Incident Reporting Workflow: Intake to Closure in 10 Days

Informal handling feels faster until counsel asks for the file. A lightweight workflow beats heroic memory: intake → assign → investigate → close with dates. When complaints live in Slack DMs, forwarded emails, and hallway conversations, you cannot prove timely response, consistent outcomes, or non-retaliation—and that gap shows up in demand letters, not in your quarterly HR dashboard.

Growing employers need a workflow that is fast enough for trust and documented enough for defense. Ten business days from intake to closure is a reasonable SLA for straightforward cases; complex matters extend with written rationale, not silent delay.

#Intake once—no parallel channels

Single portal or email alias creates a ticket with timestamps. Acknowledge receipt within one business day—silence reads as retaliation risk. The intake form should capture:

• Complainant and accused identities (if known)
• Date, location, and nature of alleged conduct
• Witnesses and artifact links (screenshots, messages, calendar invites)
• Whether interim measures are requested or required

Route every report through the same path: hotline, HRIS web form, or dedicated alias monitored by two people. Train managers that routing to HR is their job—not investigating, not mediating, not promising outcomes.

Tip. Auto-reply with case ID and expected next step within four business hours. Acknowledgment is cheap; perceived abandonment is expensive.

Prohibit parallel Slack threads as system of record. Side conversations can supplement the file; they do not replace it. Export relevant chat logs into the case folder with hash or timestamp metadata where policy allows.

#Assignment rules that protect independence

Investigator assignment rules prevent the accused's manager from owning the file. Default matrix:

Situation	Assign to
Peer dispute, no power differential	Trained HR generalist or external investigator
Manager accused	Skip-level HRBP or outside counsel
Executive accused	Outside counsel or board-directed investigator
Safety or threat of violence	Security + HR immediately; legal on parallel track

Document who assigned the investigator and why. Rotating the same friendly HR generalist for every executive complaint destroys independence in discovery. When in-house bandwidth is thin, budget outside investigators for high-exposure cases—it is cheaper than a misstep memo.

#Investigate with a scoped plan

Within three business days of assignment, the investigator publishes a scope memo: allegations to test, witnesses to interview, documents to collect, and interim measures in place (schedule changes, paid leave, system access restrictions). Scope changes get addenda—not verbal drift.

Interview practices worth standardizing:

• Separate complainant and accused interviews; no joint sessions for harassment allegations
• Open with purpose and anti-retaliation reminder
• Ask for specifics: dates, words used, who else was present
• Capture signed or emailed interview summaries where policy permits

Preserve evidence early. Slack exports, badge swipes, and calendar data disappear under retention policies if nobody pulls them in week one.

#Interim measures without prejudgment

Employees interpret interim action as guilt. Communicate that separation of parties, schedule adjustments, or paid administrative leave are neutral stability measures—not findings. Document who approved interim steps and what trigger will lift them.

Avoid ad hoc punishments before findings: removing someone from a client account "just in case" creates the same appearance problem as formal discipline. Interim measures should map to safety or investigation integrity, not frustration.

#Close with artifacts—not "handled offline"

Closure memo: allegations, scope, interviews, findings, corrective action, follow-up date. Store with role-based access; do not email conclusions. A defensible closure memo includes:

1. Case ID and date range — intake through closure
2. Allegations tested — what was in scope and what was not
3. Evidence summary — interviews, documents, credibility notes without gossip
4. Findings — substantiated, unsubstantiated, or inconclusive per allegation
5. Corrective action — coaching, policy training, discipline, separation, or no action with rationale
6. Follow-up — calendar check for recurrence, manager attestation, or monitoring period
7. Retention schedule — how long the file lives and who can access it

"Handled offline" is not a finding. If leadership pressures informal resolution to avoid documentation, escalate to counsel in writing. Informal resolutions still need a confidential memo-to-file when conduct was substantiated.

#SLA timers that survive quarter-end crunch

Publish SLAs internally:

Milestone	Target
Acknowledgment	1 business day
Investigator assigned	3 business days
Scope memo	3 business days from assignment
Interviews complete	7 business days for standard cases
Closure memo	10 business days from intake

Complex cases (multi-witness, cross-border, law enforcement parallel) extend with written notice to complainant and accused—still within anti-retaliation bounds counsel approves. Dashboard open cases weekly; red-flag anything past SLA without extension memo.

#Tie back to handbook and policy versions

Findings reference the handbook version in force on the incident date—not the policy managers wish existed. Annual handbook refresh cycles should produce a version ID investigators can cite. When policy language is ambiguous, note the gap in the closure memo and route to policy owners—do not invent rules mid-investigation.

Training completions matter: if harassment prevention training records are due, attach completion status to the file. Gaps do not automatically prove liability but they shape remediation and settlement posture.

#What breaks investigations—and how to fix it

Dual intake. Complaints filed with HR and a manager's text thread; only one gets tracked. Fix: one portal; managers forward into it within four hours.

Investigator conflict. Accused's skip-level runs the interview. Fix: assignment matrix with automatic escalation.

Endless open cases. Files stall at "waiting for witness." Fix: weekly case review with hard close-or-extend decisions.

Conclusions by email. "We talked and it's fine" in an inbox. Fix: closure memo in system of record; email only schedules conversations.

Retaliation blind spots. Complainant transferred to worse shift after filing. Fix: thirty- and ninety-day follow-up checks logged to case ID.

#Operational checklist before the next complaint

• Single intake path published; managers trained on routing-only role
• Assignment matrix approved by legal; outside investigator contract ready
• Scope memo template and closure memo template in document system
• SLA dashboard with weekly owner in HR ops
• Interim measures guidance reviewed with counsel
• Retention and access controls mapped per case type
• Handbook version ID current in investigator reference sheet

#What to do this week

1. List every complaint channel employees use today—collapse to one intake path or document why multiples exist.
2. Pull any case open longer than thirty days; write extend-or-close rationale for each.
3. Confirm investigators on last three cases satisfied assignment independence rules.
4. Draft auto-acknowledgment language with case ID and anti-retaliation pointer.
5. Schedule quarterly mock audit: can you produce closure memo and evidence folder for a random closed case in under one hour?

A ten-day workflow is not bureaucracy—it is how you answer "what did you do when someone reported?" without depending on who still remembers.

#Related guides

• Handbook Annual Refresh: A Two-Week Ops Sprint
• Defensible Calibration: One Bar, Documented Adjustments
• Stay Interview Scripts That Surface Flight Risk Early