Workplace Investigation Services

Updated 5 October 2026 by Investigation Bureau

Independent, lawful investigation of what an employee is really doing: sickness-absence abuse, moonlighting, theft and misconduct. The evidence is gathered to the standard an employment tribunal expects and handed to your HR team or solicitor to act on.

Employers tend to look for an investigator at the point where they are sure something is wrong and have no means of proving it. The instinct is usually right, but what they hold is hearsay. Challenge someone on hearsay and a dishonest employee can end up as a successful unfair-dismissal claimant.

Describe the pattern to us in a confidential enquiry. The first conversation is free, we reply within one working day, and we will tell you honestly whether it is worth investigating.

What we investigate

Long-term sickness-absence abuse. One of the most common reasons a UK employer instructs an investigator: an employee certified unfit for work who is visibly active elsewhere, whether working, running a business, playing sport or travelling. Our illustrative case story about a long-term absence shows how such a case runs.

Moonlighting and competing employment. Staff doing a second job in your time, or running a competing business with your clients, your equipment or your hours.

Theft, stock and cash leakage. Shrinkage that follows one person's shifts. Goods that leave in the right van at the wrong time.

Expenses and mileage fraud. Claims that cannot be reconciled with diaries, locations or reality.

Misconduct, harassment and grievance support. Independent fact-finding where an internal investigator would be conflicted, or where the allegations are contested.

Suspected breach of restrictive covenants. Departing employees who may be ignoring their covenants, often investigated alongside our corporate investigations work.

The patterns employers describe

Employers rarely begin with proof. They begin with a pattern that can no longer be ignored. These are the common ones.

The absence that looks like a holiday. Sick notes that arrive the day after leave was refused, or that reliably sit either side of a weekend. Certified incapacity alongside a visible second life: a side business, a sport, a house renovation. Colleagues who knew months before HR did.

The employee who never takes a day off. This is the opposite sign, and the classic marker of invoice, supplier or stock fraud. The person will not take annual leave, will not delegate and reacts out of proportion to ordinary questions about their records. Fraud needs gatekeeping to survive. Our guide to the signs an employee is committing fraud goes further.

The van that goes the long way round. Field and mobile staff whose tracked mileage, delivery windows and fuel spend do not reconcile, often because a second job is being run inside the hours you pay for.

Losses that track the rota. Shrinkage that clusters on certain shifts, at certain sites, under certain supervisors. The pattern can usually be seen in your own data before anyone observes anything.

The resignation that takes the client list with it. A departure, then clients drifting in the same direction, a new venture that looks familiar and a restrictive covenant that nobody expects to be enforced.

On its own, none of these is proof. Every one of them is a reason to get the facts established properly before an accusation is made.

What a workplace investigation involves

Most of the work is undramatic. It is disciplined observation, careful analysis of records and a documented trail of decisions.

Reconnaissance and planning. Before anyone deploys, we establish the subject's routine, the geography and what a realistic observation window looks like. Investigations get noticed when the first day is badly planned.

Covert observation of activities in public. Operatives on foot and in vehicles record what the person does where anyone could see it: leaving home, working somewhere else, doing things that are inconsistent with a medical restriction. Everything is timestamped and continuous, so the footage shows context and not a convenient clip.

Verification of second employment. We establish lawfully whether someone is working elsewhere, using publicly advertised trading, company records, open-source evidence and observation of the person attending and working.

Open-source research. Publicly visible online activity, corporate records and public registers. Never private accounts, never deception, never access to a device.

Analysis against your own records. Rotas, expense claims, mileage, access logs and stock data that you already lawfully hold, read against what we observed.

What you receive

The report is written to stand alone. It contains a factual chronology of what was observed and when, timestamped video and stills with the continuous footage retained, the operatives' contemporaneous notes, a chain-of-custody record and the documented proportionality assessment that justified the method. It is written to go straight to your employment solicitor or before a disciplinary panel, and the investigator can attend to give evidence if a tribunal requires it.

Speculation has no place in it. If the surveillance shows an employee who is genuinely unwell and doing nothing inconsistent with the certificate, that is what the report says. It is worth having. It closes the question and protects you from a very expensive mistake.

Sectors where this work arises

Cost, and how quickly we can start

Most workplace cases need one to three days of surveillance. Typical UK market rates are £500 to £1,200 per operative per day, including vehicle, equipment and reporting. You receive a fixed quote in writing before any work begins, so the cost cannot drift. We can usually deploy within days. Tell us if it is urgent, for example where a holiday has been booked during certified sickness or a notice period is about to end.

Set against a full-time salary paid through a fraudulent absence, continuing stock loss or an unfair-dismissal claim built on inadequate evidence, the sum rarely takes long to do. Our guide to investigation costs gives fuller context.

Five mistakes that cost employers their case

  1. Challenging the person too soon. The most expensive error of all. Once the person has been confronted, the behaviour stops, records are tidied and stories line up.
  2. Casting the net too wide. Blanket monitoring is neither lawful nor proportionate. A targeted investigation based on documented reasonable suspicion is both.
  3. Letting the accuser run the investigation. If the manager who raised the concern also gathers the evidence, the process is contaminated before it begins.
  4. Failing to preserve what you already hold. Rotas, expense claims, access logs and footage from CCTV you lawfully operate can be overwritten while you deliberate.
  5. Widening the circle. Investigations die through leaks. Keep the knowledge to those who have to have it.

How we work with HR and employment lawyers

  1. Scoping conversation. What you suspect, what you already hold and what a tribunal would need. If the evidence you have is already enough, we tell you, and that conversation costs nothing.
  2. Proportionality assessment. UK GDPR and the ICO's employment guidance permit investigation on reasonable suspicion where it is targeted and documented, not speculative or blanket. We record the assessment because it is the first thing tested if the case is challenged.
  3. Lawful evidence gathering. Covert observation of activities in public places, verification of second employment and open-source research. Never access to a device, and never deception about anything material.
  4. Tribunal-ready reporting. Timestamped video and stills, contemporaneous notes, chain of custody and a written report that your HR team or employment solicitor can put straight into a disciplinary process. We can attend to give evidence where required.

The order matters more than anything else: the evidence comes first and the meeting second. Once someone has been challenged, the pattern stops and the accounts start to match.

Frequently asked questions

Is it legal to put an employee under surveillance in the UK?

Yes, within limits. Covert surveillance of what an employee does in public places is lawful where there is reasonable suspicion of wrongdoing, a legitimate aim such as protecting the business from fraud, and an approach that is proportionate and documented. It is not lawful as a fishing expedition or as general monitoring. Making that judgement correctly is a central part of what you instruct us to do.

Will the evidence stand up at an employment tribunal?

Evidence that was obtained lawfully and proportionately is used in tribunals routinely. Method and documentation decide the matter: covert footage of public activity, gathered on reasonable suspicion, with a proper chain of custody and a proportionality assessment that can be defended. Your solicitor runs the procedure. Our job is to make the evidence beneath it as hard to challenge as it can be.

Can we check an employee's social media?

Publicly visible content, yes, and public posts made during certified sickness are often decisive. Getting into private accounts by deception, fake friend requests or borrowed logins is unlawful, and it taints everything connected to it.

What does a workplace investigation cost?

Most cases need one to three days of surveillance. Typical UK market rates are £500 to £1,200 per operative per day, including vehicle, equipment and reporting, and you receive a fixed quote in writing before any work begins. Measured against a salary paid during a fraudulent absence, or stock that keeps disappearing, an investigation usually pays for itself quickly. See our cost guide.

Do you work with our HR team or replace it?

Alongside it, never in place of it. We gather the evidence independently. Your HR team and employment solicitor own the disciplinary process. That separation is what makes the outcome defensible, because the decision rests on third-party evidence and not on a manager's suspicion.

Do we have to tell the employee they are being investigated?

Not in advance, where telling them would defeat the purpose. That is the basis on which covert investigation is permitted at all. You do have data-protection obligations to the employee, and the ICO expects covert monitoring to be exceptional, targeted, time-limited and documented. Handled like that, it is lawful. Used as routine surveillance, it is not. The proportionality assessment we record is the evidence of the difference.

How long does a workplace investigation take?

A typical case takes two to three weeks from instruction: a few days to plan and deploy, one to three days of observation, then the report. Cases that hinge on a particular event, such as a booked holiday, a match fixture or a trading day, are scheduled around it. If the pattern you describe would take weeks of watching to prove, we will usually tell you it is not worth the money.

What if the investigation clears the employee?

You receive a report that says so, and that is a good outcome. It ends a suspicion that was damaging the working relationship, it stops you acting on a false assumption and it gives you a documented basis for closing the matter. We are paid to establish the facts, not to confirm what you were hoping for.

Can we use the evidence to dismiss someone?

Evidence underpins a fair process. It is not a substitute for one. Your employment solicitor or HR lead still has to hold a proper investigation meeting, put the evidence to the employee, hear the explanation and follow your disciplinary procedure. What our report does is make sure the facts underneath that process are independent, timestamped and hard to dispute.

Do you investigate bullying, harassment or grievance complaints?

Yes, as independent fact-finders, where an internal investigator would be conflicted, the allegations are contested or the outcome is likely to end in litigation. That work is based on interviews and evidence and not on surveillance, and the report is written for the decision-maker, not for either party.

Something not adding up at work. Describe the pattern to an investigator, free, in confidence and without obligation. You will get an honest view of whether it can be proved and what it would cost: send a confidential enquiry.

Related reading: Employee working a second job while off sick? · Signs an employee is committing fraud · What is executive due diligence? · A long-term absence case story · Corporate investigations