Investigations are usually triggered when an employer becomes aware of a workplace concern that raises issues of potential misconduct, safety, legal or regulatory risk, breaches of workplace policies or the management of internal or external expectations.

Key considerations for determining whether formal fact‑finding is warranted and proportionate include:

• the nature and seriousness of the concern;
• whether there are disputed facts;
• whether the concern appears to be frivolous, vexatious or malicious;
• the feasibility of an investigation and its likelihood of producing reliable findings;
• any legal or regulatory obligations to investigate;
• internal policy or enterprise agreement requirements;
• potential legal, reputational, financial or operational risks to the employer;
• risks to workers, including any safety concerns and the potential for retaliation or victimisation;
• the appropriateness of alternative response options, such as mediation, or broader cultural or organisational reviews; and
• how the reporter wishes the matter to be addressed.

A decision whether to investigate should be made promptly and should usually be documented. Delay is inconsistent with best practice, may create legal risk, and may be perceived as tacit acceptance of inappropriate or unlawful conduct.

The decision must withstand legal and regulatory scrutiny, and should maintain employee and public confidence in the employer’s leadership.

There is no specific Australian law that expressly regulates the circumstances in which a workplace investigation must occur.

However, commonly an internal investigation may be warranted to demonstrate compliance and/or mitigate risk in respect of employer obligations arising under:

• whistle-blower laws;
• work health and safety (WHS) laws;
• employee protection laws relating to termination of employment and discrimination (including the Fair Work Act 2009 (Cth) (the “FW Act”) and relevant equal opportunity and discrimination legislation);
• common law duties, such as the duty of care and the duty of procedural fairness;
• individual contracts of employment, which may bind an employer to investigate if it has prescribed processes under workplace policies;
• workplace policies; and
• relevant industrial instruments, such as awards or enterprise agreements.

In some circumstances, investigations are required to meet specific legal obligations imposed by statute, workplace instruments or regulatory frameworks. In other cases, employers may initiate investigations to demonstrate that reasonable and proportionate steps have been taken to discharge responsibilities under those laws, including duties relating to WHS, procedural fairness, discrimination and harassment prevention.

For example, an employer may conduct an investigation in order to: 

• establish a sound evidentiary basis, through a procedurally fair fact‑finding process, to support disciplinary decision‑making, including termination of employment;
• demonstrate compliance with statutory obligations by evidencing that any action taken was reasonable and did not constitute unlawful adverse action under the FW Act; and
• identify, assess and address risks to WHS, including psychosocial risks, to discharge duties under WHS laws.

Employers must also be aware of laws that may restrict or impact how an investigation is conducted – for example, as follows.

• Privacy laws may limit how personal information and sensitive employee data is collected, used and disclosed during the investigation process.
• Allegations of potentially criminal conduct, such as assault, fraud or corruption, may require referral to law enforcement (see 2.2 Communication to Authorities for further detail). In such circumstances, any internal investigation may need to be paused, delayed or reframed to avoid compromising law enforcement processes.
• Whistle-blower laws may impose additional confidentiality and procedural requirements that shape how an investigation is undertaken.

Employers are generally not required to have specific reporting channels for employees to report concerns, with the exception of whistle-blowers’ disclosures (see 8.1 Whistle-Blowing).

Subject to any statutory, contractual or regulatory constraints, employers retain discretion as to the design and operation of complaint‑handling processes.

From a compliance and risk perspective, employers should ensure that appropriate and accessible options for reporting and responding to relevant unlawful conduct are provided and regularly communicated to employees and other impacted people. This is an important action that employers can take to help satisfy the positive obligation imposed under a range of WHS and anti-discrimination laws to take reasonable and proportionate measures to eliminate, as far as possible, certain unlawful conduct (such as bullying, sexual harassment and discrimination).

An effective complaint-reporting process should be in writing and contain:

• easy-to-understand processes for making and managing complaints, including possible outcomes;
• confidentiality protocols;
• protections against victimisation or retaliation for making a report;
• options for reporting internally or externally, informally or formally, including anonymously (to the extent possible);
• a choice of nominated internal contact officers for making a report;
• information about how to contact relevant external bodies (such as the Australian Human Rights Commission, the Fair Work Commission, the Fair Work Ombudsman, WHS regulators, and state and territory anti-discrimination agencies); and
• clear escalation pathways where a complaint is not managed effectively or involves senior employees.

Australia has no mandatory qualifications for workplace investigators. However, investigations that are not conducted by appropriately skilled or experienced investigators risk being poorly designed or executed, which may compromise procedural fairness, undermine outcomes and cause unnecessary distress to participants.

With new duties requiring employers to identify and address workplace psychosocial hazards, investigations have shifted from a one-size-fits-all approach to a more responsive, person-centred model. Investigators are now expected to use trauma-informed and culturally sensitive practices, and in some sensitive matters – such as sexual harassment – a same‑gender investigator may be appropriate.

Workplace policies commonly identify responsibility for the conduct of investigations and may specify whether investigations are to be undertaken internally or by external investigators.

Regardless of whether an investigation is conducted internally or externally, employers should ensure that the appointed investigator:

• has appropriate experience and training relevant to the nature of the investigation;
• can maintain strict confidentiality;
• is free from actual or perceived conflicts of interest;
• is objective (neutral and unbiased) and impartial;
• is trained in trauma‑informed investigation approaches; and
• is familiar with the applicable investigative framework, including relevant legislation, workplace policies and procedures.

Where an investigation is conducted internally, concerns may arise as to whether sufficient independence can be maintained. In such circumstances, employers may consider engaging an external investigator, particularly where senior personnel are involved or where impartiality may reasonably be questioned. External investigators are often engaged where specialised expertise or a strong understanding of investigative principles is required.

Before appointing an investigator, consideration should be given to whether it is appropriate to engage the investigator through in-house legal or external lawyers to establish and preserve legal professional privilege (LPP) over the investigation report and other documents created during the investigation. This may be particularly important where there is a real risk of litigation or regulatory scrutiny.

Employers should also consider when and how to engage external lawyers in the investigation process. Early engagement of external lawyers can assist with:

• framing the scope and terms of reference of an investigation;
• advising on process, procedural fairness and legal obligations;
• ensuring that critical evidence is preserved; and
• confirming that the appropriate investigative framework is applied.

As set out in 1.1 Circumstances and 1.2 Bases, employers are not legally required to carry out an investigation. However, an investigation may be necessary and appropriate to demonstrate and manage legal compliance and risks.

Investigations are a routine function of workplace and workforce management.

There are, however, limited circumstances in which an employer may be prohibited from commencing or continuing an investigation, including:

• direction from law enforcement not to proceed, where an internal investigation would risk prejudicing a criminal investigation; or
• an order or injunction from a court or tribunal preventing further investigation.

Although relatively rare, there may also be situations in which it is not practicable to conduct an investigation. This may include instances where:

• relevant witnesses are unavailable;
• allegations are historic and evidence is no longer accessible;
• complaints are anonymous and lack sufficient credibility or detail; or
• critical evidence has been lost.

In other cases, the concern may fall outside the employer’s responsibility to investigate, such as in purely personal disputes. Given that the boundaries between work and personal conduct can be unclear, employers should seek legal advice where the employment nexus is uncertain.

Regardless of whether an investigation cannot be or should be conducted, employers should still carefully consider:

• whether their legal obligations have been satisfied, including whether alternative steps are required to address identified risks or concerns; and
• how the status of the matter is communicated to relevant parties in a clear, appropriate and timely manner.

Refer to 1.1 Circumstances, 1.2 Bases and 1.6 Prohibition on Carrying Out an HR Internal Investigation.

Reporter

Employers are generally not legally required to inform a reporter that an investigation has commenced or regarding any other information about the investigation, such as the status of a matter, unless required by a workplace policy or whistle-blower laws. Similarly, there are usually no mandated or generally prescribed timeframes for doing so.

In practice, reporters are informed that an investigation has commenced to the extent that this can occur without compromising confidentiality or the integrity of the process. Reporters are often interviewed and required to provide further information or evidence, meaning they are notified as part of their participation in the investigation.

While the timing and extent of communication will depend on the circumstances of each matter, good practice commonly includes providing the reporter with the following information: 

• acknowledging receipt of the concern or complaint;
• advising the reporter of available employee support services;
• informing the reporter about whether the matter will be investigated or managed in another manner;
• identifying the person responsible for managing the matter;
• addressing expectations regarding confidentiality and protections against victimisation; and
• providing periodic, high‑level updates on the status of the investigation, subject to confidentiality constraints.

Respondent

To satisfy procedural fairness obligations, respondents have a right to be informed that an investigation has been commenced and of the specific allegations against them. This requirement may also arise under applicable workplace policies, enterprise agreements or legislation.

Good practice usually involves notifying the respondent of:

• the fact of the investigation, the identity of the investigator, and the allegations;
• the relevant framework governing the investigation, including applicable policies and legal obligations;
• expectations regarding confidentiality and non-victimisation;
• available employee support services;
• any entitlement to a support person or representative, depending on the applicable framework; and
• providing periodic, high‑level updates on the status of the investigation, subject to confidentiality constraints.

There is no prescribed timeframe governing when a respondent must be notified of allegations or required to provide a response, unless specified in legislation, a workplace policy or an industrial instrument.

However, procedural fairness requires that respondents be afforded a reasonable opportunity to respond to the allegations. What is reasonable will depend on the circumstances, including the seriousness, complexity and volume of allegations.

Procedural fairness is also flexible, meaning that an employer can delay notifying a respondent of an investigation or the details of allegations in order to preserve the integrity of the evidence. This may include interviewing the reporter or witnesses or securing documentary evidence before alerting the respondent.

In certain situations, employers may be obliged, or it may be prudent, to notify external authorities when an investigation commences or serious allegations are first identified. These considerations usually arise in relation to criminal conduct, significant professional or financial misconduct, serious safety incidents or statutory reporting regimes. The need to notify will depend on the nature of the allegations and the employer’s regulatory environment. For example:

• police or other law enforcement agencies – where the allegations, on their face, disclose potential criminal conduct such as sexual offences, child abuse or serious fraud;
• professional regulatory bodies, such as the Australian Health Practitioner Regulation Agency – where the allegations raise immediate concerns about professional conduct, registration or public safety;
• industry regulators, such as the Aged Care Quality and Safety Commission – where allegations may indicate non‑compliance with sector‑specific legislative or regulatory requirements;
• WHS regulators and workers’ compensation insurers – where an incident leading to an investigation involves a notifiable incident, work‑related injury or illness;
• professional indemnity insurers – where policy terms require early notification of circumstances that may give rise to a claim;
• the Commonwealth Ombudsman – where an investigation has commenced following the receipt of a public interest disclosure (PID);
• the Office of the Australian Information Commissioner (OAIC) – where there is a suspected or actual eligible data breach requiring early assessment and notification under privacy laws;
• financial regulators, such as the Australian Securities and Investments Commission (ASIC) – where allegations signal potential contraventions of the Corporations Act 2001 (Cth) (the “Corporations Act”) or related financial services legislation;
• integrity and anti‑corruption bodies, such as the Independent Broad-based Anti-Corruption Commission (IBAC) – where allegations involving public officials raise the possibility of corrupt conduct; and
• the Australian Prudential Regulation Authority (APRA) – where allegations involving APRA‑regulated entities may indicate material breaches of prudential financial standards, governance frameworks or risk management controls.

Before notifying authorities, employers should carefully review all relevant legislative, regulatory, contractual and policy obligations, including applicable thresholds, timing and content.

Where those requirements are complex or carry significant legal or regulatory risk, it is prudent to seek legal advice to ensure compliance while protecting the integrity of the investigation process.

Generally, employers should be careful and informed about the nature and extent of information provided to authorities, as that information may be used or relied on in external processes, and may impact the integrity of its internal processes for managing the matter.

Maintaining confidentiality is paramount to the integrity of workplace investigations, and participants are ordinarily instructed not to disclose information about the matter.

Investigators typically document the chosen approach in an investigation protocol to ensure that expectations are communicated consistently.

In routine or less serious matters, confidentiality is usually maintained through a lawful and reasonable direction requiring participants not to discuss the investigation while it is ongoing.

In more serious investigations, participants may be asked to sign a confidentiality or non‑disclosure agreement (NDA), although this is not mandatory and should be considered carefully in the circumstances due to the potential for delay or complexity arising from negotiation of the NDA’s terms.

For non-employees, such as contractors, a confidentiality agreement may be appropriate, as employers generally lack an equivalent power to impose enforceable confidentiality obligations by direction alone.

From 1 November 2026, Victorian legislation will prohibit the use of NDAs relating to workplace sexual harassment between employers and employees in certain circumstances. No equivalent prohibition currently applies in other Australian jurisdictions, although the regulatory landscape in this area continues to evolve.

Even where there is no legal restraint, NDAs that are overly broad, coercive or reasonably perceived as intended to “silence complainants”, particularly relating to sexual harassment matters, may attract legal or regulatory scrutiny.

Any confidentiality obligation should not prevent employees from seeking legal advice, obtaining support, or making reports to authorities where legally permitted or required.

Where an employee is subject to a lawful confidentiality obligation, failure to comply may be addressed by disciplinary action, depending on the nature and seriousness of the breach.

Preliminary investigations (or “preliminary assessments”) are a common and useful procedural step often undertaken before commencing a formal investigation, and are frequently contemplated or required by workplace policies.

A preliminary assessment assists an employer in determining whether issues warrant investigation, are better managed through other processes, or should be closed without further action.

Preliminary assessments are particularly useful for clarifying issues early and ensuring that any subsequent investigation is properly scoped, reducing cost, inefficiency and delay. They are especially valuable:

• where allegations are unclear, broad or historical, or where the availability of witnesses or documentary evidence is unclear; and
• for identifying whether threshold jurisdictional or policy issues exist or may arise.

A preliminary assessment typically involves:

• reviewing the complaint or information received;
• clarifying the nature and particulars of the allegations;
• identifying applicable policies or legal frameworks;
• identifying available evidence and relevant witnesses;
• assessing whether there is sufficient evidentiary basis to proceed;
• assessing whether alternative resolution pathways may be suitable; and
• identifying any mandatory reporting obligations or interim risk‑management measures.

Where allegations are serious or present an imminent risk, or where the circumstances are sufficiently clear on their face, it may be unnecessary or inappropriate to conduct a preliminary assessment unless required by policy or law.

Preliminary assessments can be particularly useful in the context of “stop bullying” or “stop sexual harassment” applications under the FW Act. The Fair Work Commission must consider any final or interim outcomes arising out of an investigation into the matter, any procedure available to the worker to resolve grievances or disputes, and any final or interim outcomes arising out of those procedures. A properly conducted preliminary assessment allows an employer to demonstrate early, proportionate and good faith action in response to an application. This can assist in narrowing the issues in dispute, reducing the likelihood of urgent intervention orders, and evidencing that the employer has taken reasonable steps to address workplace risks while a formal investigation or other resolution process is considered or under way.

Engaging external lawyers or investigators to conduct preliminary assessments can significantly assist employers in defining an investigation’s scope. See 1.4 Responsibility for further detail.

Who is interviewed will depend on the nature and scope of the allegations, but generally falls into the following categories.

Reporter

The reporter is usually interviewed early in the investigation in order to:

• clarify the nature and particulars of the allegations;
• understand the context, background and alleged impact of the conduct;
• identify relevant dates, locations and potential witnesses; and
• obtain any supporting documents or other evidence.

Witnesses

Witnesses can include individuals who: 

• directly observed the alleged conduct; and
• can provide relevant contextual or background information, such as supervisors or managers with knowledge of workplace practices, reporting structures or patterns of behaviour.

The number of witness interviews, and the scope of those interviews, should be no more than is relevant and necessary to help prove or disprove a material issue in dispute.

Respondent

Procedural fairness requires that the respondent be informed of the allegations and any adverse evidence and be given a reasonable opportunity to respond. Therefore, respondents are usually interviewed later in the investigation.

While they are not usually entitled to full witness statements or confidential material, they must be given sufficient information to enable a meaningful response.

Further Interviews

Sometimes, individuals need to be interviewed more than once, particularly where:

• clarification or further evidence is required as new evidence emerges; and
• apparent inconsistencies arise that can only be assessed once evidence is considered collectively.

Repeat interviews, while often necessary, can cause distress and disruption for participants. As a matter of best practice, any additional interviews should be limited to clearly identified issues, and the purpose and scope of those interviews should be transparently explained to the individuals concerned.

For many reasons, individuals may be reluctant or refuse to participate in an investigation.

In the first instance, employers should seek to understand the nature of the individual’s concerns and consider whether any reasonable measures can be put in place to allow their voluntary participation.

For example, fears of potential victimisation or adverse treatment may be addressed by:

• reiterating the employer’s obligations regarding confidentiality and victimisation;
• reminding all participants of those obligations; and
• providing the individual with a dedicated contact point to raise concerns during the course of the investigation.

Employees can generally be directed to participate in an investigation where the direction is lawful and reasonable. A refusal to comply with such a direction may itself constitute misconduct, potentially justifying disciplinary action.

If the refusal persists, the employer may be informed that, if they choose not to participate, the investigator may proceed on the available evidence and draw conclusions without the benefit of that employee’s account, provided procedural fairness requirements have otherwise been met.

In such circumstances, it may be open to the investigator to draw reasonable inferences from an employee’s failure to provide an explanation or respond to adverse information that has been put to them.

Where an employee seeks to rely on the privileges against self-incrimination or exposure to penalty to refuse to attend or answer questions, the employer should obtain specific legal advice, including whether such a right is exercisable.

Employers generally lack control over non‑employees, and, unless legally or contractually required, their participation will be voluntary.

Ideally, interviews should be conducted in-person or via videoconference (for example, Zoom) rather than telephone interviews, as it can be more challenging to assess witness credibility.

Online interviews are now standard and appropriate where:

• parties are geographically dispersed;
• travel would cause unnecessary delay or cost; 
• issues are straightforward and not highly contested;
• confidentiality and privacy can be maintained; and
• measures can be put in place to ensure confidentiality and privacy.

In-person interviews may be preferable where:

• allegations are particularly serious or sensitive;
• credibility is likely to be key to the findings;
• there are concerns about coaching or interference from a third party; and
• the interviewee requests it due to distress, lack of privacy, or difficulty with technology.

Employers should consider the suitability of an interview venue. To maintain confidentiality and privacy of participants, it may not be ideal to conduct on-site interviews and preferable to arrange an alternative suitable location. 

When conducting interviews and sharing information online, employers should ensure that confidentiality is maintained by the relevant parties and any other measures to prevent unauthorised distribution or access.

Generally, most investigations involve a single interviewer, who is the appointed investigator. See 1.4 Responsibility for the skills and considerations required of an investigator.

In many investigations, experienced interviewing skills and qualifications are required to:

• bring the appropriate gravitas and weight to the investigation;
• have the necessary subject matter expertise to make informed findings of fact and application of policies;
• draw out and test the evidence (particularly inconsistent or contradictory evidence); and
• ensure that the investigation is conducted impartially and in a trauma-informed way.

A neutral party is distinct from a support person and does not usually attend interviews. Their role is strictly to attend as a witness to observe the interview. Their presence may be appropriate in limited circumstances, such as where a matter is particularly sensitive or the process may be disputed. They may perform the role of note-taker for the participants.

In some cases, a witness may request that a person attend to act as a cultural liaison or interpreter.

Support Persons

Most investigative frameworks allow support persons at interviews, and doing so is generally considered best practice. The FW Act also treats an unreasonable refusal to permit a support person in dismissal‑related discussions as a relevant consideration in determining unfair dismissal claims.

A support person’s role is limited to providing emotional and practical support. They should not be a “mouthpiece” for the interviewee and they must not be directly involved in the investigation or have a conflict of interest.

A support person is chosen by the participant and is typically a trusted, impartial individual such as:

• a friend or family member;
• a colleague; or
• a union representative.

The support person’s role should be confirmed and recorded at the start of the interview to avoid disputes.

Lawyers

There is no general legal right to a lawyer during an interview, unless expressly provided under the relevant investigative framework or at the employer’s discretion.

Employers may alternatively permit a lawyer to be present on the basis that they only act in the capacity as a support person, and not as a lawyer or advocate.

If permitted, lawyers may advocate on behalf of the interviewee and provide them with advice, and may ask clarifying questions during the interview. However, it is not appropriate for the representative to influence an interviewee’s response or answer questions on their behalf.

The representative’s role should be confirmed and recorded at the start of the interview to avoid disputes.

Managing Disruptive Behaviour

If a support person or representative becomes disruptive during an interview, an investigator may take the following steps:

• remind them of their agreed role;
• record the behaviour and request that they stop;
• if it continues, pause the interview to reset expectations; and
• if it remains unresolved, cease the interview and consider alternative options, such as formal directions regarding alternative support persons or representatives.

Before the interview, the investigator should provide the interviewee with certain information about the investigation and the investigation process to ensure transparency and procedural fairness. This includes:

• an introduction to the interviewee about the investigator (if not known to them), confirming the fact that the investigation is occurring and their role as investigator;
• explaining the purpose of the interview;
• informing the interviewee of their rights to a support person and/or representative;
• providing contact details for employee support services; 
• explaining obligations regarding confidentiality and the prohibition on victimisation; and
• outlining who will attend the interview and whether the interview will be recorded, and obtaining consent for recording.

It is best practice to remind the interviewee of the above matters at the start of the interview.

At the end of the interview, the investigator should:

• ask whether the interviewee wishes to provide any additional information or has questions;
• confirm any request for documents in writing after the interview;
• remind the interviewee of confidentiality and non-victimisation obligations; and
• remind the interviewee of available employee support services, where appropriate.

If an interviewee requests to stop the interview, the investigator should promptly pause the interview and make a reasonable attempt to address the concern.

Common reasons may include distress, fatigue, confusion about the process or particular interview questions, or the need to consult a support person or lawyer.

Deciding how to address the concern requires a skilled investigator who can assess the situation, balance procedural fairness, and maintain the integrity of the investigation.

Depending on the nature of the concerns raised, the interview may resume once the concerns have been addressed or may be rescheduled. Interviewees should never be pressured to continue while distressed or unwell.

If an interviewee refuses to resume their participation without reasonable basis, the investigator should clearly explain any expectations or duty to co-operate and outline the potential consequences of refusal.

If the refusal persists, the employer may:

• consider any available measures to lawfully compel the interviewee’s participation; and/or
• proceed with the investigation based on available evidence.

Where an investigation involves a potential crime, the interviewee may be able to invoke the

privilege against self-incrimination. In this case, it is generally recommended that the investigator suspend the interview and seek further direction from the employer. The privilege against self-incrimination can be complex in workplace investigations; as such, the employer may need to seek legal advice accordingly.        

For reasons set out at 3.10 Recording, it is generally preferable to record interviews, where it is lawful and with the interviewee’s consent.

However, taking minutes may be preferable or required where:

• given the circumstances of the matter, recording may inhibit candid responses or increase the formality of the interview and stress for interviewees; and
• the interviewee does not consent to being recorded.

If the interview is not being recorded, the investigator should prepare a written record of the interview, which summarises the matters discussed during the interview.

The investigator should inform the interviewee that notes will be taken and a record prepared. A note-taker may attend so that the investigator can focus on the interview.

It is best practice to provide the record of the interview to the interviewee promptly after the interview to confirm its accuracy. Any changes made by the interviewee should be noted.

Recording is the standard and preferred practice in workplace investigations, for the following reasons:

• it provides the most accurate record;
• it avoids the risk of disputes about what was said;
• it saves time, allowing the investigator to focus on listening, observing and adapting questions rather than taking detailed notes; and
• when determining disputed facts, exact wording may be crucial.

However, interviews should only be recorded lawfully and with the interviewee’s consent.

Although producing a transcript is usually discretionary, transcripts assist investigators by making it easier to review evidence, assess credibility, and explain the rationale for findings without replaying recorded interviews.

Whether a transcript is provided to the interviewee is usually governed by policy, legal advice (for example, if it is necessary to maintain privilege) or the circumstances of the matter.

Whether the interviewee consents to the investigator’s recording or not, the investigator should also seek confirmation from the interviewee that they are not recording and will not record the interview. Unauthorised recordings can breach confidentiality, create legal risks, and undermine the integrity of the investigation process.

It is rare for an investigation to be limited to fact-finding from interviews only.

Investigators use a range of other evidence‑gathering and preservation steps, provided they are lawful, proportionate and procedurally fair.

Other fact-finding measures often include:

• reviewing documentary materials such as organisational charts, emails, written complaints, instant messages, photos, policies, procedures, timesheets and leave records; 
• reviewing electronic evidence such as CCTV footage, system logs and access records, and swipe card data; and
• physical inspection of work locations, safety conditions, property and equipment.

Some of these measures may require compliance with legislation (such as surveillance and privacy laws), the investigative framework, the terms of the contract of employment or engagement and/or consent.

Where documentary evidence is obtained, the investigator should consider where the document needs to be authenticated to confirm its legitimacy. 

Evidence Preservation Measures

Early steps may be required to prevent loss or destruction of evidence, particularly where litigation, regulatory reporting or serious misconduct is foreseeable. This may include:

• issuing document‑retention or “hold” notices;
• suspending routine data deletion processes;
• securing devices, files or access rights; and
• limiting contact between parties to prevent interference.

When a concern or complaint is raised, employers should assess whether the reporter’s identity needs to be protected and whether there is any risk:

• to the reporter’s or others’ psychological or physical safety;
• of retaliation, victimisation or other detriment;
• of further misconduct; and
• of compromised evidence.

The key laws that employers need to consider when assessing these risks include:

• WHS laws, which require employers to provide a safe workplace;
• whistle-blower laws which require protection of the reporter’s identity (subject to limited exceptions) and prevention of retaliation or detriment;
• federal and state anti-victimisation laws which prohibit victimisation of a person because they made or intended to make a complaint; and
• the FW Act, which prohibits taking adverse action against an employee because they have made a complaint or are the subject of a complaint.

Possible protective measures include:

• anonymising the complaint and taking steps to protect the reporter’s identity (particularly for whistle-blower matters);
• adjusting reporting lines and/or implementing remote-working arrangements to limit interaction between the reporter and the respondent or other parties;
• suspending the respondent for the duration of the investigation (where lawful and appropriate – see 4.3 Measures Against the Respondent for further detail);
• issuing lawful and reasonable directions in relation to confidentiality and co-operation with the investigation;
• issuing clear instructions to relevant staff to prevent gossip, harassment or retaliation; and
• ensuring readily accessible employee assistance services. 

See 4.1 Protection of the Reporter regarding reporter protections, which apply equally to the respondent. 

Any interim measures taken against the respondent before the investigation is finalised need to be taken with caution, as they can compromise the investigation findings and expose the employer to legal and regulatory risk.

As a guiding principle, such measures should only be taken where it is lawful and reasonably necessary to protect health and safety, safeguard the integrity of the investigation or preserve evidence.

Employers must also take care in how these measures are recorded and communicated to the respondent. It is essential that they are taken as necessary risk‑management steps, rather than as a response to any presumed misconduct.

Examples of potentially adverse measures – such as suspension from duty, reallocation of reporting lines and remote work – that may be taken against the respondent are set out in 4.1 Protection of the Reporter.

Formal disciplinary action relating to matters under investigation should not be taken prior to concluding the investigation. However, there may be circumstances in which the respondent has engaged in conduct that warrants immediate disciplinary action, such as a clear breach of confidentiality or refusing to comply with a lawful direction related to the investigation. In such cases, a warning letter or show-cause disciplinary process may be appropriate in respect of that conduct.

The protections for other employees are the same as those set out in 4.1 Protection of the Reporter. 

Investigations must be carried out in a procedurally fair manner, consistent with applicable legislation and the organisation’s investigative framework, and with regard to the principles outlined in this chapter.

A failure to follow proper process can expose employers to significant legal and organisational risk, including:

• compromised or unreliable investigative findings;
• loss of LPP;
• unfair dismissal claims;
• breach of contract claims;
• adverse action claims;
• psychological injury claims; and
• reputational harm. 

Employers often have internal regulations in workplace policies or enterprise agreements that go beyond the minimum standards of procedural fairness. These may include, for example:

• providing specific timeframes for each stage of the investigation;
• allowing an employee to participate by providing a written response only, rather than attending an interview; and
• requiring the engagement of an external investigator for certain types of allegations.

Significant risks can arise when employers fail to comply with their own policies or with investigation procedures embedded in an enterprise agreement, including the following.

• A breach of an enterprise agreement can amount to a contravention of the FW Act and exposure to significant penalties.
• Policies that state that they are “not contractually binding” may, when challenged, be found to have legal effect. In some cases, they can be treated as enforceable terms and a failure to follow them may constitute a breach of contract.
• Even when policies are not legally binding, courts and tribunals such as the Fair Work Commission have often criticised employers who have failed to follow their own procedures, especially where disciplinary action or dismissal is involved.

The employer bears the burden of proof in a workplace investigation.

This requires the employer to determine, on the balance of probabilities, whether an allegation is substantiated. In practical terms, the investigator must assess whether it is more likely than not that the alleged conduct occurred, which is a lower threshold than the criminal standard of beyond reasonable doubt.

Importantly, reaching a finding on the balance of probabilities is not a mechanical exercise of simply being marginally persuaded more one way than the other (in other words, 50+1%). The investigator must be genuinely satisfied, based on the quality, credibility and reliability of the evidence, that the alleged conduct is more likely than not to have occurred.

The balance‑of‑probabilities test must also be applied consistently with the Briginshaw principle established by the High Court decision of Briginshaw v Briginshaw [1938] HCA 34. Simply, this means that the more serious the allegation or the potential consequences, the stronger and more compelling the evidence needs to be for the decision-maker to feel an “actual persuasion” and reach the necessary state of reasonable satisfaction that the allegation is made out.

In practice, an investigation ends once the investigator is satisfied that all reasonably available evidence has been obtained, no further evidence can be gathered, and the investigator’s report has been completed and provided to the decision‑maker.

There are, however, some circumstances which may mean that an investigation ends before its completion, including as follows:

• a reporter withdraws their complaint and there is no WHS risk to other employees if the investigation is not pursued;
• the reporter’s or respondent’s employment ends, their response cannot be obtained, and there is no ongoing WHS risk to other employees;
• it has been paused or ceased due to a criminal matter (see 6.6 Communications to Authorities and 8.4 Criminal Cases); and
• the respondent is absent from the workplace for an extended period of time, such as being on long-term personal leave.

An investigation may also not proceed at all where a preliminary assessment determines that the matter does not warrant a formal investigation (see 2.4 Preliminary Investigation and Scope-Setting).

Any decision to cease an investigation before completion should be clearly documented.

The specific procedure to be followed once the investigation is complete will depend on the relevant investigative framework.

In practice, after the decision-maker has accepted the investigator’s findings, they will communicate the outcome to the reporter and the respondent.

Witnesses are not usually informed of the outcome of the investigation. However, the end of the investigation may be an appropriate time to provide them with a reminder about their ongoing confidentiality obligations.

Other parties, such as external authorities or affected team members, may also need to receive limited or tailored communication about the outcome, where appropriate (see 6.6 Communications to Authorities and 6.7 Other Communications).

Investigators should produce some form of written investigation report, the complexity and level of detail of which depends on the seriousness of the matter.

From a legal risk perspective, an investigation report is strongly recommended as investigation findings and the investigative process may become the subject of scrutiny by courts, tribunals and regulators. In such contexts, a high-quality written report is the most reliable way for an employer to demonstrate defensible findings and procedurally fair process.

The information usually contained in an investigation report is set out in 6.4 Reports.

An investigation report should stand on its own, be easy for any reader to understand, and allow for efficient review by a decision-maker and the employer’s other advisers, such as internal HR or external counsel.

A skilled investigator understands how to produce a report of this standard and to articulate findings in a logical and defensible manner.

The report should also be drafted on the assumption that it may be read by individuals who were not involved in the investigation and who may have no prior knowledge of the matter.

There are circumstances in which an investigation report (in whole or in part) may be disclosed more broadly – for example, to the reporter and respondent, a WHS regulator, or, if the matter is litigated, tribunal members and judges.

Whether a report should contain recommendations as well as findings should be decided by the employer when formulating the investigator’s scope and terms of reference. Generally, it would be undesirable to include recommendations in a report that is not protected by LPP, and which may be discoverable in subsequent legal proceedings.

An investigation report should contain:

• an executive summary;
• the terms of reference for the investigation;
• an explanation of the background and key individuals involved in the investigation;
• the methodology used, including a list of interviewees and the format used for interviews;
• an explanation of how the investigation was managed, including any sources of evidence that were not or could not be pursued, as well as any issues that arose during the investigation and how they were resolved;
• an explanation of relevant employer policies and how they were complied with;
• assessment of witness credibility, if relevant;
• a summary of relevant evidence;
• findings, with clear, logical and reasoned analysis based on the relevant supporting evidence;
• suggested next steps/recommendations (if required by the terms of reference); and
• a list and/or copies of the evidence collected.

If the investigation has been conducted under LPP, the report should clearly state that the document has been brought into existence for a legally privileged purpose and is protected by LPP.

Parties to an investigation do not have an automatic right to receive information regarding an investigation outcome.

Unless more detail is required by law, litigation processes or specific policies, best practice requires that the employer provide a letter to the reporter and respondent which notifies them of the finding of each allegation (substantiated or unsubstantiated), rather than the whole investigation report or the investigator’s detailed reasoning in respect of each finding. Typically, the following applies.

• Reporters receive a high‑level outcome and any next steps that directly affect them. They are not informed about the specific disciplinary measures imposed on the respondent (unless necessary).
• Respondents receive the findings relevant to them and an opportunity to respond before any disciplinary action is taken.

Reporters and respondents are not provided with detailed witness statements or confidential personal information.

Employers also need to be cautious to preserve LPP, if relevant, by carefully controlling communications and clearly marking and treating communications as confidential and privileged. Privilege can be lost if findings, legal advice or privileged documents are disclosed too broadly or shared with individuals who do not have a genuine need to know.

When delivering the outcome, the employer should also consider whether any protective measures are required to support and reduce the risk of victimisation of any participant.

There are some situations in which an employer must or should communicate the conclusion of an investigation to authorities, such as:

• where the conduct involves criminal behaviour or notifiable safety incidents;
• where the employer operates in a regulated sector; or
• where communication is required under whistle-blower laws.

Similar considerations to those set out in 2.2 Communication to Authorities apply.

There are typically other parties (beyond the reporter, the respondent and the internal decision-maker) who may need to be informed of an investigation’s conclusion. This may include senior leadership, legal, HR and managerial personnel responsible for implementing any risk management, disciplinary or operational processes arising out of the findings. The information shared with these parties should be limited to what is necessary for them to perform their roles, which can usually be achieved through a relevant summary rather than disclosing the full investigation report.

Often, witnesses and broader team members will have an interest in the outcome of an investigation where they have been involved and/or are aware of the investigation, and particularly where it has affected morale, operations or team dynamics. Although they have no right to any information, employers may choose to provide limited communication to support transparency and to mitigate potential gossip and miscommunication.

Ideally, any broader communication should be confined to confirming:

• that the investigation has concluded;
• that appropriate steps are being taken to support a respectful workplace; and
• any organisational or cultural measures to be implemented, such as training or team-building.

If the allegations are substantiated, employers may take a range of disciplinary actions, depending on their disciplinary processes, the employee’s terms of employment, and any obligations under the FW Act.

The appropriate disciplinary response should be timely and will depend on factors such as the seriousness and impact of the conduct, any mitigating circumstances, the respondent’s role and tenure, and any prior disciplinary history.

Common disciplinary measures include:

• counselling;
• formal warning;
• changes to duties or reporting lines;
• demotion; and
• termination of employment.

If the respondent raises new or counter‑allegations, the employer should assess their credibility, decide whether a separate investigation is needed, and ensure that the disciplinary process is not unnecessarily delayed.

A rushed or procedurally flawed process may expose the employer to unfair dismissal claims or other legal risks.

Employers may take other measures after an investigation – regardless of whether allegations are substantiated – to help address broader underlying issues, prevent future complaints and rebuild trust in the workplace.

At the team, individual or interpersonal level, this may include:

• counselling or mentoring;
• facilitated discussions or mediation to reset expectations around communication and behaviour, or to clarify roles and responsibilities;
• refresher training on respectful workplace behaviour; and
• leadership training for supervisors on managerial responsibilities.

At the organisational level, this may include:

• updating or improving workplace policies; and
• strengthening supervision, reporting channels and communication processes.

If broader cultural or systemic issues are identified, employers may also undertake a cultural review to assess patterns, behaviours or contributing factors.

Such reviews are increasingly used post‑investigation to support psychological safety and proactive cultural management. They are typically conducted by an external lawyer, investigator or other specialist with investigative or organisational culture expertise, to ensure that employees feel comfortable with speaking openly.

A cultural review may involve:

• anonymous staff surveys;
• focus groups or interviews;
• review of policies, leadership practices and team dynamics; and
• recommendations for cultural improvement.

Employers may collect personal information for the purposes of an investigation, provided that such collection complies with privacy law requirements.

In practice, employers should only collect information that is directly relevant to the investigation and proportionate to the seriousness and scope of the allegations.

“Sensitive information” such as information about an individual’s political opinions, criminal record or health information, can only be collected with the individual’s consent, unless an exemption applies.

Individuals must generally be notified:

• that their information is being collected;
• about the purpose of collection;
• about who it may be disclosed to; and
• about the consequences of not providing it.

Employers must:

• restrict access to those with a need to know;
• store investigation material securely; and
• not retain data longer than necessary once the investigation and any related proceedings conclude.

Employers must comply with the specific personal data collection rules outlined in 7.1 Collecting Personal Data.

It is often beneficial for employers to have a documented framework (such as a standard investigation protocol or dedicated privacy policy) to govern how personal information is collected, used and handled during workplace investigations.

When well designed, such framework helps to ensure that investigations are conducted consistently, lawfully and transparently, while managing employee expectations about confidentiality, data access and information sharing.

In practice, employees involved in an investigation generally do not have a right to access personal information gathered for the purposes of that investigation.

Under the Privacy Act 1988 (Cth), certain private‑sector employers are exempt from providing access to “employee records” where the records are directly related to the employment relationship. This exemption is broad; however, its scope depends on the purpose for which the information was collected and how it is used.

AI is increasingly being used in investigations as a support tool, for document review, chronology building, investigation planning, interview transcription and report preparation, such as when extracting key themes or organising evidence summaries.

However, it is well known that AI has limitations, in that it cannot assess credibility, context or demeanour, and its outputs may contain errors or bias.

AI use also creates privacy risks, and employers must ensure that it is deployed only for a lawful purpose and in a way that upholds confidentiality and procedural‑fairness obligations.

The main whistle-blowing protection regimes are:

• the Corporations Act, for the private sector and some not‑for‑profit organisations; and
• the Public Interest Disclosure Act 2013 (Cth) (the “PID Act”) for the Commonwealth public sector.

Other regimes exist under the Taxation Administration Act 1953 (Cth) for tax‑related disclosures and under various state and territory laws.

Under the Corporations Act, an eligible whistle-blower is protected when they disclose information on reasonable grounds that concerns misconduct or an improper state of affairs in relation to a company or related body corporate. Public companies, large proprietary companies and APRA‑regulated entities must maintain a compliant whistle-blower policy. Eligible whistle-blowers include current and former employees, officers, contractors and their employees, suppliers, associates and their spouses or dependants.

Under the PID Act, a public interest disclosure must relate to “disclosable conduct”, such as breaches of law, corruption, maladministration, wastage of public money, or conduct posing risks to health, safety or the environment. Protected persons include current and former Commonwealth public servants, contractors to Commonwealth agencies, members of Commonwealth companies, and others deemed public officials.

The following applies across both regimes.

• Personal work‑related grievances (such as interpersonal conflict) are generally excluded unless they involve victimisation, reveal systemic issues, or raise broader regulatory or public‑interest concerns.
• Core whistle-blower protections include confidentiality of the whistle-blower’s identity and protection from detriment. Additional protections include immunity from certain liabilities and access to compensation or other remedies for loss or damage arising from the disclosure.
• Breaches of whistle-blower protections may give rise to significant civil and criminal penalties.

Sexual harassment remains a complex workplace issue, influenced by power dynamics, organisational culture and broader social norms.

Protections apply to allegations of sexual harassment under federal and state laws, including:

• protection from adverse action for making a sexual harassment complaint under the FW Act;
• a positive duty under the Sex Discrimination Act 1984 (Cth) (SDA) to take reasonable and proportionate steps to eliminate sexual harassment;
• prohibitions on sexual harassment under state anti-discrimination laws;
• a positive WHS duty to eliminate or minimise risks to health and safety, including from sexual harassment and sex or gender-based harassment;
• protection from victimisation under the SDA; and
• the ability for workers to seek a “stop sexual harassment” order under the FW Act.

Employer responses to sexual harassment complaints are now subject to heightened scrutiny, given the recent developments of the explicit prohibition of workplace sexual harassment under the FW Act and the introduction of the positive duty under the SDA. Sexual harassment is also recognised as a psychosocial hazard under WHS laws, requiring employers to identify, assess and control associated risks. In Victoria, forthcoming legislation effective from 1 November 2026 restricting the use of NDAs in sexual harassment matters will further shape how employers manage complaints and resolution processes.

Protections also apply to allegations of discrimination, harassment, bullying and mobbing under federal and state laws. These include:

• protection from adverse action taken for making a complaint about bullying, harassment or discrimination;
• protection from adverse action taken for a discriminatory reason;
• prohibitions on discrimination based on protected attributes (such as sex, race or age);
• a positive duty under state based WHS laws to eliminate risks to health and safety; and
• the ability for a worker to seek a “stop bullying” order under the FW Act.

As outlined in 2.2 Communication to Authorities and 6.6 Communications to Authorities, allegations that are also criminal in nature can require referral to police or other authorities.

Regardless of whether police are involved or charges have been laid, concurrent HR investigations and criminal processes can raise complex issues, including the employee’s privilege against self‑incrimination, the risk of prejudicing criminal proceedings, and potential challenges to the admissibility or reliability of evidence obtained through the workplace investigation.

Accordingly, it is prudent for employers to seek legal advice when dealing with allegations that may amount to criminal conduct.

Depending on the circumstances of the matter, employers may need to adopt modified procedures, such as:

• pausing or suspending the internal investigation while criminal proceedings are under way;
• modifying the investigation – for example, limiting investigative steps, focusing on interim workplace risk management measures, or deferring ultimate findings until conclusion of the criminal process;
• providing clear communication to participants about the distinction between the internal investigation and any criminal process; and
• remaining alert to the impact of publicity surrounding criminal allegations, as media coverage or workplace discussion can affect witness recollection, independence of evidence, and willingness to participate.

There are no special procedures for multi-jurisdictional investigations; however, employers should be aware of legal and practical complexities involved.

Relevantly, the FW Act has extraterritorial reach in some circumstances, in relation to “Australian-based employees” or any employees of an “Australian employer”.

Foreign employers may carry out investigations in Australia, and, similarly, Australian employers may carry out investigations abroad.

In all cases, employers should consider:

• which jurisdiction’s laws apply to the employment relationship and conduct in question;
• whether any local laws override or conflict with the employer’s investigation framework;
• whether there are any relevant cultural differences that may impact that investigative approach, such as interview styles and confidentiality expectations; and
• whether there are different approaches to LPP (if relevant).

Engaging external investigators or counsel with cross‑border expertise can help to ensure compliance and produce defensible outcomes across jurisdictions.