Reference: shared framework for managing internal investigations from intake through final memo — privileged investigation log, document processing with needle-finding, source coverage tracking, Q&A against the log, memo drafting, and audience summaries. Loaded by $employment-legal:investigation-open, $employment-legal:investigation-add, $employment-legal:investigation-query, $employment-legal:investigation-memo, and $employment-legal:investigation-summary; not invoked directly.
Reference: shared framework for managing internal investigations from intake through final memo — privileged investigation log, document processing with needle-finding, source coverage tracking, Q&A against the log, memo drafting, and audience summaries. Loaded by $employment-legal:investigation-open, $employment-legal:investigation-add, $employment-legal:investigation-query, $employment-legal:investigation-memo, and $employment-legal:investigation-summary; not invoked directly.
Codex v1 local-input note: This migrated skill supports local files and pasted text by default. References to Drive, CLM IDs, Slack, Westlaw, iManage, Ironclad, eDiscovery, dockets, or other remote systems require a separately configured Codex connector/MCP server. When a connector is unavailable, ask for a local export, local file path, or pasted excerpts. If config/local/codex-for-legal/<practice>/CLAUDE.md is missing, ask the user to run the relevant cold-start-interview or customize skill and copy from config/templates/codex-for-legal/<practice>/CLAUDE.md.
Internal Investigation Skill
Matter context
Matter context. Check ## Matter workspaces in the practice-level CLAUDE.md. If Enabled is ✗ (the default for in-house users), skip the rest of this paragraph — skills use practice-level context and the matter machinery is invisible. If enabled and there is no active matter, ask: "Which matter is this for? Run $employment-legal:matter-workspace switch <slug> or say practice-level." Load the active matter's matter.md for matter-specific context and overrides. Write outputs to the matter folder at config/local/codex-for-legal/employment-legal/matters/<matter-slug>/. Never read another matter's files unless Cross-matter context is on.
Output header
Prepend the work-product header from config/local/codex-for-legal/employment-legal/CLAUDE.md → ## Outputs (it differs by user role — see ## Who's using this). Every file, log, memo, and summary produced by this skill opens with that header.
Distribution discipline. Every file this skill creates — log entries, memo drafts, audience summaries, document notes — inherits the privilege and confidentiality status of the underlying investigation. Distribution beyond the privilege circle (forwarding to non-attorneys outside the investigation team, cc'ing HR without scoping, handing to the business side) can waive privilege over the entire investigation. Store these files where privileged materials live, label per the work-product header, and make every distribution decision deliberately.
⚠️ Privilege notice — read before proceeding
Marking does not create privilege. The header above reflects the intended
protection and is important to include — but it does not itself establish
privilege. Whether any given output is actually privileged depends on whether
the investigation is attorney-directed, the purpose for which documents are
created, and how they are subsequently used or disclosed.
Before opening a matter, confirm: Is this investigation attorney-directed?
If it is not — if HR is running it with legal in an advisory role, or if it was
not initiated at the direction of counsel for the purpose of obtaining legal advice —
the privilege analysis changes materially and this skill's default labeling may
be misleading. Flag that question to the attorney before creating any log or file.
If there is any doubt about privilege applicability, the attorney should resolve it
before investigation files are created. Improperly labeled materials can create
problems in discovery if privilege is later challenged.
Purpose
Internal investigations fail in two ways: coverage gaps (sources that were
never gathered) and synthesis gaps (evidence that was gathered but never
connected). This skill handles both — it tracks what has and hasn't been
gathered, processes document dumps to surface what matters without burying
the attorney, and maintains a structured log that can be turned into a
privileged memo at any point.
Privilege note
All files created by this skill carry the privilege marking above.
See the notice at the top of this skill for the full caveat on what that
marking does and does not do.
Load context
Read config/local/codex-for-legal/employment-legal/CLAUDE.md → escalation table, any investigation protocols noted.
Mode 1: Open a new matter
Triggered by $employment-legal:investigation-open or "open an investigation"
or "start an investigation into".
Step 1 — Intake
Ask the following in a single block:
To open the investigation log I need a few things:
The matter
What is the allegation or concern in plain terms?
Who is the complainant (or what triggered this — complaint, tip, audit,
manager observation)?
Who is the respondent or subject?
What is the approximate timeframe the alleged conduct occurred?
Is this attorney-directed? (If yes: work product protection applies.
If no: flag privilege risk before proceeding.)
Investigation type (helps me suggest the right sources checklist)
Executive misconduct: COI / undisclosed relationships / governance failures
Whistleblower: retaliation for protected activity
Other: describe briefly
Representation and employer status (surfaces parallel legal frameworks
that change interview procedure)
Is the respondent, the complainant, or any anticipated witness represented
by a union or covered by a collective bargaining agreement? (If yes, flag
for Weingarten research — representational rights at investigatory
interviews may apply and change the interview protocol.)
Is the company a public employer (government entity, public university,
state or municipal agency) or otherwise acting under color of state law?
(If yes, flag for Garrity research — compelled statements in public-sector
investigations have special use-immunity consequences and change how
interviews must be conducted and documented.)
If either flag fires, research the applicable rules (NLRA / state
public-sector labor statutes for Weingarten; 5th Amendment and the Garrity
line of cases, plus any state analogs) before conducting interviews. Cite
primary sources. Verify currency. Do not interview until the protocol is
adjusted.
# [WORK-PRODUCT HEADER — per plugin config ## Outputs — differs by role; see `## Who's using this`]matter:"[matter name]"matter_slug:"[slug]"opened:"[ISO date]"attorney_directed: [true/false]
allegation:"[plain-language summary]"complainant:"[name/role or anonymous]"respondent:"[name/role]"conduct_timeframe:"[approximate dates]"investigation_type:"[HR/financial/executive/whistleblower/other]"status:openlast_updated:"[ISO date]"issues:-"[Issue 1 — derived from allegation, e.g. 'alleged hostile work environment']"-"[Issue 2 if applicable]"entries: []
evidentiary_gaps: []
# [WORK-PRODUCT HEADER — per plugin config ## Outputs — differs by role; see `## Who's using this`]matter:"[matter name]"total_reviewed:0total_surfaced:0last_updated:"[ISO date]"documents: []
Step 3 — Sources checklist
Generate the appropriate checklist based on investigation type. Present it
to the attorney and ask: "Does this fit your matter? Let me know if any items
are not applicable (I'll mark them N/A) or if there are additional sources
specific to this situation."
sources:-id:1source:"Complainant interview"status:opennotes:""-id:2source:"Respondent interview"status:opennotes:""-id:3source:"Witness interviews — identify from complainant and respondent accounts"status:opennotes:""-id:4source:"Email/messaging review — parties, relevant date range"status:opennotes:""-id:5source:"HR records — respondent's performance history, prior complaints,
prior discipline"status:opennotes:""-id:6source:"Prior complaints — any prior complaints against respondent in
HR system"status:opennotes:""-id:7source:"Comparator data — how were similar situations handled"status:opennotes:""-id:8source:"Relevant policies — harassment, code of conduct, reporting
procedures (version in effect at time of alleged conduct)"status:opennotes:""-id:9source:"Org chart and reporting relationships at time of alleged conduct"status:opennotes:""-id:10source:"Calendar records — any meetings or events mentioned in accounts"status:opennotes:""-id:11source:"Upjohn warning documentation — confirm interviews were preceded
by Upjohn warnings and documented"status:opennotes:""
Financial misconduct sources:
sources:-id:1source:"Expense reports — subject, relevant period"status:opennotes:""-id:2source:"Approval records — who approved the expenses or transactions"status:opennotes:""-id:3source:"Vendor/contractor records — contracts, invoices, payment records"status:opennotes:""-id:4source:"Financial system records — AP, GL entries for relevant accounts"status:opennotes:""-id:5source:"Email/messaging review — subject, approvers, counterparties"status:opennotes:""-id:6source:"Subject interview"status:opennotes:""-id:7source:"Approver interviews"status:opennotes:""-id:8source:"Counterparty/vendor interviews (if accessible)"status:opennotes:""-id:9source:"Audit logs — system access logs for relevant accounts/systems"status:opennotes:""-id:10source:"Prior audits or reviews covering the relevant period"status:opennotes:""-id:11source:"Upjohn warning documentation"status:opennotes:""
Executive misconduct sources:
sources:-id:1source:"Subject interview"status:opennotes:""-id:2source:"Board/compensation committee records — relevant resolutions,
minutes, approvals"status:opennotes:""-id:3source:"Employment agreement and any amendments"status:opennotes:""-id:4source:"Equity records — grants, exercises, vesting"status:opennotes:""-id:5source:"Expense reports and approval records"status:opennotes:""-id:6source:"Email/messaging review — subject, relevant counterparties"status:opennotes:""-id:7source:"Conflict of interest disclosures (or absence thereof)"status:opennotes:""-id:8source:"Outside business activity records"status:opennotes:""-id:9source:"Witness interviews — direct reports, peers, board members"status:opennotes:""-id:10source:"Prior complaints or concerns raised about subject"status:opennotes:""-id:11source:"Upjohn warning documentation"status:opennotes:""
Whistleblower sources:
sources:-id:1source:"Complainant interview"status:opennotes:""-id:2source:"Original complaint or tip — written form if exists"status:opennotes:""-id:3source:"Records related to the underlying allegation (the thing
complainant blew the whistle on)"status:opennotes:""-id:4source:"Records related to any adverse action taken against complainant
after the protected activity"status:opennotes:""-id:5source:"Decision-maker interviews — who made the adverse action decision"status:opennotes:""-id:6source:"Comparator data — treatment of similarly situated employees
who did not engage in protected activity"status:opennotes:""-id:7source:"Email/messaging review — decision-makers, relevant timeframe"status:opennotes:""-id:8source:"Timing analysis — proximity of protected activity to adverse
action"status:opennotes:""-id:9source:"Respondent/decision-maker interviews"status:opennotes:""-id:10source:"Upjohn warning documentation"status:opennotes:""
After presenting the checklist, write it to
config/local/codex-for-legal/employment-legal/investigation-[slug]/sources-checklist.yaml.
Mode 2: Add data
Triggered by $employment-legal:investigation-add or "add to the [matter]
investigation" or when the attorney pastes documents or interview notes.
Step 1 — Identify the matter
If multiple investigation folders exist in config/local/codex-for-legal/employment-legal/, ask which matter this
data belongs to. If only one, proceed.
Step 2 — Identify the data type
Ask (if not clear from context):
Interview notes (whose interview?)
Document batch (emails, records, files)
Attorney notes or observations
Upjohn warning confirmation
Step 3 — Document pull criteria
For any document batch, apply the following pull criteria. A document is
surfaced if it meets ANY of the following. The criteria are intentionally
set to pull slightly aggressively — it is better to surface a false positive
than to miss a significant item.
Pull criteria:
Contains the name of any party to the investigation (complainant,
respondent, witnesses named in prior log entries)
Was authored or received by a party during the key conduct timeframe
Contains keywords related to the allegation type (identified at intake
and from prior log entries — update the keyword list as new terms emerge
from accounts)
Contains explicit or implicit admissions ("I shouldn't have," "I know
how this looks," "don't put this in writing," "delete this")
Contains language contradicting any account already in the log — flag
the specific contradiction and the log entry it conflicts with
Contains language that would be sensitive in litigation: discriminatory
terms, threats, discussions of protected characteristics or activities,
financial irregularities matching the allegation pattern
Is a document type that has been mentioned in prior accounts but has
not yet appeared in the document set (e.g., a meeting was mentioned in
an interview but no calendar invite has been reviewed) → log as
evidentiary gap, not a surfaced document
Disposition for every document reviewed:
surfaced: meets one or more pull criteria — added to log as a log entry
reviewed-nothing-significant: reviewed, does not meet pull criteria —
logged in documents-reviewed.yaml with one-line description only
After processing a document batch, report:
Document review complete.
Reviewed: [N] documents
Surfaced: [N] as potentially significant
Logged as reviewed / nothing significant: [N]
New evidentiary gaps identified: [N]
Surfaced items:
[list with one-line description and which pull criterion triggered]
This report is the answer to "what about missed needles." The pull criteria
are documented, the surface ratio is visible, and the attorney can review
the full document log at any time. In Q&A mode, "I have not seen any document
on [topic] in the [N] documents reviewed" is a meaningful statement only
because every document reviewed is logged.
Step 4 — Write log entries
For each surfaced item, append to log.yaml:
-entry_id: [auto-increment]
entry_type: [interview/document/attorney-note/gap]
date_of_event:"[date the event occurred — not when logged]"date_logged:"[ISO datetime]"source:"[witness name/role, or document filename/description]"source_type: [complainant/respondent/witness/document/attorney-note]
issues: ["[which investigation issue(s) this entry relates to]"]
significance: [high/medium/background]
summary:"[what this entry adds to the record — 2-5 sentences]"quote:"[verbatim quote if significant — otherwise empty]"contradicts_entry: [entry_idornull]
corroborates_entry: [entry_idornull]
credibility_note:""pull_criterion:"[which criterion triggered — for documents]"privilege:attorney-work-product
For evidentiary gaps:
-gap_id: [auto-increment]
description:"[what document/source should exist but hasn't been found]"identified_from:"[which log entry or account raised this]"source_to_obtain:"[where to get it]"priority: [high/medium/low]
status:open
Step 5 — Update sources checklist
If the data added corresponds to a checklist item, ask the attorney if it
should be marked complete or in-progress. Do not auto-mark complete —
the attorney decides when a source is adequately covered.
Mode 3: Query the log
Triggered by $employment-legal:investigation-query or any question
phrased against the investigation (e.g., "what did [witness] say about",
"what documents corroborate", "what do we still need", "what's the
strongest evidence on each side").
Read the full log before answering. Answer types:
Factual query ("what did X say about Y"):
Answer from the log entries, citing entry IDs. If the log contains nothing
on the topic: "I have not seen any information on [topic] in this
investigation log ([N] entries reviewed). This may be worth flagging as
a gap."
Conflict query ("where do accounts conflict"):
Surface all contradicts_entry links. For each conflict: state what the
conflict is, which entries are in tension, and what (if any) documentary
evidence bears on the conflict.
Coverage query ("what do we still need" / "what are our gaps"):
Read sources-checklist.yaml and evidentiary_gaps in log.yaml. Report:
Checklist items still open
Evidentiary gaps logged
Any accounts that reference sources not yet gathered
Strength query ("what's the strongest evidence on each issue"):
For each issue in the log, identify: the highest-significance log entries,
any documentary corroboration, and any unresolved conflicts. Present
issue by issue.
Upjohn query ("have we documented Upjohn warnings"):
Check checklist item and any log entries tagged as Upjohn documentation.
Flag if not yet completed.
Mode 4: Draft or update the memo
Triggered by $employment-legal:investigation-memo or "draft the memo"
or "update the memo".
If no memo exists — first draft
Read the full log. Do not draft until the following are complete (warn if
not):
At least one entry for each open issue
Complainant and respondent entries present
Sources checklist reviewed (flag any high-priority open items)
Draft the memo in the following structure, following standard internal
investigation memorandum practice:
[WORK-PRODUCT HEADER — per plugin config ## Outputs — differs by role; see `## Who's using this`]
---
**MEMORANDUM**
To: [Attorney to fill in]
From: [Attorney to fill in]
Date: [Date]
Re: Internal Investigation — [Matter name]
Status: PRELIMINARY DRAFT
---
## Executive Summary
[2-3 paragraphs: allegation in plain terms, investigation scope and
methodology summary, key findings in bullet form (Sustained / Not
Sustained / Inconclusive), recommended actions. Written last but
appears first.]
---
## Background and Scope**Triggering event:** [What initiated the investigation]
**Allegations investigated:**
[Each issue from the log as a numbered allegation]
**Out of scope:** [Anything explicitly not investigated and why]
**Investigation period:** [Dates of conduct alleged]
**Investigation conducted:** [Date opened] to [present or close date]
---
## Methodology**Interviews conducted:**
| Witness | Role | Date | Notes |
|---|---|---|---|
[Populated from log entries with source_type = interview]
**Documents reviewed:**
[Summary of document categories reviewed, volume, date range.
Full document log is maintained separately.]
**Other sources:**
[Any other sources from checklist — policies, HR records, etc.]
**Limitations:** [Any sources requested but not obtained, any constraints]
---
## Factual Findings
*[Organized by issue — one section per allegation. Not by witness,
not purely chronological.]*
### Issue 1: [Allegation]
[Narrative of what the evidence shows on this issue. Cite log entry IDs
inline in brackets. Where accounts conflict, present the conflict directly
— do not smooth it over. Documentary evidence presented with quotes where
significant.]
### Issue 2: [Allegation]
[Same structure]
[Continue for each issue]
---
## Credibility Assessment
*[Standalone section. Address only witnesses whose credibility is
determinative — i.e., where the finding on an issue depends on which
account is credited.]*
### [Witness name/role]
**Internal consistency:** [Consistent / Inconsistent — note specifics]
**Corroboration:** [What documentary or other evidence corroborates
or undermines the account]
**Motive:** [Any reason to credit or discount the account]
**Demeanor:** [Attorney's observations if interviews were in person —
leave blank if not applicable or not observed]
**Assessment:** [Credit / Do not credit / Partially credit — with basis]
---
## Relevant Policies
[Policies in effect at the time of alleged conduct that bear on the issues.
Cite the version. Do not cite policies that were adopted after the conduct.]
---
## Conclusions
| Issue | Finding | Basis |
|---|---|---|
| [Issue 1] | Sustained / Not Sustained / Inconclusive | [One sentence] |
| [Issue 2] | ... | ... |
*Findings are based on a preponderance of the evidence standard.*
---
## Recommendations
[Organized by action type:]
**Disciplinary action:** [If any — state the basis, not just the outcome]
**Policy or process changes:** [If any gap in policies contributed]
**Training:** [If indicated]
**Further investigation:** [Any threads not fully resolved]
**Monitoring:** [Any follow-up needed]
---
## Appendix A: Chronology of Events
[Auto-generated from log entries sorted by date_of_event, not date_logged.
Format: Date | Summary | Source (Entry ID)]
## Appendix B: Documents Reviewed
[Summary table from documents-reviewed.yaml]
Write the draft to config/local/codex-for-legal/employment-legal/investigation-[slug]/memo.md.
If memo already exists — update
Read the memo and the log. Identify log entries added since the memo was
last drafted (compare date_logged against memo's last-updated date).
Report what has changed:
Since the last memo draft ([date]), the following has been added to the log:
[N] new entries
New issues: [any]
New conflicts: [any]
Resolved gaps: [any]
Sections that need updating:
Factual findings: [which issues are affected]
Credibility: [any new credibility-relevant entries]
Conclusions: [any findings that should be revisited]
Appendix A: [N] new chronology entries
Ask: "Want me to update the full memo, or just the affected sections?"
Apply updates. Preserve prior drafting. Mark changed sections with
[UPDATED: date] until the attorney reviews.
Mode 5: Draft audience summary
Triggered by $employment-legal:investigation-summary or "draft a
summary for [audience]".
Ask: who is the audience and what decision or action does this summary
support?
HR summary (for HR decision on disciplinary action):
What happened (factual summary, no legal analysis)
Finding on each allegation (Sustained/Not Sustained/Inconclusive)
Recommended action
What is NOT in this summary: privilege analysis, credibility methodology,
legal exposure assessment, attorney mental impressions
Header: "Confidential — HR Use Only — Do Not Distribute"
Do not include entry IDs or document citations — those stay in the memo
Business impact / exposure (high level — no specific legal analysis)
What the company is doing about it
Header: "[WORK-PRODUCT HEADER — per plugin config ## Outputs — differs by role; see ## Who's using this]"
Outside counsel briefing (handing off for litigation or deeper review):
Full context including legal exposure analysis
Open evidentiary threads
Credibility issues that remain contested
Documents that would be most significant in litigation
Header: "[WORK-PRODUCT HEADER — per plugin config ## Outputs — differs by role; see ## Who's using this]"
Consequential-action gate (respond to a demand or complaint)
Before producing a summary, memo, or content intended for an external response (EEOC/DFEH/state agency charge response, plaintiff's-counsel demand letter response, regulator response, or any formal complaint reply): Read ## Who's using this in config/local/codex-for-legal/employment-legal/CLAUDE.md. If the Role is Non-lawyer:
Responding to a demand, charge, or complaint has legal consequences — positions taken here are admissions in later proceedings, waivers of defenses can be inadvertent, and privilege over the underlying investigation can be lost. Have you reviewed this response with an attorney? If yes, proceed. If no, here's a brief to bring to them:
The allegation, the forum, and the deadline
What the investigation surfaced (findings by allegation; documents reviewed; witnesses interviewed; Upjohn warnings given or not)
Any unresolved evidentiary threads or credibility contests
What the proposed response says and what it implicitly concedes
Open questions and what's unresolved
What could go wrong (privilege waiver, inconsistent factual statements, missed affirmative defense)
What to ask the attorney (is this the right theory; are we preserving defenses; should an outside firm take this over; what needs redaction or a privilege log)
If you need to find an attorney, solicitor, barrister, or other authorised legal professional: contact your professional regulator (state bar in the US, SRA/Bar Standards Board in England & Wales, Law Society in Scotland/NI/Ireland/Canada/Australia, or your jurisdiction's equivalent) for a referral service. Agency and demand-letter responses are a place where untrained replies regularly create more exposure than the underlying allegation did.
Do not produce an external-response draft past this gate without an explicit yes. Internal memos, HR summaries, and leadership briefings used only within the organization do not trip this gate (but the privilege-formation caveat at the top of this skill still applies).
What this skill does NOT do
Make disciplinary decisions — it supports the attorney's findings,
not HR's action
Guarantee privilege — privilege depends on how the investigation is
structured, not on how the memo is labeled
Process documents it cannot read — if files are in formats that cannot
be parsed, flag them for manual review
Conduct interviews — it logs interview notes, it does not interview witnesses
Replace Upjohn warnings — it tracks whether they were given, it does not
give them
Close with the next-steps decision tree
End with the next-steps decision tree per CLAUDE.md ## Outputs. Customize the options to what this skill just produced — the five default branches (draft the X, escalate, get more facts, watch and wait, something else) are a starting point, not a lock-in. The tree is the output; the lawyer picks.
