Workplace investigations derive their credibility from evidence, and the most reliable evidence is often that which exists before anyone knows an investigation has begun. Documentary evidence forms the backbone of any fair investigation, providing objective contemporaneous records that can corroborate or contradict the accounts that witnesses will later provide. For human resources professionals, business owners, and people managers across Canada, understanding how to identify, preserve, and gather documentary evidence before conducting interviews represents one of the most critical skills in the investigative toolkit. This lesson examines the legal framework that governs evidence gathering in Canadian workplaces, explores the practical considerations that arise when collecting documents, and provides guidance on how to approach this phase of an investigation with both rigour and fairness.
The legal authority to gather documentary evidence in workplace investigations stems from the employment relationship itself and from the statutory obligations that Canadian employers must fulfill. Under the common law that applies in British Columbia, Alberta, Saskatchewan, Ontario, and other provinces outside Quebec, employers have an implied right to manage their workplaces, which includes the authority to investigate misconduct and maintain order. This managerial prerogative, however, must be exercised in accordance with the duty of good faith that courts have recognized as fundamental to the employment relationship. In Quebec, the Civil Code governs employment relationships and similarly requires that employers act in good faith when exercising their rights, including the right to investigate. The distinct civilian tradition in Quebec means that employers in that province must be particularly attentive to the codified nature of their obligations, though the practical implications for evidence gathering remain broadly similar to those in common law jurisdictions.
Federal and provincial human rights legislation across Canada imposes obligations on employers to investigate complaints of discrimination and harassment, and these obligations implicitly require the gathering of relevant evidence. The Canadian Human Rights Act, as of the date of authorship, applies to federally regulated employers such as banks, telecommunications companies, airlines, and interprovincial transportation firms, while provincial human rights codes govern provincially regulated workplaces. Whether an employer falls under federal or provincial jurisdiction depends on the nature of the business rather than on the location of its operations, a distinction that matters significantly when determining which legislative framework applies to an investigation. Occupational health and safety legislation similarly creates investigative obligations, particularly in cases involving workplace violence or harassment. The Canada Labour Code, as of the date of authorship, requires federally regulated employers to investigate occurrences of harassment and violence, while provincial statutes such as the Occupational Health and Safety Act in Ontario and corresponding legislation in other provinces impose parallel requirements on provincially regulated employers.
The duty to investigate that arises under these various statutory frameworks necessarily entails the power to gather evidence, but this power is not unlimited. Privacy legislation constrains how employers can collect, use, and disclose personal information during investigations. The Personal Information Protection and Electronic Documents Act, as of the date of authorship, applies to federally regulated private sector employers and to provincially regulated employers in provinces without substantially similar legislation. British Columbia, Alberta, and Quebec have enacted their own private sector privacy statutes that apply to provincially regulated employers within their borders. These laws generally permit employers to collect personal information without consent where the collection is necessary for an investigation into a breach of an agreement or a contravention of law, but employers must still comply with requirements around reasonableness and proportionality.
Documentary evidence in workplace investigations encompasses a remarkably broad range of materials. Electronic communications represent perhaps the most common and most valuable category, including emails, text messages, instant messages through platforms such as Slack or Microsoft Teams, and communications through internal social networks or collaboration tools. Employers generally own the communications systems they provide to employees and have the right to access communications made through those systems, though clear policies about this access should ideally be in place before an investigation begins. Employment records form another crucial category, including personnel files, performance reviews, disciplinary records, attendance records, and compensation information. These records often reveal patterns that illuminate the context of a complaint or provide evidence of prior incidents that may be relevant to understanding current allegations.
Business records more broadly can also prove essential to an investigation. Financial documents may reveal evidence of fraud or theft. Access logs showing when employees entered buildings or logged into computer systems can establish or refute claims about where someone was at a particular time. Project documentation may be relevant to allegations involving work quality or credit for work performed. Security footage, where available, provides visual evidence that can corroborate or contradict witness accounts. The investigator must consider what categories of documents might be relevant to the specific allegations under investigation and ensure that all potentially relevant materials are identified and preserved.
Preservation of evidence must occur at the earliest possible stage of an investigation, ideally before any party to the dispute becomes aware that an investigation is underway. Once employees know that their conduct is being scrutinized, the risk that relevant evidence will be destroyed, deleted, or altered increases substantially. Human resources professionals should work with information technology departments or external digital forensics specialists to ensure that relevant electronic evidence is preserved in its original form before any collection takes place. This may involve placing litigation holds on email accounts, preserving backup systems, or creating forensic images of computers or mobile devices. The precise technical steps required will depend on the organization's systems architecture, but the overarching principle is that the integrity of electronic evidence must be maintained from the moment it is identified as potentially relevant.
The chain of custody for documentary evidence matters throughout the investigation. Investigators should maintain careful records of when documents were obtained, from whom they were obtained, and how they have been stored. If evidence is later challenged on the grounds that it may have been altered or tampered with, a clear chain of custody documentation can demonstrate that proper procedures were followed. This documentation need not be elaborate, but it should be systematic and consistent. For physical documents, this may involve logging when items were received, maintaining them in a secure location, and tracking who has accessed them. For electronic evidence, metadata can help establish authenticity, but investigators should avoid opening or modifying files in ways that might alter this metadata.
Consider the experience of Westbrook Community Services, a non-profit organization in Winnipeg that provides housing and employment support to vulnerable populations. In March of a recent year, the executive director received an anonymous complaint alleging that the director of programs had been falsifying time records for casual staff in her department. The complaint suggested that the director was approving payment for hours that employees did not actually work and that some of these employees were her relatives. The executive director recognized immediately that this allegation, if substantiated, would constitute serious misconduct warranting termination for cause and potentially criminal prosecution. She also recognized that evidence gathering would be critical and that she would need to move quickly before word of the investigation spread.
The executive director contacted Westbrook's external human resources consultant that same afternoon and outlined the situation. Together, they developed a plan for gathering documentary evidence before any interviews took place. The first step was to preserve payroll records and timesheets for the programs department going back eighteen months. The consultant advised that although the immediate allegations focused on the current fiscal year, patterns over a longer period might reveal whether the conduct was isolated or systemic. The organization's payroll was processed through a cloud-based system, and the consultant recommended immediately downloading and preserving the raw data before anyone with administrative access might have an opportunity to alter it. The executive director contacted the payroll provider and arranged for a complete export of all records for the programs department, which was delivered via secure file transfer that evening.
The next category of evidence to preserve was electronic communications. The director of programs had a work email account and access to the organization's project management software. The consultant recommended working with the organization's contracted information technology support provider to create a backup of the director's email account and to preserve access logs showing when and from where the director had accessed organizational systems. The executive director was careful to request only evidence relevant to the allegations and to document her reasoning for seeking each category of information. She was aware that overbroad evidence collection could later be criticized as an invasion of privacy, even in circumstances where the employer had legitimate grounds for investigation.
Physical records also required attention. Westbrook maintained paper sign-in sheets at its program locations, which casual staff were supposed to complete when they arrived and departed. The executive director arranged for these sign-in sheets to be collected from all program locations and secured in a locked filing cabinet in her office. She documented the date and time of collection and which locations the sheets had been retrieved from. She also collected the physical personnel files for the casual staff members who had been specifically mentioned in the anonymous complaint, which allowed her to confirm their home addresses and identify any disclosed relationships with existing staff.
One complicating factor emerged during this evidence gathering phase. Westbrook had recently transitioned from paper timesheets to an electronic time tracking system, but the transition had occurred only eight months earlier. Records from before the transition existed only in paper form in departmental filing cabinets. The executive director needed to retrieve these paper records without alerting the director of programs to the investigation, which presented a logistical challenge. She ultimately decided to frame the retrieval as part of a routine audit preparation process, which was not entirely inaccurate given that Westbrook's funders did require periodic audits of program expenses. She sent a general email to all department directors requesting that historical payroll records be gathered for audit purposes, which allowed her to collect the programs department records without signaling that this department was under particular scrutiny.
The evidence gathering process at Westbrook took approximately one week to complete. By the end of that week, the executive director and the human resources consultant had assembled a comprehensive documentary record that included payroll data exports showing all payments to casual staff in the programs department over eighteen months, copies of electronic timesheets submitted through the new system over the past eight months, paper timesheets from the period before the system transition, sign-in sheets from program locations, email communications between the director of programs and payroll staff regarding timesheet approvals, personnel files for the casual staff members mentioned in the complaint, and organizational policies regarding time reporting and conflicts of interest. With this documentary foundation in place, the investigation was ready to proceed to the interview phase.
The Westbrook situation reveals several important principles about documentary evidence gathering that apply across Canadian workplaces regardless of size or sector. First, speed matters. The executive director acted on the same day she received the complaint, recognizing that delay creates opportunities for evidence to disappear. This does not mean that investigators should proceed recklessly or without appropriate authorization, but it does mean that evidence preservation should be treated as an urgent priority. Second, comprehensiveness requires thoughtfulness. The consultant helped the executive director think through what categories of evidence might be relevant to the specific allegations, which prevented both over-collection and under-collection. Third, documentation of the collection process is as important as the evidence itself. The executive director maintained records of when and how each category of evidence was obtained, which would later allow her to demonstrate that the investigation had been conducted fairly and systematically.
The implications for Canadian employers extend beyond the immediate context of conducting investigations. Organizations should consider their evidence preservation capabilities before any investigation arises. Does the organization have policies that clearly communicate to employees that workplace systems are subject to monitoring and that data on those systems may be accessed for investigative purposes? These policies, often included in acceptable use agreements or employee handbooks, provide important legal foundation for evidence gathering. They also set employee expectations in ways that reduce the likelihood of later claims that privacy rights were violated. Organizations should also consider whether they have the technical capacity to preserve electronic evidence effectively. Many small and medium-sized businesses rely on external technology providers and may not have immediate access to the tools and expertise needed for forensic preservation. Identifying these resources in advance, before an investigation is needed, allows for faster and more effective response when allegations arise.
Human resources professionals should develop protocols for evidence gathering that can be adapted to different types of investigations. A harassment complaint will typically require different categories of evidence than an allegation of theft or fraud. Performance-related disputes may turn on documentation that exists in personnel files and project records rather than in communications. Safety incidents will require review of training records, equipment maintenance logs, and potentially security footage. By thinking through the evidence requirements for common types of investigations, organizations can respond more efficiently when complaints arise. These protocols should address both the substantive question of what to collect and the procedural question of how to collect it, including who has authority to authorize collection, how collected materials will be secured, and how the collection process will be documented.
The collection of documentary evidence must be conducted with attention to fairness and proportionality. While employers have broad authority to access information stored on their systems, this authority is not unlimited. Investigators should collect evidence that is relevant to the allegations under investigation and should avoid sweeping collection of materials that have no reasonable connection to the issues being examined. This restraint serves multiple purposes. It protects employee privacy interests, it demonstrates that the investigation is being conducted in good faith, and it reduces the volume of material that investigators must review. An investigation that produces thousands of irrelevant documents alongside the relevant evidence is an investigation that will take longer to complete and may miss important details amid the noise.
Fairness also requires attention to the interests of respondents in investigations. The person accused of misconduct has a legitimate interest in the integrity of the evidence that will be used to evaluate their conduct. Documentary evidence that has been gathered through proper procedures and maintained with appropriate chain of custody documentation is more reliable than evidence whose provenance is unclear. Respondents and their representatives may later challenge evidence that appears to have been selectively collected or improperly handled. By following systematic procedures for evidence gathering from the outset, investigators protect not only the integrity of the investigation but also the interests of all parties.
The practical steps that human resources professionals should take when gathering documentary evidence begin with identifying all categories of potentially relevant materials. This requires careful analysis of the allegations and consideration of what evidence might tend to prove or disprove each element of those allegations. Once categories are identified, the next step is to determine where that evidence is located and who has access to it. Some evidence may be centrally stored and easily accessible, while other evidence may be distributed across multiple locations or systems. The third step is to preserve evidence in place, ensuring that materials cannot be altered or deleted before formal collection takes place. The fourth step is to collect evidence systematically, maintaining documentation of the collection process. The fifth step is to secure collected evidence appropriately, with access limited to those who need it for purposes of the investigation.
Questions that investigators should ask themselves during the evidence gathering phase include whether all relevant categories of evidence have been identified, whether evidence has been preserved before collection to prevent alteration, whether the collection process has been documented adequately, whether collected evidence is being stored securely with appropriate access controls, whether the scope of collection is proportionate to the seriousness of the allegations, and whether the organization's policies provide adequate legal foundation for the types of evidence being collected. These questions form a framework for self-assessment that can help ensure evidence gathering is conducted thoroughly and appropriately.
Documentation during this phase should include a record of when the investigation was initiated and what allegations are being investigated, a list of all categories of evidence identified as potentially relevant, records of when evidence preservation steps were taken and by whom, records of when evidence was collected and from what sources, logs of who has accessed collected evidence and for what purpose, and notes on any challenges or complications encountered during evidence gathering and how they were resolved. This documentation serves multiple purposes. It creates a contemporaneous record that can be referenced if the investigation is later challenged. It provides accountability for investigative decisions. And it allows for continuity if the investigation must be handed off to another investigator or if external review becomes necessary.
The foundation laid during the documentary evidence phase shapes everything that follows in an investigation. Interviews are more productive when investigators already know what the documents show, because they can ask targeted questions and identify inconsistencies between documentary evidence and witness accounts. Credibility assessments are more reliable when investigators can compare testimony against contemporaneous records. Findings are more defensible when they rest on documentary evidence as well as oral testimony. And outcomes are more likely to withstand challenge when the evidence supporting them was gathered through procedures that demonstrate fairness and thoroughness. For these reasons, the time invested in systematic documentary evidence gathering before interviews begin is time well spent, setting the stage for an investigation that serves the interests of the organization, the complainant, the respondent, and the workplace as a whole.