• Section 1 - Purpose
• Section 2 - Authority
• Section 3 - Scope
• Section 4 - Instruction

Section 1 - Purpose

(1) This Instruction provides details on how fraud and corruption investigations are conducted at RMIT. It aligns with expectations for professional, fair, thorough and skilled investigations outlined in Australian Standard AS8001:2021 Fraud and Corruption Control.

Section 2 - Authority

(2) Authority for this document is established by the Fraud and Corruption Control Policy.

Section 3 - Scope

(3) This Instruction applies to fraud and corruption investigations conducted anywhere across the RMIT Group.

(4) Not all allegations of fraud or corruption are investigated internally by RMIT. After a preliminary assessment by Central Complaints and Investigations, the case may be referred to the police or an external agency (e.g. the Independent Broadbased Anti-Corruption Commission [IBAC]) by the Executive Director, Governance, Legal and Strategic Operations.

Section 4 - Instruction

(5) RMIT’s internal investigators in Central Complaints and Investigations are appropriately skilled and experienced officers who are independent of the business unit in which the alleged fraud or corruption has occurred.

Investigation stages

(6) A fraud or corruption investigation typically has the following stages:

1. receiving and recording an allegation
2. preliminary assessment and immediate response
3. planning
4. collecting evidence, including from witnesses and the person suspected of committing the fraud or corruption
5. assessing evidence
6. eeporting findings, internally and potentially to external agencies.

Receiving and recording an allegation

(7) There are multiple avenues within RMIT for employees, students or third parties to disclose suspected fraud or corruption, including on the Complaints Portal, to supervisors, the Whistleblower Coordinator, the Director of Risk, or directly to the Central Complaints and Investigations Unit. All fraud and corruption allegations are directed from these recipients to the Associate Director, Central Complaints and Investigations, to triage and allocate to an investigator or refer to an external body where required by law.

(8) All disclosures received by RMIT are acknowledged, and the discloser is advised of the process, particularly whether RMIT or an external agency will manage their complaint.

(9) Employees can seek confidential advice from Central Complaints and Investigations if they are uncertain about whether to disclose an allegation of fraud or corruption to RMIT or to an external body.

(10) Initial allegations are completely and accurately documented, including the components of each allegation to assist in planning the investigation.

Preliminary assessment

(11) Investigators determine the legislation or policies that are relevant to the suspected fraud or corruption investigation and the implications from those instruments, e.g. where criminal legislation is relevant, more stringent rules of evidence may apply, and where there is a public interest disclosure there may be additional protection offered to the person who disclosed the corruption.

(12) The preliminary assessment also considers whether:

1. there have been similar matters or allegations in the past that may inform how the investigation is conducted and where there are potential gaps in fraud and corruption risk controls
2. the matter needs to be promptly reported to regulators, law enforcement, or insurers
3. the suspected fraud or corruption requires an immediate response to further protect RMIT assets (see section below).

Immediate response

(13) On the discovery of fraud or corruption, RMIT investigators:

1. identify the parties involved, both internal and external to RMIT
2. identify as quickly as possible if funds have been removed from RMIT’s bank accounts
3. where applicable, freeze RMIT bank accounts to prevent any further leakage of funds through unauthorised transactions that are awaiting processing
4. take swift legal action to freeze an account into which RMIT’s funds have been transferred, where this has been identified
5. quarantine and capture digital and other physical evidence, and secure it to prevent the removal or destruction of evidence
6. assess the impact on RMIT and activate the relevant response and recovery plan
7. suspend suspected employees and deactivate their access to systems and facilities.

(14) The early capture of digital evidence is performed by an external forensic information technology expert in accordance with the International Standard ISO/IEC 27037 Information Technology – Security Techniques – Guidelines for identification, collection, acquisition, and preservation of digital evidence.

Investigation activities and evidence collection

(15) Investigators prepare an investigation plan that documents:

1. the background to the matter
2. objectives of the investigation
3. preliminary steps
4. resourcing for the investigation
5. potential sources of evidence and potential witnesses
6. legal considerations for capturing evidence
7. storage of evidence
8. risks associated with the investigation and to the investigators, and
9. reporting requirements.

(16) Investigators may employ any of the following activities when investigating allegations of fraud or corruption:

1. interviewing witnesses and persons suspected of involvement in fraud and corruption, and obtaining statements
2. data search and seizure
3. reviewing and collating documentary evidence, including but not limited to telephone records, emails, employee files, building access records, video surveillance
4. forensic examination of computer systems and captured digital evidence
5. search of physical offices for documentary and physical evidence
6. expert witness and specialist testimony
7. tracing funds, assets or goods
8. liaison with police, other law enforcement agencies or regulatory agencies.

(17) Interviews are carefully planned to ensure all pertinent information is collected in a way that enhances credibility. Planning includes topics and the order in which they are covered, questions for each topic and the way they will be asked, evidence to be presented to the interviewee, and detailed knowledge of evidence that has been collected.

Notifying the respondent

(18) When a complaint is referred for investigation, the Central Complaints and Investigations Unit notify in writing the person suspected of the fraudulent or corrupt conduct (the respondent) and include:

1. an outline of the allegation
2. clear instructions about maintaining confidentiality with respect to all aspects of the investigation
3. a summary of any initial assessment that has been made to determine whether policies have been breached or laws broken
4. referral to the relevant policies and procedures
5. an invitation to respond in writing and to provide evidence for the investigator to consider.

Procedural fairness

(19) Investigations of suspected fraud or corruption are conducted in a manner consistent with the principles of natural justice and procedural fairness. This means:

1. decision makers are impartial, or where applicable, disclose and manage any conflicts of interest that may be perceived to affect their impartiality
2. decisions are based on the balance of relevant evidence to ensure decisions are well founded and defensible
3. persons being investigated have an opportunity to respond to a case against them and to present their own case
4. investigations are managed in a timely manner to mitigate the impact on the affected parties
5. all information pertaining to the investigation is treated as confidential and only disclosed where necessary to meet legislative or law enforcement requirements.

(20) In addition to considering evidence about what occurred, consideration is given to whether the persons involved knew or should have known that the conduct was forbidden.

Record-keeping

(21) For each investigation, RMIT records:

1. a list of the allegations under investigation
2. key decisions, actions and communications
3. working papers that demonstrate the investigative procedures performed and the basis for findings and conclusions
4. details of liaison with law enforcement and regulatory agencies
5. proof of adherence to principles of procedural fairness (refer to clause 17 above)
6. anything subject to legal professional privilege
7. the use of investigative powers and the source of those powers (e.g. contract, enterprise agreement, policy)
8. the investigation report and all its attachments
9. quality review of the investigation and report.

(22) Investigation records are prepared, maintained and retained in accordance with the Information Governance Policy and the Privacy Policy, and comply with the requirements for Victorian Auditor-General’s Office and the IBAC.

(23) All evidence captured is recorded at the time it is collected, always held securely, and accounted for each time it is handed to another party (known as continuity of evidence or chain of custody).

(24) RMIT may capture oral evidence through audio or video recordings with the knowledge of the participants and in accordance with relevant policies such as the Complaints Governance Policy, e.g. in the presence of a support person for the interviewee.

(25) Recordings are made in a manner that is likely to ensure that information obtained from the interviews is admissible in court, such as having the person confirm on the recording that they have given permission for the recording.

(26) Interviews may be converted to written form and preferably signed or acknowledged as true and accurate by the participants.

(27) Any exculpatory evidence is recorded, i.e. evidence that is favourable to the person suspected of fraud or corruption and which may exonerate them.

Assessing evidence and reporting findings

(28) Investigators methodically check that every element of every allegation has been properly covered in the investigation.

(29) Reports of an investigation recognise the need to protect whistleblowers and exhibit fair treatment of the person who has allegedly engaged in fraudulent or corrupt conduct.

(30) Reports include an executive summary, background, details of each allegation, relevant evidence collected, assessment of the evidence, conclusion and recommendations.

(31) Reports include an assessment of whether there was a serious breakdown of fraud and corruption risk controls, and how these controls could be improved to prevent further incidents.

(32) If there appears to be adequate evidence to support either a criminal prosecution or further investigation by the police, the investigator works with Legal Services to prepare a police brief.

Determining the outcome

(33) The response to an adverse finding must be proportional to the seriousness of the fraud or corruption.

(34) At the conclusion of an investigation, the findings are referred to the relevant senior officer as prescribed by the Delegation of Authority Schedule 3 – People Delegations, to determine the outcome for the employee in terms of their employment at RMIT, in accordance with relevant policies and enterprise agreements.

(35) In cases where an investigation occurred in response to a disclosure from an employee, student or third party, the Associate Director, Central Complaints and Investigations will inform the discloser when the investigation is concluded. The level of detail provided about the outcome of the investigation is dependent upon a number of factors, including the confidentiality of the matter, RMIT’s privacy obligations regarding the respondent, and whether a criminal prosecution is being pursued.