Scoping a Workplace Investigation: How to Define What You're Actually Investigating

A complaint arrives. Someone says their manager retaliated against them after they raised a pay concern. The HR team opens an investigation. Six weeks later, the investigator has interviewed eleven people, reviewed two years of email, and documented three separate incidents — none of which was the one in the original complaint. The report is sprawling, the findings are unclear, and legal can't figure out what question was actually answered.

Scope failure is one of the most consistent problems in workplace investigations, and it tends to happen quietly. There is rarely a moment where someone decides to investigate too much or too little. The scope drifts, or it was never defined clearly enough to hold.

What Scoping Actually Means

Scoping a workplace investigation means defining three things at the outset: the conduct at issue, the time period to be examined, and the people and records relevant to those questions. Done well, it produces a working statement investigators can return to throughout the process — something like: This investigation will examine whether [Respondent] engaged in [specific described conduct] during [defined period], in potential violation of [policy or standard].

That statement does real work. It tells interviewers which questions are in scope and which tangents to set aside. It anchors the evidence-gathering plan. It gives report writers something to answer. And it creates a record that the investigation was purposeful and defined — which matters if the findings are later challenged.

The EEOC's Promising Practices for Preventing Harassment describes effective investigations as prompt, impartial, and thorough. Thoroughness is measured against the questions the investigation set out to answer: an investigation that covers the right ground deeply is more defensible than one that covers everything superficially.

Where Scope Problems Come From

Most scope problems fall into one of three categories.

Vague intake. When the initial complaint is taken without enough specificity — dates, conduct, people involved — investigators start without a clear target. The complaint says someone was "treated unfairly" or the workplace is "toxic." Descriptions at that altitude give an investigator nothing concrete to examine. Intake is where specificity gets built: What happened? When? Who was present? What was said or done? Without that foundation, every downstream decision is harder.

Scope creep during interviews. Witnesses often share information that goes beyond the complaint — about other incidents, other people, other time periods. Some of that information is genuinely relevant. Some is peripheral. Investigators without a defined scope struggle to tell the difference in the moment, and they end up chasing threads that dilute the investigation's focus. This is also where investigators sometimes create inadvertent legal exposure, uncovering issues they aren't prepared to investigate properly.

Pressure to broaden or narrow artificially. Investigations involving senior leaders sometimes face pressure to keep the scope tight in ways that limit accountability. Conversely, investigations that began with a narrow complaint sometimes expand under pressure to examine a whole department's culture. The conduct at issue should drive scope decisions, and pressure in either direction deserves to be named and resisted.

When Scope Should Expand (and How to Handle It)

Some scope expansion is legitimate and necessary. If an investigator interviewing a harassment complainant learns that a second employee experienced similar conduct from the same respondent, that is relevant and probably within scope even if it wasn't in the original complaint. Courts and agencies look at whether employers had notice of misconduct and what they did with it — Faragher v. City of Boca Raton, 524 U.S. 775 (1998) and its companion case Burlington Industries v. Ellerth established that employers can be liable for harassment they knew or should have known about. The EEOC's enforcement guidance on vicarious liability, issued in the wake of those decisions, spells out what the agency expects once an employer learns of possible harassment — including a prompt and thorough inquiry into the conduct at issue. Deliberately narrowing scope to avoid that knowledge is not a defense.

What good practice looks like: when new information suggests the scope should expand, investigators document that decision explicitly — what was learned, when, and why it warranted a change. That documentation distinguishes a reasoned investigative judgment from a reactive or politically driven one.

If what surfaces is genuinely a different matter — a separate complaint, unrelated conduct — the right move is typically to flag it for a separate intake rather than fold it into the current investigation without a plan.

Records and Evidence Planning

Scope also determines the evidence map. Investigators who define their scope clearly can identify in advance which records are relevant: email from which accounts, covering what date range; access logs or security footage for which locations; HR files for which employees. This matters for two reasons.

First, evidence requests proportionate to scope are more likely to be executed well. IT and records teams prioritize defined requests; open-ended ones often produce incomplete results or delays. Second, proportionate preservation reduces the risk of over-collection — gathering records that are irrelevant to the investigation but potentially harmful in discovery. The Sedona Principles, the leading reference on proportionality in discovery, make the same point in the litigation context: collect what is necessary, document why, and resist preserving everything just in case. The logic applies equally to investigation planning.

What Practitioners Should Watch For

Investigators who revisit their scope statement at each major phase — after intake, after the first round of interviews, before closing — catch drift before it becomes a problem. If the scope has changed, they document why. If new facts require a decision about expansion, they make that decision explicitly rather than letting the investigation grow organically.

The final report should answer the question the investigation was scoped to answer. If it can't — if the findings address something adjacent to the original complaint, or if key questions were never resolved — that usually means the scope was either poorly defined or poorly maintained.

Scoping is investigative work in its own right, and the care taken at that stage shapes everything that follows.

Marshal's case-scoping tools let investigators record the defined conduct, time period, and relevant parties at intake — creating a documented anchor that every subsequent decision can be measured against.