What is an Investigation Report and How to Write One? [2023 Guide]


Investigation reports are crucial documents that serve as a record of the findings and conclusions reached as part of an investigation. Whether you conduct an investigation within your organization or you work as a private investigator, compiling a thorough investigation report is essential in order to efficiently communicate your findings and recommendations with the relevant stakeholders.

In this blog article, we will cover the key elements of an investigation report as well as provide practical tips on how to write an investigation report that meets the needs of your audience. Let's start by covering some basics.


What is an investigation report?
What is the added value of an investigation report?
What should be included in an investigation report?
10 steps towards writing a comprehensive investigative report
How ZyLAB ONE can support your investigation efforts?

What is an investigation report?

An investigation report is a document that provides details on the findings of your investigation - be it a simple workplace one, or a more complex criminal case. When you write an investigation report, be sure to include all pertinent information about the case and any evidence that was gathered. 

What is the added value of writing an investigation report?

An investigative report is important, because it serves as a written record of an entire investigation and can be used in court as evidence documentation. Other benefits of writing an investigation report include: communicating your investigation findings clearly to a judge or jury as well as coming up with the right recommendations for further action based on the key findings.

Moreover, investigation reports can help promote a common understanding of the situation among stakeholders, and even prevent similar incidents from occurring in the future, if recommendation are implemented efficiently. Through the investigation process, you may also identify areas of your organization that require improvement, such as policies or procedures. By documenting these findings in the investigation report, you can help to ensure that these issues are addressed and corrected.

What should be included in an investigation report?

Efficient investigation reports should consist of the following sections:

Executive summary: should represent a concise overview of an investigation from A to Z. This section should not contain any information that is not already covered within the investigative report itself. As most people reading an investigation report, most of the time do not go beyond executive summary, it is crucially important that the executive summary section covers the key takeaways related to the allegations, investigation, and outcome without having to dive deeper into the details.

Preliminary case information: this section should cover the most important information related to the case and is usually displayed either before or after the Executive Summary. Make sure to record the following information: your name and investigator identification number; the case number; the date that the case was assigned to you; when the report was reviewed; how the report was received (i.e. hotline; email to HR, verbally, etc.).

If the reporter of the incident is an employee, record their: name; email address; job position or department; hire date; hire code; location; employee identification number. If the reporter is not an employee, having their email address and personal phone number is enough.

Incident summary: the goal of an incident summary is to answer the who, when, where, what about the reported incident. As part of this section, be sure to provide clear input on the following matters:

  • What type of incident is it? - e.g. harassment, discrimination, fraud, or other workplace misconduct
  • Who is the alleged victim?
  • Who is the subject of the investigation?
  • What are the parties involved?
  • Where and when did the incident occur?
  • Delineate the details of the allegation - i.e. describe the allegation in simple and clear language that is understandable across your organization and to all relevant stakeholders and parties involved.

Allegation subject: this section aims to highlight details about the alleged subject of the investigation. For every alleged 'bad actor', include the following details: name; email; phone number. If the subject happens to be an employee of your organization, include their employment status; job seniority/ position; job code; hiring date; business location; employee identification number.

Investigation details and notes: start this section by defining the scope of the investigation. Next, record in details each action undertaken during the investigation and mention who it was performed by, when, and what consequences it had. Consider structuring this section by: type of action (e.g. initial review, meeting, contacting parties, conducting an interview, etc.); person responsible for the action; date and time when the action was performed; short description of the action (i.e. who you met with, where, and for how long). Be sure to include all the possibly relevant information related to the investigation within this section, as it might be a useful resource in case you ever need to refer back to the full details of your investigation
Investigation interviews: with each and every interview that you conduct as part of your investigation, it is important that you create brief outlines of each interview, covering details such as: who conducted the interview; who was interviewed; where and when the interview took place; and summary of the key points discussed. Make sure you assess the credibility of each interview subject.

Some questions you might want to address in that regard:
- Is the testimony believable at face value? Does it make sense?
- Does the person's demeanour suggest you anything?
- Does the person have a motive to falsify? Do they feel threatened for any reason?
- Is there a witness or physical evidence that validates the person's testimony?
- Does the alleged subject have a history of similar behaviour in the past?

(Physical) Evidence: this section is aimed at describing all the evidence you have obtained throughout your investigation - e.g. video or audio footage; email and messaging records; (physical) documents; computer and other device login records; etc. Number each piece of evidence for easy reference within your investigation report.

Recommendations and Conclusions: in the last section of your investigative report, you should provide comprehensive answers to all the questions you've set yourself at the beginning of the investigation. As an investigator, you want to include all conclusions that are defensible, and supported by relevant evidence documentation.

Depending on the outcome of your investigation, you might want to provide recommendations to the organization on how to proceed with the alleged subject of the investigation and the alleged victim.

Appendices: the investigation report concludes with appendices, where any supplementary information related to case that was not essential for the core section of the investigation report, yet still relevant, is listed.

10 steps towards writing a comprehensive investigative report

Investigation reports tend to be a time-consuming and tedious task for corporate investigators. Consider following these ten best practices next time you are faced with writing an investigation report.

Consider your audience

Before delving into writing your investigation report, consider the audience who will be reading your report. Depending on their function, level of expertise and involvement, you might want to tailor the language and the complexity of your writing to meet their needs and expectations.

Clearly define the purpose and scope of the investigation report

To keep your investigation report relevant and focused, define its scope and purpose clearly. Here are some extra steps that you should consider:

    • Identify the problem or issue that the investigation conducted will address;

    • Identify the stakeholders who will be impacted by the investigation findings;

    • Determine the desired outcome of the investigation;

Organize the information you gather in a standardized format

Using a standardized format when organizing your information can help ensure that your investigation report is clear and easy to follow. Consider using headings, subheadings, and bullet points to structure the report efficiently. There are several commonly used investigation report templates that you might look into:

  • 5W + H: this template includes the key elements of who, what, when, where, why, and how. It can be useful for investigations that focus on a specific incident or issue.

  • Incident report: this template is commonly used for workplace incidents and focuses on describing the incident and documenting witness statements, evidence, etc.

  • Root cause analysis: for investigations that focus on identifying the root cause of a problem.

Ensure confidentiality

In case the investigation contains sensitive information, take steps towards ensuring confidentiality of your interviewees. This might imply using pseudonyms or redacting the confidential information from the report.

Follow a timeline

If the investigation involves a timeline of events, it might be smart to create a visual timeline to accompany the investigation report. This will make it easier for readers to understand the sequence of events.

Use visual aids

Similarly, engaging visual aids might be helpful in illustrating the investigation findings. Consider using graphs that would support your investigation claims and findings and help readers better comprehend the full picture.

Check for biases

When listing the findings of your investigation, be aware of any biases that might influence the investigation conclusions. That said, you might want to look for alternative explanation for the evidence gathered.

Acknowledge limitations

Be transparent about any limitations in your investigation - if there are any gaps in the evidence or limitations in the scope of your investigation, make sure to mention them within your report.

Be objective

When compiling an investigative report, you have to ensure that you stay objective and only stick to the facts that are supported by evidence in your writing. Avoid making assumptions or drawing conclusions that are not supported by evidence.

Use AI-driven eDiscovery technology

Gathering relevant electronic data is a must when performing internal investigations and when subsequently creating an investigation report. Hence, eDiscovery solutions can be considered extremely helpful when it comes to investigation reports in several ways, namely it helps:

  • Identify relevant data sources - this can include emails, text messages, social media posts, and more.

  • Collect and preserve data that has been identified - eDiscovery tools can help to do that in a forensically sound manner.

  • Process and analyze data - eDiscovery tools can help to process and analyze large amounts of electronic data quickly and efficiently.

  • Review and categorize data: After the data has been processed and analyzed, eDiscovery tools can be used to review and categorize the data based on its relevance to the investigation.

  • Produce reports: Finally, eDiscovery tools can be used to produce investigative reports summarizing the relevant electronic data and its significance to the investigation.

How ZyLAB ONE can support your investigation efforts?

ZyLAB ONE is the complete end-to-end eDiscovery solution that helps you uncover and review critical information buried within your organization’s documents and files. Legal teams use ZyLAB ONE to resolve complex internal investigations, tackle regulatory requests, meet data privacy obligations, and perform smart eDiscovery for litigation readiness.

To learn more about ZyLAB and ZyLAB ONE, contact us or schedule a demonstration.