Workplace investigations will require different types of evidence to be collected. This includes indirect and direct evidence. They are important in workplace investigations as they give proof of whether something happened and will assist the investigator in reaching a conclusion. Some pieces of information may be more relevant than others and may give a clearer picture of what occurred. However, the investigator should try to collect as much evidence as possible to avoid an incomplete or biased conclusion. While a hierarchy of evidence may sometimes be used, it usually depends on the quality of the information. This is where indirect and direct evidence come in. 

Difference between indirect and direct evidence

A workplace investigation may require eyewitnesses, CCTV, photos, messages or other online media. It is crucial then that there is a clear link between the evidence and the incident.

Direct evidence

Direct evidence proves a fact, they highlight that something happened. For example, an employee seeing another employee committing fraud is something they directly witnessed themselves. Direct evidence includes observations, CCTV or computer software that can show whether an individual committed misconduct or not. It also includes the statements of the main parties involved.

Direct evidence proves a fact first-hand and in some cases, there is little room for bias. Witness statements are one of the few instances where evidence may be influenced by bias. Recalls of events can be either orally recorded or written. As time passes, witnesses’ recounts may be influenced by other recollections of the incident which may result in a misleading statement unintentionally. So even though direct evidence can be used to prove an incident happened, sometimes it is not fully trustworthy hence why indirect evidence is needed.

Indirect evidence

Some investigations may not have direct evidence at all. There may be no witnesses or CCTV that links a person to a crime. The investigator may need to make a conclusion based solely on circumstantial evidence. This leaves more room for error which is why it is crucial that the right individual is chosen to conduct the investigation. Indirect evidence can refer to a series of events that lead up to an incident, such as witnesses reporting the behaviour of an individual leading up to an event. Certain reports may have been submitted incomplete or with errors on previous occasions. However, even though they may be used during the investigation, they need to be supported by other sources.

This is because indirect evidence can indicate that an event occurred, for example, CCTV showing an individual entering the room at the time of an incident. It does not show that they are guilty of misconduct, but it makes it likely. From indirect evidence, the investigator can understand someone’s involvement in the incident, but cannot draw a conclusion solely from them.


Indirect and direct evidence need a safe place to be stored during and after the investigation, for as long as necessary. Polonious offers its clients a safe place to store all their documents, CCT, videos, images and other relevant information. Investigators can access interview notes, schedule new interviews and access everything from anywhere, anytime. We are ISO 27001 which reinforces our commitment to secure storage of data during the process and keeping all details confidential. If you want to learn more about what we have to offer request a demo!

Indirect and direct evidence

Where are they similar?

Direct and indirect evidence may be different in many cases but they are similar in the sense that they follow the same rules. Both indirect and direct evidence need to be of high quality. They need to be reliable and there needs to be sufficient evidence to determine the outcome of an incident. Sufficient information collected from multiple sources can meet the standard of proof, so an incident can come to a certain result rather than a dubious one. 

As a workplace investigation is usually a civil matter, the ‘balance of probabilities’ applies which means the investigator needs to analyse all evidence carefully and decide whether it is more likely that the accused behaviour or incident occurred than not, rather than proving ‘beyond reasonable doubt’. This makes indirect evidence more useful, though it is also possible to prove a case beyond reasonable doubt with indirect evidence. 

 To come to a conclusion all evidence needs to be consistent. They should all point to the misconduct taking place and the individual accused being responsible for it. There should not be another potential candidate that may have committed the incident. For example, in a discrimination case that happened online, it should be clear that the employee accused was the one sending the messages and not someone pretrending to be them. 

 All evidence, whether direct or indirect, needs to be obtained legally. The company should not breach any laws or regulations to collect evidence and should clearly state how they found it. For example, in some countries or states, the use of audio recordings is not considered legal. Moreover, all evidence should be relevant to the case being investigated and should contribute to the outcome in some way. 

Something to remember

Indirect evidence is not less reliable than direct evidence. However, they have to be very strong to prove a fact and help reach a conclusion. An ideal investigation will have a combination of indirect and direct evidence that will help an investigator reach an accurate result. The investigator should assess what evidence is more credible than other evidence and try to spot potential contradictions. Indirect and direct evidence can be both very helpful in the case and should be treated with the same level of importance. This also extends to their storage and collection. All evidence should be stored securely without the possibility of being accessed by third parties.

Polonious’s detailed security configuration ensures that all evidence and the confidentiality of those involved are protected. We offer our clients a place where they can upload all relevant data so they can access them from one single place anytime they need to. We can assist in the investigation of internal matters such as bribery and corruption, discrimination and other fraudulent activities. Do you want detailed reporting and no security gaps? Reach out!