How to conduct workplace investigations and handle whistleblower complaints

Hire Your Detective editorial teamUpdated 21 October 20267 min read

What is a workplace investigation?

A workplace investigation is a structured, impartial fact-finding exercise into an allegation of misconduct: fraud, conflict of interest, bullying, leaking information, policy breaches, bribery or retaliation. Its job is to find out what happened, not to punish. Punishment comes later, through the procedure your standing orders, service rules or employment contract require.

In India this distinction matters. For workmen covered by the Industrial Employment (Standing Orders) Act, 1946, major penalties normally require a domestic enquiry with a charge sheet, an enquiry officer and the right to defend. A good preliminary investigation feeds that enquiry; a sloppy one gives the employee grounds to challenge any dismissal before a labour court. The four labour codes, including the Industrial Relations Code, 2020, came into force on 21 November 2025 and carry forward a standing-orders framework with revised thresholds; some rules are still being finalised, so check what currently applies to your establishment.

Sexual harassment complaints by women follow a separate statutory route. Those go to the Internal Committee under the POSH Act; see our POSH complaint and inquiry guide. Theft and stock loss have their own playbook in our guide on employee theft and fraud.

How do you file a whistleblower complaint in India?

For private-sector employees, the main channel is the company's own vigil mechanism. Section 177(9) of the Companies Act, 2013 requires every listed company, and other prescribed classes, to establish one for directors and employees to report genuine concerns. Under the Companies (Meetings of Board and its Powers) Rules, 2014, these include companies that accept deposits from the public and those that have borrowed more than Rs 50 crore from banks and public financial institutions. Section 177(10) requires adequate safeguards against victimisation and direct access to the Audit Committee chairperson in appropriate cases. Listed companies must also comply with SEBI's LODR Regulations on whistle-blower policies.

To raise a concern:

1. Find the whistle-blower or vigil policy on the intranet or the company website (listed companies publish it).
2. Write factually: what, when, who, and what documents support it. Avoid speculation and personal attacks.
3. Send it to the designated channel, ombudsperson or Audit Committee chair, keeping a copy and proof of submission.
4. Do not take confidential data you are not authorised to hold; describe where it is so investigators can secure it.

Public servants and complaints about government bodies are covered by different routes, including the Central Vigilance Commission. Where a criminal offence such as fraud is involved, a police complaint or FIR is also possible.

How should an employer plan an investigation?

Before the first interview, settle four things in writing:

• Terms of reference. The specific allegations to be examined, the period, and the questions to answer. Scope creep is the most common reason reports are attacked.
• Investigator. Someone with no reporting relationship to the parties and no stake in the outcome: internal audit, an independent HR lead, an external law firm, or a professional investigator for field enquiries.
• Evidence hold. Instruct IT to preserve mailboxes, chat logs, access-card data and CCTV, and finance to freeze relevant records. Do this before the accused is told.
• Interim measures. Paid leave, suspension under the rules, or changed access rights if there is a risk of tampering or retaliation.

Monitoring must stay within your policy and the Digital Personal Data Protection Act, 2023. Reviewing company email and devices under a clear policy is generally defensible; accessing an employee's personal phone, WhatsApp or social accounts without consent is not, and may be an offence under the IT Act.

Stages of a workplace investigation and how long each takes

A simple complaint can close in three to four weeks; a multi-location fraud can take several months. These are indicative ranges and vary with scope, data volume and cooperation.

How to interview the complainant, witnesses and the accused

Interview in a private room, one person at a time, with a second person taking notes. Start with the complainant, then witnesses, and interview the subject last, once you know what needs answering.

• Explain the purpose, confidentiality and the no-retaliation rule.
• Ask open questions first ("Tell me what happened at the meeting"), then specific ones.
• Put documents to the person and record their explanation.
• Never threaten, promise outcomes, or extract a written confession under pressure. A confession taken that way is likely to be disregarded by a labour court.
• Have each person read and sign the notes, or record their refusal.

The subject must be told the substance of the allegation and shown the material relied on, and given time to respond in writing. Audio recording of interviews should be done openly, with consent, and noted in the record.

How does an employer prove misconduct?

Internal findings are made on the preponderance of probabilities: is it more likely than not that the misconduct occurred? That is a lower bar than a criminal trial, but labour courts examine whether the finding is supported by evidence and whether the enquiry was fair. A finding resting on no evidence, or on material the employee never saw, is vulnerable.

The strongest cases combine documents (approvals, invoices, emails), system data (logs, access records), and witness accounts that corroborate each other. Where misconduct involves outside parties, such as a vendor kickback or a staffer running a side business with company clients, external verification is often decisive. Our guides to vendor and supplier verification and trade secret theft describe the checks involved. Electronic records used later in court need a BSA s.63 certificate.

How to write a workplace investigation report

A good report can be read by a judge who knows nothing about your company. Use this structure:

1. Background and terms of reference. Who complained, about what, and who investigated.
2. Methodology. Documents reviewed, people interviewed, dates.
3. Allegation-by-allegation analysis. Evidence for, evidence against, the subject's explanation, credibility assessment.
4. Findings. Substantiated, not substantiated, or inconclusive, with reasons.
5. Recommendations. Disciplinary proceedings, control fixes, or closure. Leave the penalty decision to the disciplinary authority.
6. Annexures. Signed interview notes and key documents.

Keep the report confidential and share only on a need-to-know basis. Tell the whistleblower the outcome in general terms, and monitor for retaliation afterwards.

When should you bring in an outside investigator?

Use an external professional when senior management is implicated, when the facts lie outside the office (a vendor's real ownership, an employee's undisclosed business, a former employee working for a competitor), or when the board needs independence. Lawyers handle privilege and legal strategy; investigators gather facts through lawful field enquiries, public records and discreet verification. They do not tap phones, obtain call records or access personal accounts. You can engage vetted professionals through our corporate investigation service.

Bottom line

Secure the evidence first, appoint someone independent, hear everyone including the accused, and write findings that follow from the evidence. Route sexual harassment complaints to the POSH committee and whistleblower tips through the vigil mechanism. A fair process protects both the outcome and the people involved.

This guide is general information, not legal advice. Laws and procedures change, and every case is different — speak to a lawyer about your situation. In an emergency, call 112.