Workplace Investigations in Australia (2026): Running Defensible Employer Investigations

Workplace investigations australia employers now face sharper legal exposure in 2026, as Fair Work reforms, heightened regulator activity and increased penalties raise the stakes for any employer who mishandles a complaint. A poorly run process is no longer just an HR problem, it is a litigation liability that can be exposed in the Fair Work Commission, the Federal Court or before a privacy or work health and safety regulator. This guide sets out a practical, litigation-aware process for conducting workplace investigations that will withstand scrutiny, preserve evidence, and protect your organisation from avoidable claims. You will get a clear decision framework for in-house versus external investigators, a step-by-step operational playbook, checklists, and answers to the questions employers ask most.

Why a defensible investigation matters in 2026 (compliance and litigation risk)

The cost of getting an investigation wrong has risen. Under the Fair Work Act 2009 (Cth), employees can bring unfair dismissal claims, general protections (adverse action) claims and claims connected to discrimination and workplace rights. Each of these turns, in practice, on whether the employer acted reasonably and fairly, and a defensible investigation is the primary evidence that it did. Workplace investigations australia employers run in 2026 are increasingly tested against a backdrop of tougher enforcement and a regulator community that is more willing to litigate.

The commercial reality is simple: the investigation file is the first thing a lawyer, a Commission member or a judge will read. If it shows a logical process, contemporaneous notes, allegations properly put and a genuine opportunity to respond, the employer is well placed. If it shows assumptions, missing records and predetermined outcomes, the employer is exposed regardless of whether the underlying misconduct occurred.

Recent Fair Work changes, key points for employers

The direction of recent reform under the Fair Work Act, including the “Secure Jobs, Better Pay” and “Closing Loopholes” packages, has consistently expanded employee protections and strengthened enforcement. Relevant measures include a positive duty on employers in relation to sexual harassment, changes to casual employment and the “right to disconnect”, and, from 1 January 2025, criminal penalties for intentional wage underpayment (“wage theft”) in certain circumstances. The practical effect is greater regulator scrutiny of employer processes, higher potential penalties for serious contraventions, and closer attention to procedural fairness in dismissal-related matters.

Employers should assume that the margin for procedural error has narrowed and that regulators such as the Fair Work Ombudsman are better resourced to pursue contraventions, particularly around underpayments, adverse action and unlawful conduct.

What this means in practice is that the policies and processes you relied on five years ago may no longer be sufficient. A workplace investigation policy that has not been reviewed against current law is a risk in itself. The sensible step is to treat 2026 as a prompt to re-baseline your investigation framework, your templates and your training.

How investigations are tested in the FWC and Federal Court

When a dismissed employee challenges their termination, the Fair Work Commission examines whether there was a valid reason for dismissal and whether the employee was afforded procedural fairness, including whether they were notified of the reason, given a chance to respond, and not unreasonably refused a support person. The criteria the Commission must consider for unfair dismissal are set out in the Fair Work Act. In general protections and discrimination litigation in the Federal Court or Federal Circuit and Family Court, the investigation record is scrutinised for whether the employer’s stated reason for action was genuine or a pretext. In both forums, the quality of your documentation often influences the outcome.

The practical effect of weak records can be an adverse finding, not because the employer was wrong on the facts, but because it cannot demonstrate it acted fairly.

Decide: immediate action, informal resolution or formal investigation?

Not every complaint requires a full formal investigation, and over-investigating a minor matter can be as damaging as under-investigating a serious one. The first decision, triage, is the most important one you will make, because it sets the entire process in motion and shapes what evidence survives. Managing workplace complaints well starts with assessing seriousness, safety risk, regulatory reporting obligations, the need to preserve evidence, and urgency.

A practical triage flow runs like this: Is anyone at immediate risk? If yes, act now to ensure safety and preserve the scene. Does the conduct, if proven, warrant disciplinary action or dismissal? If yes, a formal investigation is likely required. Is the matter minor, interpersonal and capable of resolution through conversation or mediation? If yes, informal resolution may be appropriate, but document the decision and the reasoning either way.

When to pause and preserve evidence

The moment a serious complaint lands, the clock starts on evidence preservation. Emails, CCTV footage, swipe-card logs, messaging app records and device data can be overwritten or lost quickly. Pause before launching interviews and secure the evidence first. If you cannot afford external counsel immediately, you can still take low-cost, high-value steps: issue a written hold notice to IT and relevant managers instructing them not to delete relevant records, export and store CCTV before it is recycled, and keep a dated log of what you have secured. Free guidance from the Fair Work Ombudsman can help structure the early process, but high-risk matters warrant legal advice as soon as practicable.

When to notify regulators or police

Certain conduct triggers external reporting obligations that sit alongside, and sometimes ahead of, your internal process. Serious workplace incidents involving death, serious injury or illness, or dangerous incidents may be “notifiable incidents” that must be reported to the relevant regulator and the site preserved under work health and safety law; consult Safe Work Australia guidance and your state or territory WHS regulator for the specific requirements that apply to you. Suspected criminal conduct such as assault, serious theft or fraud may require a police report, and you should take advice on how a criminal process interacts with your internal investigation.

Discrimination and sexual harassment matters engage obligations and guidance from the Australian Human Rights Commission, including the positive duty on employers. Wage underpayment allegations may attract Fair Work Ombudsman attention. Do not let an internal investigation delay a mandatory external report.

In-house vs external investigators: a side-by-side comparison for workplace investigations australia

One of the most consequential decisions is who conducts the investigation. The choice affects cost, perceived independence, whether legal professional privilege may attach, and how the investigation will hold up if it is later reviewed by a regulator or court. Below is a direct comparison, followed by a clear decision framework.

Decision framework: who should investigate

Choose an in-house investigator when:

• The allegation is low-severity, internal and factual with limited legal exposure, such as minor interpersonal conduct;
• You need speed and confidentiality and you have trained HR or in-house counsel with documented impartiality;
• There are no significant regulatory, criminal or systemic risk indicators, and evidence preservation can be managed internally.

Choose an external investigator when:

• The allegation is serious, sexual harassment, violence, theft, discrimination or wage fraud, or criminal elements may exist;
• There is a real risk the investigation will be subject to Fair Work Commission or Fair Work Ombudsman review or litigation, and independence or privilege is strategically important;
• Senior management or the board are potential witnesses or are themselves implicated, or the impartiality of internal staff is reasonably in doubt.

Our recommendation is clear: if the matter is serious enough that dismissal, a regulator or a court is a realistic prospect, consider appointing an external investigator. The modest cost premium can buy independence, litigation-ready documentation and, where scoped correctly through legal counsel, the potential for privilege. For genuinely minor matters, an appropriately trained in-house investigator is often the sensible, proportionate choice.

Hybrid models and external legal review

A hybrid approach often delivers the best of both. Use an internal investigator for the fact-finding, then commission an external legal review of the report and the proposed remedial recommendations where legal risk exceeds your threshold. This keeps costs proportionate while adding a layer of legal rigour and defensibility before any decision is acted upon. Where privilege is a priority, engage external counsel to direct the investigation from the outset rather than retrofitting advice at the end.

Step-by-step defensible investigation process (operational playbook)

This is the core of conducting workplace investigations defensibly. Follow these steps in order, document each one, and treat every record as a potential exhibit. Watch for the red flags noted at each stage.

1. Intake and triage

Capture the complaint in writing as soon as it is received, recording who reported it, when, and what specifically is alleged. Avoid summarising away detail. Confirm the complainant’s account, identify the respondent, and make an initial assessment of seriousness and risk.

• Record the complaint as fully as possible, with dates and names.
• Assess immediate safety, conflict of interest and confidentiality needs.
• Decide the pathway, informal resolution or formal investigation, and document the reasoning.

Red flag: A complaint logged only in someone’s memory or a casual email thread. If it is not documented, it is difficult to prove later.

2. Appoint the investigator and set the scope

Prepare written terms of reference that define the allegations to be investigated, the investigator’s authority, the standard of proof to be applied, confidentiality expectations and the reporting format. A tightly scoped investigation stays focused and defensible; a vague one drifts and invites challenge.

• Confirm the investigator’s independence and freedom from conflict.
• Define the allegations as specific, particularised questions.
• State the applicable standard, the balance of probabilities.

Red flag: An investigator who reports to someone implicated in the complaint.

3. Preserve evidence and maintain chain of custody

Secure all relevant records before interviews begin. Issue a hold notice to IT and custodians, export and store electronic evidence, and log every item with its source, date collected and who handled it. Handle employee personal information in line with OAIC privacy guidance, collect only what is reasonably necessary and store it securely.

• Preserve emails, messages, CCTV, access logs and relevant documents.
• Maintain a dated evidence log and chain-of-custody record.
• Limit access to the investigation file on a need-to-know basis.

Red flag: Relevant CCTV allowed to overwrite because no one issued a hold.

4. Plan the witness interviews

Prepare an interview plan and question script for each participant. Decide the order of interviews, usually complainant first, then witnesses, then the respondent, who must have the allegations put squarely. Advise participants of their entitlement to a support person and the confidentiality obligations that apply.

• Draft tailored, non-leading questions for each interviewee.
• Offer a support person and reasonable notice.
• Plan how contemporaneous notes will be taken and verified.

Red flag: Putting vague or shifting allegations to the respondent, denying them a genuine chance to respond.

5. Conduct the interviews

Interviews must be fair, neutral and recorded accurately. Take contemporaneous notes, read them back or have them signed where practicable, and avoid any suggestion that the outcome is predetermined. The respondent must understand the allegations and be given a real opportunity to answer them.

• Ask open questions; do not lead or pressure.
• Take and retain detailed, dated notes of every interview.
• Give the respondent time to respond to each allegation.

Red flag: Notes written up days later from memory, with no record made at the time.

6. Assess the evidence and make findings

Weigh the evidence against each allegation and make findings on the balance of probabilities, not beyond reasonable doubt. Consistent with the principles in Briginshaw v Briginshaw, more serious allegations call for stronger, more cogent evidence before a finding is made. State findings clearly, with reasons tied to the evidence, and distinguish findings of fact from recommendations.

7. Determine outcome, remedial action and communication

Separate the fact-finding from the decision on consequences, which should rest with an unbiased decision-maker who then provides the respondent a further opportunity to respond on penalty where dismissal is contemplated. Communicate outcomes carefully, maintain confidentiality, and record every decision and its rationale.

8. Prepare the investigation report and retain records

Produce a structured report covering the allegations, process followed, evidence, findings and reasons. Then retain the complete file securely. Treat the report as a document that may be disclosed in proceedings, so write it with that audience in mind, clear, factual and free of gratuitous commentary.

Download the employer investigation checklist to run each of these steps consistently across your organisation. See Workplace investigation templates & letters (download) for the full toolkit.

Procedural fairness and natural justice: legal principles employers must apply

Procedural fairness, also called natural justice, is the backbone of a defensible process, and it is the dimension most often tested in the Fair Work Commission. For the employer, procedural fairness has three core components: the respondent must be told the substance of the allegations against them; they must be given a genuine opportunity to respond before any decision is made; and the decision must be made by an unbiased decision-maker. Where dismissal is a possibility, the opportunity to respond should also extend to the proposed outcome.

These are not mere technicalities. The Fair Work Act’s unfair dismissal framework and the body of Fair Work Commission decisions consistently treat the denial of a fair opportunity to respond as a significant factor weighing against the employer, even where there was a valid underlying reason for dismissal. In other words, you can be right on the facts and still lose on process. Procedural fairness for the employer is therefore both a legal obligation and a risk-management discipline.

Common procedural fairness traps

• Vague allegations. Telling an employee they are being investigated for “performance issues” without particulars denies them a meaningful chance to respond.
• Predetermined outcomes. Drafting the dismissal letter before the respondent’s interview is a classic and serious error.
• Biased decision-maker. Allowing the complainant, or a person implicated, to decide the outcome undermines independence.
• Unreasonably denying a support person. Unreasonably refusing a request for a support person is routinely held against employers.
• No opportunity on penalty. Moving straight from finding to dismissal without inviting a response on consequences.

Evidence preservation, privacy and disclosure risks (WHS, OAIC, discovery)

Investigation evidence preservation is where litigators win and lose cases. The practical task is to preserve relevant material in a way that is verifiable, while respecting privacy obligations and anticipating disclosure. That means securing devices and accounts, preserving emails and messaging records, exporting CCTV before it is overwritten, and capturing relevant social media content before it is deleted. Every item should be logged with its source and handling history.

Privacy obligations run in parallel. Under OAIC guidance and the Privacy Act 1988 (Cth), employers must take reasonable steps to protect personal information, collect only what is reasonably necessary for the investigation, and store it securely with restricted access. Note that the Privacy Act contains an employee records exemption in some circumstances, the scope of which has been the subject of reform discussion; take advice on how it applies to your handling of information. Serious work health and safety incidents carry their own preservation duties, Safe Work Australia model laws and the relevant state or territory regulator require that the site of a notifiable incident be preserved so far as is reasonable and the incident reported.

Chain of custody and retention periods

Maintain a chain-of-custody record for every piece of evidence: what it is, where it came from, when it was collected, who collected it, and where it is stored. For serious misconduct matters, retain the complete investigation file for a period long enough to cover applicable limitation periods and potential proceedings. Many practitioners apply a retention period of around seven years for serious matters, having regard to recordkeeping obligations and limitation periods, though the appropriate period depends on the matter. Document your retention decision and apply it consistently. Note that the Fair Work Act and Fair Work Regulations also impose minimum employee-record retention requirements (generally seven years for prescribed employment records).

Privacy versus disclosure

Investigation documents are frequently discoverable in Fair Work Commission and court proceedings. Legal professional privilege may protect genuinely legal advice and, in defined circumstances, communications and documents created for the dominant purpose of obtaining or providing legal advice or for use in anticipated litigation, but privilege is easily lost through careless handling or mixed-purpose documents. The Law Council of Australia and your state or territory law society can point to guidance on privilege and the ethical considerations of engaging external counsel. The safe assumption is that your investigation file may one day be read by the other side, so document professionally and take advice early where privilege matters.

When to escalate: regulators, Fair Work Commission, police and litigation readiness

Escalation is a judgment call, but the triggers are reasonably clear. Escalate when the conduct is serious or systemic, when criminal elements emerge, when the matter is likely to attract a regulator, or when internal independence is compromised. Understand how your internal process interacts with external ones: a Fair Work Commission matter or a Fair Work Ombudsman inquiry can proceed in parallel, and your investigation file may be requested, subpoenaed or discovered. Preserve privilege where it exists, respond to subpoenas with legal advice, and keep your documentation litigation-ready at all times.

Regulatory reporting checklist

• Notifiable WHS incident, report to the relevant state or territory WHS regulator and preserve the site so far as is reasonable.
• Suspected criminal conduct, consider a police report and take advice on sequencing.
• Discrimination or sexual harassment, consider AHRC guidance and positive-duty obligations.
• Wage underpayment, assess Fair Work Ombudsman reporting and rectification steps, and note the potential for criminal liability for intentional underpayment.

Practical tools: templates, checklists and recommended policies

Consistency is what makes workplace investigations australia defensible at scale. Standardised documents help ensure every matter is handled to the same evidentiary standard. The following tools should form part of your investigation toolkit:

• Workplace investigation policy, the governing framework and triggers.
• Investigator terms of reference, scope, authority and standard of proof.
• Interview script and witness statement template, consistent, fair questioning.
• Evidence log and chain-of-custody record, verifiable preservation.
• Investigation report template, structured, disclosure-ready findings.

See Workplace investigation templates & letters (download) for the complete toolkit, and How to draft a workplace investigation policy for a policy template and worked examples.

Conclusion and next steps

Defensible workplace investigations australia employers can rely on are built on three things: sound triage, rigorous procedural fairness, and disciplined evidence preservation, all documented as if a court will one day read the file, because it may. In 2026, with sharper enforcement and higher stakes, the margin for procedural error is smaller than ever. Decide early who should investigate, scope the matter tightly, put allegations fairly, preserve evidence from day one, and retain a clear, professional report. Download the employer investigation toolkit to standardise your process, and seek specialist legal advice for high-risk matters where independence, privilege and litigation readiness will decide the outcome.

You can also find employment lawyers in Australia through the Global Law Experts directory and explore the Employment practice area, Australia for related guidance.

Sources

1. Fair Work Act 2009 (Cth)
2. Fair Work Commission
3. Fair Work Ombudsman
4. Australian Human Rights Commission
5. Safe Work Australia
6. Office of the Australian Information Commissioner
7. Law Council of Australia