Misconduct Investigations Involving Money

How to Run a Misconduct Investigation

Run an employee misconduct investigation through a written plan, preserved records, witness interviews, the employee’s response, financial analysis and an allegation-by-allegation report. Confirm the applicable employment law and workplace procedures before starting.

An internal HR or legal team can investigate where it has the skills and can assess the evidence impartially. Appoint an external investigator when a manager is implicated or the internal team has a conflict. Identify the investigator’s authority and the person who will decide any disciplinary outcome.

Use this sequence:

1. Define each allegation. Identify the alleged act, relevant period, transaction or system change and the policy or duty allegedly breached. Separate a complaint from facts already established.
2. Preserve the records. Retain original expense claims, receipts, payroll exports, audit logs, emails and company bank statements. Restrict access and record who collects each file.
3. Interview relevant witnesses. Ask what each person saw or did, then distinguish direct knowledge from assumptions. Obtain the records they identify and test conflicting accounts.
4. Put each allegation to the employee. Explain the conduct alleged and the material evidence supporting it. Provide reasonable time to respond and consider requests for a support person or representation under the applicable process.
5. Analyse the records and responses together. Reconcile payments with approvals and test innocent explanations, including payroll corrections or reimbursements. Put new adverse evidence to the employee before relying on it.
6. Write findings with reasons. Link each conclusion to the evidence and explain how you assessed the employee’s response. Keep any proposed disciplinary outcome separate from the factual findings.

Before finalising, confirm that every adverse finding concerns an allegation the employee could answer. If a witness account conflicts with a payment record, resolve the conflict or explain why it remains unresolved.

In Francis v Kalgoorlie Consolidated Gold Mines, [2010] FWA 5472, the employer alleged that a supervisor dismissed a colleague’s safety concerns. The colleague’s evidence showed that the supervisor demonstrated the method and the colleague was satisfied. The tribunal rejected the employer’s characterisation. The investigation lesson is to test the witness’s actual evidence before adopting a report’s conclusion.

Serious and Gross Misconduct

Serious misconduct under the Fair Work Regulations 2009 includes deliberate behaviour inconsistent with continued employment and conduct causing serious and imminent risk. The risk can concern a person’s health or safety, or the employer’s business reputation, viability or profitability.

Regulation 1.07 also lists theft, fraud, assault and sexual harassment during employment. Intoxication at work and refusal of a lawful and reasonable instruction consistent with the employment contract are further examples. For these listed examples, the regulation includes an exception where the employee shows that continued employment during notice was reasonable in the circumstances.

Gross misconduct is a term used in workplace policies and employment contracts for conduct considered sufficiently grave to justify dismissal without notice. For a national-system employee, assess the actual conduct against the applicable legal rules. A policy label does not establish that a disputed payment was theft or fraud.

For a workplace misconduct investigation in Queensland’s public sector, use the state employment framework. The Queensland investigation guide identifies the Public Sector Act 2022, Industrial Relations Act 2016 and relevant directives. The Industrial Relations Act’s public-service appeal provisions include review of disciplinary decisions. Identify the employee’s coverage before applying federal dismissal rules.

Planning Investigation Questions

Plan investigation questions around each allegation and the evidence the employee needs to answer. Give particulars before asking for an explanation. Avoid questions that assume dishonesty has already been proved.

Consider this hypothetical expense allegation. An employee submits a $600 reimbursement claim, but the supplier receipt records $400. The investigation must establish how the difference arose and whether the employee authorised or knowingly submitted it.

Use the following interview sequence.

• Explain the allegation: the employee allegedly claimed $200 above the recorded expense without authorisation.
• Show the claim and receipt, then ask the employee to describe how the claim was prepared.
• Ask which expenses the $600 covers and whether further receipts or approvals exist.
• Identify who could edit the claim and ask about the employee’s role in its submission.
• Put any conflicting evidence separately and invite an explanation.
• Ask the employee to identify records or witnesses that could support their account.

Record the answer to each allegation and any promised documents. If the employee requests time to obtain representation or relevant records, assess the request and document the reason for your response. New evidence can require a further interview or written response.

For gross misconduct investigation questions, the seriousness of the possible outcome increases the need for precise particulars. Asking why an employee stole money assumes the disputed conclusion. Asking how a specific claim differs from its receipt leaves the explanation open.

Financial Records in Employee Investigations

Expense records, payroll records and company bank statements test different parts of a financial allegation. Use them together to distinguish a false claim from an approval error or an authorised payment.

Record	What It Tests	Follow-Up Check
Expense claim and receipt	Amount claimed against expense incurred	Match the original receipt, business purpose and approval
Payroll export and employment records	Payment against entitlement	Compare hours, rate, allowances and authorised changes
System audit log	User account making a change	Check access permissions and whether the account was shared
Company bank statement	Money actually paid	Match the debit, payment reference and recipient details
Approval correspondence	Permission for the payment	Confirm who approved it and what information they received

A system username alone does not establish who made a change. A bank debit establishes a payment, while the supporting records explain whether it was authorised. Use the employee fraud guide for the wider categories, with separate guidance on expense claims and payroll fraud.

An employer cannot compel a bank to hand over an employee’s personal statements through an ordinary internal investigation. Personal records can be supplied voluntarily with appropriate authority or obtained through an applicable court or statutory process. Limit requests to relevant records and establish the lawful basis for collection and use.

The NSW Independent Commission Against Corruption has statutory powers beyond an employer’s internal authority. Its section 22 document notice power can require production from a person outside the public authority. That power can reach bank-held records of a public official’s personal accounts for an ICAC investigation, subject to the Act’s protections.

FinTrace saves investigators and forensic accountants hours of bank-statement review by consolidating supplied PDFs into a searchable ledger and a readable findings report. The service flags suspicious transactions and gives you the source filename and page behind each finding. You can connect those transactions with payroll approvals and interview evidence while spending less time locating payments across the bundle.

How Long It Takes

A misconduct investigation’s duration depends on the evidence and the steps needed to give the employee a fair response. Record volume, missing documents, witness availability and representation requests can extend the process. There is no useful single deadline for every financial allegation.

Build the timetable around tasks you can identify. Record the period needed to preserve records, obtain bank information, interview witnesses and allow responses. Review the timetable when a new allegation or disputed transaction changes the scope.

Financial analysis and the full workplace investigation have different timeframes. Completing statement analysis does not finish witness interviews or the disciplinary process. Keep the employee informed about progress and reasons for delay without disclosing other people’s confidential evidence.

If analysis stalls because a payment cannot be reconciled, request the missing payroll or approval record and record the unresolved issue. If a witness is unavailable, identify whether another document can establish the fact. Set the next review point instead of allowing an unanswered request to suspend the entire investigation indefinitely.

Investigation Report Template

An investigation report records the allegations, evidence, findings on each allegation and reasons for those findings. Organise the report so a decision-maker can follow the evidence without repeating the investigation.

Use these sections as a working template:

Report Section	What to Record
Authority and scope	Investigator, terms of reference, applicable policies and questions investigated
Allegations	Numbered particulars of each alleged act and the duty or policy at issue
Method and records	Interviews conducted, documents collected and evidence identifiers
Employee response	Response to each allegation, supporting records and further enquiries it prompted
Findings and reasons	Outcome for each allegation and reasons for the conclusion, addressing supporting and contrary evidence
Outstanding issues	Missing records, unresolved conflicts and their effect on the finding
Attachments	Evidence index, payment schedule and source documents with access restrictions

Use the applicable standard of proof and explain how the evidence meets it. Workplace factual findings generally use the balance of probabilities: whether the alleged conduct more likely occurred than did not. Serious allegations require careful assessment of the quality of the evidence.

In the hypothetical $600 claim, the report might find that the payment exceeded the receipt by $200. Whether the employee knowingly submitted a false claim requires evidence about preparation and authorisation. Record those as separate questions and explain any reason the evidence supports one finding but leaves the other unresolved.

Check the final report against the allegation list. Every finding must have a reason and identifiable evidence, and every material employee explanation must receive consideration. Deliver the report to the authorised decision-maker through the agreed restricted channel.

ICAC Investigations and Referrals

An ICAC investigation is an inquiry by the NSW Independent Commission Against Corruption into possible corrupt conduct involving public officials. Its investigation process examines what occurred and whether conduct meets the statutory definition of corruption.

Victoria’s equivalent body is the Independent Broad-based Anti-corruption Commission, or IBAC, established under the IBAC Act 2011. Queensland’s Crime and Corruption Commission, or CCC, operates under the Crime and Corruption Act 2001. Each jurisdiction has its own powers and referral rules.

Under section 11 of the NSW ICAC Act, a principal officer of a public authority must report matters they reasonably suspect involve corrupt conduct. The principal officer is generally the authority’s head or most senior officer. Proof is unnecessary, and the reporting duty does not permit delay until an internal investigation finishes. ICAC explains the duty in its reporting guidance.

After a referral, ICAC generally asks an authority to await its decision before taking further investigative steps. Coordinate proposed interviews or other action with ICAC so the internal process does not hamper its investigation. The authority can continue or resume work in line with ICAC’s response, including where ICAC refers the matter back. Referral does not remove other reporting obligations or responsibility for warranted disciplinary action.

Preserve original financial records and keep a record of how they were obtained. If ICAC requests documents, provide the requested material through its specified channel with an evidence index. Retain the handover record and distinguish original records from analysis, interview notes and later annotations.

A finding of corrupt conduct is not a criminal conviction. ICAC explains that its findings are distinct from findings of criminal guilt. Keep that distinction in the workplace report and any briefing about a referral. Confirm who now owns each investigative step before arranging further interviews or issuing disciplinary findings.

An integrity agency’s investigation does not replace the employer’s procedural-fairness duties. Put any adverse material the employer proposes to rely on to the employee under the applicable workplace process. Coordinate the timing with the agency where its investigation restricts further action.

The institution’s response to a later ICAC inquiry involves a separate agency process, including public-hearing records and responses to proposed findings. Preserve original records and the handover history for that response. A represented individual preparing for a private compulsory examination needs advice about that examination, separate from the employer’s internal investigation.