In 2024, the Bureau of Labor Statistics recorded 733 U.S. workplace fatalities from violent acts, including 470 homicides. That's the reality employers are up against.
Many business owners and HR managers freeze the moment a complaint about threats or aggression lands on their desk. They're unsure what's legally required, what's legally risky, and how fast they need to move. This guide breaks down the clear do's and don'ts of a workplace violence investigation, plus when it's time to bring in a neutral outside expert.
Key Takeaways
- Workplace violence spans threats, intimidation, and bullying—not just physical acts
- Fast, documented action and objective interviews build a defensible investigation
- Privacy violations, illegal recordings, defamation, and improper disclosure can undo a solid case
- Bring in a neutral third-party investigator when objectivity is in question
What Qualifies as Workplace Violence?
OSHA defines workplace violence as any act or threat of physical violence, harassment, intimidation, or other threatening behavior that occurs at the work site. That definition covers a lot more ground than a physical altercation. It includes verbal threats, aggressive emails, stalking, and behavior that simply makes someone feel unsafe.
The Four Recognized Types
The National Institute for Occupational Safety and Health (NIOSH) breaks workplace violence into four categories:
- Criminal intent – Perpetrator has no legitimate relationship to the business (robbery, trespassing)
- Customer or client-perpetrated – Violence from patients, customers, or visitors
- Worker-on-worker – Coworker or supervisor conflict, including bullying and verbal abuse
- Personal relationship spillover – Domestic or personal disputes that follow someone into work
These categories show up unevenly by industry. Health care, social assistance, retail, and rideshare or delivery driving carry elevated risk because employees handle money, work alone, or serve unpredictable members of the public.
What This Looks Like Day to Day
For small and mid-size employers, reportable behavior often looks like:
- A coworker making veiled or explicit threats during an argument
- Repeated intimidation or bullying from a supervisor
- An employee bringing a weapon onto company property
- Stalking behavior tied to a personal relationship
- Physical shoving, blocking, or aggressive gestures
None of these require an injury to trigger an investigation. If someone felt threatened, treat it as grounds to investigate.
Why Workplace Violence Investigations Matter
The OSH Act's General Duty Clause requires every employer to provide a workplace free from recognized hazards likely to cause death or serious physical harm. There's no dedicated federal workplace-violence standard, so OSHA enforces this through that general obligation.
California employers face a more specific mandate. Since July 1, 2024, most covered employers must maintain a written Workplace Violence Prevention Plan under Labor Code section 6401.9. That plan must address reporting procedures, employee training, hazard correction, and post-incident investigation.
Skipping or botching an investigation isn't just a compliance gap. It exposes employers to:
- Negligent retention claims if a known risk later causes harm
- EEOC charges tied to harassment or retaliation
- Reputational damage that affects hiring and retention long after the incident
A thorough, well-documented investigation is often an employer's strongest legal defense.
The Do's of Workplace Violence Investigations
A workplace violence investigation only holds up if it is fast, fair, and well documented. Use these practices to protect people first and keep the process defensible.
Act Quickly and Secure Safety First
When there's an immediate risk, separate or suspend the accused employee pending investigation. Confirm that action in writing and start gathering facts within a few business days.
Waiting a week or two to "see how things settle" almost always makes the situation worse, not better.
Assemble the Right Team
Designate one clear decision-maker before you start. Then build the right support around that person:
- Loop in legal counsel for high-risk or high-exposure cases
- Contact law enforcement immediately if criminal conduct (weapons, physical assault, or credible threats) is suspected
- Bring in a neutral third-party investigator when internal bias or capacity is a concern
Investigations run by committee tend to stall.
Interview Every Party Objectively
Interview order matters:
- Complainant first – Get a complete list of allegations and ask who else witnessed the behavior
- Witnesses next – Use a consistent introduction and open-ended questions before narrowing in
- Accused last – This lets you compare their account against everything you've already gathered
Open-ended questions ("Walk me through what happened") produce more reliable information than leading ones.
Document Everything Factually
Record objective facts: what was said, who was present, what documents or video were reviewed. Keep subjective conclusions, speculation, sarcasm, or any reference to protected characteristics out of your notes entirely. Investigator notes can end up in front of a judge.
Reach a Defensible Conclusion and Follow Up
In "he said, she said" situations, weigh corroboration and internal consistency over gut instinct about demeanor. Communicate the outcome to both parties in writing. Then schedule a follow-up check-in 30 to 60 days out to confirm the resolution actually held.
The Don'ts of Workplace Violence Investigations
Avoiding these mistakes protects the investigation—and limits legal exposure for your business.
Don't Violate Employee Privacy
Searching lockers, vehicles, or personal devices without a legitimate business reason invites an invasion-of-privacy claim. Even with cause, keep searches narrow and tied to a written no-privacy-expectation policy.
Don't Secretly Record Without Legal Review
Recording laws vary by state. Some allow one-party consent; others, including California, require every party's consent to record a confidential communication. Check your state's rule before you turn on audio or video, especially in areas people reasonably consider private.
Don't Restrain or Coerce Anyone During an Interview
Blocking a door, refusing to let someone leave, or pressuring continued participation can support a false imprisonment claim. If someone refuses to cooperate, document the refusal. Don't force the issue.
Don't Make Unsupported Public Accusations
Sharing unverified allegations with anyone who lacks a legitimate business need to know creates defamation exposure. Qualified privilege only protects limited, appropriate disclosures made in good faith, not office gossip.
Don't Overshare Investigation Outcomes
Even true information can create liability if shared too broadly. Keep disciplinary outcomes and investigation results out of casual conversation, team meetings, and social media entirely.
Don't Destroy Records After a Complaint Is Filed
Once litigation is reasonably anticipated, the duty to preserve evidence kicks in. Emails, texts, video, and interview notes must be kept, even the ones that don't help your case. Deleting them afterward is spoliation, and courts treat it harshly.
When to Call in a Neutral Third-Party Investigator
Some situations call for outside help, no matter how capable your internal HR team is:
- The allegation involves a business owner, executive, or someone HR reports to directly
- Internal staff lack investigative bandwidth or experience with violence-related claims
- There's a real risk the investigation will look — or be — biased
- Multiple locations, complex evidence, or witness conflicts overwhelm internal resources
A neutral third party strengthens the employer's good-faith defense and protects the credibility of the findings if the case is ever challenged in court or before a state agency. When the person conducting the investigation has no stake in the outcome, the conclusions carry more weight.
For small and mid-size businesses without a full HR department—or those that need unbiased eyes on a sensitive claim—Moving Mountains HR's workplace investigation services provide that neutral support. A typical engagement covers:
- Intake and complaint assessment
- A tailored investigation plan
- Neutral interviews with every involved party
- Evidence collection and a summary report with findings and recommendations
Confidentiality and anti-retaliation protections run through the entire process. If a threat, intimidation complaint, or violent incident has landed on your desk, a free consultation is a reasonable next step before you decide how to proceed internally.
Frequently Asked Questions
How do you investigate workplace violence?
Secure safety first, assemble a clear decision-making team, and interview the complainant, witnesses, and the accused in that order. Document everything factually, then reach a written, defensible conclusion.
What qualifies as workplace violence?
Workplace violence includes threats, intimidation, bullying, and verbal or written aggression, not just physical assault. If the behavior makes someone feel unsafe, it warrants review.
What is considered a workplace violence investigation?
A workplace violence investigation is a formal, documented process of gathering facts, interviewing everyone involved, and reaching a conclusion about an alleged incident or threat. The output should be defensible if challenged later.
Who should conduct a workplace violence investigation?
It depends on severity and objectivity concerns. Internal HR or management can handle lower-risk cases, while high-risk or high-exposure situations call for a neutral third-party investigator.
How long should a workplace violence investigation take?
Most investigations should begin within a few days of the report and wrap up within roughly 7 to 10 business days. Moving faster preserves evidence, witness memory, and employee trust in the process.
What happens after a workplace violence investigation is complete?
The employer communicates findings to both parties in writing, takes appropriate corrective action, and follows up afterward to confirm the issue has actually been resolved.
