How to Conduct a Workplace Investigation: The Email Documentation Checklist

When a complaint lands on your desk, the investigation timeline starts immediately. So does your obligation to preserve the email record.

Most HR professionals know that. What's less understood is how to do it systematically, in a way that holds up if the investigation is later scrutinized, whether by a plaintiff's attorney, an agency investigator, or a court. An informal grab of a few emails isn't enough. Neither is printing threads and stuffing them in a manila folder.

This workplace investigation email documentation checklist walks through the full process: what to collect, when to collect it, how to organize it, and what to watch out for.

Why the Email Record Is the Investigation

Witnesses contradict each other. Memories fade. People tell you what they think you want to hear, or what protects them.

Email doesn't do any of that. It has timestamps. It has recipients. It captures what people actually said, not what they later claim they meant. For workplace investigations involving harassment, discrimination, retaliation, or performance disputes, the email record is almost always the most reliable evidence you have.

If that record is incomplete, disorganized, or can't be authenticated, your entire investigation becomes vulnerable. That's a problem whether you're presenting findings to leadership or defending the company in a lawsuit.

Before You Start: Issue a Preservation Notice

Before you collect a single email, issue a preservation notice to anyone whose communications might be relevant. This includes the complainant, the respondent, and any witnesses who may have received or sent relevant messages.

The notice should:

• Clearly state that a matter is under review
• Instruct recipients not to delete, alter, or forward any potentially relevant communications
• Cover email, messaging apps, and any other digital communication channels used for work
• Be sent in writing and acknowledged in writing

Document who received the notice and when. If email is later found to be missing, this record proves you took the right steps.

The Workplace Investigation Email Documentation Checklist

Phase 1: Scope and Collection

Identify the custodians. A custodian is anyone whose email account needs to be searched. At minimum: the complainant and the respondent. Add direct managers, HR contacts who were previously notified, and any witnesses named in the complaint.

Define the date range. Cast a wider net than you think you need. If the complaint describes conduct over the past six months, start your collection twelve months back. Context matters, and patterns often emerge before the specific incidents under review.

Collect from all relevant accounts. This means:

• Corporate email accounts (Microsoft 365, Google Workspace, etc.)
• Any shared inboxes or distribution lists the parties used
• Any known personal email accounts used for work communications (yes, you need to ask about this)

Preserve native format. Do not print emails as your primary preservation method. Export from the email platform in a format that preserves metadata: EML or MSG files for individual messages, PST or MBOX for larger sets. Metadata, specifically the sending timestamps, routing headers, and read receipts, may be critical to your findings.

Log what you collected. For each custodian, note: the account(s) searched, the date range, the search terms used, the number of results returned, and the date and method of collection. If the investigation is ever challenged, this log is your proof of process.

Phase 2: Review and Organization

Build a chronological timeline. This is the most useful thing you can do with a raw email collection. Sort messages by date and map them against the events described in the complaint. Patterns become visible. Gaps become visible too.

Flag categories of relevant content. As you review, sort emails into buckets:

• Direct evidence (messages containing the conduct at issue)
• Contextual evidence (messages that establish relationship, tone, or history)
• Contradictory evidence (messages that conflict with a witness's account)
• Potentially privileged communications (emails to or from attorneys, flagged for legal review before use)

Document what you don't find. If a key conversation is referenced in other emails but the actual messages don't appear in your collection, note that. Missing evidence is itself a data point. It may indicate deletion, a gap in collection scope, or communication on a channel you haven't captured yet.

Keep your working copies separate from originals. Work from copies. Originals stay preserved in their native format, untouched. This matters for authentication later.

Phase 3: Interviews and Corroboration

Use the email record to prepare interview questions. Before you sit down with any witness, review the relevant emails. You should know what was said before you ask anyone to recall it. Specific documents jog specific memories, and discrepancies between emails and witness accounts are often where the truth lives.

Present relevant emails during interviews. Show the email. Ask the witness to explain it. Note their response in your interview summary and attach the exhibit. This creates a clean record tying the document to the testimony.

Look for gaps in the story. If a respondent claims they never discussed the subject with the complainant, and your email collection shows three separate email threads on exactly that subject, you have a documented inconsistency. That belongs in your investigation report.

Phase 4: Report and Retention

Attach the key exhibits to your investigation report. The report should not just reference emails, it should include them. Attach the actual messages, clearly labeled, in the order they appear in your narrative. Anyone reading the report should be able to verify your conclusions without hunting for separate files.

Maintain a complete, organized file. The final investigation file should include: the initial complaint, the preservation notices, your collection log, the raw email exports, the reviewed and organized subset, your interview notes and attached exhibits, and the final report. Everything in one place, clearly named.

Establish a retention period and stick to it. At minimum, retain the full investigation file for as long as any related claim could reasonably be filed. In employment matters, that typically means at least three to four years from the close of the investigation, longer if a charge has already been filed. Check with employment counsel for jurisdiction-specific guidance.

Restrict access. Investigation files are sensitive. Limit access to HR, legal, and senior leadership who have a direct need. Document who has accessed the file and when.

Common Mistakes to Avoid

Starting collection too late. By the time you begin searching for emails, some may already be gone. Auto-delete policies, departing employee account closures, and routine purges can wipe out relevant evidence quickly. Move fast.

Relying on screenshots. A screenshot of an email is not the email. It can be edited. It doesn't contain metadata. Courts and opposing attorneys know this. Collect native files.

Ignoring messaging apps. Many workplace conversations have moved to Teams, Slack, or text. Email is your foundation, but it's not the whole picture. Document which other channels were in use and preserve those records separately.

Letting the respondent self-collect. Asking a respondent to gather and submit their own relevant emails is not a sound practice. It creates obvious chain of custody problems. Collect directly from the system wherever possible, with IT assistance if needed.

Failing to document your process. If the investigation later becomes the subject of a dispute, you'll be asked to explain exactly what you did. A documented, step-by-step process is far more defensible than "we looked through emails and found what we needed."

A Note on Privilege

If you find emails to or from an attorney, including in-house counsel, stop before using them. Attorney-client privilege may apply, and using privileged communications improperly can create serious problems for the company. Flag them and route them to legal for a determination before they go anywhere near your investigation report.

The Standard You're Working Toward

A well-documented workplace investigation tells a clear story: here is what happened, here is the evidence we gathered, here is what we found, and here is what we did about it. Every link in that chain should be traceable to a document.

Email is almost always the evidence that makes or breaks that story. Get the collection right, keep the record organized, and preserve everything that might be relevant. The alternative, a gap-filled record that a plaintiff's attorney can poke holes in, is far more expensive than the time it takes to do this properly.

ThreadLine helps HR teams and employment counsel organize email records into clear, chronological timelines, making workplace investigations faster to conduct and easier to document. If you're managing an active investigation or want to build a better process, see how ThreadLine works.