Español

Employee Relations and Investigations Without Legal Grenades

A senior engineer pings you on Slack: "Got a minute? It's about my manager." You hop on a call, she tells you a story that makes your stomach drop, you say something reassuring like "we'll make this right," and you take a few notes in a Google Doc. Twelve months later, you're sitting across from outside counsel and they're asking you why you wrote the words "we'll make this right" in a document you never expected to surface. That's a legal grenade. And it didn't go off because of what the manager did. It went off because of what you did in the first thirty minutes.

Most employee relations cases that turn into actual legal exposure don't fail at the finding. They fail at intake, witness sequencing, and documentation. The underlying incident might be ugly, but the case becomes plaintiff-friendly because HR took bad notes, interviewed the accused first, told the reporter "we'll take care of it," or handed down a discipline outcome that doesn't match what happened to the last three people in the same situation. Investigators lose cases on process. This playbook is about the process.

The 24-Hour Rule

Almost every ER case I've watched derail did it inside the first 24 hours. Someone tipped off a witness in a side conversation. Someone made a verbal promise about discipline. Someone wrote down their personal opinion of the accused next to the actual interview record. Someone forwarded the intake notes to the manager being investigated because that manager was their day-to-day partner. None of these are exotic mistakes. They're what happens when an HRBP runs an intake call the same way they'd run a coaching conversation.

ER investigations are not coaching conversations. They are evidence-gathering exercises that may eventually be read by a lawyer who is paid to find your mistakes. Treat the first 24 hours like a deposition is going to happen, because sometimes one does. The discipline you bring to intake matters more than whether you eventually find the accused did or didn't do the thing.

The Intake Call

The intake call has one job: get a complete, unprompted account of what the reporter saw, heard, or experienced, with enough parallel context to assess credibility later. Three rules.

Open-ended questions only. The first question is "walk me through what happened, from the beginning, in your own words." Then you shut up. You don't say "did he say X" or "was it sexual" or "did anyone else see this." Leading questions contaminate the account, and a contaminated account is a lawyer's gift. Let the reporter tell the story their way. When they finish, your follow-ups are still open: "what happened next," "who else was there," "tell me more about that meeting."

Written notes in real time. Take notes while the person is talking. Use exact quotes when you can, and wrap them in quotation marks. Note timestamps, locations, who else was present, what artifacts the reporter mentions (Slack threads, calendar invites, emails, ticketing tools). Do not write down your impressions, your guesses, or your sympathy. Your impressions go in a separate file. The intake record is just facts the reporter stated.

Zero promises about outcomes or discipline. Not "we'll take care of it." Not "this won't happen again." Not "he won't be your manager next week." What you can say: "I hear you, this matters, here's what happens next. I'm going to look into this carefully, you may not hear every detail of the outcome but you will hear from me when the investigation closes, and you can come to me at any point if anything changes for you at work in the meantime." That's the script. Memorize it.

Before you end the call, ask about parallel context. Is there a recent PIP? A comp cycle decision? A manager change? A prior complaint the reporter filed? A reorg pending? A close peer of the accused on the People team? These details aren't gossip. They shape credibility, retaliation risk, and witness reliability. A complaint filed two weeks after a PIP looks different than a complaint filed cold, and you need to know which one you're working with.

Sample intake question list

  1. Walk me through what happened, from the beginning, in your own words.
  2. When and where did this happen?
  3. Who else was present, in person or on the call?
  4. What did the person say, exactly? (probe for direct quotes)
  5. What was your reaction at the time?
  6. Has anything like this happened before, with this person or anyone else?
  7. Have you talked to anyone else about this (peers, manager, skip-level)?
  8. Are there messages, emails, calendar invites, or other records that relate to what you described?
  9. Is there anything happening at work right now I should know about (performance review, comp, reorg, a pending PIP, a manager change)?
  10. What outcome are you hoping for? (Useful for understanding their frame, not a commitment.)
  11. Is there anything I haven't asked you that you think I should know?

Credibility Assessment

After intake, you have one account. You don't have a case. The next move is corroboration, not confrontation. He-said/she-said is the worst place an investigation can land, and the only way to avoid it is to find artifacts and adjacent witnesses before you talk to the accused.

What artifacts exist? Slack DMs, channel messages, email threads, calendar invites, Zoom recordings if your company keeps them, ticketing tools (Jira, Linear), HRIS records of comp and performance actions, badge data if it's a physical-presence question. Pull these through whatever process your company uses for legal holds and preservation. Don't ask the reporter to forward you screenshots, since those are easy to challenge. Go through IT and legal.

Who else was in the room? The reporter named witnesses. List them. Map their relationships to the accused and the reporter. A witness who reports to the accused will give you a different account than a witness on a different team. That doesn't make either account wrong, but it shapes how you weight what they say.

What's the pattern on each side? Has the accused had prior complaints? Look in the HR system. Have they had complaints that were closed without action (meaning they exist but weren't substantiated)? That's still a pattern. Has the reporter filed prior complaints? Same question. Patterns matter, but they're not findings on their own. A reporter with prior complaints isn't lying; they may simply work for managers who keep behaving this way. An accused with prior complaints isn't guilty; they may be a frequent target. Patterns inform credibility. They don't decide it.

Witness Order

You interview witnesses in concentric circles, closest to the incident first. Never interview the accused first. Never tip off witnesses about who reported.

Order Who Why
1 Direct witnesses to the incident Their accounts are freshest and least contaminated. Locking them in early prevents alignment with the accused's version later.
2 Adjacent witnesses (same team, same meeting, same Slack channel) Provide corroborating context — culture, frequency, reporter's and accused's day-to-day behavior.
3 The accused Comes after you've gathered the evidence base. You want to know what their version is, but you want to ask informed questions, not exploratory ones.
4 Unrelated/general culture witnesses Useful for pattern questions — has anyone else seen behavior like this — but their answers carry the least weight on the specific incident.

A few hard rules. Don't say the reporter's name to any witness unless legally required and pre-cleared. Don't share what other witnesses said. You're not running a debate, you're collecting separate accounts. Don't conduct interviews in shared rooms or on calendars where titles leak the topic ("ER investigation - Alex"). Use neutral calendar titles: "1:1 with [HRBP name]." When the accused is interviewed, treat it the same way: neutral language, written record, no pre-judgment in your tone, but you do not need to share the specific reporter's identity unless your jurisdiction or company policy requires it. Coordinate with legal on this exact point, since it varies.

If the accused is your peer's manager, your former manager, or someone you've worked closely with, recuse yourself. The manager you're investigating used to be your peer's peer. That's a recusal flag, not a footnote. Pass the case to another HRBP or to your director, document the recusal, and stay out of the file.

Documentation Discipline

Your investigation file is the case. If a lawyer ever reads it (internal counsel, outside counsel, or opposing counsel) they will read it word for word. Write accordingly.

Timeline format. Build a single chronology of events: incident dates, complaint date, intake date, evidence collection dates, each interview, the close date. Every entry has a date, a what, and a source. The timeline is the spine of the file.

Facts only, no editorial. "Reporter stated that on March 12 at approximately 2:45pm, in a 1:1 with [accused], [accused] said [exact quote]." Not "Reporter seemed credible and clearly upset; this kind of behavior fits a pattern I've seen before." That second sentence is your impression, and it does not belong in the interview record. It belongs in a separate, clearly labeled HRBP notes file, kept under the same access restrictions but never confused with the primary record.

Exact quotes in quotation marks. When the reporter or a witness uses specific words, capture them exactly. "He said, 'I don't trust women on engineering calls.'" Not "He said something dismissive about women on engineering calls." Specific quotes are the strongest evidence and the easiest for a future reader to evaluate. Paraphrasing is where bias creeps in.

Source for every claim. Each line in the timeline cites where it came from: "(intake call with reporter, March 14, 10am)" or "(Slack thread, #project-orion, March 12 2:38pm)" or "(witness interview with [name], March 16, 2pm)." If you can't cite a source, the line doesn't go in.

Separate impressions file. Your gut, your guesses, your hypotheses about credibility, your strategic notes about who to interview next: all of that goes in a second file, clearly labeled "HRBP working notes (not the investigation record)." Same access controls, separate document. Never merge them. The investigation record is what gets read by future lawyers; your working notes are how you think.

Escalate early, not when the case is already messy. The cost of looping legal in on a case that turns out to be straightforward is one extra meeting. The cost of not looping them in on a case that turns out to be a problem is years of exposure. Always loop legal when:

  • The complaint involves harassment of any kind (sexual, racial, religious, disability, age, or any protected class)
  • The complaint involves retaliation, real or alleged
  • The accused is a VP or above, regardless of the substance
  • The complaint involves a protected-class dynamic (a manager and a direct report from a different protected class, for example)
  • Termination is on the table, even as one possible outcome
  • The reporter is on a visa, a leave, or a recent accommodation request
  • The reporter has retained counsel or mentioned doing so
  • There's any whisper of a class pattern (meaning more than one person reporting similar behavior from the same accused)

When in doubt, loop legal in. The conversation costs nothing. The grenade costs everything.

Confidentiality Maintenance

Confidentiality on an ER case isn't a vibe. It's a written list. Decide who needs to know (typically the investigating HRBP, the HRBP's director, internal or outside counsel, and at most one HR exec) and write that list down in the case file. Anyone not on the list does not get briefed, including peers, the accused's manager (until the appropriate time), and anyone in the reporter's reporting chain.

No Slack DMs about the case. None. Slack DMs are discoverable, and casual phrasing in a DM is exactly what plaintiff's counsel quotes back at you. Use phone calls or in-person conversations for sensitive discussion, and write decisions into the case file with neutral language. No discussion in shared calendars: neutral calendar titles, generic locations. Store the investigation file in a restricted-access folder, not in the general HR drive. If your HRIS supports case management with permissioning, use it.

The accused does not get briefed on the existence of the investigation until your evidence base is gathered and your legal partner has signed off on the timing. Tipping off the accused early is how evidence disappears and witnesses get pressured.

Outcomes — Comparator Analysis

This is where most cases create discrimination claims. The finding can be perfectly reasonable on its own and still create exposure if it's inconsistent with how you handled the last three similar cases. Plaintiff's counsel doesn't have to prove your finding was wrong. They have to prove it was inconsistent.

Before you finalize an outcome, run a comparator analysis. Pull the last three to five cases at your company involving the same kind of conduct. Look at:

  • The proposed discipline (verbal warning, written warning, final written, termination)
  • The accused's tenure, level, and demographic profile
  • The substance of the complaint (was it as severe, less severe, more severe?)
  • The outcome that was actually delivered

If your proposed outcome for this case is meaningfully harsher or lighter than recent comparable cases, you need a documented reason. Tenure, level, severity, and prior corrective action are legitimate reasons. "I didn't like this guy" is not. Write the reason into the case file. If the outcome can't be defended on the comparator analysis, change the outcome.

Comparator analysis worksheet

Case Conduct Severity Accused level Accused tenure Prior actions Outcome Notes
Current case (proposed)
Comparator 1
Comparator 2
Comparator 3

If you can't pull comparators because the company hasn't tracked them, that's your second project. Start the tracking now, because the next case will need it.

Close-the-Loop With the Reporter

The investigation closes. You owe the reporter a closing conversation. Here's the script.

What you can say: "We took your complaint seriously. We investigated. We took action. Your role here is unaffected, and I will check in with you over the next 90 days to make sure that stays true. If anything changes, come to me directly."

What you can't say: the specific discipline. You can't tell the reporter the accused got a final written warning, was reassigned, was terminated, or was cleared. Discipline is between the company and the accused. Most reporters accept this if you've handled the rest of the process well. Some don't.

The "is that it?" reaction is real and it's understandable. The reporter has lived with this for weeks or months, and the closing conversation can feel anticlimactic. Sit with the discomfort. Don't fill the silence with promises you can't keep. Repeat the script. Remind them of the 90-day check-in. Mean it.

Retaliation monitoring checklist (90 days)

  • 30-day check-in scheduled with reporter
  • 60-day check-in scheduled with reporter
  • 90-day check-in scheduled with reporter
  • Reporter's manager and skip-level briefed on retaliation policy (not on the case)
  • Watchlist on reporter's performance reviews, comp adjustments, and any disciplinary action during the 90-day window (anything unusual triggers HRBP review before it's finalized)
  • Reporter's removal from any team or project documented with a non-retaliation justification, reviewed by HRBP and legal
  • Watchlist on the accused's behavior during the same window (coaching follow-up if a corrective action was issued)
  • Closing note in case file at day 90 confirming no retaliation indicators surfaced

What This Looks Like When It Works

A clean investigation looks unremarkable from the outside. The reporter felt heard. The accused had a fair process. The witnesses were interviewed in the right order. The file reads cleanly. The outcome lined up with the comparators. The 90-day window closed quietly. Nobody filed a charge. Nobody called outside counsel. The HRBP slept through the night.

That doesn't happen by accident. It happens because the HRBP ran the first 24 hours like the case mattered, and treated every later step as a continuation of that discipline. Legal grenades come from sloppy notes and inconsistent outcomes, not from the underlying incident. If you handle the process, the process handles you back.

Learn More