What actually happens once a workplace investigation into online conduct begins

Workplace policies risks are usually discussed from the perspective of whoever drafts the rules. This page is for the person on the other end: someone has raised something about a post, and a process has started.

Nothing here is legal advice. This article uses the United States as its example, but rights and procedures depend on applicable law, your contract, any collective bargaining agreement, and employer policy.

What to take away

What usually happens

In the U.S., a common sequence is below, although employer policies, collective bargaining agreements, and applicable law can change the details or combine stages.

Two features of this are worth knowing in advance. The people running it usually do this rarely, so the process is often improvised at the edges. And the evidence is almost always incomplete, because a screenshot of a reply is not a screenshot of a conversation.

The first hour

Preserve everything, and change nothing. Take a full copy of the item, the thread around it, and the timestamps, before anything is edited or deleted. Deleting looks like concealment even when it is not, and it destroys the context that most often helps.

Write your own account now. What you posted, when, why, and what was around it. Memory of sequence degrades fast and the sequence is usually the contested part.

Ask for the allegation in writing. Which item, which policy provision, and what specifically is said to have breached it. This is a reasonable request and it is the single most useful thing you can do, because a vague concern cannot be answered and will otherwise expand during the process.

Ask which version of the policy applies. The one in force when you posted, not the one in force now. If the policy changed in between, that is a material fact and it is easy to establish only if somebody asks early.

Find out what kind of process this is. Informal conversation, formal investigation, or a disciplinary meeting are different, with different consequences and often different rights to be accompanied. In the U.S., a union-represented employee covered by the National Labor Relations Act may, on request, have a union representative present at an investigatory interview the employee reasonably believes could lead to discipline. This is known as the Weingarten right and does not apply to every worker or meeting. The National Labor Relations Board administers the Act.

What you can reasonably ask for

None of these are confrontational requests. All of them are things a well-run process provides without being asked, and asking for them in writing creates a record either way. No single federal deadline applies to every U.S. workplace investigation or internal appeal; check the employer's policy, any collective bargaining agreement, and applicable state law for rules that may govern a particular situation.

Where the process usually goes wrong

Selective enforcement. A neutral rule applied unevenly stops being evidence of a standard. If comparable incidents got different responses, that difference has to be explainable from the file, and asking about it is legitimate.

Retrospective application. A rule that changed after the post is applied as though it had always said the current thing.

Evidence with no provenance. A screenshot with no source, no date and no surrounding thread. Ask where it came from and what else was in the conversation.

The person raising it is also deciding it. A conflict of interest that is obvious in retrospect and common in small organizations.

Conflating conduct with performance. Two different processes with different standards, merged because the same person is unhappy about both.

The general concept of who has to establish what, and to what standard, is set out in an explanation of burden of proof. That describes a legal setting rather than an internal one, and internal processes are not courts, but the underlying idea that an allegation has to be made out rather than assumed is worth holding on to.

Getting advice

Take advice earlier than feels necessary. Before the first meeting beats after it, and beats after a decision by a wide margin. Depending where you are, that might be a union representative, an employment adviser, or a lawyer.

In the U.S., the National Labor Relations Board (NLRB) administers the National Labor Relations Act and accepts unfair labor practice charges, including certain claims of retaliation for protected concerted activity. It is not a general appeal body for every workplace investigation, and whether its process applies depends on the worker and the facts.

Two things not to do. Do not post about the process while it is running. And do not accept an informal resolution that includes a record you have not seen, since the record is the part that persists.

If the account itself is affected

Where the material sits on a service that has also acted, two separate processes may run: the employer's and the service's. They have different decision-makers and standards, although the same material may be relevant to both; neither decision automatically binds the other, and a service's decision alone does not establish what happened for the employer's purposes.

Each service sets its own appeal route; check the notice in the account and the service's terms and content policies for any available appeal. No single mechanism applies across platforms. What the service's process can and cannot do appears in what an appeal achieves. The agreement that governs it is in what you accepted when you signed up.

The document you are being assessed against, and what it should and should not contain, is the subject of what goes wrong with these policies. If the concern involves a young person, an entirely different structure applies and it overrides the ordinary sequence: that is described in which document governs an incident in a school.

Common questions

Should I take the post down?

Take a full copy first, with timestamps. After that, removing a post that identifies someone else is usually right and should be accompanied by telling whoever is handling it, rather than done quietly.

Can I be disciplined for something posted outside work?

It depends on where you work, on your contract, and on what was posted. The honest answer is that this varies enough between jurisdictions that a general page cannot tell you, and it is exactly the question worth asking an adviser locally.

They will not put the allegation in writing. What then?

Write your own summary of what you were told, send it, and ask them to confirm or correct it. That produces a record without requiring their cooperation.

Is an apology a good idea?

Sometimes, and it is not a neutral act in a process that may have consequences. Where anything significant is at stake, that is a decision to take with advice rather than in the meeting.