Developing an Investigative Plan

An investigative plan sets forth how to conduct an investigation along with important details needed. This is an overview of the key parts it should contain.

An investigative plan is a written document that sets forth how the investigation is to be conducted and provides a checklist of things that must be accomplished. It puts the information developed in preparing for the investigation into a useful order.

Managing the information obtained during an investigation is an important responsibility of the investigator. A plan provides a means for organizing the investigation and making sure that all important issues are investigated.

Each investigator, over time, will develop his or her approach to organizing an investigative plan.

The following will provide the basic information that should be contained in the plan. The order in which this information is presented and how it is arranged will be what best fits the needs of the investigator. 

Contact List

A contact list provides ready access to all people who are important to the investigation. At a minimum, it should contain a list of all people the investigator has met or intends to contact, including witnesses, employees, managers, and staff supporting the investigation such as human resources staff and attorneys from the legal department.

The list should contain the name, telephone number, email address, and physical location of the person. Having all this information at your fingertips saves needless time trying to find phone numbers and email addresses.

The list would look like this:

Sam Jones: 123-456-7890 1234 Main Street, Suite 319, Anytown, MD

Felicia Smith: 123-456-7890 1234 Main Street, Suite 325, Anytown MD

Notification List

It is important to notify appropriate entities or persons in the workplace who you will be investigating. An investigator should not enter a workplace without having notified managers or security personnel that he or she will be talking to employees. The investigator should tell appropriate supervisors the purpose of the investigation and who will be interviewed.

Preparing a list of who should be notified that the investigator will be investigating avoids misunderstandings as to the actions of the investigator and helps to arrange interviews with witnesses.

The list would look like this:

Todd Aubrey (Supervisor of S Jones) 123-456-7890 1234 Main Street, Suite 503, Anytown MD

Michele Schneider (Chief of HR) 123-456-7890, 12345 Independence Ave, Washington DC

Background Information

All background information should be reviewed as part of the investigative plan. Background information is all the information relating to the issues being investigated that exists at the time the investigator begins the investigation. It also includes information that helps to understand the issue but is not actual evidence. It is important to find all information that bears on the issues being investigated, even though it may not be clearly relevant.

The following is potential background information:

  • Union contract
  • Copy of grievance filed
  • Overtime regulations
  • Copy of disciplinary action code of penalties

Issues List 

The investigative plan should have a list of the issues to be investigated.

Before beginning an investigation, research must be done to determine what issues must be investigated. If an employee is alleged to have abused sick leave, the investigator should list what will be investigated.

The following are some potential elements for an allegation of sick leave abuse:

Issue: Did employee abuse sick leave?

  • What was employee’s sick leave balance at time of alleged abuse?
  • Did employee request sick leave and was it granted?
  • Had employee been issued a sick leave abuse letter?
  • Did employee fail to comply with requirements of sick leave abuse letter?

Proof Analysis

Look at each legal or contract element that must be proven and then determine what evidence must be collected to prove or disprove the element.

A proof analysis provides an outline of evidence necessary to substantiate each allegation, including legal theories. It is an orderly way of looking at what needs to be proven and what evidence is needed to support it. It requires the investigator to think about what evidence must be obtained and from where it will come. It includes a list of witnesses and documents that pertain to each issue.

The following is an example of a proof analysis:

Proof Analysis

What was sick leave balance at the time of alleged abuse?Employee time and attendance record
Did the employee request sick leave and was it granted?Request for sick leave document, testimony of supervisor and employee
Had the employee been issued a sick leave abuse letter?Copy of sick leave abuse letter, testimony of supervisor and employee
Did the employee fail to comply with the sick leave abuse letter?Testimony of the employee and supervisor

Interview Sequence Plan

The sequence in which employees are interviewed can sometimes have an impact on what evidence is given by witnesses and what questions are asked.

Often, certain witnesses have considerably more information than others do. The best approach is usually to first interview witnesses who can lay out what the issue is that is being investigated. If you are investigating a workplace allegation of sexual harassment, it would work best to first interview the employee alleging the harassment, and then the person alleged to have committed the harassment, and then witnesses such as coworkers who may have information. 

Chronology of Events

The best way to tell a story is to start at the beginning and go to the end. This is the easiest way for the listener to follow the story.

Setting forth a chronology of events as known by the investigator helps to understand what took place and when. When something does not make sense in the chronology, it usually means more evidence is needed, or there is a problem with the proof necessary to conclude the investigation. It also helps to determine whether more evidence is needed and what may be potential additional ways to get it.

A chronology of events looks like the following:


October 22, 2012, Director John Cole issued a policy letter setting forth the starting time for the facility as 8:00 AM with a quitting time of 5:00 PM. 

Oakley Norris, a new employee was given a copy of the policy at employee orientation on November 6, 2012.

At a staff meeting on December 1, 2012, Norris was told, along with all other employees in his work unit that the starting time was 8:00 AM with no exceptions, unless approved in advance by the supervisor. 

On June 1, 2012, Norris was late for work and was counseled by his supervisor. No action was taken.

On October 25, 2012, Norris was late for work. This was reported to the supervisor by the lead in Norris’s department. The supervisor counseled Norris about tardiness. 

On December 21, 2012, Norris did not come to work. He was placed in AWOL status.

Logistical information

Logistical information includes such things as travel required, use of private office space on site where interviews are to be conducted, and such things as use of laptops or other office equipment. If not properly handled, logistics issues can be very time-consuming and interfere with an expeditious investigation. 

Why prepare a plan?

A plan requires the investigators to be disciplined in their approach to an investigation. A disciplined approach provides the best means of doing a thorough and well thought out investigation.

About the Author

Joe Swerdzewski, former General Counsel of the FLRA & owner of JSA LLC is the author of The Essential Guide to Federal Labor Relations, A Guide to Successful Federal Sector Collective Bargaining, etc. For more info on JSA’s services, email or subscribe to JSA’s newsletter.