Once a company is on notice that it may be exposed to an incident (eg bribery and corruption), there are many reasons to properly investigate. They include:

• Understanding the facts – you will want to understand the facts as quickly as possible to appreciate what happened and why. This will form the basis for any necessary remediation.

• Containment – You also need understand fairly quickly whether this is a one-off event, or whether the issue is systemic.

• Law enforcement and regulatory exposure – companies have various obligations to report serious indictable offences, licence breaches and material information to law enforcement and regulators (see more on this topic in Section 4).

• Money laundering – continuing to make and receive payments or property once on notice that they might be associated with serious misconduct can itself be an offence (see more on this topic in Section 6).

• Leniency – thoroughly investigating concerns and dealing with them appropriately can significantly reduce the likelihood of being prosecuted and the penalty imposed if there is a prosecution.

• Counterparties – corruption and other serious misconduct often involves two or more parties. If you do not investigate, then the other party may (and may report your conduct to authorities).

• Directors' duties – directors and officers may breach their duties if they do not investigate once suspicions of misconduct are awakened (see below).

• Commercial reputation – when allegations of serious misconduct or other serious misconduct become known to the public or to commercial partners, how a company responds will often be seen as a sign of the company's culture and tolerance for the conduct at issue. The company's commercial reputation will be much better protected if you can say you promptly and thoroughly investigated the concerns as soon as they were brought to your attention.

• Reducing future risk – it is only by investigating, identifying the root causes and remediating them that the company can reduce its risk of more incidents occurring in the future.

An investigation necessarily risks uncovering facts that will create an exposure for the company and for individuals – however, it is imperative to ensure the scope of the misconduct has been properly identified and addressed. It is important to have 'buy-in' from the senior management and Board for an investigation to be conducted and to be properly scoped and resourced.

Legal professional privilege applies to confidential communications between a lawyer and a client for the dominant purpose of the client receiving legal advice (and there is a slightly broader privilege where legal proceedings are anticipated or under way). Privileged documents do not need to be produced to courts and regulators. The privilege exists so that people and companies can give their lawyers a candid account of the facts in order to receive legal advice without fear that those communications will be used against them.

This privilege could cover various aspects of an investigation and can be an important protection to have in place.

However, it is also important to recognise that there are limitations to the privilege:

Part 9.4AAA of the Corporations Act and Part IVD of the Taxation Administration Act 1953 (Cth) contain significant protections for whistleblowers. The protections in the Corporations Act were expanded in 2019 to provide greater protection for those who report misconduct about companies and company officers. Some key issues to consider are:

• Who could be considered an 'eligible whistleblower' and thus, subject to protection? – this now includes a wide range of people, including former employees, contractors, employees of contractors, associates of the company, and spouses, dependents and other relatives of such individuals.

• Protection of identity – a whistleblower's identity and any information likely to lead to their identification is protected where the information the whistleblower discloses concerns misconduct or an improper state of affairs about a company and the disclosure is made to officers, senior managers or someone authorised to receive the information in the company (amongst others).

• Very limited exceptions to disclosure of identity – it is an offence to disclose the whistleblower's identity, or information likely to lead to their identification, save for in particular circumstances such as:

• if the whistleblower consents to their identity being disclosed or it is being disclosed to ASIC, APRA, the AFP or to a lawyer to seek legal advice; or

• where information is disclosed which is likely to lead to the identification of the whistleblower, it is because it is reasonably necessary for the purpose of investigating the matter and all reasonable steps have been taken to reduce the risk that the whistleblower will be identified.

• Public interest disclosure – Whistleblowers can make a 'public interest disclosure' in limited circumstances:

• to journalists or parliamentarians in certain circumstances where the whistleblower has already made a protected disclosure to ASIC or APRA and where the whistleblower provides written notice to the original recipient of the information that they intend to make the disclosure; and

• where they have reasonable grounds to believe it would be in the public interest.

• Emergency disclosure – whistleblowers can make an 'emergency disclosure' in limited circumstances where they have reasonable grounds to believe the information concerns a substantial and imminent danger to a person's health or safety, or to the natural environment.

• Policy – under the new whistleblower laws, public companies and large proprietary companies must have, and comply with, a whistleblower policy that addresses prescribed issues.

You may need to have strict protocols in place to keep an investigation confidential internally (as well as externally), particularly if it relates to serious misconduct.

• Tipping off – you can be exposed to offences for 'tipping off' people involved in offences, particularly if they destroy documents or other evidence relevant to the investigation (see below).

• Impacts on employees – there could be significant reputational implications for employees who are, or who are perceived to be, involved in the misconduct and their reputations may be tarnished if untested allegations are inadvertently disclosed.

• Organisational risks – if allegations become known outside of the organisation, this may have commercial, reputational and legal consequences, eg triggering ASX disclosure obligations, inquiries from commercial partners and potential media coverage.

There are significant penalties for destroying or concealing documents or other evidence that may be relevant to legal proceedings or investigations by a regulator (eg section 39 of the Crimes Act 1914 (Cth) and section 67 of the ASIC Act 2001 (Cth)).

To avoid any suggestion that documents have been destroyed inappropriately, an important first step in an investigation is to take positive steps to 'lock down' all potentially relevant documents and evidence. This might involve suspending routine document destruction processes, taking forensic images of relevant file and email servers and copying laptops and mobile devices of relevant employees. Subject to any confidentiality restrictions you have imposed, it may also be appropriate to send a formal notice to staff that they should not destroy documents.

A plan should also be put in place regarding how the documents will be collected. This should include:

• Official records – what official records are relevant, including Board and committee papers, project files and archives?

• Custodians – which people may have relevant documents and how are their documents kept? This will guide email accounts to be collected, devices to be imaged and hardcopy documents to be found.

• Forensic soundness – are specialised techniques required to collect information in a forensically sound manner that preserves metadata and can verify the authenticity of the documents?

• Record keeping – how will the document collection be recorded? The collection records themselves may be sought by law enforcement and tendered in court.

• Third party providers – do you need assistance from a third party provider of electronic and/or hardcopy collection services? Or do you have capacity to do this in-house?

There are further issues to consider as to how the documents will be searched and reviewed after collection to get to the key facts as efficiently as possible.

Directors and officers of a company have duties under the Corporations Act and at general law, one of which is that they must exercise their powers and discharge their duties with the degree of care and diligence that a reasonable person in the same position as that director would have exercised. A breach of that section carries with it significant penalties and potential disqualification from managing corporations.

In relation to investigations, that duty requires that a director or officer must:

• make reasonable inquiries when suspicions are awakened, or would be awakened, in a prudent director. A director is not excused from making his or her own inquiries relying on a simple assurance from management. This duty is a continuing obligation; and

• consider the nature and extent of the foreseeable risk of harm to the company that would arise if the director failed to exercise reasonable care and diligence.

Failing to investigate 'red flags' for foreign bribery and sanctions compliance has been found to amount to a breach of director duties (see ASIC v Flugge and Geary [2016] VSC 779).