The confidentiality challenge: managing legal risk in workplace investigations

Workplace investigations are often treated as a practical HR task: appoint an investigator, gather statements, make findings, and issue an outcome. But when an investigation leads to disciplinary action (or even just dissatisfaction), it can quickly become the centrepiece of a Fair Work Commission (FWC) dispute, general protections claim, a discrimination complaint, or civil proceedings. 

A recent FWC decision, Crafti v Cohealth Limited [2025] FWC 3285, is a useful reminder of an uncomfortable reality: investigation reports aren’t automatically protected by legal professional privilege. Even where lawyers are involved, privilege can be uncertain, difficult to prove, and easy to lose – exposing your report,  process, and internal decision-making to scrutiny. 

Why investigations are inherently uncertain 

Investigations sit at the intersection of law, people, and organisational risk. Even with good intentions, outcomes can be unpredictable because: 

• The “facts” are rarely definite: witnesses recall differently, perceptions vary, and credibility assessments can be contested. 

• Procedural fairness is judged with hindsight: what felt reasonable at the time may look different once a claim is filed and the process is dissected step-by-step. 

• The legal characterisation can shift: what starts as ‘misconduct’ may, in a later proceeding or complaint, become characterised as alleged adverse action, discrimination, victimisation, bullying, or a breach of contract/enterprise agreement obligations, each with different tests and risk profiles. 

• Documents become evidence: notes, drafts, emails, and investigation materials are often reviewed by external decision-makers. 

This is why investigation planning should never be ‘set and forget’. It needs to be risk-managed from the start and throughout.  That’s where legal advice is critical. 

The key lesson from Crafti v Cohealth: Legal privilege isn’t a given 

What is legal privilege? 

Legal professional privilege protects confidential communications and confidential documents made for the dominant purpose of: 

• A client obtaining legal advice, 

• A lawyer providing legal advice; or 

• Use in existing or reasonably anticipated litigation. 

The privilege belongs to the client and may be waived, either expressly or by conduct inconsistent with maintaining confidentiality. It doesn’t protect underlying facts, nor does it apply to communications made for an improper or unlawful purpose. 

What happened in the case? 

In Crafti, the employer responded to a complaint about an employee. It first ran an internal investigation. After the employee challenged the process (including procedural fairness issues under the enterprise agreement), the employer’s lawyer engaged a barrister to conduct a further “independent” investigation and produce an investigation report. 

The employer later issued an outcome letter identifying substantiated allegations and referencing the evidence.  In FWC proceedings eventually commenced by the employee, the employee sought an order that the employer produce the investigation report.  The employer resisted on the basis that the investigation report was the subject of legal privilege and therefore didn’t have to be produced.  Despite this, the FWC ordered the production of the investigation report. 

The FWC order highlights two key areas of uncertainty and risk in respect of employer-led investigations: 

1. whether legal privilege applies at all to investigation reports where a law firm is involved; and 
2. whether legal privilege has been waived, even if it did originally apply. 

Proving the “Dominant Purpose” can be tricky 

In Crafti, the FWC accepted that the employer intended the investigation report to assist in providing legal advice. However, the FWC also found that the report served other significant purposes, including reviewing workplace policy compliance and informing decisions about possible disciplinary action. 

Importantly, the employer didn’t provide clear evidence from the relevant decision-makers to demonstrate that obtaining legal advice was the  dominant purpose  for commissioning the report, and therefore, the report didn’t attract legal privilege. 

Takeaway for Employers 

• Even is a law firm is involved, the FWC or a Court may view an investigation report as an HR or disciplinary tool and therefore not protected by legal privilege. 

• Even where legal privilege exists, it can be lost if the employer acts inconsistently with maintaining confidentiality. This can occur where an organisation discloses the substance of legal advice or the contents of an investigation report in communications with employees. 

• Outcome letters must strike a careful balance. Employers need to provide sufficient detail to ensure procedural fairness, including explaining the substance of allegations and the basis for findings. This is often a fine line: there can be competing priorities between maintaining privilege and affording procedural fairness, and careful drafting is required to manage both. 

Investigation report checklist 

1. Plan the investigation model before you begin: Most risk is created at the scoping stage. Clarify the allegations, the decision-maker, the applicable instrument, and the procedural framework before interviews commence.
    
2. Be clear about purpose at the outset: Decide whether the investigation is primarily an HR decision-making tool or whether it’s being commissioned for the dominant purpose of obtaining legal advice. Mixed purposes weaken privilege claims.
3. Assume the report may be produced: Approach every investigation on the basis that a tribunal or court may ultimately read it. Draft with that audience in mind.
4. Ensure decision-makers can give evidence about purpose: If privilege may later be claimed, those commissioning the investigation must be able to explain, in evidence, why legal advice was the dominant purpose. Silence or ambiguity at that level can be fatal.
5. Where possible, separate operational decision-making from legal advice: Legal advice should be provided independently rather than embedded within the investigation report that informs disciplinary action.
6. Control circulation strictly: Limit who receives investigation reports and legal advice. Broad internal distribution is inconsistent with maintaining confidentiality, and proper consideration should be given to discussions about investigation matters at a broad level.
7. Draft outcome letters with discipline: Provide sufficient reasoning to meet procedural fairness obligations, but avoid reciting detailed evidentiary analysis, witness accounts, or comparative credibility findings unless legally necessary.
8. Reassess risk as the matter evolves: What begins as a misconduct issue can quickly become a matter of managing the risk of a general protection, discrimination, or enterprise agreement dispute. Adjust legal oversight and tone accordingly.
9. Don’t rely on privilege as a safety net: In employment matters, privilege over investigation reports is often uncertain. Risk management should assume the process itself must withstand scrutiny. 

How can Citation Legal help? 

Legal involvement in investigations is not simply about attempting to shield a report with legal privilege, although where it can be properly claimed, privilege remains an important protective tool. It also serves a broader purpose by helping ensure the investigation is structured appropriately from the outset, so that the process can withstand scrutiny, protect the organisation’s interests, and support sound, defensible decision-making. When engaged early, Citation Legal assists employers to: 

• Determine an investigation model that aligns with the risk profile of the conduct or performance issue. Clearly define and frame allegations to avoid scope creep and procedural missteps. 

• Build a procedurally fair process that can withstand tribunal or court review. 

• Identify and manage legal exposure as legal risk and process-related issues evolve. 

• Structure communications to balance fairness obligations with risk control. 

• Preserve legal protections where appropriate and minimise the risk of inadvertent privilege waiver. 

• Prepare outcome documentation that is clear, disciplined, and defensible. 

In employment disputes, most of the risk is created at the beginning of the investigation. Once interviews are conducted, letters issued, and documents circulated, it’s often too late to correct structural flaws without significant cost and reputational impact. 

At Citation Legal, we approach investigations as legal risk management exercises, not administrative HR tasks.  Whether you require discreet strategic oversight, assistance at key decision points, or independent legal investigation support, early engagement allows us to position your organisation for the strongest possible outcome if the process is later challenged.  Our team brings together legal and experienced HR practitioners with the skills and expertise to support organisations throughout the investigation process. 

If your organisation is about to commence, or is already navigating, a sensitive workplace investigation, we would be pleased to provide a confidential, upfront legal risk assessment to ensure the process is structured for defensibility from the start. 

About our authors 

Brittany Byrne is a Partner and Solicitor at Citation Legal and is based in our Brisbane office. Brittany is a leading expert in providing workplace business solutions to employers in an array of industries. Using her common-sense approach to disputes and litigious matters, she has allowed her clients to achieve commercial outcomes while protecting their reputations in the marketplace.

Nicole Visedo is a Senior Associate and Workplace Mediator at Citation Legal. Based in our Brisbane office, she has over 25 years’ experience in Human Resources, having held several senior HR management roles in both large national and international organisations. Nicole has extensive experience working for large organisations in strategic human resource management, workplace relations, organisation change, process and systems improvement and project management.