The investigation nobody documents: the step that wins or loses your case before the hearing starts

A cash-up comes in R3,000 short on a Tuesday. The owner knows who was on the till. She calls the cashier in on Wednesday, asks her about it, gets a flustered denial, decides she does not believe it, and schedules a disciplinary hearing for Friday. At the hearing she reads out a charge of theft, the cashier again denies it, and the owner dismisses her.

There was never an investigation. There was a suspicion, a confrontation, and a foregone conclusion. At the CCMA, the arbitrator will ask the owner a simple question: what did you do to establish what actually happened before you charged her with theft? The honest answer is "nothing" — and a shortfall on a till is not, on its own, proof that any particular person took the money. The dismissal fails on the merits, not because the cashier was innocent, but because the employer never built a case.

This is the stage employers skip. It is also the stage that decides everything that comes after it.

What the Code actually says about investigations

Here is the line that gets misread more than any other in the whole Code of Good Practice: Dismissal (GN 3470, GG 53294, 4 September 2025):

An investigation or enquiry does not have to be formal. Its nature should be appropriate to the circumstances, including the type of allegation and the nature and size of the employer.

That is Item 11(3), and small employers hear it as a reprieve — I don't have to do a formal investigation, so I don't really have to do one at all. That is the wrong reading, and it is an expensive one.

The Code is not telling you the investigation is optional. It is telling you the investigation does not have to look like a courtroom. You do not need an external investigator, a formal commission, sworn statements, or a week of interviews. What you do need is to have actually found out what happened before you decide someone is guilty of it. "Informal" describes the form, not the existence.

The Code reinforces this for small businesses specifically. Item 3 says that "small businesses cannot reasonably be expected to engage in time-consuming investigations or pre-dismissal processes while at the same time keeping the business going," and that anyone judging fairness must take the realities of a small operation into account. This is genuine protection — a five-person business is not held to the standard of a corporate HR department. But it is protection against disproportionate process, not against doing the basic work of establishing facts.

Why the investigation is the part that matters

Every dismissal has to pass two tests at the CCMA: was there a fair reason (substantive fairness), and was it done through a fair procedure (procedural fairness). Item 5 of the Code states it plainly: "A dismissal is fair if it is for a fair reason and in accordance with a fair procedure."

The hearing — the notice, the charge sheet, the right to representation — is mostly about the procedure. We covered the procedural side in detail in The 48-hour rule: why 'reasonable notice' sinks more dismissals than you think. But a procedurally perfect hearing cannot save a case that has no substance behind it. And substance is built in the investigation, before a single notice goes out.

The investigation is where you answer the questions Item 8 of the Code says determine whether a sanction is fair:

Was there actually a rule or standard, and did the employee break it?
Was the rule valid and reasonable?
Did the employee know about it, or could they reasonably be expected to?
How important is the rule, and what harm did the breach cause?
Has the rule been applied consistently to other employees?
Is dismissal an appropriate response to this breach?

You cannot answer a single one of those at the hearing if you have not done the work beforehand. The hearing tests your case. The investigation is your case.

The two ways employers get it wrong

There are two opposite failure modes, and small employers fall into both.

Under-investigating: the foregone conclusion. This is the till-shortfall owner. A suspicion hardens into certainty without any evidence-gathering in between. No CCTV pulled, no other staff spoken to, no check of whether the shortfall pattern points to one person or several, no consideration of an honest error. The employee is charged with the most serious possible offence on the thinnest possible basis. At arbitration the employer cannot discharge the onus — and in misconduct dismissals, the onus is always on the employer — because there is nothing to discharge it with.

Over-investigating: the trial before the trial. This is the opposite mistake, and it is its own kind of unfair. The employer turns the investigation into a full interrogation: hours of questioning, demands for written explanations, confrontations with evidence, sometimes with the employee believing the matter is already being decided. By the time the formal hearing arrives, the employee has effectively been tried twice, and the "investigation" has prejudged the outcome. Item 11(1) says the purpose of a fair procedure is "a genuine dialogue and an opportunity for reflection before any decision is taken." An investigation conducted as a guilt-extraction exercise is the opposite of reflection.

The right posture sits between the two: do enough to know whether you genuinely have a case, keep it proportionate to the seriousness and complexity of the allegation, and keep an open mind until the hearing has actually happened.

What a proportionate investigation actually looks like

For most misconduct at a small business, a sound investigation is a few hours of work, not a few weeks. The principle is proportionality: a late-coming charge needs a glance at the clock-in records; an alleged R50,000 fraud needs document trails, reconciliations, and witness accounts.

A proportionate investigation does the following:

Establishes what the rule was. Written policy, a clause in the contract, a standing instruction, or a workplace norm everyone understands. If you cannot point to the rule, you do not yet have a misconduct case.
Gathers the available evidence while it is fresh. CCTV footage before it is overwritten, till records, access logs, emails, photographs, damaged goods, delivery notes. The single most common evidentiary loss we see is CCTV that auto-deleted on a 7-day cycle because nobody pulled it in time.
Takes brief accounts from anyone who saw what happened. A short signed note of what each witness says, dated, is worth far more at arbitration than a manager's memory six months later. Witnesses leave, forget, and change their stories.
Considers the innocent explanation. Before you charge, ask whether there is a non-misconduct account that fits the facts — an error, a system fault, an authorised exception, a misunderstanding. If you have not ruled it out, your case is not ready.
Checks consistency. Item 10 of the Code requires the sanction of dismissal to be applied consistently. If three other employees did something similar last year and got written warnings, the investigation is the moment to discover that — not the arbitration, where the other side will raise it for you.
Decides whether there is a case to answer at all. The honest possible outcome of an investigation is "there is not enough here to charge." Reaching that conclusion is the investigation working, not failing.

Notice what is not on this list: a formal hearing, cross-examination, a chairperson, or a finding of guilt. Those belong to the disciplinary enquiry that comes after. The investigation gathers; the enquiry decides.

A note on the investigatory suspension

Owners often want to suspend the employee while they investigate, and that is frequently appropriate — especially where the employee could interfere with evidence or witnesses, or where their presence is genuinely untenable. Two points keep a precautionary suspension fair: it must be on full pay (an unpaid suspension before any finding is itself a penalty imposed before guilt), and it must be genuinely precautionary and time-limited, not an open-ended punishment dressed up as a process step. A suspension that runs for two months "while we look into it," on no pay, will draw its own unfair-labour-practice complaint regardless of how the misconduct case ends.

Document it, or it did not happen

Everything above is worth nothing at the CCMA if there is no record of it. The arbitrator was not in your warehouse on the Tuesday. The only version of the investigation that exists at arbitration is the one you can produce in writing.

This is where the Notice of Investigation earns its place. It is not a charge — it tells the employee that an allegation is being looked into, what it broadly concerns, and gives them the chance to put their side before any decision to charge is taken. It also creates the dated paper trail that proves the investigation happened, when, and what it covered. Pair it with your signed witness notes, the preserved evidence, and a short written record of your findings, and you walk into the hearing — and later the CCMA — with a case that exists on paper rather than in your memory.

The practical checklist

Before you issue a charge sheet, your investigation should have produced:

A clearly identified rule or standard that was allegedly breached, and where it comes from.
The available physical and documentary evidence, preserved — CCTV pulled before it overwrites, records exported, items photographed.
Brief signed and dated accounts from any witnesses, taken while memories are fresh.
An honest consideration of the innocent explanation, and a reason it does not hold.
A consistency check against how similar matters were handled before.
A documented decision on whether there is a case to answer — and the integrity to stop if there is not.
A Notice of Investigation on file, giving the employee early sight of the allegation and a chance to respond before charges are framed.

The Code lets you keep all of this proportionate and informal. It does not let you skip it. The employers who lose at the CCMA on the merits almost never lose because they investigated badly — they lose because, when the arbitrator asked what they did to find out what happened, the truthful answer was "I already knew."

CasePilot walks you through the investigation stage before you ever issue a charge — generating the Notice of Investigation under the correct GN 3470 citation, capturing the employee's response, prompting you to preserve evidence and check consistency, and logging the whole trail into your CCMA bundle. Start a free 7-day trial — no credit card required.

This article was generated by CasePilot as general guidance and does not constitute legal advice. Consult a qualified labour law practitioner for advice on a specific matter.