Who controls the truth in a corporate investigation?

Months later, the investigation is complete. However, the employee who raised the concerns may never see the report or receive a detailed explanation of what it found.

That outcome is not necessarily unlawful or evidence that the investigation was inadequate. The company may have legitimate reasons to keep some information confidential, including protecting the privacy of employees, preserving the integrity of related proceedings, or obtaining legal advice about its potential exposure.

Where a report or communication meets the legal requirements for privilege, the organisation may also be entitled to withhold it from disclosure. Legal professional privilege protects certain confidential communications made for the dominant purpose of obtaining or providing legal advice, or for use in existing or reasonably anticipated litigation.

However, the fact that an organisation is legally entitled to withhold a report does not resolve a separate question: What should it tell the person who brought the allegations to light?

“For the whistleblowers we act for, accountability that happens out of sight is not accountability at all,” Mia Pantechis, principal lawyer at Maurice Blackburn, told Lawyers Weekly.

“A person who has taken a real personal and professional risk to raise serious concerns deserves more than an assurance that the matter has been ‘dealt with’.”

VIEW ALL

The tension is particularly acute when a company commissions an investigation into allegations concerning its own conduct or senior personnel.

Even where an external lawyer conducts the investigation independently, the organisation that commissioned it may retain control over the report and decisions about its disclosure, subject to its legal obligations.

That creates a distinction between the independence of the investigation itself and the transparency of its outcome.

For lawyers advising corporate clients, the challenge is not simply determining whether an investigation report is legally protected. It is also deciding what information can be shared with whistleblowers, regulators, and others without compromising legitimate confidentiality obligations.

Recent scrutiny of privilege claims in corporate investigations, including the Australian Securities and Investments Commission’s (ASIC) dealings with KPMG, has brought that tension into sharper focus.

The privilege question

In September, Lawyers Weekly reported that KPMG Australia continued to claim legal professional privilege over 74 documents in connection with ASIC’s scrutiny of alleged misconduct at the firm.

According to correspondence from ASIC chair Sarah Court to the parliamentary joint committee on corporations and financial services, the material comprised 68 independent director documents and six engagement documents.

Court said KPMG had indicated that it would produce other material under a proposed voluntary disclosure agreement, while ASIC had not, at that stage, pressed the firm to produce documents over which privilege was maintained.

The correspondence also identified material KPMG had already provided under voluntary confidential disclosure arrangements, including reports prepared by external law firms and documents relating to internal investigative work.

Such arrangements allow parties to provide information to ASIC for investigative purposes while seeking to preserve legal professional privilege. Their effectiveness depends on the terms of the agreement, and third parties may still dispute whether privilege has been waived.

The correspondence does not establish that KPMG’s outstanding privilege claims are invalid or that the firm has improperly withheld material.

KPMG chief executive John Sams also told the parliamentary committee that the firm had provided, or would shortly provide, relevant legal advice to regulators and professional bodies, and was responding to requests for supporting documents.

Rather than establishing wrongdoing in the use of privilege, the exchange illustrates the complexity of obtaining access to documents generated during corporate investigations.

A report may be important to a regulator’s inquiries, while the company holding it maintains that its contents are protected by privilege.

The question then becomes not only whether privilege exists, but whether sufficient information can be provided for regulatory scrutiny without surrendering the protection altogether.

What privilege does (and does not) protect

Engaging a lawyer to conduct or oversee an investigation does not automatically make every document generated during the process privileged.

Whether privilege applies depends on why the particular confidential communication or document was created, rather than simply the professional status of the person who prepared it.

ASIC makes that distinction explicit in its guidance on legal professional privilege claims.

The regulator does not accept blanket claims of privilege. It requires parties responding to compulsory notices to identify the documents over which privilege is claimed and provide information supporting those claims.

Its guidance also distinguishes between material created for the purpose of obtaining legal advice and pre-existing documents that do not become privileged merely because they are provided to a lawyer.

The position becomes more complicated when an investigation serves several purposes simultaneously.

It may be intended to establish what happened, assess potential breaches of company policy, determine whether disciplinary action is warranted, provide advice to a board or prepare for regulatory proceedings.

The difficulty is establishing which purpose was dominant when the relevant material was created.

When an investigation has more than one purpose

The involvement of a lawyer is not, by itself, enough to establish that obtaining legal advice was the dominant purpose of an investigation.

That principle was illustrated in the Fair Work Commission’s decision in Crafti v Cohealth Ltd [2025] FWC 3285, where an employer’s claim of privilege over an investigation report was unsuccessful.

The dispute concerned a report prepared by a barrister engaged to investigate a complaint against an employee. The employer asserted legal professional privilege over the report and associated material, resisting an application for their production.

The commission considered whether the investigation had been undertaken for the dominant purpose of obtaining legal advice.

Deputy president Kamal Farouque accepted that obtaining legal advice was one of the employer’s purposes. However, the evidence also pointed to a significant employment and disciplinary purpose, and the commission was not satisfied that the legal advice purpose was dominant.

The privilege claim therefore failed.

The commission separately considered whether privilege would have been waived had it attached to the report.

The employer had provided the employee with an investigation outcome letter containing detailed information about the findings, reasoning and evidence relied upon.

The commission concluded that the extent of that disclosure was inconsistent with maintaining confidentiality over the relevant material.

The first risk for organisations arises at the outset: a report prepared by a lawyer may not attract privilege if obtaining legal advice was not its dominant purpose.

The second arises after the investigation: disclosing substantial parts of a report’s reasoning or evidentiary basis can create a waiver issue, even where the organisation intends to preserve privilege.

The case arose in an employment dispute involving production of an investigation report. It does not establish a general right for whistleblowers to obtain corporate investigation findings.

Nevertheless, it underscores the importance of identifying an investigation’s purpose at the beginning and considering how its outcome will eventually be communicated.

An organisation may want to provide a detailed explanation to demonstrate that allegations have been properly examined. Yet the extent of that explanation may have consequences for the confidentiality of the underlying report.

That does not mean organisations must choose between complete disclosure and complete silence. It means decisions about what to communicate cannot safely be treated as an afterthought.

Accountability from the whistleblower’s perspective

The importance of effective whistleblower processes is underscored by the volume of disclosures Australian companies receive – and questions about how consistently those processes are reviewed.

In its December 2025 report on whistleblower practices, ASIC found that 30 per cent of 134 surveyed companies did not regularly review the effectiveness of their whistleblower programs.

The companies had received a combined 8,095 disclosures through their designated whistleblower channels between July 2024 and June 2025.

While those figures do not establish how much information whistleblowers receive about investigation outcomes, they highlight the scale of corporate reporting processes and the importance of assessing whether those processes are working.

For whistleblowers, the consequences of limited disclosure are not confined to uncertainty about the outcome.

Pantechis said an absence of information can deepen the distrust that prompted a disclosure in the first place.

“A lack of transparency erodes trust, and whistleblowers are often left questioning whether their concerns were properly investigated, whether they should escalate to a regulator, or whether the investigation was quietly turned on them,” she said.

“Further, when others in the workplace see a disclosure disappear without trace, they tend to draw the obvious conclusion that speaking up is not worth it.”

In her experience, the personal consequences can be severe.

“An investigation cloaked in secrecy does not just fail a whistleblower; it can turn the process against them, and an unsubstantiated finding quickly becomes a mark against their credibility,” Pantechis said.

“The personal and professional toll is often devastating, including stress, isolation and careers that never recover.”

Pantechis’ concerns go to the credibility of corporate reporting and whistleblower protection mechanisms.

Organisations may encourage employees to speak up, establish confidential reporting channels and commit to investigating disclosures. But those measures can lose their value if people who raise concerns cannot tell whether the information they provided was meaningfully examined.

That does not necessarily entitle a whistleblower to every document generated during an investigation.

There may be legitimate reasons to protect confidential legal advice, the personal information of other employees, sensitive evidence, or material relevant to ongoing proceedings.

Procedural fairness considerations may also affect what can be disclosed about individuals who were investigated.

Nevertheless, Pantechis argues that organisations should be able to provide more than a generic assurance that the process has concluded.

“At a minimum, they should be told what was investigated, who investigated it, whether their allegations were upheld and what (if any) disciplinary or remedial action has been taken,” she said.

“Otherwise, the whistleblower is left to trust the same organisation they had reason to distrust in the first place.”

Pantechis’ proposed standard is not necessarily one of unrestricted access to the full investigation report, but of meaningful information about what was examined and what followed.

The difference between confidentiality and silence

An organisation may have good reasons to protect particular communications while still explaining the scope and outcome of an investigation.

The difficulty lies in determining how much information can reasonably be provided without revealing privileged advice, breaching privacy obligations or compromising other legal interests.

Pantechis rejects the proposition that an investigation can restore confidence if the whistleblower is given no meaningful account of its outcome.

“An investigation that ends in silence protects the organisation, not the whistleblower, and confidence cannot be restored behind closed doors,” she said.

“At the very least, a whistleblower should be told which issues were examined, the outcome for each allegation, what action has been taken, and the specific reasons any further detail is being withheld. Generic references to ‘confidentiality’ are not reasons.”

An employer may be constrained in what it can reveal about disciplinary outcomes involving other staff. A company facing regulatory scrutiny may also need to avoid prejudicing an ongoing investigation.

The legal entitlement to receive particular information will depend on the applicable statutory framework, employment arrangements and circumstances of the disclosure.

But the broader governance question remains: whether the organisation has considered what meaningful feedback can be given, rather than treating confidentiality as a complete answer.

For corporate counsel, that requires separating several questions that are sometimes treated as interchangeable.

Is the information legally privileged? Is it otherwise confidential? Is there a legal obligation to disclose it? And, even if disclosure is not required, would providing a carefully framed account of the outcome serve a legitimate accountability purpose?

Can privilege become a shield?

Pantechis accepts that legal professional privilege has a legitimate function, but is concerned about how broadly it can be invoked in the investigations context.

“Legal professional privilege has a legitimate role, but it is too often used to shield the whole investigation rather than to protect legal advice,” she said.

“Privilege protects advice. It does not protect facts, and it does not stop an organisation telling a whistleblower whether their concerns were substantiated.”

She argues that the use of lawyer-led investigations can become problematic where the result is that findings are never meaningfully communicated.

“When investigations are routinely run through lawyers so that the findings never see daylight, the purpose of privilege has been distorted,” she said.

Those concerns raise an important distinction between the underlying facts of an investigation and the legal communications or documents in which those facts may be recorded.

Facts do not become privileged merely because a lawyer examines them.

However, a confidential report containing factual findings may itself attract privilege where the applicable legal requirements are satisfied. Its protection cannot be determined solely by describing its contents as factual rather than legal.

Nor does a valid privilege claim, without more, demonstrate an intention to conceal wrongdoing.

The legitimacy of the protection and the adequacy of the organisation’s response to a whistleblower are related but separate questions.

An organisation might be legally entitled to withhold a report while still facing criticism about the amount of information it has chosen to communicate.

Equally, a demand for transparency does not automatically override a valid claim of privilege.

This is where the role of external lawyers becomes particularly delicate.

Lawyers may be asked to investigate allegations, provide legal advice on the findings, advise on disciplinary or regulatory consequences and assist with communications about the outcome.

Those functions can overlap, but they are not identical. Clarity about the purpose of the engagement, the intended recipients of any report and the boundaries of subsequent disclosure can help avoid confusion about what the organisation is commissioning and what it expects to keep confidential.

Who gets to decide?

The question of control becomes sharper where the investigation concerns allegations against senior executives, the board, or the organisation itself.

A company may commission an external investigation precisely because it wants to demonstrate independence.

Yet an investigator’s independence in gathering evidence and reaching conclusions does not necessarily determine who owns the report or controls its release.

That authority may remain with the client that commissioned the work, subject to legal obligations and the terms of the engagement.

The result is a potential gap between the independence of the investigative process and the transparency of its outcome.

A report may have been prepared independently, but those outside the organisation may have limited means of assessing whether its recommendations were implemented or whether the findings were accurately characterised.

Regulators may be able to compel production of non-privileged material or challenge privilege claims, but their powers and processes are not equivalent to a general right of access for whistleblowers.

ASIC’s voluntary confidential disclosure arrangements offer one means by which privileged information may be supplied for investigative purposes while the privilege holder seeks to maintain protection.

Such arrangements do not necessarily resolve the separate question of what should be communicated to the person who first raised the concerns.

The regulator, the whistleblower, and the public may have different interests in the same investigation, and different legal rights to information.

An organisation’s disclosure strategy must account for those differences.

Is reform needed?

Pantechis believes the current framework leaves whistleblowers too dependent on the organisations whose conduct they have questioned.

She advocates for the creation of an independent whistleblower protection authority with powers to scrutinise investigations.

“An independent whistleblower protection authority, with power to review investigations and privileged material, is overdue,” she said.

“Without enforceable transparency obligations, investigations can be weaponised against those who speak out.”

That proposal would raise substantial questions about the interaction between regulatory oversight, legal professional privilege and existing whistleblower protections.

Any power to examine material over which privilege is claimed would need to be carefully designed, including the circumstances in which access could be compelled and the protections governing its subsequent use or disclosure.

There is also a distinction between empowering an independent authority to scrutinise an investigation and requiring an organisation to disclose privileged advice directly to a whistleblower.

The former could provide an additional mechanism for oversight without necessarily making every report public.

Whether such a model would improve confidence in corporate investigations would depend on its powers, independence and safeguards.

For now, the tension remains largely a matter of legal obligations, governance decisions, and professional judgement.

Companies have legitimate interests in obtaining confidential advice, protecting sensitive information, and ensuring investigations are conducted fairly.

Whistleblowers have an equally significant interest in knowing whether their concerns were taken seriously and whether the process led to meaningful action.

The challenge for lawyers is not simply to establish whether an investigation report can be withheld. It is to advise on how the organisation can preserve necessary legal protections while demonstrating that the investigation served a purpose beyond producing a confidential document.

An investigation can establish what happened. Whether it delivers accountability may depend on what the organisation is prepared – and legally able – to say about what it found.