Planning and scoping templates
Investigation Evidence Log & Chain of Custody Template
Last updated 2026-07-30
The evidence log answers a question that comes up long after the investigation closes: where did this document come from, and who has touched it since? For physical and electronic material alike, an unbroken record of custody is what separates evidence from an assertion about evidence.
The log's second function is to record what you asked for and did not get. That column does more defensive work than any other part of the document, because it converts a gap in the evidence into a documented limitation.
Jurisdiction
Written primarily against US federal standards — EEOC guidance, NLRB decisions and Title VII case law — and against general investigative practice. State law, sector rules (public employers, education, regulated industries) and collective agreements impose additional requirements this page does not cover. Where a page borrows a concept from another jurisdiction it says so explicitly. Outside the US, treat the structure as transferable and the legal references as not.
Investigation Evidence Log template
Free Word download, no email required. Or open it in Professional Drafter — it lands in your template library, ready to draft against.
When to use this document
- Any investigation involving electronic evidence, CCTV, access logs or physical items.
- Matters likely to be litigated, audited or externally reviewed.
- Investigations where evidence is collected by more than one person.
Worked example
Fictional scenario, continuing the dispatch-team matter. Six entries from the log, including the two that matter most: an item whose provenance was recorded properly, and the request that came back empty.
Items 4 and 5 — provenance recorded
- Description:
- Message thread, respondent to complainant, 12 Feb – 2 May 2026. Message of 14 March reads 'looking good today, as always'.
- Source / custodian:
- Complainant, from her personal handset.
- Date requested:
- 9 Jun 2026 | Date received: 9 Jun 2026
- Format:
- Photographed in the interview with her consent; 6 images, PNG. Original device shown to me; I did not take an export.
- Stored:
- HR case drive, restricted to case team (3 named users).
- Relevant to:
- Allegations 1, 2
- Note:
- A photograph of a screen is a claim about a thread, not the thread. The complainant was willing to provide a full export if required. Recorded so that a later reviewer can see the limitation was identified rather than missed.
Item 4
- Description:
- Message, complainant to Witness A, 8 April 2026 — 'Said something to him yesterday, we'll see if it makes any difference.'
- Source / custodian:
- Complainant, personal handset.
- Date requested / received:
- 9 Jun 2026
- Relevant to:
- Allegation 2 — the only contemporaneous record bearing on sequence.
Item 5
Preservation steps
9 Jun 2026 — Asked the complainant and Witness A not to delete the threads at items 4 and 5 pending the investigation. Confirmed by both.
16 Jun 2026 — Requested Facilities suspend routine overwrite on Bay corridor CCTV. See item 7.
Item 7 — sought but not obtained (the entry that does the most work)
- Item sought:
- CCTV covering the corridor between the dispatch office and the loading bay, 15–20 April 2026.
- Requested from:
- Facilities Manager
- Date requested:
- 16 Jun 2026
- Response:
- 18 Jun 2026 — 'The corridor camera has been out of service since January 2026. There is no footage for any date in that range.' Confirmed in writing by email, logged as item 8.
- Also requested:
- door access logs for the same corridor. Response: no access control is fitted on that door.
- Consequence for the findings:
- Allegation 3 turns on a one-to-one account with no corroboration available from any source. This is the reason it is recorded as inconclusive rather than not substantiated.
This entry is why the log exists. Without it, the absence of CCTV in the final report looks like something nobody thought of. With it, the gap is a documented limitation with a date, a name and a reason.
Section-by-section guide
What each section is for, what a good one contains, and where they typically go wrong.
1.Log header
Matter identifiers and who maintains the log.
2.Evidence item (repeat per item)
One entry per item. The item number is what the report cites, so number them once and never renumber.
3.Preservation steps
Any legal hold issued, systems suspended from auto-deletion, and the date each step took effect. Where retention is short, note the deadline.
4.Evidence sought but not obtained
The most valuable section. Record what was requested, from whom, when, the response, and the effect on the analysis. This is what converts an evidential gap into a documented limitation.
5.Disclosure and retention
What will be disclosed to the parties, and how long the evidence will be retained after the matter closes. Retention should follow the organization's schedule and any litigation hold.
Common mistakes
The failure modes that show up most often when this document is reviewed later.
Logging evidence only when it arrives
The request date matters as much as the receipt date. A three-week gap between them is a fact a reviewer may care about.
Accepting screenshots without provenance
A screenshot of a message thread is a claim about a message thread. Record who produced it, from which device or account, and whether the original was available.
Renumbering items mid-investigation
Every cross-reference already written into notes and drafts silently breaks.
Questions
- A party has produced a covert recording. Can I use it?
- Take advice before you listen to it. Recording consent is governed by state law and the rules differ — some states require all parties to consent, others only one — and the answer can turn on where each participant was. Separately from legality, using it has consequences: it tells the other party they were recorded, and it may breach your own policies. Log its existence, its source and the date it was offered, and get a decision before it becomes part of the evidence.
- How do I handle Slack, Teams and messages on personal devices?
- Define the export scope in writing before you request anything — custodians, date range, channels — because an over-broad pull creates its own problems. Note the difference between what an administrator can retrieve and what an employee voluntarily produces, and record which you have. Deleted-message retention varies by platform and plan, so check the retention setting rather than assuming, and treat a screenshot of a thread as a claim about a thread until you have the export.
- Do internal HR investigations need a chain of custody?
- Not with the formality of a criminal matter, but the underlying question is the same: can you show where this came from and that it has not been altered? For electronic evidence in a matter that may be litigated, record source, date, format and storage at minimum.
- What should we do about CCTV or access logs?
- Request them immediately and check the retention period on day one. These systems commonly overwrite within weeks, and evidence lost to a retention schedule is indistinguishable in hindsight from evidence nobody sought.
The blank template
Exactly what is in the Word download, so you can see the structure before deciding whether you want it.
Log header
Evidence item (repeat per item)
Preservation steps
Evidence sought but not obtained
Disclosure and retention
Download this template
Free Word download, no email required. Or open it in Professional Drafter — it lands in your template library, ready to draft against.
Related templates
Workplace Investigation Plan Template & Example
An investigation plan template covering scope, allegations, witnesses, evidence, sequencing and interim measures — written before the first interview.
Allegation Matrix Template & Example
An allegation matrix template that tracks every allegation to its evidence and its finding, so nothing is left unaddressed in the final report.
Policy & Code of Conduct Investigation Report Template
A policy or code-of-conduct breach investigation template — for expenses, timekeeping, misuse of systems, conflicts of interest and similar rule-based allegations.
This page is a documentation aid, not legal advice. Workplace investigation requirements vary by jurisdiction, sector and policy, and a template cannot tell you what your matter requires. The worked example describes a fictional scenario.