There are many "official" ways to conduct employee investigations. I will be going over what has worked for me in the past while conducting employee investigations in both the Army and in the business world.
When conducting an employee investigation, you first have to determine what is the purpose. Is it to substantiate or non substantiate an employee allegation? Is it to prove or disprove an allegation of employee misconduct. Or is the purpose something else? Once you determine the purpose, this will focus the path you will take in conducting the employee investigation.
One thing you have to realize is that you do not have the ability to tell if someone is telling the truth or not. You can't say, "I know this person is not telling the truth." Just because your instinct tells you this. You have to go from the perspective that everyone is telling the truth from their point of view. You will have instances where people will provide different answers on the same situation. Even though they all saw it at the same time. But they each saw it from their personal lens and this distorts their reality. Never tell someone that they are not telling the truth.
You then have to come up with a plan. Usually, I start with the people who I believe had the least to do with the situation. Or who have the least amount of information to provide to the finalization of the investigation. Then I talk to the person being accused last. This way I have all the information from all the other people I have talked to about the situation.
Before I forget, your goal should be to conduct the investigation as quickly and fairly as possible. This should both be in reality and in perception. It does no good if the investigation is conducted fairly. But in the eyes of all the employees the perception is that it was not conducted fairly.
You need to keep detailed notes of everything you do to have a record of the investigation. Especially, when you have a lengthy investigation and you have to talk to many people. Once the investigation gets rolling, it will be hard for you to remember all the details.
One thing I like to do is when I ask questions. I actually write them down and then have the person write down their answers. This way their is no confusion on what was asked and/or answered during the interview session. It also allows both the interviewer and interviewee to be sure of the questions and answers.
From my point of view you are not looking for anything beyond a reasonable doubt. You are only looking for a more likely than not situation. Based on the evidence you have, is it more likely than not that the employee did what they are accused of doing.
Once you finish talking to everyone and write everything up, you should then take at least a one day break. Then come back and take a fresh look at everything. Once you have done this, then write up your recommendations and turn them in to the employee's supervisor. Or whatever the protocol calls for at your place of work.