What Makes an Investigation Report Defensible in Discovery

When an employment discrimination or retaliation case reaches discovery, plaintiff's counsel frequently turns attention to the investigation report itself. Not just the conclusion — the reasoning behind it. A report that states "after a thorough review, the complaint was found unsubstantiated" without showing the analytical steps that led there becomes a document that can be picked apart: which witnesses were interviewed, what weight their accounts received, how conflicting evidence was resolved, and what "thorough" actually meant in practice. Understanding what courts and agencies look for in a written investigation record helps practitioners build reports that can survive that scrutiny.

The Citation Problem

Many investigation reports read like executive summaries — conclusions presented without the evidentiary architecture that supports them. An investigator interviews six witnesses, reviews forty emails, and writes that "several witnesses corroborated the complainant's account." Under adversarial examination, that sentence raises more questions than it answers. Which witnesses? What specifically did they corroborate? How did the investigator weigh their accounts against each other?

Defensible reports treat citations the way legal briefs treat footnotes: as load-bearing structure. Each factual finding should trace to a specific source — for example, "Witness B stated during her October 14 interview that she observed Respondent raise his voice at Complainant in the break room on September 3 (Interview Notes, Exhibit 4)." When documentary evidence contradicts witness testimony, the report should acknowledge the conflict explicitly and explain how the investigator resolved it. Unexplained contradictions are precisely what depositions are designed to surface.

The EEOC's enforcement guidance on employer liability for harassment establishes that adequacy of an investigation is measured by whether it was prompt and effective. Courts applying that standard look at the written record. In Swingle v. State of Indiana, the court examined whether the employer's investigation was genuine or pretextual in part by evaluating whether the documentation supported the stated conclusions. A report that cannot answer "why did you find that?" invites the inference that the conclusion preceded the analysis.

Timeline Documentation as a Legal Asset

The dates in an investigation report serve a function beyond administrative completeness. They form the evidentiary skeleton of a retaliation defense.

When a complainant files a charge alleging that an adverse employment action was retaliatory, the temporal relationship between the protected activity and the employer's action becomes central. Under Burlington Northern & Santa Fe Railway Co. v. White, 548 U.S. 53 (2006), the standard for materially adverse action in retaliation claims is broad — any action that would dissuade a reasonable employee from making a complaint qualifies. Proximity in time between a complaint and an adverse action is treated as circumstantial evidence of retaliation. A documented timeline showing what happened between those two events, and why, is the employer's primary rebuttal.

Every investigation report should include a standalone chronology: when the complaint was received, when the investigation opened, when each interview occurred, when documents were collected, when findings were reached, and when outcomes were communicated. A 90-day gap between a complaint and a termination means something different when the record shows a documented performance improvement plan, multiple documented warnings, and a decision made by a manager with no knowledge of the complaint.

SHRM's guidance on conducting workplace investigations identifies timeline reconstruction as a core investigative competency, in part because courts treat temporal compression or unexplained gaps as signals about employer good faith.

How Findings Language Works

The words investigators choose to state conclusions carry legal and procedural consequences that aren't always obvious at the drafting stage.

"Substantiated" and "unsubstantiated" are widely used, but they are meaningful only if the report specifies the standard applied. The operative standard in most workplace investigations is preponderance of the evidence — more likely than not. EEOC guidance explicitly endorses the preponderance standard for employer fact-finding. A report that doesn't state its standard leaves open the argument that no consistent standard was applied at all.

Findings should also be factual rather than legal in character. A statement like "Respondent's conduct constituted sexual harassment" is a legal conclusion that belongs to the trier of fact, not the investigator. A statement like "Respondent made repeated comments about Complainant's appearance after being asked to stop, which Complainant found offensive and which were corroborated by two coworkers" is a factual finding the investigator is competent to make. The distinction matters procedurally: investigators who render legal conclusions in reports can be deposed as quasi-legal experts, creating lines of inquiry that carry significant strategic risk.

On the other end of the spectrum, hedging language — "it appears that," "may have occurred" — often signals unresolved credibility questions rather than resolving them. If the investigator made a credibility determination, the report should explain it: what made one account more credible than another, what corroborating evidence existed, and what the basis for weighing competing accounts was.

Structural Requirements

Taken together, a defensible investigation report typically contains: an explicit scope statement; a sourced chronology; a stated evidentiary standard; witness-by-witness credibility analysis; documented evidence review with citations to specific exhibits or notes; reconciliation of conflicting accounts; and findings language that is factual rather than legal.

Each element addresses a specific vulnerability. Missing any one of them doesn't just weaken the report in isolation — it creates an opening for the inference that the investigation was not conducted in good faith, regardless of what conclusion it reached. Courts and agency reviewers evaluating the adequacy of an investigation look at the written record as a whole, and the record's architecture is what communicates diligence.

Marshal's investigation reports are structured to capture citations, chronology, and credibility reasoning as the investigation progresses — so the documentation that makes findings defensible is built into the record before the report is ever drafted.