Receiving a workplace harassment report is only the beginning. Here is how companies can structure triage, evidence collection, interviews, decision-making and closure without compromising confidentiality or fairness.
A reporting channel can work perfectly until the first serious allegation arrives.
Then a different question appears:
What does the company actually do with the report?
A poorly handled investigation can create problems beyond the original allegation: unnecessary exposure of the people involved, lost evidence, conflicts of interest, premature decisions and loss of trust in the reporting process itself.
Receiving a report and investigating it are therefore two different parts of the same system.
In Brazil, Law No. 14,457/2022 requires companies with a CIPA to establish procedures for receiving and following up on reports, investigating allegations and, where appropriate, applying administrative sanctions in cases involving sexual harassment and other forms of workplace violence. The law also requires protection of the reporting person’s anonymity.
What the law does not provide is a universal investigation playbook.
Organizations still need to design that process.
There is no universal 24-hour or 30-day legal deadline
Some companies establish internal service levels such as:
initial triage within 24 hours;
target completion within 30 days.
Those may be useful governance standards.
They should not, however, be presented as universal statutory deadlines for every private workplace investigation in Brazil.
The more important principles are prompt handling, prioritization of urgent situations and documented reasons when an investigation takes longer than expected.
Brazilian Ministry of Labor guidance states that when a detailed investigation is necessary, it should begin promptly and be handled by someone with appropriate authority, independence, resources and competence to conduct interviews, collect evidence and assess the facts.
1. Triage the report before investigating it
Triage is not about deciding whether the allegation is true.
It is about understanding what was reported and what kind of response it requires.
At this stage, consider:
the alleged conduct;
the people or departments mentioned;
whether there is an immediate safety or retaliation risk;
whether evidence has been identified;
whether temporary protective measures may be necessary;
who can handle the case without a conflict of interest.
One question deserves immediate attention:
Has anyone who would normally receive or investigate the case been named in the allegation?
If so, that person should not control that investigation.
Official integrity frameworks also emphasize independence, confidentiality and the absence of conflicts of interest when forming an investigation team.
The decision to open — or not open — a fuller investigation should also be documented.
2. Define the investigator, team and scope
Sensitive reports should not circulate freely simply because several departments may be interested in the outcome.
Access should follow a need-to-know principle.
More complex cases may require a small investigation team selected according to the skills needed.
The exact number of people matters less than four characteristics:
independence, impartiality, confidentiality and absence of conflicts of interest.
Then define the scope.
For example:
Investigate allegations of repeated humiliating conduct attributed to Manager X during Team Y meetings between March and June.
That is far more useful than:
Investigate possible harassment in the sales department.
Vague scope usually produces a vague investigation.
3. Preserve relevant evidence
Potential evidence can include:
emails;
messages;
corporate records;
documents;
meeting records;
lawfully obtained audio or video;
witness accounts.
For each relevant item, the organization should ideally be able to explain:
Where did it come from?
When was it received?
Was the original preserved?
Who accessed it?
Was it modified?
Access logs, version controls and file hashes can strengthen the traceability of digital material, but they are not universal legal requirements for every internal investigation.
The principle is simpler:
Evidence should be preserved in a way that supports reliability and traceability.
Personal data also needs appropriate protection. Brazil’s LGPD requires data minimization and security measures designed to protect personal information against unauthorized access, loss, alteration and improper disclosure.
4. Plan interviews instead of improvising them
There is no mandatory interview order that works for every case.
The sequence should be designed to reduce contamination between accounts, preserve evidence and allow the relevant people to be heard properly.
Depending on the circumstances, investigators may need to speak with:
the reporting person or affected employee, when identified;
witnesses with relevant knowledge;
the person whose conduct is being investigated.
Brazilian Ministry of Labor guidance similarly recognizes interviews with the affected person, the accused and relevant witnesses as part of a detailed investigation.
Interviews should be private.
Avoid interruptions.
Start with open questions before moving to specific ones.
Do not tell one witness what another witness said.
Do not turn the interview into an attempt to discover “whose side” someone is on.
And record only what is relevant to the investigation.
Holding a harassment interview in a glass meeting room in the middle of an office is a confidentiality failure before the first question is asked.
5. Confidentiality does not eliminate the right to respond
This is one of the hardest balances to get right.
The identity of reporting persons and witnesses should receive appropriate protection.
But a fair investigation cannot reach conclusions about someone based on allegations they have no meaningful opportunity to understand or address.
This means distinguishing between:
revealing the reporter’s identity
and
giving the investigated person enough information about the allegations to respond.
Those are not necessarily the same thing.
The investigated person should have a fair opportunity to address the material allegations. Depending on the process, this may require information about events, dates, conduct and circumstances without automatically identifying the reporting person.
If revealing identity becomes genuinely necessary for a particular investigation or defense right, the issue should be handled carefully with appropriate legal and data-protection review.
6. Evaluate the allegations based on the evidence
Once interviews and evidence have been reviewed, the company needs to determine what can reasonably be concluded.
An internal classification might use outcomes such as:
substantiated;
unsubstantiated;
partially substantiated;
inconclusive.
These are not mandatory legal categories.
They are simply a useful internal framework.
The important point is that the conclusion follows from the evidence.
A report is not automatically true because someone submitted it.
But an allegation is not automatically false because the available evidence was insufficient to prove it.
“We could not reach a conclusion” is not the same as “it did not happen.”
That distinction should be reflected in the final record.
7. Decide what action is necessary
Where misconduct is established, the organization needs to decide what happens next.
Depending on the seriousness of the conduct and applicable rules, measures may include:
guidance or training;
formal warnings;
process changes;
changes in reporting structures;
monitoring;
suspension;
other appropriate disciplinary measures.
Official workplace guidance emphasizes that corrective action should both stop the conduct and help prevent recurrence.
Urgent cases may also require temporary protective measures before the investigation is finished.
But temporary protection should not become punishment before findings are made.
The purpose should be preventive and proportionate.
8. Close the investigation with a clear record
A useful final report should make it possible to reconstruct the reasoning behind the decision.
It may include:
investigation scope;
period reviewed;
methodology;
relevant interviews;
evidence considered;
facts supported or not supported;
conclusion;
actions taken or recommended;
responsibilities and deadlines where appropriate.
The goal is not to create the longest possible document.
It is to ensure that an authorized reviewer can later understand why the organization reached its conclusion.
Should the reporting person receive an update?
When the reporting mechanism allows it, yes.
That does not mean disclosing confidential personnel information or explaining another employee’s disciplinary sanction.
A simple update may confirm that:
the report was reviewed;
the investigation was completed;
appropriate action was taken where necessary.
That communication has value beyond the individual case.
It tells employees that reports do not simply disappear into a black box.
A channel where people speak up and never hear anything again quickly loses credibility.
Common mistakes that damage investigations
Some mistakes are particularly risky:
leaving a report without a clear owner;
allowing someone named in the allegation to control the investigation;
sharing the report beyond those who need access;
confronting people before preserving relevant evidence;
interviewing witnesses together;
unnecessarily exposing information that can identify the reporter;
deciding the disciplinary outcome before hearing the other side;
treating lack of evidence as proof that the complaint was malicious;
closing the case without documenting the conclusion and actions;
collecting or retaining more personal data than necessary.
The broader lesson is that the investigation is part of the reporting-channel experience.
A company can invest heavily in anonymity and security at the point of submission.
If the report later circulates without control, sits untouched or exposes the person who raised it, that trust disappears.
Receiving reports is one function. Handling them well is another.
Brazil’s Law No. 14,457/2022 makes the need for procedures to receive, follow up on and investigate certain workplace reports particularly clear for companies with a CIPA.
But the quality of the process depends on more than having a written policy.
A company needs answers to questions such as:
Who owns the case?
Who must not see it?
How do we preserve evidence?
How do we interview people without contaminating the investigation?
How do we protect reporters while still giving the investigated person a fair opportunity to respond?
And how do we explain our decision later?
The reporting channel opens the door.
Trust is decided by what happens after someone walks through it.