduct typically warrants written discipline and training. Pattern conduct or serious substantiated findings warrant more severe discipline up to termination. Organizational remediation — reporting-line changes, policy revisions, training rollouts — may accompany individual discipline in systemic cases.

The recommendation is just that — a recommendation. The designated decisionmaker applies company policy and, where appropriate, legal counsel's advice to reach the disciplinary decision. That separation protects the report from being attacked as a pre-judged disciplinary document and protects the investigator from being called as a witness on the disciplinary decision.

Follow-up

For harassment findings, the Faragher/Ellerth "promptly correct" prong requires follow-up to confirm that the substantiated conduct has stopped and the complainant has not experienced retaliation. The conventional cadence is 30-, 60-, and 90-day check-ins with the complainant, documented in the matter file. Failure to follow up after a substantiated harassment finding is a common weakness in Faragher/Ellerth defenses.

Generate your investigation report now
4 variants · 50-state scoring · 24 compliance checks · free, no signup
Open Generator →

Related reading

Informational only. Not legal advice. Workplace investigations frequently implicate statutes, regulations, and case law that vary by jurisdiction and evolve. Consult qualified employment counsel for your specific matter.