Suspected Misconduct: Employer Investigation Checklist

When suspected misconduct comes up in your business, the pressure to act fast is real. A founder hears about missing stock, a manager spots inappropriate messages, or a team member complains about bullying, and suddenly every next step matters. The problem is that employers often make the same avoidable mistakes: suspending someone without checking the contract, relying on gossip instead of evidence, or deciding the outcome before the employee has had a proper chance to respond.

Those mistakes can turn a manageable workplace issue into an unfair dismissal claim, a general protections dispute, or a broader culture problem inside the business. The legal risk is not just about whether the employee actually did something wrong. It is also about whether your process was fair, consistent and properly documented.

This guide explains what suspected misconduct means for Australian businesses, what to check before you sign off on any disciplinary outcome, and where employers commonly get caught when handling workplace investigations.

Overview

Suspected misconduct is not the same as proven misconduct, and that distinction matters. An employer can investigate concerns, but the process should be proportionate, confidential and fair, especially before you issue a warning, stand someone down, or terminate employment.

A practical investigation usually turns on a small set of legal and operational checks made early.

• Confirm what behaviour is actually being alleged, and whether it may amount to misconduct or serious misconduct.
• Check the employment contract, workplace policies, enterprise agreement if any, and any applicable award obligations.
• Identify what evidence you have now, and what evidence still needs to be gathered.
• Give the employee clear details of the allegations and a genuine opportunity to respond.
• Decide whether suspension or stand down is justified, and whether it should be with pay.
• Keep records of interviews, documents reviewed, findings made and reasons for any outcome.
• Separate the investigation stage from the disciplinary decision stage where possible.
• Consider privacy, confidentiality and workplace safety risks while the matter is ongoing.
• Check that any final action is proportionate, consistent with past practice and legally defensible.

What Suspected Misconduct Means For Australian Businesses

Suspected misconduct means you have a concern that an employee may have breached workplace standards, but you have not yet established the facts. For Australian businesses, the key point is simple: suspicion alone is rarely enough to justify serious disciplinary action.

Misconduct can cover a wide range of behaviour. That includes repeated lateness, policy breaches, misuse of company systems, bullying, harassment, conflict of interest issues, safety breaches, dishonesty, or misuse of confidential information. In more serious cases, the conduct might amount to serious misconduct, which can justify dismissal without notice if the facts support that outcome.

The line between ordinary misconduct and serious misconduct matters because the potential consequences are different. It also affects how carefully you need to assess risk before acting. If you move straight to dismissal because the allegation sounds serious, but the facts are unclear, this is where employers often get caught.

Misconduct versus serious misconduct

Ordinary misconduct usually involves behaviour that breaches expectations or policy, but may be capable of correction. Serious misconduct is generally conduct that causes serious and imminent risk to the business, its people, or its reputation, or conduct that is fundamentally inconsistent with the employment relationship.

Common examples that may raise serious misconduct concerns include:

• theft or fraud
• assault, threats or serious bullying
• sexual harassment or serious harassment
• serious breaches of safety procedures
• deliberate misuse of confidential information
• working while intoxicated where safety is affected
• serious insubordination

Not every allegation in these categories will automatically justify summary dismissal. The facts, the context and the evidence still matter. A one-line complaint or rumour from another employee is not the same as a substantiated finding after a fair process.

Why process matters even when the conduct looks obvious

Many employers focus only on the alleged behaviour. Fair Work risks often arise because of the process. If you do not tell the employee what is alleged, do not let them respond, or do not genuinely consider their explanation, you create a separate problem even if you believe the misconduct occurred.

For small businesses, that can feel frustrating. Owners often want a practical answer, especially when trust has broken down. But before you sign a termination letter or final warning, it is worth remembering that a fair process helps you test whether the concern is real, whether there are mitigating circumstances, and whether a lesser outcome is more appropriate.

When to start a formal investigation

A formal investigation is usually appropriate where the allegation could lead to disciplinary action, where facts are disputed, or where there are safety, harassment or integrity concerns. Not every issue needs a major process. A minor attendance issue may only need an informal discussion. A complaint about bullying, falsified records or missing cash usually calls for something more structured.

Good founders make an early judgment about scale. Ask:

• Could this lead to a warning, demotion or dismissal?
• Are there conflicting accounts?
• Is there documentary, digital or CCTV evidence to preserve?
• Is anyone at risk if the employee remains at work during the investigation?
• Do you need an independent decision-maker because the manager involved is part of the issue?

If the answer to several of those questions is yes, a documented workplace investigation process is usually the safer path.

Legal Issues To Check Before You Sign

Before you sign off on any warning, suspension outcome, deed, or termination letter, check whether your investigation process lines up with the employee's contract, workplace rules and general employment law obligations. The legal risk often sits in the detail, not just in the headline allegation.

1. The employment contract and any applicable industrial instrument

Start with the employee's contract. It may deal with notice, termination for serious misconduct, suspension, confidentiality, investigation procedures, and policy compliance. If the employee is covered by a modern award or enterprise agreement, that may impose extra consultation, procedural or dispute handling obligations.

Before you sign, check:

• whether the contract allows suspension, and on what terms
• whether policies are incorporated into the contract or merely guidance
• whether there are procedural steps you have promised to follow
• whether the employee is award covered or subject to an enterprise agreement
• whether any notice, final pay or accrued entitlement issues arise if termination is being considered

If you skip this step, you can end up breaching the contract while trying to enforce it.

2. Procedural fairness

An employee should know the substance of the allegations and have a real chance to respond before a final decision is made. This does not mean a courtroom process, but it does mean fairness.

In practical terms, that usually includes:

• telling the employee what conduct is alleged, with enough detail for them to answer it
• providing any key documents or evidence you are relying on, where appropriate
• giving them reasonable time to prepare a response
• allowing a support person for disciplinary meetings where appropriate
• keeping an open mind until you have considered their response

A common error is sending a meeting invite that simply says “serious misconduct” without particulars. That is usually too vague. The employee should know what incident, date, behaviour or complaint is in issue.

3. Evidence and record keeping

You do not need perfect evidence, but you do need enough reliable material to make a reasonable finding. Collect the documents early, especially if the issue involves emails, messaging platforms, roster records, expense claims, swipe access logs or customer complaints.

Good records often include:

• the initial complaint or report
• notes of who received the complaint and when
• copies of relevant documents, screenshots or system logs
• witness interview notes
• the allegations put to the employee
• the employee's written or verbal response
• the reasons for your findings and outcome

Where witness accounts differ, note why one version was preferred over another. A decision that is documented usually stands up better than one explained only after a dispute starts.

4. Suspension or stand down

Removing an employee from the workplace can be appropriate, but it should not be automatic. If there is a risk to people, property, evidence, or the integrity of the investigation, a temporary suspension may be justified. In many cases, suspension on full pay is the lower-risk option while facts are being tested.

The main risk is treating suspension as punishment before findings are made. Before you suspend someone, ask:

• is there an immediate safety or operational concern?
• is there a risk of interference with witnesses or evidence?
• does the contract or policy deal with paid suspension?
• could alternative duties or restricted access work instead?

Use clear written terms for any suspension, including duration, contact arrangements, confidentiality expectations and whether the employee must remain available during work hours.

5. Privacy and confidentiality

Workplace investigations often involve sensitive personal information. Limit access to those who need to know, store records securely and avoid broad internal discussions. Telling half the team that someone is under investigation can create separate legal and cultural issues.

You also need to be careful when reviewing devices, emails or messages. The right approach depends on ownership of the device, your workplace policies, and what monitoring has been disclosed to staff. Before you rely on material from a device or account, check whether your systems, workplace policies and privacy notice clearly support that access.

6. Consistency and proportionality

Like cases should be treated in a broadly similar way unless there is a good reason for a difference. If one employee was warned for a safety breach last year and another is dismissed for comparable conduct today, you should be able to explain the distinction.

Proportionality also matters. Sometimes the right outcome is training, a warning, coaching, an apology requirement, or a managed return to work. Dismissal may be justified, but it should not be your default setting every time trust is shaken.

7. Who should make the decision

The person investigating the facts does not always have to be the person deciding the outcome. In sensitive matters, separating those roles can help. It shows the final decision was made after an objective review, not in the heat of the complaint.

This is particularly useful where:

• the direct manager is a witness
• the allegation concerns bullying by a senior employee
• there are competing versions from multiple team members
• the business owner has already expressed a view about guilt

Even in a small business, a modest separation of roles can improve fairness.

8. Termination risk checks

If dismissal is on the table, do a final review before you sign. Ask whether the employee is protected from unfair dismissal, whether there could be a general protections issue, and whether any recent complaint, leave, union activity or safety concern could complicate the picture.

For example, an employee who recently raised underpayment concerns or made a bullying complaint may argue the real reason for dismissal was that protected activity, not misconduct. That does not stop you from acting on genuine misconduct, but it does mean your evidence and reasoning need to be especially clear.

Common Mistakes With Suspected Misconduct

The most common mistakes are rushing, assuming, and documenting too little. Businesses often know something is wrong, but handle the issue in a way that creates a second and larger problem.

Deciding the outcome before hearing the response

This often happens when the allegation feels obvious or emotionally charged. A manager becomes convinced after one complaint, then the meeting with the employee becomes a formality. If your notes, emails or wording show the decision was already made, the process looks unfair.

Use neutral language early. Describe concerns as allegations or matters under investigation until findings are made.

Using vague allegations

An employee cannot fairly respond to a general statement like “you have behaved inappropriately”. They need enough detail to understand the case against them. Dates, incidents, names and the relevant policy or expectation should be identified where possible.

Specific allegations produce better responses and better outcomes. They also help you avoid drift during interviews.

Failing to preserve evidence

Phone records are overwritten, CCTV is deleted, and chat threads disappear. Delay can damage the investigation. Once suspected misconduct is raised, secure the key material early and keep a record of how it was obtained.

This is particularly important where the allegation involves expense claims, stock, customer interactions, system access, or internal messaging platforms.

Over-relying on policy without checking the contract

Policies matter, but they do not always override the employment contract. If your handbook says you can suspend without pay, but the contract does not support that, relying on the policy alone may expose the business.

Before you act, make sure your contract, policies and actual practice are aligned.

Treating every issue as serious misconduct

Founders sometimes use the label “serious misconduct” because the conduct feels serious to the business. Legally, that label has consequences. If you use it too loosely, especially to avoid notice, final pay disputes can follow.

A poor performance issue, a misunderstanding, or a one-off low-level breach will not always justify summary dismissal. Match the label to the facts, not the frustration.

Ignoring support person and meeting process issues

While there is no universal rule that every investigation meeting must allow a support person, refusing one unreasonably in a disciplinary context can create risk. The same applies to springing serious allegations on an employee in a meeting with no warning.

Small process choices can become central later. Give notice of the meeting purpose, allow a reasonable opportunity to prepare, and keep minutes.

Letting confidentiality collapse

People talk. In smaller teams, rumours spread quickly. If the employee under investigation is publicly sidelined or discussed openly, you may damage morale and create defamation, privacy or psychosocial safety concerns.

Tell managers and witnesses only what they need to know. Remind everyone involved that confidentiality is expected.

Forgetting the complainant and the wider team

An investigation is not just about the subject employee. The complainant, witnesses and team may need interim support, changed reporting lines, or practical steps to reduce tension while the matter is being assessed.

That is especially true in bullying, harassment or safety matters. A legally sound process should also be workable for the people who have to keep turning up to work.

Using templates without adapting the facts

Template letters can save time, but generic wording causes trouble. A termination letter that refers to conduct never put to the employee, or a warning that cites policies they were never given, weakens your position.

Templates should be tailored to the allegations, evidence and contractual context. This is where founders often get caught when they copy a document from an older matter and hope it fits.

FAQs

Can I suspend an employee during a suspected misconduct investigation?

Yes, sometimes, but it should be justified and handled carefully. Paid suspension is often the safer option while you investigate, especially if there is a risk to safety, evidence, or workplace relationships.

Do I have to tell the employee exactly what they are accused of?

Yes, in substance. The employee should be told enough detail about the allegations to give a meaningful response before any final disciplinary decision is made.

Can I dismiss someone for suspected misconduct if I am not 100 per cent sure?

You do not need absolute certainty, but you do need a reasonable basis for your findings after a fair process. Suspicion, rumour or incomplete evidence alone is risky, especially for summary dismissal.

Should the investigator and decision-maker be different people?

Where possible, yes. Separate roles can improve fairness and help show the final outcome was considered objectively, particularly in sensitive or senior-level matters.

What records should I keep during a workplace investigation?

Keep the complaint, interview notes, relevant documents, messages or system logs, the allegations put to the employee, their response, and the reasons for your final decision. Good records matter if the outcome is later challenged.

Key Takeaways

• Suspected misconduct is only a starting point, not proof, and employers should investigate before making disciplinary decisions.
• Check the employment contract, policies, any award or enterprise agreement, and whether suspension or summary dismissal is actually supported.
• Procedural fairness matters, which usually means clear allegations, a real opportunity to respond, and a genuine consideration of that response.
• Good evidence and clear records are essential, especially where the matter may lead to termination or involve conflicting witness accounts.
• Confidentiality, privacy and workplace safety should be managed throughout the investigation, not just at the end.
• Many employer risks come from process failures, including vague allegations, rushed decisions, inconsistent treatment and poor documentation.
• A proportionate, well-structured investigation helps protect the business and supports better workplace outcomes.

If you want help with investigation process, employment contracts, disciplinary letters, or termination risk checks, you can reach us on 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.