Why evidence quality decides the outcome

Employee misconduct cases often stand or fall on the quality of the evidence, not the seriousness of the allegation. A fair investigation gathers relevant documents, emails and witness accounts lawfully, records how each item was obtained, and keeps an unbroken trail from discovery to decision. When gaps appear, findings become harder to defend — both in an internal appeal and at an employment tribunal. The good news is that a calm, methodical approach prevents most problems before they arise.

Plan the evidence before you collect it

Start with the terms of reference. Set out the allegation in plain terms, the period it covers, and the policies or contractual duties said to have been breached. Ask yourself what a reasonable investigator would need to see to decide whether the allegation is more likely than not. Then list the evidence that could prove or disprove it.

• Documents: contracts, policies, training records, timesheets, expense claims, meeting minutes and performance notes.
• Emails and messages: relevant threads, attachments, calendar invites and, where lawful and necessary, business messaging records.
• System evidence: access logs, audit trails, file metadata, CCTV or building entry records, if covered by a clear policy.
• People: witnesses who saw or heard something relevant, including those who may support the employee’s account.

Keep the scope proportionate. You are investigating a specific allegation, not conducting a general audit of someone’s working life.

Collect documents and emails lawfully

In the UK, personal data in an investigation is governed by the UK GDPR and the Data Protection Act 2018. You need a lawful basis — usually legitimate interests or legal obligation — and you must handle data fairly, securely and only as far as necessary. Check your organisation’s monitoring, acceptable use and data protection policies before you search devices or mailboxes. Do not access legally privileged communications, such as advice from a lawyer, and avoid “fishing” for anything that might be useful.

Preserve evidence early. Ask IT to suspend routine deletion for the relevant accounts and folders, and remind relevant staff not to delete or alter records. If you copy a mailbox or drive, record exactly what was copied, when, by whom and from where. Redact third-party personal data that is not relevant to the allegation, but keep an unredacted master copy securely.

Take witness statements that hold up

Witness evidence is often the most powerful — and the most fragile. Interview witnesses promptly, while memories are fresh, and explain why their account matters. Ask open questions, let them tell their story, then clarify details without leading them. Record interviews in a contemporaneous note or a signed, dated statement. If a witness prefers to write their own statement, that is fine too.

• Capture the basics: full name, role, date, time, location, and what the witness saw or heard.
• Test the detail: ask what happened next, who else was present, and whether anything was recorded.
• Note limitations: distance, lighting, noise, memory, and any relationship with the people involved.
• Be clear about anonymity: you can rarely promise it, and witnesses should understand that their evidence may be shared.

Where accounts conflict, record the conflict rather than smoothing it over. Corroboration — a document, a log, another witness — strengthens a statement; isolation does not automatically discredit it, but it deserves careful weighing.

Keep a clear chain of custody

Chain of custody is simply the documented story of every piece of evidence: who had it, when, where it went, and what happened to it. It matters for paper documents, USB drives, screenshots and digital files alike. A simple evidence log is enough, provided it is completed consistently.

• Give every item a unique reference and describe it clearly.
• Record the date, time and source of collection, and the name of the collector.
• Store originals securely and work from copies where possible.
• Restrict access to named investigators and log every handover or viewing.
• For digital evidence, record hash values at the point of collection and keep metadata intact.

If evidence is mishandled, the other side may argue it was altered or unreliable. A clean log closes that argument down.

Close the gaps before they close your case

Once evidence is gathered, build a timeline and test it against the allegation. Look for missing documents, unexplained gaps in emails, inconsistent dates or accounts that do not fit the sequence. Go back for what is missing — a follow-up interview, a system report, a diary entry — and document your attempts.

Do not fill gaps with assumptions. Distinguish clearly between what the evidence shows, what you infer, and what remains unknown. Share relevant evidence with the employee and their companion in good time, and give them a proper opportunity to respond. The ACAS Code of Practice on disciplinary and grievance procedures expects a fair process, and tribunals look closely at whether the employer acted reasonably. A thorough, lawful and well-documented evidence file is not just a legal safeguard; it is the foundation of a decision you can stand behind.