Consequence Management Framework

Document control

1. Purpose

This Framework sets out how [Organisation] responds when a person does not meet the standards of conduct, risk management and compliance expected of them, and how it recognises people who do the right thing. It ensures that:

2. Scope and application

This Framework applies to all employees, directors, officers and contractors of [Organisation] and its subsidiaries, including people employed by a related body corporate or service company who work in [Organisation]'s business. For contractors and people engaged through service providers, consequences are applied through the contract and the service provider, and the matter is still recorded and reported under this Framework.

3. Key definitions

4. Principles

Consequence management at [Organisation] follows these principles. They are the test every decision is checked against.

5. Three lines of accountability

6. Roles and responsibilities

7. What triggers consequence management

A conduct matter is opened when there are reasonable grounds to suspect that a person has done, or failed to do, any of the following. The list is not exhaustive.

8. Rating the severity of a conduct matter

Every conduct matter is given a severity rating of Critical, High, Medium or Low, using the same scale as the RiskFA Risk Management Framework and the RiskFA Incident & Issues Management Standard. The rating combines two things: the impact of the outcome and the person's culpability.

9. Identifying, referring and triaging a matter

• Any person who becomes aware of a possible conduct matter tells their manager, People and Culture, Risk or Compliance, or uses the RiskFA Whistleblower Policy channels. Managers must refer every possible matter rated Medium or above to People and Culture within [2 business days].
• Matters arising from incidents are linked to the incident record. The incident owner refers the people aspects of an incident rated High or Critical to People and Culture when the incident is recorded.
• People and Culture records the matter in the [case management system] within [2 business days], gives it a provisional severity rating, and agrees with second line who will investigate and who will decide (section 11).
• A matter that involves a possible whistleblower disclosure is handled under the RiskFA Whistleblower Policy. The discloser's identity, and information likely to identify them, must not be disclosed except as the law permits.
• A matter that involves an accountable person, the CEO, a senior manager or an executive director is reported to the [Chair of the Board Remuneration Committee] and the [General Counsel] within [2 business days].

9.1 Interim measures

While a matter is investigated, [Organisation] may take interim measures to protect customers, staff, evidence and the organisation. Interim measures are not a finding and not a consequence. They include:

10. Investigation

The purpose of an investigation is to establish the facts fairly, so that a sound decision can be made. The depth of the investigation is proportionate to the severity rating.

10.1 Investigation steps

1. Plan. Set the terms of reference: the allegations, the policies and obligations concerned, the scope, the evidence needed and the timeline. Check the investigator has no conflict of interest.
2. Preserve and collect evidence. Secure records, system logs, emails, call recordings and documents early. Nothing is altered or destroyed.
3. Interview witnesses. Keep a written record of each interview.
4. Put the allegations to the respondent. Give the respondent the allegations in writing with enough detail and the substance of the evidence to respond meaningfully, reasonable time to prepare, the opportunity to respond in an interview and in writing, and the right to bring a support person.
5. Consider the response and make any further enquiries it raises.
6. Make findings. For each allegation, find whether it is substantiated, not substantiated or unable to be determined, using the standard of the balance of probabilities and giving more weight to clear evidence the more serious the allegation. Record the reasons.
7. Assess culpability and contributing factors, including process, system, supervision, workload, incentive and culture factors, and refer any control gaps as issues under the RiskFA Incident & Issues Management Standard.
8. Report to the decision-maker. The report states the facts and findings; it does not decide the consequence.

10.2 Procedural fairness and wellbeing

• The respondent is presumed not to have engaged in the conduct until findings are made.
• A person who is the subject of an allegation, a witness or a person who raised the matter is offered support, for example through the [Employee Assistance Program].
• Unreasonable refusal to allow a support person at discussions relating to dismissal is a matter the Fair Work Commission takes into account (Fair Work Act s387(d)).
• Investigations into regulated persons (for example financial advisers and mortgage brokers) must also consider the information that may later need to be shared in a reference (section 18).

11. Decision-making

The person or body that decides the consequence is separate from the investigator. Decisions are made on the investigation findings, the severity rating, the respondent's response, precedent and the consequence matrix (Appendix A).

11.1 The Consequence Management Committee

• Membership: [Chief People Officer] (chair), [Chief Risk Officer], [General Counsel / Head of Compliance], [one or two executives not from the business unit involved]. A quorum is [three], including the chair or the CRO.
• Independence: a member with a conflict of interest, or who manages the respondent, does not take part. The respondent's executive may attend to give context but does not vote.
• Meetings: at least [monthly], and as needed for urgent matters. Decisions and reasons are minuted.
• Outputs: the severity rating, the findings accepted, the consequence, any variable remuneration recommendation to the Board Remuneration Committee, root cause referrals, and regulatory notification referrals.
• Reporting: the Committee reports to the Board Remuneration Committee at least [quarterly] (section 20).

11.2 Telling the person and the right of review

• The respondent is told the findings, the consequence and the reasons in writing, as soon as practicable after the decision.
• The respondent may ask for a review within [10 business days] on the grounds that the process was unfair, new evidence is available or the consequence is disproportionate. A review is decided by a person or body not involved in the original decision. A review does not delay a termination that has been decided, unless the reviewer directs otherwise.
• Where appropriate and lawful, the person who raised the matter is told that it has been dealt with, without disclosing confidential details.

12. The range of consequences

Consequences range from support and development to termination of employment. More than one consequence can apply to the same matter, for example a written warning, a performance rating impact and a variable remuneration adjustment. Appendix A sets the normal range for each type of breach and severity rating.

12.1 Aggravating and mitigating factors

13. Performance and variable remuneration outcomes

Conduct outcomes flow into performance and remuneration outcomes through the RiskFA Remuneration Policy. The two documents must be read together.

14. Positive consequences and speaking up

Consequence management is not only about failures. [Organisation] recognises and rewards people who demonstrate the conduct and risk behaviours it wants.

15. Employment law considerations

Consequence decisions must comply with employment law, the employment contract and any applicable modern award or enterprise agreement. This section summarises key Fair Work Act 2009 provisions as at October 2026. It is not legal advice: take advice from your employment lawyer before any dismissal or significant adverse action.

16. Accountable persons under FAR

Where [Organisation] is an accountable entity under the Financial Accountability Regime Act 2023, conduct matters involving accountable persons follow this Framework with the additional steps below.

17. Regulatory and other notifications

A conduct matter can also trigger notification obligations other than FAR. These are assessed and made under the RiskFA Incident & Issues Management Standard (section 10), which applies to every possible breach regardless of rating. Examples include reportable situations to ASIC (including certain conduct of financial advisers or mortgage brokers), breaches of prudential requirements to APRA, eligible data breaches to the OAIC, and suspicious matters to AUSTRAC. The [Consequence Management Committee] confirms that each High or Critical matter has been referred to Compliance for this assessment.

18. Reference checking and information sharing

18.1 Financial advisers and mortgage brokers (mandatory)

AFS licensees and credit licensees must comply with the ASIC reference checking and information sharing protocol (Corporations Act 2001 s912A(1)(cc); National Consumer Credit Protection Act 2009 s47(1)(ea)). The current protocol is set out in ASIC Corporations and Credit (Reference Checking and Information Sharing Protocol) Instrument 2024/647, which commenced on 20 August 2024 and replaced Instrument 2021/429. ASIC's guidance is INFO 257. In summary (confirm against the instrument):

18.2 Banks: ABA Conduct Background Check Protocol

ADIs that subscribe to the Australian Banking Association's Banking Industry Conduct Background Check Protocol must, for final-stage candidates and with their consent, ask former employers that are also subscribers whether, in the previous 5 years, the person was dismissed for misconduct, resigned after being notified of a misconduct investigation, or is subject to a notified investigation. Former employers must answer in writing within 5 business days unless otherwise agreed, and must keep their records accurate and up to date, including correcting them if a court or tribunal later finds there was no valid reason for a dismissal. The protocol is an industry commitment, not a law; check the current version and subscriber list on the ABA website.

18.3 All other roles

• Reference checks for other roles follow the [Recruitment Policy], with the candidate's consent.
• References given about former employees are factual, accurate, and approved by People and Culture. Managers must not give informal references about conduct matters.
• Settlement agreements, deeds and contracts must not prevent [Organisation] from meeting its reference checking, regulatory reporting or whistleblower obligations.

19. Record keeping and privacy

• Every conduct matter is recorded in the [case management system] using the case record in Appendix B. The register is the single source of truth for consistency analysis and reporting.
• Investigation files, findings, decisions and reasons are kept securely, with access limited to those who need it. Whistleblower information is kept separately under the RiskFA Whistleblower Policy.
• Records are kept for at least [7 years] after the matter is closed, and in any case for long enough to meet reference checking requirements (5 years under the ASIC protocol) and FAR, employment and limitation periods.
• The Privacy Act 1988 exempts some acts and practices of an employer that are directly related to a current or former employment relationship and an employee record (s7B(3)). The exemption does not cover all information (for example information about contractors, candidates or other individuals in the file). Handle all personal information in line with the [Privacy Policy] and take advice before relying on the exemption.
• Where [General Counsel] directs that an investigation is conducted under legal professional privilege, records are created and stored as Legal directs.
• Warnings and records of minor matters are given a retention date for disciplinary purposes (for example [12–24 months]), after which they are not relied on for future consequence decisions, unless the conduct is repeated or the law requires otherwise.

20. Reporting, consistency analysis and oversight

People and Culture and second line report on consequence management to the executive [monthly], and to the [Board Remuneration Committee] and [Board Risk Committee] at least [quarterly]. Reports cover at least:

20.1 Consistency analysis

At least [half-yearly], second line analyses outcomes to test whether consequences are consistent and fair:

21. Training, assurance and review

• Decision-makers, investigators and people leaders are trained in this Framework, procedural fairness and unconscious bias before taking part in decisions, and refreshed every [2 years].
• All staff are told about this Framework, the [Code of Conduct] and speak-up channels at induction and [annually].
• Internal Audit reviews this Framework's design and operating effectiveness, including the consistency of outcomes and the link to remuneration, at least every [3 years].
• For SFIs, this Framework forms part of the remuneration framework that CPS 511 requires to be reviewed for compliance annually and independently reviewed for effectiveness at least every three years (CPS 511 paras 54–55).

22. Related documents

• the RiskFA Risk Management Framework, the RiskFA Risk Appetite Statement and [Incident & Issues Management Standard]
• [Code of Conduct], the RiskFA Remuneration Policy and [Performance Management Policy]
• the RiskFA Whistleblower Policy, [Fit and Proper Policy] and [FAR Accountability Policy]
• [Recruitment Policy], [Privacy Policy] and [Workplace Behaviour Policy]
• APRA: CPS 511 Remuneration and CPG 511 Remuneration; CPS 510 / SPS 510 Governance; CPS 520 / SPS 520 Fit and Proper
• FAR: Financial Accountability Regime Act 2023; APRA and ASIC, Financial Accountability Regime: Information for accountable entities (July 2024; ASIC RG 279)
• ASIC: INFO 257 ASIC reference checking and information sharing protocol; RG 78 Breach reporting by AFS licensees and credit licensees; RG 270 Whistleblower policies
• Fair Work Act 2009 and Fair Work Regulations 2009; Corporations Act 2001 Part 9.4AAA; Privacy Act 1988
• Australian Banking Association, Banking Industry Conduct Background Check Protocol

Appendix A. Consequence matrix

The matrix gives the normal range of consequences for each type of breach and severity rating. Decision-makers choose within the range using the aggravating and mitigating factors in section 12.1, and record a reason for any outcome outside it. Every substantiated matter also has root cause actions under the RiskFA Incident & Issues Management Standard. 'VR' means variable remuneration for the current performance year; adjustments to deferred or vested awards (malus or clawback) are additional where the matter meets the CPS 511 criteria.

Appendix B. Case record template

Appendix C. Procedural fairness checklist

• Investigator and decision-maker are different people, and neither has a conflict of interest.
• Allegations were given to the respondent in writing with enough detail to respond.
• The respondent saw the substance of the evidence relied on.
• The respondent had reasonable time to respond and was offered a support person.
• The response was considered and any new lines of enquiry were followed up.
• Findings were made on the evidence, with reasons recorded for each allegation.
• The consequence was checked against Appendix A and precedent, and reasons recorded.
• The real reasons for the decision were recorded, and no protected attribute or workplace right formed part of them.
• Legal advice was obtained before any dismissal, demotion or clawback.
• Variable remuneration was held during the investigation where CPS 511 requires it, and the outcome was sent to Reward.
• Regulatory notifications (FAR, ASIC, APRA) and reference checking records were assessed and completed on time.