Chapter 8: Investigation and determination
8.1. Undertaking a misconduct investigation includes gathering and assessing evidence, and, in many cases, preparing an investigation report, to inform a breach determination that is sound and defensible.
8.2. It is recommended that the breach decision-maker not be informed that the person under investigation has previous findings of breaches of the Code, if that is the case. Where this is not possible, the decision-maker should not take previous findings into consideration. This allows the decision-maker to make their determination solely on the evidence relating to the matter under investigation. However, it may be reasonable for a decision-maker to take into account previous warnings, directions, or other management action that has been taken in relation to the same matter. The relevance of prior misconduct should be considered in making a sanction decision.
8.3. Evidence can be collected from a range of sources. These can include interviews with witnesses, electronic records (for example, system logs or building access), or written statements. In some cases, physical evidence may be sufficient to establish the facts—for example, in cases involving suspected improper access to personal information, or improper use of email or internet, the investigation is likely to be founded on records of computer use. In other cases, witness statements or other evidence will need to be collected and considered.
8.4. Where the person under investigation suggests there may be additional evidence that could corroborate their version of events, or otherwise disprove the allegations against them, this evidence should be gathered where practicable. Such requests should be evaluated in light of the relevance of the evidence and the requirements of procedural fairness.
8.5. The purpose of an interview is to gather and test evidence to assist in establishing factual matters. An investigator or decision-maker should consider the following good practice in conducting interviews:
- Providing the interviewee with sufficient notice to allow for adequate preparation
- Where appropriate, advising the interviewee that they may be accompanied by a support person (see ‘Support roles’ for more information)
- Considering whether it would be appropriate to make available to the interviewee, before the interview, any documents that will be discussed at the interview
- Preparing a set of questions
- Questions should be framed in clear and neutral terms, and witnesses should not be prompted, even inadvertently, to confirm a particular set of facts or version of events
- Advising interviewees that personal information relating to them, or any other person, and any evidence they provide, may be disclosed to others, including the person under investigation, where necessary and appropriate
- Ensuring, where practicable, that the interview is conducted in a private location free from interruption. This may be a location outside the workplace
- Wherever possible, seeking corroborating evidence from the interviewee of any claims they make
- Advising the interviewee that a record of the discussion will be prepared and will be provided to them
- The objective is to have jointly agreed records of interviews. If this cannot be achieved, it is good practice to document the areas of disagreement
- Informing the interviewee of the arrangements for confirming the accuracy of the record of the interview, recording any disagreements, and setting a timeframe for the interviewee to respond
- Deciding before the interview whether it is desirable for it to be audio-recorded, and, if so, establishing the interviewee’s consent to the recording. It is usually appropriate to make a copy of the recording available to the interviewee
- Ensuring notes of the interview are accurate and are recorded in the interviewee’s own words. Where a written record of interview is to be prepared, it may be convenient to use a note-taker
- After the interview, considering whether evidence provided by the interviewee needs to be checked, either with the interviewee or against other sources of evidence.
Interviewing the person under investigation
8.6. Investigators are often required to interview the person under investigation for the purpose of establishing facts. An interview in these circumstances is not an avenue for procedural fairness, and the investigator may need to explain this to the person, and assure them that they will be given other opportunities to respond to the case against them before a decision is made.
8.7. An employee can be given a lawful and reasonable direction to answer questions relating to their activities as an employee. However, they cannot lawfully be directed to answer questions where the answer would:
- incriminate them in relation to a criminal offence. This is consistent with the common law privilege against self-incrimination
- disclose confidential information the employee cannot lawfully provide
- disclose information that is subject to legal professional privilege, such as discussions the employee has had with their lawyer.
8.8. Agencies may wish to seek legal advice where an employee seeks to claim privilege against self-exposure to penalty.
8.9. An employee choosing not to answer such questions cannot, for that reason alone, be taken to have breached the Code.
8.10. Any direction requiring an employee to attend an interview must also be reasonable. What is reasonable will depend on the particular circumstances, including considerations relating to the employee and the details of the investigation.
Reviewing and assessing evidence
8.11. The investigator’s role includes seeking out the available evidence, and then weighing that evidence, including inconsistencies in accounts, to form a view (whether as a finding of fact, or as a recommendation to a decision-maker) about what occurred, applying the standard of ‘on the balance of probabilities’. In evaluating evidence, investigators should have regard to the impact of unconscious bias on their assessments.
Reviewing the evidence
8.12. In reviewing the evidence it is advisable to keep the following considerations in mind:
- Has the person under investigation been given a reasonable opportunity to respond to the evidence, including to new or conflicting evidence that has arisen during the investigation?
- Has the response of the person under investigation been genuinely and fairly considered, and have lines of inquiry suggested by that person been pursued where it is reasonable to do so?
- Have witnesses been questioned about evidence that conflicts with their witness statements?
- Is any evidence missing? Is there enough credible, relevant, and significant (i.e. logically probative) evidence to support findings of fact on which a breach determination can be made?
Assessing and evaluating evidence
8.13. When making a judgement about the reliability of the evidence, investigators and decision-makers should consider the following:
- Primary sources of evidence are preferable to secondary sources. For example, hearsay evidence is of less value than a first-hand account.
- First-hand evidence of an event is what a witness to the event relates, while hearsay evidence is what someone says they were told about an event by another person who witnessed it.
- Test disputed facts, or seek corroboration from other witnesses or evidence, where possible.
- Evidence is more likely to be reliable if it can be confirmed or verified from another independent source.
- Consider the credibility of witnesses, having regard to, for example, inconsistencies in evidence, honesty, or the possibility of collaboration or improper purpose.
- Be mindful that conflicting versions of an event do not necessarily mean someone is lying. It is possible for different people to perceive or remember events differently. Consider what the balance of evidence suggests is the truth of the matter—for example, whether someone’s account is consistent with other evidence.
- Be mindful of the impact of unconscious bias in assessing the credibility of witnesses. For example, a witness not making eye contact is not in itself a reason to conclude they are evasive or untruthful. More information about unconscious bias is in section 4.2.2.
- A record of an event made contemporaneously is generally preferable to a record made days or weeks later.
- For example, a diary note made close to the time of a conversation is likely to be more reliable than someone trying to recall the details of the conversation several months after it occurred.
- An opinion generally has greater weight if it is given by someone with expertise on the matter.
- For example, a medical practitioner’s diagnosis of a person’s state of health will be more reliable than a lay person’s opinion. Expert evidence may be evaluated by, for example, looking at the expert’s area of expertise and its relevance to the opinion or evidence they have provided. However, an investigator should be wary of relying on their own non-expert opinion in a matter that requires expert judgement.
Standard of proof
8.14. The standard of proof applicable to findings that the Code has been breached, including the findings of fact that support the breach determination, is the civil standard. That is, findings are based on the conclusion that it is more likely than not, having regard to credible evidence, that the person under investigation has done what they were alleged to have done. This is referred to as ‘the balance of probabilities’.
Procedural fairness—investigation and determination’
8.15. Subject to agency s.15(3) procedures, the investigator should provide the person under investigation with the relevant, credible, and significant evidence collected during the investigation and allow them to respond, comment, or correct the record. This may take the form of a summary of the substance of the evidence or witness statements, rather than the full documentation.
- The hearing rule does not require all investigation material relevant to the allegations to be provided, but the person under investigation must be given sufficient details of the case against them to be able to respond properly.
- Credible, relevant, and significant material may include adverse material that the decision-maker does not propose to rely on in making a particular finding or the decision on breach. Depending on the circumstances, it may be necessary for the person under investigation to be given an opportunity to comment on this.
- If new or conflicting evidence comes to light that is relevant, credible, and significant, reasonable steps must be taken to provide the person under investigation with a reasonable opportunity to respond to that evidence before a decision on breach is made.
- Procedural fairness does not always require that adverse material be put in writing. Subject to any requirement in agency s.15(3) procedures, it may be appropriate in some cases to put adverse material to the person at an interview.
8.16. The investigator should also ensure that the person under investigation has a reasonable opportunity to state their case, including any extenuating circumstances.
- The length of time given to respond to adverse material may depend on the complexity of the allegations and the evidence, and the particular circumstances of the person under investigation, having regard to the requirement in the Commissioner’s Directions to conduct the determination process with as much expedition as a proper consideration of the matter allows.
- The person under investigation should be informed, consistent with the agency’s s.15(3) procedures, of how long they have to respond and whether the response can be oral or in writing. What can be considered a ‘reasonable opportunity’ to respond depends on the relevant circumstances, including the extent and seriousness of the alleged misconduct and the capacity of the employee to respond. Whether the response is oral or in writing may depend on the complexity of the matters the employee wishes to raise, or the capacity of the employee to provide a written statement.
- Procedural fairness requires the person under investigation to be given a reasonable opportunity, not a perfect opportunity, to put their case. This is determined by an objective standard—that is, what a reasonable person would believe was a reasonable opportunity given the circumstances.
- Declining to respond to allegations of misconduct cannot be assumed to be evidence that the alleged misconduct occurred.
8.17. The breach decision-maker may advise the person under investigation of their preliminary views about the alleged breach, and give them an opportunity to respond. This might be in the form of a draft decision or report if the decision-maker deems this appropriate in the circumstances, or if it is a requirement of an agency’s s.15(3) procedures.
8.18. An investigation report is an explanation of how the available evidence leads to a particular conclusion about what happened. It is not enough to set out only the allegations, evidence, and conclusion—the report also needs to articulate the analytical process and explain how the evidence leads to the specific conclusion that has been reached.
8.19. A good quality investigation report should:
- set out clearly the nature of the alleged misconduct—well-drafted allegations will assist with this
- outline the factual matters that need to be established to determine whether the person under investigation did what was alleged. In order to do this, the investigation report may need to establish a clear chronology of events
- set out the steps taken to collect evidence and information
- present the evidence in a balanced way, including both evidence that supports and challenges the allegations
- acknowledge and consider the response of the person under investigation to the allegations, and their response to any new or conflicting evidence uncovered in the course of the investigation
- if there is a conflict in the evidence, explain why one set of evidence is preferred over another
- outline the conclusions that are able to be reached on the available evidence—these need to flow logically from the evidence
- include reasons why the action or behaviour that is found on the evidence could or could not be determined to be a breach of an element or elements of the Code.
Making a breach determination
8.20. The process of determining a breach of the Code requires the decision-maker to decide, after weighing the evidence, whether or not the person under investigation has, on the balance of probabilities, done what they were alleged to have done, and then to decide, as a consequence, whether or not the person has breached a particular element or elements of the Code.
8.21. When a different person has undertaken the investigation, the breach decision-maker remains responsible for the decision. The decision-maker needs, separately and independently, to consider the evidence where an investigator has made a recommendation about whether a breach of the Code has occurred. The decision-maker must then reach their own conclusions, both on the findings of fact and about breach.
8.22. Where a breach decision-maker has concerns about the recommendations made by an investigator, or about the investigative process, the decision-maker may act on those concerns and take additional steps to correct procedural flaws or satisfy themselves on particular matters. This might include writing to the person under investigation and giving them an opportunity to comment on the decision-maker’s preliminary view about findings of fact or breaches of the Code before a decision is made.
8.23. In determining which elements of the Code have been breached, it is important to focus on the elements most relevant to the behaviour. A targeted approach is consistent with the premise that misconduct action in the APS has a corrective function. It is easier to explain to a person found to have breached the Code that their conduct was inappropriate if the elements of the Code are relevant to the misconduct. The person is also more likely to change their behaviour in the future if they have a clear understanding of the link between their conduct and the breach. Where more than one element of the Code has been breached, each element will need to be considered separately in the final decision.
8.24. It may become clear to the breach decision-maker in the course of the investigation that no breach has occurred, or that there is insufficient evidence on which to base a finding that a breach has occurred. In some cases, this can be because the breach decision-maker forms the view that the person under investigation has done what was alleged but has made an honest and reasonable mistake due to, for example, systemic issues, such as a lack of adequate training or problems with technology, leading to a number of similar mistakes by colleagues, or that the action was taken at the direction of a manager.
8.25. If evidence does not support a finding of a breach, the decision-maker can either terminate the decision-making process, or, alternatively, finalise the decision-making-process with a determination that the employee has not breached the Code. The person under investigation should be advised of the outcome.
8.26. Generally, there is no practical difference between an investigation that is discontinued without a finding of breach and one that determines no breach has occurred. However, in deciding how to proceed, a decision-maker should have regard to all the circumstances, including whether the time and resource costs of finalising the investigation are justified, and the impact on the person under investigation of discontinuing or of finalising the investigation.
Preparing a record of the determination
8.27. Under s.63 of the Commissioner’s Directions, a written record must be made of the breach determination. Agency s.15(3) procedures may prescribe the form of such a written record, though they are not required to do so.
8.28. As a matter of good practice, a record of a breach determination should generally include:
- a summary of the evidence considered by the decision-maker
- where the decision-maker also considered a recommendation from an investigator, the decision-maker’s response to the recommendation, including reasons for accepting or not accepting the investigator’s recommendation. The investigator’s report could be attached to avoid the need to reproduce the detail of the report in the decision record
- findings of fact about what the person under investigation has done or not done. The findings need to be as specific as possible, and, wherever possible, linked to specific events
- a decision as to whether what happened amounts to misconduct, and, if so, which element(s) of the Code were breached
- the reasons for reaching these conclusions.
Advising the person under investigation of the breach determination
8.29. Under s.60 of the Commissioner’s Directions, reasonable steps must be taken to inform an employee found to have breached the Code of the breach determination, the sanctions(s) under consideration, and the factors under consideration in determining the sanction, before any sanction can be imposed. It is good practice to provide this information in writing.
8.30. Where a former employee is found to have breached the Code, agencies should take reasonable steps to inform them in writing of the breach determination and their review rights.
8.31. As a matter of good practice, a letter to the person under investigation should generally also:
- enclose a copy of the breach determination record, and, if appropriate, the investigation report
- for an employee, provide information about the process for making a sanction decision
- In some cases it may be appropriate at this stage to advise the employee of the sanctions being considered, and the factors under consideration in determining a sanction
- notify the employee or former employee of the right to seek review of the determination under s.33 of the PS Act
- Both employees and former employees found to have breached the Code have the right to seek review by the MPC of the determination.
- Applying for a review will not operate to stay the finding of breach or, in the case of a current employee, consideration of any sanction.