12. Conducting an investigation

What is an investigation?

An investigation is a formal and systematic inquiry to establish facts about an incident, complaint or alleged non-compliance by collecting, documenting, examining and evaluating evidence. An investigation is not an end in itself. Throughout an investigation, the investigator should keep an open mind about the possible outcomes of the investigation, such as education, compliance action, or a decision not to pursue the matter. The regulatory authority must ensure the safety, health and wellbeing of all children at the service. This may mean addressing immediate risks before the investigation has been completed.

The investigator must remain impartial throughout the investigation.

The investigator should also be mindful of the best practice regulation principles outlined in the section on good decision-making when conducting the investigation.

When to investigate

An investigation may be initiated where there is reason to believe that an offence against the National Law has been or is being committed.

A regulatory authority may decide to investigate an issue after receiving a notification of a serious incident, a complaint, or becoming aware of potential or apparent contravention. An investigation might also be initiated if a pattern of non-compliance across a particular group of services or roles in a service leads a regulatory authority to suspect an offence may have been, or is being, committed. The potential or apparent contravention may be identified during an assessment and rating or monitoring visit to a service or through other intelligence.

For information on conducting monitoring activities, see Monitoring, Compliance and Enforcement – Monitoring. For information about receiving and responding to complaints, see Monitoring, Compliance and Enforcement – Complaints.

Power to investigate

Regulatory authorities can investigate incidents and alleged contraventions of the National Law and Regulations, using the powers of regulatory authorities and authorised officers detailed in the National Law. The term ‘investigator’ is used in this guide to refer to a person with the appropriate powers given to them in the National Law or through delegation. See Monitoring, Compliance and Enforcement – Powers of regulatory authorities and Monitoring, Compliance and Enforcement – Powers of authorised officers.

Where a regulatory authority becomes aware of potential or apparent contravention of a different law, the relevant authority should be contacted. The disclosure of information to other authorities is permitted in particular circumstances by section 271 of the National Law.

See Operational Requirements – Other regulatory frameworks.

The role of the investigator

The role of the investigator is to:

  • define the focus and scope of the investigation
  • collect evidence
  • establish and document the facts
  • prepare a report on the findings.

An investigator should always ensure they have the necessary delegation to use the powers given to them under the National Law to conduct an investigation. Authorised officers may exercise their specific powers under the National Law, while other powers are given to the regulatory authority. See Monitoring, Compliance and Enforcement – Powers of regulatory authorities and Monitoring, Compliance and Enforcement – Powers of authorised officers for more information.

Collaboration with other agencies

At times more than one regulatory agency will be involved in investigating an issue. This could include the police, child protection, environmental protection, or a regulatory authority from another jurisdiction. If another agency is involved, the regulatory authority should identify the appropriate channels of communication with the agency as soon as possible. This is likely to be through senior management and must be in accordance with any protocols in place. Agencies should exchange information about their investigative and compliance powers and the direction and scope of their investigations to get the best outcome by avoiding overlap and identifying any gaps. An investigation conducted by the approved provider in question does not relieve the regulatory authority of its power to investigate a potential non-compliance.

Regulatory authorities should be mindful that while they can share information with other agencies, the extent to which they can share some information gathered in an investigation can be restricted by the National Law (see Part 13 of the National Law).

The regulatory authority should liaise closely with the other agency to avoid taking any action that jeopardises the other agency’s investigation. This is particularly important when a police investigation is being carried out. In some circumstances, a regulatory authority might consider deferring its investigation while another agency is investigating.

Communicating with children, families, and educators

Children, families and educators cannot always be made aware of the details and particulars of the notification that prompted the investigation, however, if possible the regulatory authority should help those affected to understand why an investigation is occurring and how this might impact on the education and care of children attending the service. The regulatory authority may detail the potential outcomes of the investigation including the possibility that the investigation may find no evidence to support a contravention. The investigator must remain impartial about the outcomes of the investigation.

The regulatory authority must consider confidentiality requirements in meeting the needs of children, families and educators for information about the investigation. It can be helpful to nominate a specific contact person who can address any questions or concerns.

Where the subject of an investigation has caused distress or anger, the regulatory authority might consider additional resources to support people who are affected. For example, taking along assistants, as permitted by section 199 of the National Law (see Powers of entry for investigating approved education and care service), or providing details for counselling services.

Record keeping

The investigator must thoroughly and objectively document the investigation, mindful that it may need to be used to support a future compliance action, including prosecution. Investigators should take thorough notes of phone calls, discussions and observations related to the investigation. Records should indicate the date, time and author. Calls and discussions held at the office should also be noted on a running sheet.

The running sheet is a chronological list that records the actions and tasks completed as part of the investigation along with details such as date, time, responsible person and comments. Running sheets give a clear overview of the investigation and may be helpful for reviews or as a reference when giving evidence in court.

See Good Regulatory Practice for information on keeping records of investigations and decisions. The State Records Act 1998 (NSW) applies to all jurisdictions for the purposes of the National Law and Regulations except to the extent that the National Law applies to a regulatory authority and the records of a regulatory authority (section 265).

Planning an investigation

Planning an investigation is essential to ensure that:

  • the focus or reason for the investigation is clearly identified
  • the investigation addresses any immediate and ongoing risks to children being educated and cared for at the service
  • the investigation is carried out methodically and professionally
  • resources are used effectively
  • appropriate sources of evidence are identified and opportunities for people to remove, destroy or alter evidence are minimised.

When planning an investigation, the investigator should remember the aim of the investigation is to establish facts, and consider the below matters.

Considerations when planning an investigation

Any perceived or real conflicts of interest

Allegations that have been made

Possible sources of information and evidence

The investigation timeframe

Any cultural sensitivities or special needs and what resources are needed to address these

Any other regulatory bodies involved

Resources required, including staff (both on the visit and in the office for immediate inquiries), cameras, travel, laptops, printers, scanners, specialist consultants

Communication protocols between teams, particularly if multiple visits are conducted simultaneously.

Closing an investigation

Once an investigation has concluded, the investigator should compile a report that details the findings of the investigation. Regulatory authorities should be mindful of the good decision-making principles set out in Good Regulatory Practice when making a decision on what action, if any, to take as a result of the investigation. Investigators should close the investigation in the National Quality Agenda IT System.

The investigator might recommend a particular course of action in the report, however in most cases, it is good practice for a person other than the investigator to decide what, if any, action should be taken as a result of the investigation. Appropriate action may be compliance focused or it may be educative. In some cases, the regulatory authority might notify the parties to the investigation, including families, of the outcome, where appropriate and within the confidentiality requirements of the National Law. Compliance actions and prosecutions must be initiated by the relevant delegate.

12.1 Gathering evidence

What is evidence?

Evidence is gathered to establish facts which prove or disprove whether an offence has been committed. The manner in which the evidence is gathered is important and evidence to be relied upon for an enforcement action must be sufficient to prove each and every element of the alleged offence or breach. In an investigation, the main sources of evidence are:

  • oral evidence (recollections) including witness statements
  • documentary evidence (records)
  • real evidence (physical evidence or objects)
  • expert evidence (technical advice)
  • site inspection and the resulting investigator statements, video or photographs.

In some circumstances, one piece of evidence might be enough to prove a fact. However it is best to collect supporting evidence where possible. Evidence may be either direct or circumstantial. Direct evidence establishes a fact directly, for example a confession statement or security footage of a person contravening the law. Circumstantial evidence may lead an investigator to deduce a particular fact, for instance forensic evidence that indicates a person was present in a particular location.

Characteristics of evidence


The evidence is factual and real


The evidence is relevant to the facts it is used to prove


The evidence is trustworthy and may be supported by other evidence


The evidence is relevant to the time period in question

When collecting evidence for legal proceedings, it is particularly important to ensure that it is gathered correctly so it can be used in court. Investigators should seek advice from the relevant area of the regulatory authority about satisfying the rules of evidence in their jurisdiction. It is also important any evidence seized or copied is kept in a secure location with a clear process that will ensure continuity and eliminate any claims of misconduct.

Records of the recovery, storage and movement of evidence should be kept.

Standard of proof

The standard of proof is the amount and type of evidence that is required to prove something. In some jurisdictions, it is best practice to always operate at a standard of proof of beyond reasonable doubt. If unsure of the applicable standard of proof, seek advice from the regulatory authority’s legal team, or equivalent.

Depending on the purpose of the investigation then there may be different standards of proof. For civil prosecutions, the evidence will need to show that on ‘the balance of probabilities’ something occurred. However, for criminal prosecutions, the proof must be ‘beyond reasonable doubt’.

Conducting interviews

In some circumstances, people involved in an incident, including witnesses to an incident, may need to be interviewed as part of the investigation. People being interviewed should be informed of the investigation, any confidentiality requirements and that they may be asked to give evidence in person at a later point. Different requirements apply when interviewing persons of interest, including the giving of a warning under section 212 of the National Law.

If unsure, seek advice from the regulatory authority’s legal team, or equivalent. The investigator may take a written witness statement to record facts established in an interview.

A statement should set out the relevant facts in chronological order. Statements should be specific, detailed and accurate. The statement should set out:

  • where the incident occurred
  • when the incident occurred
  • who was present
  • what the person observed.

If possible, the statement should specify the exact words that were used. If the person does not remember the exact wording, the statement should make this clear, for example ‘she said words to the effect of’. Where a person provides an opinion, the statement should include the reason that the person formed that opinion. The statement should reflect the person’s account of the incident, rather than conclusions drawn by the investigator.

Using photographs or film

An authorised officer may photograph or film at an education and care service or business premises when exercising their powers under sections 197 (powers of entry for assessing and monitoring approved education and care service), 199 (powers of entry for investigating approved education and care service), and 200 (powers of entry to business premises). When entering business premises that are not an education and care service premises, an authorised officer must have consent from the occupier of the premises to take photographs or film.

Using photographs or film as evidence

The regulatory authority may sometimes need to take photographs or film when investigating a service, including possible contravention of the National Law or Regulations or circumstances surrounding a serious incident. For instance, if a provider has failed to maintain fixtures at the service premises and there is a risk to children’s safety, the authorised officer might photograph the fixture. The images may be used as evidence to support a compliance action, or to support a prosecution if the contravention is serious.

State or territory based legislation may include requirements for the collection and storage of photos or film to be used as evidence for a prosecution. Other jurisdictional or national legislation may also apply to the use and storage of photographs and film of children, such as privacy, child protection and copyright legislation and criminal codes. Regulatory authority staff should consult their legal team as required about relevant legislation and the proper collection and maintenance of photos and film to be used as evidence. For information on privacy, ‘Information Sheet 1 (Public Sector) on Information Privacy Principles’ is available on the Office of the Australian Information Commissioner website: www.oaic.gov.au.

The regulatory authority may also be required to show continuity of custody for photographs or film used as evidence for court proceedings. For instance, if photos are taken on a digital camera and stored electronically, the regulatory authority may be required to provide a record of who has accessed the file. It might also need to demonstrate it has measures in place to ensure a reliable framework for storing digital records, including:

  • policies and procedures to guide digitisation processes
  • training programs and support for staff about collecting and storing photos and film
  • documented security controls for digital images
  • documented monitoring and review mechanisms.

In general, where a photograph or film is taken, it is recommended that a minimum of three photographs are taken or ‘aspects’ covered:

  • a close up of any identifying features
  • a close up to show the whole subject
  • a wide shot to show the context.

An authorised officer should record in their notebook any photos taken as part of monitoring and compliance activities. This should include details of the direction the camera is facing, a brief description of the image, the time and the photographer’s name.

As soon as practicable after taking the photograph or recording the film, an authorised officer should upload the photographs or film from the device onto a computer belonging to the regulatory authority and follow relevant labelling conventions. For video recordings, an authorised officer should record the date, time and location verbally as part of the audio recording, and log the video in their notebook.

Photographs or film should only be recorded on a camera (or other device) belonging to the regulatory authority, rather than a privately-owned camera, mobile phone or other device.

Photographing or filming children

An authorised officer should avoid taking photographs or film of children unnecessarily in the exercise of their powers. When deciding whether to take photographs or film of children in the exercise of their powers, an authorised officer should consider if evidence could be gathered effectively without taking photographs or filming children, for example, by moving children out of the frame, or by using another means of recording the information.

An authorised officer should explain to any person who is or appears to be concerned about the photographing or filming of children that they are only taken and used for purposes directly related to the regulatory authority’s function, which is to monitor education and care services.

They should also advise the person that the regulatory authority is bound by the Information Privacy Principles set out in the Commonwealth Privacy Act 1988.

Disruption to the service program should be minimised.

Wherever possible, an authorised officer should avoid taking photographs of children:

  • in toileting areas
  • in nappy changing areas
  • when they are in any state of undress or exposure.