How to Write an Investigation Report That Survives a Lawyer

Separate fact from inference — ruthlessly

This is the most important discipline in the entire document, and it is where most weak reports die. A fact is something you observed or that a source stated: "The swipe-card log records entry at 22:14." An inference is what you concluded from it: "This suggests the subject was present after hours." The two must never blur into one another.

A report that says "the subject was clearly stealing" has stated an inference as if it were a fact and handed the defence an open goal. A report that says "the following facts were established… from which it may be inferred that…" is defensible, because the reader can see exactly what you observed and exactly where your reasoning began. Every conclusion in your report should be traceable back to the facts that support it, with the join clearly marked.

Source every single claim

Every factual statement should be answerable to the question "how do you know that?" Attach the source to each: the statement and line it came from, the document reference, the exhibit number, the log entry. A report where the reader can follow every claim back to its evidence is one that inspires confidence. A report full of assertions with no visible source reads like opinion, however sound the underlying work was.

This also protects you. When you are cross-examined months later and can no longer remember the detail, a properly sourced report answers for you.

A structure that holds up

A defensible investigation report generally moves through these parts. Adapt the headings to your context, but keep the logic:

1. Terms of reference / mandate. What you were asked to investigate, by whom, and the scope. This frames everything and stops the reader (or a lawyer) claiming you strayed beyond your brief or ignored part of it.

2. Executive summary. A short, plain account of what you did and what you found, written so a busy decision-maker gets the picture in a minute. Write it last. Keep it faithful to the body — no conclusion here that isn't supported below.

3. Methodology. What you did and how: who you interviewed, what evidence you gathered, what techniques you applied, what you could not access and why. Naming the limits of your investigation is a strength — it shows you know where your findings stop.

4. Findings of fact. The established facts, in a logical order (often chronological), each one sourced. This is the spine of the report. No inference here — just what you established and how.

5. Analysis. Here, and only here, you reason from the facts. This is where inferences live, clearly signalled as inferences, each tied to the facts above.

6. Conclusions. What the analysis supports — pitched to the correct standard (see below) and never overstated.

7. Recommendations / next steps. What you suggest should happen, kept separate from your findings so no one confuses "what I found" with "what I think should be done about it."

8. Appendices. The statements, documents, logs, and — importantly — the audit trail. The evidence itself, so the reader can check your working.

Pitch to the right standard of proof

Know which standard applies and write to it. A workplace or civil matter usually turns on the balance of probabilities — more likely than not. A criminal matter needs beyond reasonable doubt, but that is the court's finding, not yours; your job is to present the evidence, not to pronounce guilt. Overstating your conclusion — writing "this proves" when your evidence supports "this indicates" — is one of the fastest ways to have the whole report discounted. Match your language to what your evidence can actually bear.

Write in plain, neutral language

Emotive language undermines you. "The subject brazenly lied" is an invitation to be challenged; "the subject's account is inconsistent with the swipe-card log in the following respects" is unarguable. Drop the adjectives, drop the sarcasm, drop anything that reads as though you had made your mind up before the evidence was in. Neutral, precise language reads as fair — and a report that reads as fair is a report that gets believed.

The mistakes that get reports torn apart

• Stating inferences as facts. Covered above; the number one killer.
• Unsourced claims. Assertions the reader cannot trace to evidence.
• Overstated conclusions. Claiming more than the evidence supports.
• Ignoring the innocent explanation. A report that never acknowledges alternative explanations looks like advocacy, not investigation. Address the innocent version and say why the evidence still points where it does.
• Selective evidence. Leaving out facts that don't fit your conclusion. If it comes out later — and it does — your credibility is gone.
• No audit trail. No way to show the evidence wasn't altered between collection and report.

The audit trail is part of the report

For a report to survive challenge, the reader has to trust that the evidence you relied on is the evidence as it was collected — unaltered. A clear record of what was gathered, when, by whom, and that it has not been changed since, turns "trust me" into "check for yourself." Build the audit trail as you go, not at the end, and include it as an appendix.

Doing this consistently under time pressure

Structuring a report properly, sourcing every claim, keeping fact and inference apart and attaching a clean audit trail is disciplined work — and it is easy to let slip when you are busy. Conectir's reporting tools are built around exactly this discipline: they assemble findings with their sources attached, keep the leads-and-inferences separate from the facts, and generate a hash-chained audit-log appendix so the report can show its evidence is intact. It helps you produce the defensible structure; the judgement and the words stay yours. If you write reports that end up in front of lawyers, see how the reporting tools are set up.