The Investigator’s Diary: Best Practice for Case Logs

The investigator’s diary — the running, dated log of what you did, when and why — is one of the least glamorous and most powerful tools in an investigation. When findings are challenged, a contemporaneous case log often carries more weight than memory ever could.

This article sets out best practice for keeping a case diary in a South African investigations context. It is practical guidance, not legal advice.

Why contemporaneous records win

“Contemporaneous” means written at the time, or as close to it as possible. That timing is precisely what gives the record its authority. A note made on the day, before the outcome was known, is hard to dismiss as convenient reconstruction. A summary written weeks later, after the investigator knows how the case turned out, invites the obvious challenge that memory has been shaped by hindsight. At a disciplinary hearing or the CCMA, a well-kept diary lets an investigator give evidence with confidence and lets a chairperson trust the sequence of events.

What belongs in the diary

A case diary is a log of process and observation, not a place for conclusions. Each entry should generally capture:

• Date and time of the entry and of the events it describes.
• What you did — the step taken, such as an interview, a site visit, an evidence collection.
• What you observed — facts, not inferences.
• Who was involved — people present, people spoken to.
• Decisions and reasons — why you took a particular step or chose not to pursue a line.
• Next steps — what the entry sets up.

Fact versus inference

The most common weakness in case logs is blurring what happened with what the investigator thinks it means. Record that the employee “arrived at 21:14 and left at 21:22 carrying a black bag” — not that they “were clearly stealing.” Keep observation and interpretation separate. Interpretation belongs in your analysis and final report, where it can be weighed against the evidence. A diary crowded with conclusions reads as a mind already made up, which undermines the impartiality a fair process demands.

Record what a camera would have seen, not what you believe it proves. The proving comes later, on the strength of what you recorded.

Timeliness and integrity

Two habits protect a diary’s credibility. First, write entries promptly — the same day wherever possible. Second, do not alter earlier entries. If you need to correct or add something, make a new, dated entry rather than editing the original; an audit trail that shows honest corrections is far stronger than one that looks suspiciously clean. Where diaries are kept in a system, timestamps and version history do this automatically, which is one reason structured case management is more defensible than a personal notebook that only the investigator controls.

Language and tone

Write plainly and neutrally. Avoid loaded words, speculation about motive, and anything you would be uncomfortable reading aloud at a hearing. Assume the diary may one day be seen by the employee, their representative and a chairperson. That assumption tends to produce exactly the measured, professional record you want. Avoid abbreviations and private shorthand that no one else can decode, since a diary that only its author can read loses much of its evidential value.

The diary and personal information

A case diary is full of personal information about identifiable people, so POPIA applies. Keep it secure, limit who can access it, and record only what the investigation genuinely needs. Gossip, irrelevant personal detail and speculation about people not central to the matter should not be there — on both fairness and data-protection grounds. Our trust centre sets out how we approach securing this kind of operational record.

Common pitfalls

1. Backfilling. Reconstructing days of activity from memory in one sitting.
2. Editing the past. Changing earlier entries instead of adding corrections.
3. Conclusions everywhere. Recording judgements rather than observations.
4. Gaps. Long unexplained silences that suggest missing activity.
5. Illegible shorthand. Notes only the author can interpret.

If you want to test your own practice, pull a recent diary and ask whether an outsider could follow the investigation from it alone, and whether every entry sticks to what was observed. Those two questions surface most of the improvements worth making.