Define the question, preserve the sources, and separate facts from advice

Record how the concern arrived, the exact allegations, people involved, dates, policies or laws potentially implicated. Also include immediate risks, known evidence, potential retaliation, conflicts and requested relief. Decide whether medical attention, physical separation, schedule changes, paid leave, system-access controls, law enforcement, insurer notice, board or government reporting, or another urgent measure is needed. Interim action should avoid prejudging the merits and should be reassessed as facts develop.

Create a written scope that lists allegations and decision questions without assuming a conclusion. Identify the investigator, reporting lawyer or business owner, authority, expected work product, recipients. Also include standard of proof if the organization uses one, privilege purpose if legal advice is sought and who decides corrective action. Add a process for scope changes when interviews reveal a related allegation.

An investigation of harassment is different from an audit of broad culture, criminal conduct, trade-secret loss, payroll practice, safety, or financial controls.

Issue targeted preservation instructions and collect policies, native messages, email, personnel and discipline records, schedules, access logs. Also include expense or payroll records, video, complaint history, prior investigations and relevant device or vendor data. Document source, person responsible for the records, collection date, format, and gaps. Do not alter original files or allow an accused manager to select the only records reviewed. Privacy, medical, personnel, trade-secret, and cross-border data may require access limits.

Plan interviews from neutral background to specific events. Explain the investigator's role, the employer's anti-retaliation instruction, the qualified nature of confidentiality. Also include whether counsel represents the organization rather than the witness. Ask what was personally observed, what documents exist, who else has knowledge, what could contradict the account, and whether the witness wants to add or correct anything. Test material inconsistencies through follow-up rather than writing a credibility conclusion from demeanor alone.

Attorney-client privilege can protect confidential communications made for obtaining or providing legal advice. It does not cloak underlying facts merely because counsel asks about them. Work-product protection uses a separate test. Business-purpose investigations, reports circulated beyond necessary recipients, reliance on an investigation as a defense, witness communications, and later disclosures can create waiver or scope disputes. Define the legal purpose, recipients, labels, storage, and reporting format, but do not market privilege as assured.

A final work product should identify allegations, scope, sources, undisputed and disputed facts, credibility considerations grounded in evidence, policy findings if requested, unanswered questions, and limitations. The decisionmaker—not an ambiguous committee—should document responsive action, consistency, communication, follow-up, and retaliation monitoring. Faragher and Ellerth make preventive and corrective care relevant in defined harassment cases. An investigation does not establish a defense merely because it occurred.