Workplace Investigation Services

Updated 1 August 2026 by K3K Investigations

Independent, lawful investigation of what an employee is actually doing — sickness-absence abuse, moonlighting, theft and misconduct — evidenced to the standard an employment tribunal expects, and handed to your HR team or solicitor to act on.

Employers usually contact us at the point where they are confident something is wrong and completely unable to prove it. The suspicion is sound, the evidence is hearsay, and confronting the person on hearsay is how a dishonest employee becomes a successful unfair-dismissal claimant.

Call 020 3343 7007 — 24 hours, free and confidential — and describe the pattern. We will tell you honestly whether it is worth investigating.

What we investigate

Long-term sickness-absence abuse. The most common instruction we receive from UK employers: an employee certified unfit for work who is visibly active elsewhere — working, running a business, playing sport, travelling. The Six-Month Bad Back is an anonymised account of exactly this.

Moonlighting and competing employment. Staff working a second job on your time, or running a competing business using your clients, equipment or hours.

Theft, stock and cash leakage. Shrinkage that tracks one person's shifts; goods leaving with the right van at the wrong time.

Expenses and mileage fraud. Claims that do not reconcile with diaries, locations or reality.

Misconduct, harassment and grievance support. Independent fact-finding where an internal investigator would be conflicted or the allegations are contested.

Suspected breach of restrictive covenants by departing employees — often alongside corporate investigations.

The patterns employers actually describe

Employers rarely call us with proof. They call with a pattern that has become impossible to ignore, and these are the ones we hear most:

The absence that behaves like a holiday. Sick notes that arrive the day after leave is refused, or that consistently bracket a weekend. Certified incapacity that coexists with a visible second life — a side business, a sport, a house renovation. Colleagues who knew months before HR did.

The employee who is never off. The opposite tell, and the classic marker of invoice, supplier or stock fraud: someone who will not take annual leave, will not delegate, and reacts disproportionately to ordinary questions about their records. Gatekeeping is what fraud needs to survive.

The van that takes the long way. Field and mobile staff whose tracked mileage, delivery windows and fuel spend do not reconcile — often because a second job is being run inside your paid hours.

Losses that follow a rota. Shrinkage that clusters on particular shifts, at particular sites, under particular supervisors. The pattern is usually visible in your own data before anyone observes anything.

The departure that takes the client list with it. A resignation followed by clients migrating in the same direction, a new venture that looks familiar, and a restrictive covenant nobody expects to be enforced.

None of these prove anything on their own. Each is a reason to establish the facts properly before anyone is accused.

What a workplace investigation actually involves

Most of the work is not dramatic. It is disciplined observation, careful record analysis, and a documented decision trail.

Reconnaissance and planning. Before any deployment we establish the subject's routine, the geography, and what a realistic observation window looks like. A badly planned first day is how investigations get noticed.

Covert observation of activities in public. Foot and vehicle teams record what the person is doing where anyone could see them — leaving home, working elsewhere, carrying out activity inconsistent with a medical restriction. Everything is timestamped and continuous, so the footage shows context rather than a convenient clip.

Verification of second employment. Establishing lawfully whether someone is working elsewhere: publicly advertised trading, company records, open-source evidence, and observation of them attending and working.

Open-source research. Publicly visible online activity, corporate records and public registers. Never private accounts, never deception, never device access.

Analysis against your own records. Rotas, expense claims, mileage, access logs and stock data you already lawfully hold, read against what we observed.

What you receive

A written report that stands on its own: a factual chronology of what was observed and when, timestamped video and stills with continuous footage retained, contemporaneous operative notes, a chain-of-custody record, and the documented proportionality assessment that justified the method. Written to be handed straight to your employment solicitor or put before a disciplinary panel — and we can attend to give evidence if a tribunal requires it.

What you will not receive is speculation. If the surveillance shows the employee genuinely unwell and doing nothing inconsistent with their certificate, that is the report you get, and it is worth having: it closes the question and protects you from a very expensive mistake.

Sectors we work with

Logistics, haulage and distribution (mileage, fuel, cargo and depot losses). Construction and trades (moonlighting, ghost workers, plant and materials). Retail and hospitality (cash and stock leakage, shift-linked shrinkage). Care and healthcare providers (long-term absence, working elsewhere while certified unfit). Professional services and finance (conflicts of interest, client diversion, confidentiality breaches). Manufacturing (supplier collusion, stock, procurement fraud). Small and family businesses, where the suspected person is often trusted, long-serving and related to someone — the cases that most need an outsider.

Cost, and how quickly we can start

Most workplace cases run one to three surveillance days, at realistic UK rates of £500–£1,200 per operative per day including vehicle, equipment and reporting. The quote is fixed in writing before we begin, so the cost cannot drift. Straightforward instructions can usually deploy within a few working days, and sooner where timing matters — a booked holiday during certified sickness, or a notice period about to end.

Set against a full-time salary paid during a fraudulent absence, ongoing stock loss, or the cost of an unfair-dismissal claim built on inadequate evidence, the arithmetic is usually short. Fuller context in our guide to investigation costs.

Five mistakes that cost employers their case

1. Confronting too early. The single most expensive error. Once challenged, behaviour stops, records get tidied and stories align.
2. Investigating too widely. Blanket monitoring is not lawful and not proportionate. Targeted investigation on documented reasonable suspicion is.
3. Letting the accuser investigate. If the manager who raised the concern also gathers the evidence, the process is contaminated before it starts.
4. Not preserving what you already hold. Rotas, expense claims, access logs and CCTV you lawfully operate can be overwritten while you deliberate.
5. Telling too many people. Leaks are how investigations die. Keep the circle to those who must know.

How we work with HR and employment lawyers

1. Scoping call. What you suspect, what you already hold, and what a tribunal would need. If your existing evidence is already sufficient, we tell you — that call costs nothing.
2. Proportionality assessment. UK GDPR and ICO employment guidance permit investigation on reasonable suspicion where it is targeted and documented, not speculative or blanket. We record that assessment because it is the first thing that gets tested if the case is challenged.
3. Lawful evidence gathering. Covert observation of activities in public places, verification of second employment, and open-source research — never device access, never deception about anything material.
4. Tribunal-ready reporting. Timestamped video and stills, contemporaneous notes, chain of custody, and a written report your HR team or employment solicitor can put straight into a disciplinary process. We can attend to give evidence where required.

The critical sequencing point: get the evidence before the meeting, not after it. Once challenged, patterns stop and stories align.

Frequently asked questions

Is it legal to put an employee under surveillance in the UK?

Yes, within limits. Covert surveillance of an employee's activities in public places is lawful where there is reasonable suspicion of wrongdoing, a legitimate aim such as protecting the business from fraud, and a proportionate, documented approach. It is not lawful as a fishing expedition or general monitoring. Getting that judgement right is a core part of what you are instructing us for.

Will the evidence stand up at an employment tribunal?

Lawfully and proportionately obtained evidence is used in tribunals routinely. What decides it is method and documentation: covert footage of public activity, gathered on reasonable suspicion with a proper chain of custody and a defensible proportionality assessment. Your solicitor runs the procedure; our job is to make the evidence underneath it unimpeachable.

Can we check an employee's social media?

Publicly visible content, yes — and public posts during certified sickness are frequently decisive. Accessing private accounts through deception, fake friend requests or borrowed logins is unlawful and taints everything connected to it.

What does a workplace investigation cost?

Most cases run one to three surveillance days at realistic UK rates of £500–£1,200 per operative per day, including vehicle, equipment and reporting, quoted as a fixed price before we start. Against a salary being paid for a fraudulent absence, or ongoing stock loss, it usually pays for itself quickly. See our cost guide.

Do you work with our HR team or replace it?

We work alongside it. We are the independent evidence-gathering arm; your HR team and employment solicitor own the disciplinary process. That separation is precisely what makes the outcome defensible — the decision rests on third-party evidence rather than a manager's suspicion.

Do we have to tell the employee they are being investigated?

Not in advance, where doing so would defeat the purpose — that is the whole basis on which covert investigation is permitted. You do have data-protection obligations to the employee, and the ICO expects covert monitoring to be exceptional, targeted, time-limited and documented. Handled that way it is lawful; as routine surveillance it is not. The proportionality assessment we record is what evidences the difference.

How long does a workplace investigation take?

Most are resolved inside two to three weeks from instruction: a few days to plan and deploy, one to three days of observation, then reporting. Cases that depend on a specific event — a booked holiday, a match fixture, a trading day — are scheduled around it. If the pattern you describe needs weeks of watching to prove, we will usually tell you it is not worth the money.

What if the investigation clears the employee?

You get a report saying so, and that is a good outcome. It ends a suspicion that was damaging the working relationship, protects you from acting on a false assumption, and gives you a documented basis for closing the matter. We are paid to establish the facts, not to confirm what you hoped.

Can we use the evidence to dismiss someone?

The evidence supports a fair process; it does not replace one. Your employment solicitor or HR lead still needs to run a proper investigation meeting, put the evidence to the employee, hear their explanation and follow your disciplinary procedure. What our report does is ensure the factual foundation underneath that process is independent, timestamped and hard to dispute.

Do you investigate bullying, harassment or grievance complaints?

Yes — as independent fact-finders where an internal investigator would be conflicted, the allegations are contested, or the outcome is likely to be litigated. That work is interview and evidence-based rather than surveillance-led, and the report is written for the decision-maker rather than for either party.

Something not adding up at work? Describe the pattern to a senior investigator — free, confidential, no obligation — and get an honest view of whether it is provable and what it would cost. Call 020 3343 7007 (24 hours) or book a call.

Related reading: Signs an employee is committing fraud · What is executive due diligence? · The Six-Month Bad Back · Corporate investigations