Evidence Gathering for Workplace Misconduct Investigations

What evidence to gather, how to preserve it, and how to evaluate its weight, a guide for HR professionals investigating misconduct in Australian workplaces.

Evidence is the foundation of every finding

Every finding in a workplace investigation must be grounded in evidence, not assumptions, not gut feeling, and not the seniority of the person making the allegation. Australian employment tribunals are highly attuned to whether findings are evidence-based. An investigation that relies on bare assertions from the complainant without corroborating evidence is unlikely to support a dismissal that holds up under scrutiny.

Types of evidence

Documentary evidence

This is usually the most reliable category: emails, instant messages, access logs, CCTV footage, payroll records, system audit trails, contracts, and policies. Documents are harder to fabricate and cannot change their account under cross-examination.

Witness evidence

Oral or written accounts from people who directly observed the conduct. Note the difference between direct evidence (the witness saw it happen) and hearsay (the witness was told about it). Both are admissible in a workplace investigation, as the standard of evidence is not as strict as in a court, but you should note and weigh the distinction.

Physical evidence

Items such as damaged property, safety equipment, physical documents, or biological samples (in personal injury or drug/alcohol matters). Chain of custody documentation is important here.

Digital evidence

Screenshots, metadata, device logs, and browser history. Be aware of privacy obligations. You can generally access employer-owned devices and systems, but personal devices raise different considerations. Seek legal advice before accessing an employee's personal device.

Securing evidence early

Evidence can disappear quickly. Once you know an investigation is underway, take immediate steps to preserve:

Email and messaging records (work with IT to place a legal hold)
CCTV footage (many systems overwrite after 14 to 30 days)
Access card logs and building entry records
System access logs for software or financial systems
Any physical items relevant to the allegation

Do not wait until you have decided whether to proceed with a formal investigation. Preserving evidence is a precautionary step, and you can always decide not to use it.

Case360 keeps every step documented automatically.

Audit trail, evidence storage, task tracking, and AI Fact Find — built for Australian investigators.

Start free trial

Chain of custody

For evidence that may later be used in legal proceedings (including unfair dismissal applications or criminal referrals), document the chain of custody: who collected the evidence, when, from where, and how it has been stored. This is especially important for CCTV footage, device images, and physical items. A broken chain of custody can make evidence inadmissible or undermine its weight.

Evaluating the weight of evidence

Not all evidence is equal. When assessing evidence, consider:

Reliability: Is the source generally credible? Does their account contain internal inconsistencies?
Corroboration: Is the evidence supported by other independent evidence?
Contemporaneity: Evidence closer in time to the alleged conduct is generally more reliable than evidence given months later
Motive: Does the witness have a reason to fabricate or exaggerate?
Specificity: Vague, general accounts are less reliable than specific, detailed ones

Where you prefer one account over another, document your reasoning explicitly in the investigation report.

Privacy and surveillance obligations

Gathering evidence in an Australian workplace is subject to privacy law. Under the Privacy Act 1988 (Cth), the Surveillance Devices Act (in some states), and workplace surveillance laws in NSW, Victoria, and other jurisdictions, there are limits on what you can collect and how.

Employees generally must be notified if workplace surveillance is in use (with some exceptions for covert surveillance with authorisation)
You cannot access an employee's private communications on personal devices without their consent or a court order
Health information is sensitive information under the Privacy Act, requiring heightened care in how it is collected and stored

When in doubt, seek legal advice before gathering evidence that might cross these lines.