You have just learned that an employee is complaining of sexual harassment by a co-worker via email.  What should you do first, or at least at the very top of the list?  

Take steps to insure that the accused harasser does not have access to any of the evidence supporting the alleged victim’s claims.  For example, you want to immediately preserve evidence before emails can be deleted from computers and servers.  The IT staff of the employer should be notified immediately so the evidence can be procured off the employer’s servers.  

I once investigated a case where the accused harasser was in charge of IT and all of the settings on the company’s server were scheduled to delete emails off the server after only a few hours.  IT experts were later hired by the company and even they could not retrieve that evidence!  Another investigation could have been resolved easily by viewing the surveillance tapes of a particular hallway and office entrance on a particular date.  However, the employer did not preserve the video evidence and it was taped over before I was ever called upon to conduct the investigation.  

Employers might want to consider adding a "preservation of evidence" policy to any policies they might already have concerning workplace investigations.  For instance, some employers have a written policy in their employee handbook that requires all employees to cooperate in internal investigations of the employer.  The additional policy might state that employees are prohibited from destroying any documentation that could in any way be relevant to a workplace investigation should they be put on notice of an investigation.

Once the employer and/or investigator determines which documents may be relevant during the investigation, the employer might want to issue a "preservation order" to each witness or party who may have access to any relevant evidence.  If any employee is later found to have knowingly tampered with the evidence, after receiving a preservation order, it makes it much easier to terminate that employee since the employee was put on notice.

Another consideration is to block the accused harasser from accessing his computer or the network from off-site.  An employee with computer software allowing him/her to access the employer’s computer network from offsite (LogMeIn, pcAnywhere, GoToMyPC, and many others) needs to be locked out by the IT staff immediately.  If the accused harasser is to be placed on administrative leave pending the outcome of the investigation, this computer lock out should be done before the accused harasser is advised of the charge against him/her.  

Each of these steps should be witnessed by the investigator and documented in the investigator’s report or file notes.

The investigator also needs to insure that the chain of custody is documented for physical evidence obtained. The investigator should keep note of when and how physical evidence was obtained, who has handled it, who else was present (witnesses) during the evidence collection process, where and how it was transported, and where it has been stored during the pendency of the investigation up until the time the matter is resolved.  

Failing to properly document the chain of custody could result in information becoming inadmissible in court.