Building a "Due Diligence Record”: Your Legal Shield in Australia

In the current Australian regulatory climate, "I didn't know" is no longer a valid legal defence. Whether you are a Director, Legal Counsel, or a Compliance Officer, the burden of proof has shifted towards a model of radical accountability. If a workplace incident occurs or a payroll error is discovered, the first thing a regulator will ask for is your due diligence record.

This isn't just about good paperwork; it is your primary shield against multi-million dollar fines and, increasingly, the threat of criminal imprisonment.

What is "Reasonably Practicable"?

The term "reasonably practicable" is the cornerstone of Australian compliance under the Fair Work Act 2009 and various State-based WHS Acts. But what does it actually mean in a courtroom?

Essentially, it requires you to balance the likelihood of a risk and the severity of its harm against the cost and availability of ways to stop it. To prove you’ve met this standard, you must show that you didn’t just "set and forget" a policy, but that you systematically applied techniques to bring risk levels down to a tolerable threshold.

The Power of Documented Consultation

One of the most overlooked parts of a due diligence record is worker consultation. Australian law considers your workers' "on-the-ground" experience essential for identifying hazards and choosing effective controls.

Failing to document these conversations is a major compliance gap. A robust record should serve as evidence that you consulted with your team, listened to their expertise, and used that knowledge to safeguard the business.

Building an Effective Risk Register: Your Early Warning System

A cornerstone of the risk management process—specifically AS/NZS ISO 31000:2018—is the maintenance of a Risk Register. Think of this as your organisation’s "early warning system".

To build a register that actually stands up to legal scrutiny, you need to follow four critical steps:

• Risk Identification: Don't just look at what's happened before. Brainstorm potential setbacks based on research, past projects, and even unlikely "black swan" scenarios.
• Risk Analysis: Use qualitative (Low/Medium/High) or quantitative (dollar values/statistical models) methods to determine the likelihood and impact of each threat.
• Risk Prioritisation: You can't fix everything at once. Categorise your risks to decide which require immediate intervention and which can be safely monitored.
• Risk Ownership: This is vital for accountability. Every risk must be assigned to a specific individual—like a Site Manager or CISO—who is responsible for monitoring and leading the response if that risk turns into an active issue.

Conclusion

Maintaining a due diligence record is no longer just a management preference; it is a statutory survival skill. With the criminalisation of wage theft taking effect on January 1, 2025, a single gap in your records could lead to up to 10 years of imprisonment and multi-million-dollar fines.

By building a real-time, transparent risk register, you do more than just make "auditors and regulators smile". You create a resilient culture where risks are managed, outcomes are predictable, and your directors are protected.

To move away from high-error manual tracking and secure your legal shield, you need a risk management system that automates the collection of evidence and provides real-time visibility into your compliance status.

Sentrient provides an all-in-one GRC solution specifically built for the Australian regulatory environment. From automating worker consultation records to maintaining an audit-ready risk register with clear ownership, Sentrient ensures your due diligence is always up to date and defensible.

Ready to protect your directors and secure your organisation's future?

Request a Free Demo

FAQs

1. How long should I keep my due diligence records? 

While requirements vary by state and the type of record (e.g., WHS vs. Payroll), the best practice in Australia is to maintain these records for at least seven years to align with both tax and Fair Work limitations.

2. Does a spreadsheet count as an "audit-ready" record?

Technically, yes, but it’s risky. Spreadsheets lack a timestamped audit trail and are prone to version control errors. Regulators prefer automated GRC systems that show exactly who changed what, and when.

3. What happens if a risk I "Accepted" becomes an issue?

If you have a documented reason for accepting that risk (e.g., the cost of the fix outweighed the potential loss), and you monitored it regularly, you have a much stronger "due diligence" defence than if you simply ignored it.

4. Who should "own" the Risk Register?

While a Compliance Officer often manages the document, the "ownership" of individual risks should sit with the person closest to the action—such as a Department Head or Site Manager—to ensure the response is fast and accurate.