How to Conduct a Research Misconduct Investigation: A Practical Guide

By Dr. Zubair Khalid, DVM, MS, PhD · 2026-11-11

By the end of this guide, you will be able to triage an allegation of research misconduct, secure evidence so it holds up under later scrutiny, run a fair inquiry, escalate to a full investigation when the facts warrant it, reach defensible findings, and take the corrective steps that actually repair the scientific record. The process looks intimidating from the outside, but it is a structured administrative procedure, and every stage has a defined purpose, a defined standard of proof, and a defined output.

Here is what you need on hand before you start:

Your institution's written research integrity policy, including its definitions and deadlines
The rules of any relevant funding agency, such as the US Public Health Service regulations that govern research supported by the National Institutes of Health
A secure, access-controlled location for case files, physically or digitally
A case log template for dates, decisions, and interview summaries
The names of two or more people qualified to serve as panel members who have no conflict of interest in the outcome

What Counts as Research Misconduct

Most modern frameworks, including the US Public Health Service definition used by federal agencies, define research misconduct as fabrication, falsification, or plagiarism in proposing, performing, or reviewing research, or in reporting research results. These three behaviors are often abbreviated FFP.

Fabrication means making up data or results and recording or publishing them.
Falsification means manipulating research materials, equipment, or processes, or changing or omitting data so that the record does not accurately represent the research.
Plagiarism means appropriating another person's ideas, processes, results, or words without giving appropriate credit.

History shows that falsification can be subtle and can take years to surface. A recent historical analysis of Nobel laureate Hermann J. Muller's final research program describes how Muller altered the research record regarding confirmation of dosimetry accuracy after his radiation experiments failed to produce publishable results, a reminder that misconduct can involve changing what the record claims, not only inventing raw data [1].

A second category sits just below the line of formal misconduct. Questionable research practices (QRPs) are behaviors that fall short of fabrication, falsification, and plagiarism but still distort the record. A large survey-based classification found that QRPs involving omission are reported far more often than those involving addition or modification, and that the most commonly reported practices were selective analysis, selective citation, and selective reporting of covariates [2]. Selective analysis, for example, means trying several statistical approaches and reporting only the one that gives the desired result. Most institutional policies treat QRPs as matters for education and correction rather than formal misconduct findings, but a pattern of QRPs can escalate.

Authorship disputes occupy a gray zone. Authorship has become a form of academic currency that affects standing, salary, and grant success, and that pressure produces real misconduct in how editors and coauthors handle credit [3]. Gift authorship, coerced authorship, and denied authorship may be handled as misconduct, as breach of authorship guidelines, or as a professional conduct matter, depending on your institution's policy. Researchers in a Ghanaian university study drew a useful distinction between regulatory definitions of fabrication, falsification, manipulation, and plagiarism, and broader professional standards that misconduct definitions did not fully capture [4]. Your first analytical task in any case is deciding which definition applies, because the definition controls what you can legitimately find.

The Institutional Frame: Who Investigates and Under What Rules

In the United States and most other research systems, institutions investigate their own researchers. Federal funding agencies oversee the process, review institutional findings, and can impose their own administrative actions, but the day-to-day work of gathering evidence and interviewing witnesses happens inside the university or institute. This self-regulatory model is convenient for institutions and troubling for skeptics. An analysis of policies at Australian Group of Eight universities found that institutions were not adopting robust policies on reporting findings and correcting the record, and that some failed to follow even their own policies, leading the authors to call for an independent oversight body with enforcement powers [5]. Commentators on the Australian system have reached a similar conclusion, arguing that the national code should mandate how institutions investigate and that a national integrity committee should be empowered to scrutinize investigations and order reinvestigations [6].

That skepticism is not limited to Australia. A Delphi survey contrasting independent research "sleuths" with research integrity experts found agreement that academic incentive structures damage integrity, but sharp polarization on whether institutional self-regulation is adequate and how common serious misconduct really is [7]. The practical lesson for anyone running an investigation is this: because your process will be scrutinized by people who distrust self-regulation, document everything and follow your own policy exactly. An investigation that is procedurally flawless can survive outside criticism. One that deviates from the written policy cannot.

Older reviews of the field identified the recurring unresolved questions you should expect to face in any case: how misconduct is defined, whether anonymity is allowed, what role the whistleblower plays, where the burden of proof sits, what statute of limitations applies, what sanctions are available, and whether rehabilitation is possible [8]. Your institution's policy should already answer most of these. If it does not, that gap is your first finding, and you should close it before the next case arrives.

How to Conduct a Research Misconduct Investigation, Step by Step

The procedure below follows the two-stage model used in US federal rules and mirrored in most institutional policies: a preliminary inquiry to decide whether an allegation has substance, followed by a full investigation if it does. A good faith allegation means one made with an honest belief, even if it turns out to be wrong. An allegation made in bad faith, knowingly false, is itself a policy violation.

Step 1: Receive and Log the Allegation

When an allegation arrives, whether from a whistleblower, a reviewer, a journal editor, or an anonymous message, the research integrity officer (RIO), the designated official who administers the misconduct policy, logs it immediately. Log the date received, the allegations as stated, and the respondent, the person against whom the allegation is made. Do not assess plausibility at this stage. Do not forward the allegation to the respondent's department head, collaborators, or anyone with a personal stake.

Anonymous allegations deserve careful handling. Experience at the US Office of Research Integrity and its predecessor from 1989 through 1997 showed that institutions treated anonymous allegations seriously, but anonymous complainants were a small minority, 8 percent of 986 allegations, few anonymous complaints were substantive enough to pursue, and only 1 of 13 such formal cases resulted in a misconduct finding [9]. The operational takeaway is not to dismiss anonymous allegations but to recognize that you cannot interview an anonymous complainant, which limits what you can corroborate. Ask early whether the whistleblower will consent to being identified, because anonymity narrows the fact-finding options later.

Step 2: Sequester the Evidence

Before anyone speaks to the respondent, secure the records the allegation concerns: data files, lab notebooks, electronic lab notebook entries, instrument logs, code repositories, email, grant applications, and drafts of manuscripts. In federal terms this is sequestration, taking original materials into custody so they cannot be altered. Do it quietly and completely, because a respondent who learns of an allegation before sequestration can, and occasionally does, alter or destroy records.

For digital evidence, work on copies and preserve the originals. Compute a cryptographic hash, a fixed-length fingerprint of a file, so you can prove later that the copy is identical to the original.

# Create a controlled case directory with restricted permissions
mkdir -p /cases/2026-014/evidence
chmod 700 /cases/2026-014/evidence

# Copy the files under review, then hash both original and copy
sha256sum lab_notebook_scan.pdf raw_qpcr_Ct_values.csv > /cases/2026-014/evidence/hashes.txt
sha256sum /cases/2026-014/evidence/lab_notebook_scan.pdf >> /cases/2026-014/evidence/hashes.txt

Expected output in hashes.txt:

a3f1c9e2b7d4...  lab_notebook_scan.pdf
a3f1c9e2b7d4...  lab_notebook_scan.pdf

Matching hash values on the two lines demonstrate the copy is bit-for-bit identical to the original. Re-run the hash check before any analysis session to confirm nothing has changed. Keep a physical chain-of-custody log alongside the digital one, recording who took custody of each item and when.

Step 3: Open the Inquiry

Diagram of an allegation being logged, evidence sequestered, an inquiry opened, then either a full investigation or the case closed.

An inquiry is a preliminary, information-gathering process. Its purpose is narrow: decide whether the allegation falls within the definition of misconduct, whether it is credible on its face, and whether it warrants a full investigation. The inquiry typically involves a preliminary review of the sequestered records and brief interviews where needed. US federal rules expect the inquiry to conclude promptly, generally within about 60 calendar days, with documented extensions if the evidence requires more time. Institutional policies usually mirror that expectation.

Track the clock explicitly so the deadline never slips silently:

from datetime import date, timedelta

inquiry_start = date(2026, 1, 12)
inquiry_deadline = inquiry_start + timedelta(days=60)
print("Inquiry decision due:", inquiry_deadline)

Expected output:

Inquiry decision due: 2026-03-13

The inquiry panel, commonly two or three members with relevant expertise and no conflicts, weighs the evidence against the standard for this stage, which is whether a reasonable person could believe misconduct may have occurred. The panel does not decide at the inquiry stage whether misconduct actually happened. If the answer to the threshold question is no, you write an inquiry report, notify the respondent of the outcome, and close the case. If the answer is yes, or if the respondent does not cooperate with the inquiry, you proceed to an investigation.

Step 4: Plan and Run the Investigation

The investigation is a formal examination that develops the factual record in depth. Its components are standard across frameworks:

Appoint an investigation panel, usually at least three members with the scientific expertise to evaluate the questioned work and no conflicts of interest with either party.
Give the respondent written notice of the specific allegations, the applicable policy provisions, and their rights, including the right to respond to the evidence and, in most policies, to be accompanied by an advisor.
Interview the whistleblower, the respondent, and relevant witnesses. Two interviewers at minimum, one asking questions and one taking verbatim notes. Offer the interviewee the chance to review the summary.
Perform the technical analysis. Re-run the analyses from the original data files where possible, compare the data behind each figure in the questioned papers against the raw instrument output, and check image data for duplications or manipulations using established forensic methods.
Assemble the complete evidence package with a numbered exhibit list.

Structure every interview summary the same way so the panel can compare accounts:

Interview Summary
Case number:      2026-014
Interviewee:      [name or role]
Role in project:  [e.g., postdoc, performed Western blots]
Date and place:   2026-02-03, conference room 4-112
Interviewers:     RIO, panel chair
Summary:          [narrative account, attributed statements]
Exhibits shown:   Exhibit 7 (gel image), Exhibit 12 (analysis log)
Corrections:      [none / attached signed correction page]

The comparison of figures against raw data is where most fabrication and falsification cases are won or lost. If a published bar graph claims n = 9 biological replicates but the instrument log shows 5 runs on the date in question, that discrepancy, verified against sequestered original records, is the kind of finding an investigation exists to establish. Do the analysis yourself or engage an external expert with documented qualifications, and preserve every intermediate file so a reviewer could reproduce your path from raw data to conclusion.

Step 5: Reach Findings Under the Correct Standard of Proof

Findings of research misconduct require, at minimum under the US federal framework: a significant departure from accepted practices, the conduct committed intentionally, knowingly, or recklessly, and proof by a preponderance of the evidence, meaning the evidence shows the allegation is more likely true than not. This is a deliberately lower bar than the criminal standard, and you should say so plainly in your report so panel members do not import a "beyond reasonable doubt" habit from other contexts.

For each allegation, write a finding in one of three forms: substantiated, unsubstantiated, or unfounded, following your policy's exact terminology. A substantiated finding needs a factual basis, the policy provision violated, and the evidence supporting each element, cited by exhibit number. Write the finding so that a reader who has never seen the raw evidence could follow the reasoning.

Step 6: Report, Correct the Record, and Follow Through

An investigation that ends in a finding and then stops is a failed investigation. The record correction stage is where the public interest gets served. Retractions, expressions of concern, and corrections must be pursued with the journals that published the affected work, and granting agencies must be notified where required. Institutional weakness at exactly this stage is well documented. The Australian analysis found institutions failing to follow their own policies on reporting findings and correcting the record [5], and the pattern extends to quiet departures. Commentators at major journals have described new hires discovered to have left a previous employer during or immediately after a misconduct investigation without either party disclosing it, and called for more transparency to rebuild credibility [10]. A well-publicized case at the Salk Institute, where a prominent researcher departed quietly after a misconduct investigation while the findings stayed sealed, drew exactly this criticism from staffers [11].

Practical steps that close the loop:

Send a formal notification letter to each affected journal, summarizing the findings and recommending an action such as retraction or correction.
Notify funding agencies as your policy and their rules require.
Record the outcome in internal systems so hiring, promotion, and grant compliance screens can catch a respondent who moves institutions mid-case.
If the finding involves images or data, consider whether coauthors' other papers are implicated, because misconduct rarely confines itself to one manuscript.

The scale of the downstream problem justifies the effort. Among 9,323 Cochrane systematic reviews, 81, about 0.9 percent, included or cited at least one paper authored by someone with 24 or more retractions, and 32 reviews actually included such studies [12]. Evidence syntheses inherit the integrity of their inputs, which means every corrected record ripples outward through reviews, guidelines, and meta-analyses.

Step 7: Sanctions, Appeals, and Institutional Response

After findings, the institution decides on sanctions: supervision requirements, removal from projects, loss of privileges, termination for cause, or referral to funding agencies for administrative actions. Most policies give the respondent an appeal window with defined grounds, such as procedural error or new evidence. Handle appeals through people who were not on the investigation panel. Remember that deterrence and rehabilitation are perennial unresolved issues in misconduct handling [8], so a sanction that is proportionate, documented, and consistently applied does more for institutional culture than a maximal one applied erratically.

Working With Whistleblowers

Every part of the process above depends on people being willing to report, and the evidence says most are not. In a Malaysian survey of researchers, fewer than half of respondents were willing to blow the whistle, citing lack of identity protection, a tedious investigative process, and cultural norms against confronting superiors [13]. Whistleblower research in Iran found the dominant motives were commitment to academic integrity, frustration with institutional inaction, and sometimes personal grievance, while nearly all whistleblowers reported fear of legal, professional, or personal retaliation, and editors described weak ethics committees and insufficient protection as conditions that allow misconduct to persist [14].

Two practical tips follow directly from this evidence. First, prepare whistleblowers. Interviews with 77 research integrity officers who had recently handled cases found that officers who covered more topics in their first contact with a whistleblower, often using a memory aid or checklist, and who had trained through RIO workshops or consultation with federal staff, were better at preparing whistleblowers for what to expect, which reduced stress and helped whistleblowers make informed decisions about reporting [15]. Build a first-contact checklist and use it every time. Second, separate the motive from the evidence. Motives vary and some whistleblowers have grievances, but the investigation evaluates the underlying facts, not the reporter's character. Investigators in the Iranian study noted that assessing motives was one of their hardest tasks, precisely because motive and evidence are easy to conflate [14].

Institutional culture work belongs in peacetime, not mid-case. Awareness of institutional integrity policies relates to lower engagement in questionable research practices, though that relationship depends on researchers' own confidence and attitudes toward integrity [16]. Institutions such as the Kenya Medical Research Institute have institutionalized responsible conduct of research through train-the-trainer programs, symposia, hybrid training delivery, and digital dissemination, reaching over 1,200 of more than 4,000 staff across 15 research centers [17]. A qualitative study in Japan added a structural warning: researchers there identified job insecurity for junior researchers and pressure on principal investigators as barriers to integrity, and observed that integrity regulations were not widely disseminated [18]. Investigations are more credible, and less necessary, in institutions that have already built this culture.

Quick Reference: The Stages at a Glance

Stage	Core question	Typical output	Common failure mode
Triage	Does the policy cover this?	Logged allegation	Forwarding the allegation to the respondent's allies
Sequestration	Are records secured?	Hashed, access-controlled files	Alerting the respondent before evidence is taken
Inquiry	Could misconduct have occurred?	Inquiry report, proceed or dismiss	Applying the full standard of proof too early
Investigation	Did it occur, by a preponderance?	Findings per allegation, exhibit list	Analyzing altered copies instead of originals
Reporting	Is the record corrected?	Journal and agency notifications	Findings issued, record never corrected
Sanctions and appeal	What follows, and fairly?	Sanction letter, appeal record	Panel members judging their own appeal

Common Mistakes and Limitations

These are the errors that most often unravel otherwise sound cases:

Tipping off the respondent before sequestration. A casual conversation in the elevator can lead to altered notebooks and deleted files. Always secure evidence first, notify second.
Analyzing the wrong version of the data. If you hash and verify copies, as shown above, you can prove which version you analyzed. If you skip that step, the respondent's counsel can argue the analyzed files were never the originals.
Using the wrong standard of proof at the wrong stage. The inquiry asks only whether misconduct could have occurred. Panels that demand certainty at the inquiry stage dismiss cases that a full investigation would have substantiated.
Failing to follow your own written policy. The Australian evidence shows institutions sometimes deviate from their own procedures, and those deviations become the story [5]. Print the policy, check each procedural requirement against it, and document the check.
Treating questionable research practices as misconduct, or misconduct as QRPs. Selective analysis and selective citation are common and corrosive [2], but your findings must map onto your policy's definitions. A finding of "sloppy science" is not a finding of falsification.
Ignoring authorship issues in the case file. Authorship misconduct in editorial handling and credit allocation is a documented professional conduct problem [3], and cases that look like data problems often have an authorship dispute underneath.
Not interviewing the whistleblower at all. Anonymous allegations are legitimately harder to pursue [9], but an unwillingness to speak with the complainant at all guarantees an incomplete factual record.
Letting a respondent resign and closing the file. Quiet departures shift the problem to the next employer and leave the published record untouched [10]. Complete the investigation before or after the resignation, and finish the record correction regardless of employment status.
Conflicts of interest on the panel. A collaborator, coauthor, or rival of the respondent cannot serve. Screen every panel member and document the screening.
Assuming the investigation fixes the culture. Policy awareness and confidence in institutional integrity efforts do influence researcher behavior, but the effect depends on researcher acceptance and attitudes [16]. An investigation is one event. Responsible conduct of research training, clear definitions in policy, and whistleblower protection are the standing infrastructure [4], [17].

One limitation of scope: every jurisdiction, funder, and institution has its own policy details, timelines, and terminology, so the framework above must be applied through your own institution's written rules, and individual cases, particularly those with legal exposure, need advice from your institution's counsel and compliance office.

Frequently Asked Questions

What qualifies as research misconduct under the standard definition?

Fabrication, falsification, and plagiarism in proposing, performing, or reviewing research, or in reporting results, provided the conduct represents a significant departure from accepted practices and was intentional, knowing, or reckless. Lesser behaviors are usually classified as questionable research practices and handled through education and correction.

Can an institution act on an anonymous allegation?

Yes. Agencies and institutions have historically treated anonymous allegations seriously, though such complaints are rarely substantive enough to open a formal case, and the inability to interview the complainant limits corroboration. Log it, assess it on its content, and invite the reporter to identify themselves.

What standard of proof applies in a misconduct investigation?

In the US federal framework, findings must be supported by a preponderance of the evidence, meaning the allegation is more likely true than not. The conduct must also be intentional, knowing, or reckless, and a significant departure from accepted practices.

How long should each stage take?

Worked example adding 60 calendar days to an inquiry start date of 12 January 2026 to give a decision due date of 13 March 2026.

Federal rules expect an inquiry to conclude within about 60 calendar days, with documented extensions, and a full investigation to be completed promptly, generally within about four months unless the funding agency approves more time. Track both deadlines in writing from day one.

What happens if the accused researcher resigns during the investigation?

The investigation should generally continue and reach findings on the evidence, and the record correction work with journals and funders proceeds regardless of employment. Quiet resignations that leave findings sealed are a recognized failure of institutional transparency.

Are questionable research practices the same as misconduct?

No. Practices such as selective analysis, selective citation, and selective reporting of covariates are common and damaging, but they fall short of the fabrication, falsification, and plagiarism definitions. They are typically addressed through education, correction, and supervision rather than formal misconduct findings.

Who should serve on an investigation panel?

At least three people with the scientific expertise to evaluate the questioned work, no conflicts of interest with either party, and training in the institution's procedures. Screen and document the independence of every member before appointment.

How should findings be reported and the record corrected?

Deliver a written report with findings per allegation, notify affected journals and recommend retraction or correction where warranted, notify funding agencies as required, and record outcomes internally so downstream employers and evidence synthesizers can see them. An investigation is incomplete until the published record reflects the truth.