The email arrived at 4:50 on a Thursday, or the conversation happened in a doorway and you are now the person who knows. Either way there is a complaint, it involves someone senior enough to matter or conduct serious enough to matter, and by Monday somebody expects you to have a position.
If you are the HR leader, the in-house counsel, or the executive the complaint came to, the next two days are the part of this file that gets least attention and does most of the work.
Here is the reason. What you are about to do is not an investigation. An investigation has a plan, a scope, interviews, and a report, and it takes weeks. The next 48 hours are something else: six decisions, made under time pressure, usually by whoever happens to be in the room. Each of the six is reversible on paper. In practice most of them are not, because each one becomes part of the record a reviewer reads later, and a decision made by default reads much like a decision made carelessly.
The uncomfortable part is that all six will get made in the next two days whether or not you make them. Not deciding is a decision with a worse audit trail.
Decision 1: whether you are treating this as a complaint
The decision. Do you characterise what you received as a complaint or an incident of workplace harassment, misconduct, or discrimination — or as something else?
The default. It becomes "a conversation," "feedback," "a personality thing," or "a performance issue," and nothing is triggered. That default is attractive because it is often how the person who raised it described it themselves.
The trap. In Ontario, section 32.0.7 of the Occupational Health and Safety Act requires an employer to ensure that an investigation appropriate in the circumstances is conducted into incidents and complaints of workplace harassment. The duty does not wait for a form to be filled in. Ontario decisions in the Metrolinx line have confirmed that the obligation can be triggered by what the employer knows rather than by what was formally filed, and can extend to off-duty conduct with a workplace impact — we covered that ruling in detail here. If the conduct alleged touches a protected ground, the Human Rights Code is engaged as well, and the two obligations are separate rather than interchangeable.
There is a second characterisation to make at the same time, and it is jurisdictional. Provincially regulated Ontario workplaces investigate under the OHSA. Federally regulated workplaces follow the Canada Labour Code framework introduced by Bill C-65. These are two different regimes for two different sets of employers, and the requirements do not transfer between them. Get this wrong at intake and every subsequent step is built on the wrong framework.
Who owns it. Not, ideally, the person who received the complaint. See decision 2.
What to write down today. Date and time received. What was said, as close to verbatim as you can manage, separated from your interpretation of it. The characterisation you have applied and the reason. The framework you have identified as applicable. If the person who raised it asked for informality, record that they asked, and record what you decided about it.
Decision 2: who holds the file, and who is conflicted out of it
The decision. Which named individual is the custodian of this matter from here, and which people are now excluded from touching it?
The default. Whoever received it keeps it, because they already know the story and it feels efficient.
The trap. Efficiency is the wrong criterion. The screening question is whether independence could reasonably be questioned by someone reading the file later. A non-exhaustive list of people who ordinarily should not hold or conduct it: anyone involved in the underlying events; anyone who reports to the respondent or manages the respondent; anyone who was consulted informally about the situation before it became a complaint; anyone who authored or owns the policy whose application is in question; and anyone in a standing advisory relationship with one of the parties.
Ontario's Ministry of Labour is explicit on the investigator side of this: the person conducting the investigation must not be involved in the incident and must not be under the direct control of the alleged harasser (Ministry guidance on workplace harassment investigations). The same logic applies upstream to whoever is holding the file while the decision about an investigator is being made.
Who owns it. Someone above the conflict line. In a smaller organisation that may be the CEO or a board committee, and that is a legitimate answer.
What to write down today. Who holds the file. Who was considered and screened out, and on what basis. Screening decisions recorded at the time are worth considerably more than the same reasoning reconstructed six months later.
Decision 3: what happens to the parties while you decide
The decision. Do you separate the complainant and respondent, change reporting lines, adjust duties, or place someone on leave — and on what basis?
The default. The complainant is quietly moved, because it is the least disruptive change to make and it feels protective.
The trap. This is the single most common way an employer converts a harassment file into a reprisal file. A measure that removes the complainant from a project, changes their shift, drops their hours, or takes them out of view of the people who make promotion decisions imposes a cost on the person who raised the concern. Intent does not travel well onto paper. The Ontario Labour Relations Board's remedy decision against Randstad Canada is the recent illustration of what a procedurally weak post-complaint change can cost.
The related trap is confidentiality. Do not offer more than you can hold. An investigation requires that allegations be put to a respondent, which means the substance will be disclosed to at least one other person. State plainly what will be shared, with whom, and why, rather than promising secrecy and then breaching it in week two.
Who owns it. The file holder, with employment counsel involved where the measure affects the complainant or where the allegations are serious.
What to write down today. The measure, who it applies to, the operational reason for it, what the affected person keeps, and the date it will be reviewed.
Decision 4: what gets preserved, starting now
The decision. What records are relevant, and what instruction goes out today to stop them disappearing?
The default. Nothing goes out, and retention policies keep running.
The trap. This decision has the shortest fuse of the six, and it is the one most often missed inside 48 hours. Message platforms purge, mailboxes auto-archive, access logs roll over, scheduling systems overwrite, video retention windows close, and devices get reassigned when someone changes roles. None of that waits for your characterisation decision. A record that expired on schedule is indistinguishable, in the file, from a record that was allowed to expire.
Think in categories rather than trying to guess relevance: email and calendars for the parties and their managers; internal messaging; the relevant HR and performance records; scheduling and rostering; building or system access logs; any recorded footage; and any devices due to be wiped or reissued. Where you are unsure whether something is in scope, preserve it and decide later. The reverse order is not available.
One sequencing point worth stating plainly: preservation is ordinarily put in place before the respondent is notified, and the order in which those two steps happen is a decision to take with employment counsel rather than one to improvise at 5pm.
Who owns it. The file holder, executed by IT and payroll or HRIS administrators.
What to write down today. A dated preservation instruction, the categories it covers, who received it, and confirmation back that it was actioned.
Decision 5: who investigates, and who signs the findings
The decision. Internal, external, or a hybrid — and, inside that, which named person will conduct the investigation and sign the report.
The default. "HR will look into it," which answers neither half.
The trap. The internal-versus-external question is well covered and worth reading before you decide; our internal versus external investigation guide walks the decision, and how to choose a workplace investigator sets out the questions to ask a candidate. Not every complaint needs an outside investigator.
The half that gets skipped is the second one. "Our firm is handling it" and "an external firm has been retained" are not answers to the question who is the investigator. A firm cannot be examined. A firm does not assess credibility, cannot explain why one account was preferred over another, and does not sign anything. A person does all three.
Who owns it. The file holder, with the decision approved above the conflict line.
What to write down today. The model chosen and why. The name of the investigator, or the date by which the name will exist. If external, the fact that a written scope will precede the work.
Decision 6: what you write down today
The decision. Whether decisions 1 through 5 exist as a contemporaneous record or as a memory.
The default. They exist in a Slack thread, three forwarded emails, and one person's recollection.
The trap. The file that gets read later is not only the interview notes and the findings report. It is the decision record: what you knew, when you knew it, what you decided, and why you decided it that way. That record either exists in real time or it gets reconstructed, and reconstruction is visible. A short, dated, factual decision log — six entries, a paragraph each — is one of the highest-value hours available in this entire matter.
Keep the log separate from your interpretation of the allegations. It records process decisions, not conclusions.
The one decision not to make in the first 48 hours
Do not decide the outcome.
Not the finding, not the discipline, not the reassurance. Three specific forms this takes, all of them tempting:
- Reaching a view on the allegation before the respondent has had it put to them and before the evidence has been gathered. An investigation that starts from a conclusion tests one account and accepts the other, and that asymmetry shows up in the reasoning.
- Telling either party what you think. Both will ask. The answerable version is process, not substance: what happens next, roughly when, and what they can expect to be told.
- Putting a preliminary conclusion in writing. An email at 6pm on day one saying what you suspect is now part of the file and will be read alongside the findings you reach in week six.
The purpose of the first 48 hours is to make the next 88 days possible. It is not to shorten them.
Decision quality under a named investigator of record
Everything above is about decision quality, so here is the honest structural point about why naming a specific investigator changes it. This is not a formality and it is not branding. It changes which decisions have to be made explicitly.
A named person has to complete the conflict screen themselves, and can be asked about it. Before accepting an investigation, 1205 assesses whether the firm, the proposed investigator, or any current client relationship creates an actual or perceived conflict. Where independence could reasonably be questioned, the recommendation is a separate investigator or a different firm. That assessment is only meaningful if there is an individual attached to it, which is what makes decision 2 explicit rather than assumed.
A named person has to set scope before interviews rather than after. Someone who will sign findings allegation by allegation has to know, in advance, which allegations are in scope, which framework applies, and what evidence would resolve each one. A written plan precedes the first interview because the person writing the report needs it to exist.
A proposed investigator is identified before acceptance. Their role, relevant training, conflict position, methodology, and reporting responsibility should be explicit rather than inferred. Fees and expected timing can be scoped only after the parties, evidence volume, urgency, jurisdiction, availability, and any parallel legal or workplace process are understood.
The mandate has an edge, and the edge is stated. The investigation mandate is limited to independent fact-finding and the agreed report. Remediation, training, policy work, or HR support is separately scoped after findings are delivered, and only where independence, fairness, and your counsel permit it. An investigator who is also selling you the fix has an interest in the finding.
What no provider can offer you is an outcome. No firm can promise how a tribunal, arbitrator, or court will treat a particular report. What can be described is the process: a documented investigation process designed to support fair decision-making and independent review. Anyone telling you more than that about a matter they have not yet investigated is telling you something they cannot know.
For the record, apply the same test in this article to 1205 Consulting. Before accepting a mandate, we confirm the proposed investigator, role, relevant training, conflict position, jurisdiction, and availability. We are not a law firm and do not provide legal advice.
The 48-hour checklist
Hand this to whoever is holding the file. Each line names the window, the decision, and the artifact it has to produce.
- Hours 0 to 2 — record what was received, verbatim and dated, with your interpretation kept separate. Artifact: the intake note.
- Hours 0 to 4 — characterise the matter and identify which statutory framework applies. Artifact: a characterisation entry with reasons.
- Hours 2 to 6 — name the file holder and screen out the conflicts. Artifact: a custody and conflict-screen note listing who was excluded and why.
- Hours 4 to 8 — issue the preservation instruction. Artifact: the dated instruction, plus written confirmation it was actioned.
- Hours 8 to 24 — decide and document interim measures. Artifact: the measure, who it applies to, the rationale, and a review date.
- Hours 24 to 48 — decide the investigation model and the investigator. Artifact: a written scope naming the investigator, or a date by which the name will exist.
- Hour 48 — close the intake log. Artifact: a six-entry decision record, each entry dated.
If a step cannot be completed inside its window, record why. A documented delay is a different thing from a gap.
What the next 88 days look like
The Ministry of Labour's workplace harassment investigations guidance states that an incident should be investigated as soon as possible, ideally within 90 days or less, unless there is a compelling reason a longer investigation is needed — for example, multiple witnesses, or a key witness unavailable through illness. That is guidance rather than a statutory deadline, but it is the benchmark an inspector applies, and it is the number worth planning against. We unpacked the June 2026 refresh of that guidance, including the written-results obligation and an inspector's power to order an impartial investigator at the employer's expense, in our breakdown of the update.
Spend two days getting the six decisions right and you have 88 left to run a process. Spend two days avoiding them and you spend the 88 explaining the first two.
If a complaint has landed and you want a second view on the intake decisions before you commit to a path, that is a short conversation and it is worth having before the preservation window closes. Talk to us about the matter — you will get a view on which framework applies, whether the matter needs an external investigator at all, and where it belongs with employment counsel instead.
This article is general information and is not legal advice. Statutory duties, Ministry guidance, and procedural expectations change, and the right call on a specific matter turns on its facts — confirm current requirements against the OHSA and official guidance, and consult employment counsel on live matters. 1205 Consulting provides workplace investigation and HR advisory services; we are not a law firm.
Related reading: The Complete Guide to Workplace Investigations in Ontario · OHSA Investigation Obligations: Ontario Checklist · Am I Legally Required to Investigate? · Third-Party Workplace Investigations in Ontario · What Happens After a Workplace Investigation
