Responding to compliance notices: practical steps for employers

Employers routinely describe anything that arrives from a regulator as "a notice". That habit is the first source of error. A document issued under a statutory power is an instrument: it has an enabling provision, a named recipient, a service requirement, statutory preconditions, a defined act that must be done, a due date, sometimes a display or notification duty, a specific review route and specific consequences for non-compliance. Two documents that both use the word "notice" can differ on every one of those points.

The instruments an Australian employer is most likely to receive fall into five practical groups. A compliance notice issued by a Fair Work Inspector under section 716 of the Fair Work Act 2009 requires an employer to remedy an alleged contravention of a specified kind. A work health and safety or occupational health and safety improvement notice requires a contravention or risk to be remedied within a stated period. A prohibition notice stops an activity that involves or may involve a serious risk. A non-disturbance notice, and in the model-law jurisdictions a provisional improvement notice issued by a health and safety representative, operate differently again. Separately, a regulator may issue a compulsory requirement to answer questions, attend an interview or produce records and documents, which is not a direction to fix anything at all.

The practical consequence is that the response cannot begin with drafting. It begins with classification. Until the organisation knows which instrument it holds, under which enacted law, against which legal person, it cannot know what it must do, by when, what it may dispute, or whether anything at all is suspended while it thinks.

Two things must be settled before any strategic discussion. The first is whether anyone is currently exposed to a risk the notice identifies. The second is whether money is currently not reaching employees who are entitled to it. A review, a legal opinion or a request for an extension is not a reason to leave either running.

Where a prohibition requirement applies, the activity described stops, and it stops on the terms of the instrument rather than on a manager's reading of how serious the risk really is. Where a non-disturbance requirement applies, the site, plant or thing identified is preserved and controlled, and preservation is itself an operational task with an owner, a physical boundary and a record. Where an alleged underpayment is ongoing, the forward-looking payroll position should be corrected or quarantined immediately, separately from the harder work of quantifying any historical amount.

It is equally important not to invent relief that does not exist. Asking a question, requesting more time, seeking a variation or lodging a review application does not, of itself, pause a notice. A stay, suspension, variation or extension exists only where the applicable enacted law provides for it, or where the decision-maker or regulator has granted it. Treat any such relief as real only when it is confirmed in writing, and record who confirmed it, when, and precisely what it covers.

A disciplined read extracts and records, in one place, the issuing agency and officer, the enabling Act and provision, the notice number, the exact legal entity named as recipient, how and when the instrument was served or received, the site, activity, plant or employee cohort affected, the acts required, every date on the face of the instrument, any display or notification obligation, the stated review route and the stated consequences of non-compliance. Anything ambiguous is recorded as ambiguous rather than resolved by assumption.

For a Fair Work compliance notice, the Fair Work Ombudsman's published guidance on compliance notices explains that the notice sets out the alleged contravention, what the employer must do to fix it and what evidence must be provided, the time allowed, how to seek review of the notice in court, and the consequences of not complying. The FWO's current guidance also states that it cannot commence civil proceedings against the employer for the contraventions set out in the notice if the employer complies with it. That protection should be read narrowly and literally: it is directed at the contraventions specified in that notice. It does not extend to other contraventions, other periods, other employees, other regulators, criminal exposure, employee-initiated claims or unrelated liabilities. A compliance notice is also a different instrument from an infringement notice, an enforceable undertaking or a notice requiring the production of information, each of which has its own effect and its own consequences; the FWO's broader compliance and enforcement material sets out the range.

For safety notices, jurisdiction is decisive. Safe Work Australia develops model laws and national guidance but does not regulate any workplace; the model laws have legal effect only as enacted by the Commonwealth, a state or a territory, as Safe Work Australia's own material on model WHS laws and on how regulators enforce WHS laws makes clear. Victoria operates under its own Occupational Health and Safety Act 2004 and WorkSafe Victoria's own processes, including a distinct internal-review pathway described in WorkSafe's guidance on requesting review of an OHS inspector decision. Do not transplant model-law terminology, review periods, display rules or compliance-certificate concepts into Victoria, and do not assume any single national review period applies anywhere. The instrument itself and the enacted law of the issuing jurisdiction govern.

A notice response fails most often through diffusion: several people partly involved, none accountable, and a deadline met by whoever happened to be free. Name the roles explicitly and in writing on day one.

A response owner coordinates the schedule, the evidence and the single regulator contact channel. An authorised decision-maker, with actual authority to commit resources and approve positions, signs off what is done and what is said. Operational, safety and payroll owners deliver the substantive remedial work. A records custodian controls preservation, collection and the index of anything produced. A communications owner manages workforce, representative and, where relevant, external messaging. Qualified legal advice is engaged where rights, validity, privilege or exposure require it.

One caution matters more than the rest. A response owner is a coordination role. It does not displace the person or entity that actually holds the statutory duty, nor the officer or decision-maker whose obligations the applicable law imposes. Where an instrument is directed at a specific legal entity or a specific duty holder, the response structure must sit under that person, not around them.

The matrix below is an orientation aid, not a substitute for the instrument. Every cell is qualified by the enacted law of the issuing jurisdiction and by the actual terms of the notice received.

Preservation is the step most often done late and most costly to do late. Issue a documented hold as soon as a notice or compulsory requirement is received, scoped proportionately to the subject matter. In practice it usually needs to reach email and calendar data, payroll and time systems, rosters, the HRIS, safety and incident systems, CCTV, workplace messaging platforms, access and machine logs, contractor records and the working notes people keep on their own devices. Crucially, it must also reach the automated controls that quietly destroy material: mailbox retention rules, CCTV overwrite cycles, log rotation, device refresh programs and departing-employee account deletion.

Integrity matters as much as coverage. Preserve source material in its original form, with metadata intact, and record where each item came from, who holds it and who has accessed it. Do not backdate, edit, tidy or retrospectively "complete" records. If a document genuinely needs to be created after the event — a note of a conversation, a reconstruction of a decision — it must be dated when it was actually written and identified on its face as a later record.

Preservation, collection, review and production are four separate decisions. Preserving broadly is prudent; producing broadly is not automatically required. What must be produced is governed by the terms of the notice or compulsory requirement and the enacted law, not by what happens to be in the hold. Legal professional privilege is fact-specific and narrower than most organisations assume: copying a lawyer into an email, or stamping a document "privileged", does not make it privileged. Where privilege, self-incrimination or scope limits may be live, obtain legal advice before anything leaves the organisation.

Convert the instrument into a schedule that lists each discrete obligation as a separate line. For each line, record the exact wording of the requirement, the evidence that will demonstrate it has been met, the accountable owner, any dependency, an internal due date set ahead of the statutory date, the statutory date itself, current status, the escalation trigger, and who will verify completion.

The internal date is deliberate. Deadlines calculated backwards from the statutory date leave no room for the evidence to fail verification, and evidence frequently fails verification the first time. Building in a buffer converts a late discovery into a manageable problem rather than a request for an extension that may not be granted.

Keep the schedule as the single record of the response. Where an organisation already maintains an obligations and controls register — the discipline described in the AWS briefing on a compliance framework that is monitored and evidenced — the notice response should sit inside that structure rather than in a parallel spreadsheet that disappears when the matter closes. GRC technology is useful here for the same reason it is useful elsewhere: it keeps the obligation, the owner, the evidence and the verification result attached to one another over time.

Route regulator communication through one controlled channel with a named owner, so that what the organisation says is consistent, complete within the lawful scope of what is asked, and recorded contemporaneously. That control has one important limit: where a regulator has lawfully required a particular individual to answer questions, attend an interview or produce something, that individual must comply with the requirement that applies to them. A central channel coordinates; it does not override a personal legal obligation.

Accuracy is a discipline, not an attitude. Say what is known, say what is not yet known, correct anything that turns out to be wrong as soon as it is identified, and never speculate to fill a gap. Keep a record of every call, meeting and item of correspondence, including who attended and what was said, and reconcile that record against the response schedule.

Seek clarification where the requirement is genuinely ambiguous, and seek a variation or extension where the timeframe cannot realistically be met. Neither should be treated as achieved until it is confirmed in writing by a person with authority to give it. An informal indication in a phone call that the regulator is "comfortable" with a later date is not a change to the instrument. Until written confirmation arrives, plan and work to the original date on the face of the notice.

Separate four things that are commonly collapsed into one. Immediate containment or remedy addresses the specific matter identified. Systemic corrective action addresses why it happened and whether the same fault exists elsewhere. Evidence of completion demonstrates that the action was in fact taken. Verification of effectiveness tests whether the control actually operates in practice.

The fourth is where most responses are weakest. A revised policy, a training attendance sheet or a screenshot of a configuration change demonstrates that something was produced. It does not demonstrate that a control works. Effectiveness is shown by testing a sample of transactions, observing the task being performed, re-running the calculation on live data, or checking the exception report over a subsequent period. Where the notice concerns payment obligations, the testing discipline set out in the AWS briefing on wage compliance reviews and documentation applies directly.

Record accountable owners, resources committed, dates, dependencies, exceptions accepted and the escalation path for anything slipping. Verification should be proportionate to the risk and sufficiently independent of the person who implemented the action — at minimum, a different individual; for significant matters, a different function or an external reviewer.

There is no universal rule that employees must always hear about a notice from the employer before they hear about it from anywhere else. What communication is required, and when, depends on the display and consultation duties the applicable safety law imposes, any industrial instrument obligations, privacy and confidentiality constraints, procedural fairness where individuals are implicated, operational necessity and the facts of the matter.

Work from those obligations outwards. Where the enacted law requires a notice to be displayed or workers and health and safety representatives to be consulted or informed, do it in the manner the law specifies. Beyond that, tell affected workers what they need in order to work safely and to understand what is changing, without prejudging allegations, identifying individuals unnecessarily or making admissions the organisation has not considered. Investigation material and personal information should be handled on a need-to-know basis; the OAIC's guidance on the employee records exemption is a reminder that the exemption is narrower and more conditional than it is often assumed to be, and that other confidentiality and secrecy obligations continue to apply regardless.

Board and executive reporting should be driven by materiality, not by reflex. A minor improvement notice remedied within days may warrant nothing more than inclusion in a periodic compliance report. A prohibition notice halting a revenue-generating operation, an alleged systemic underpayment, or a matter with prosecution potential is a different proposition and should reach the accountable executive and, where appropriate, the board promptly and in a consistent format.

Keep five options distinct, because they carry different consequences: complying; seeking clarification; requesting a variation or extension; applying for review of the decision; and challenging the validity of the instrument. They are not mutually exclusive, and in many matters an employer complies with the operative requirement while separately pursuing review of a part of it. Review periods in some jurisdictions are short, and any capacity to extend time is limited and jurisdiction-specific, so the review position should be assessed immediately.

Two cautions run in opposite directions. Remediating a matter does not necessarily amount to an admission of every alleged contravention, and organisations should not delay fixing something out of a general fear that fixing it concedes liability. Equally, complying with a notice does not guarantee that all exposure is closed. Employee claims, other contraventions, other periods, other regulators and criminal exposure are not resolved by compliance with one instrument.

Escalate to qualified legal advice immediately where validity, scope, stay or review rights, privilege, compulsory questioning, self-incrimination, potential admissions, prosecution risk or parallel employee claims are live. AWS is a workplace consultancy, not a law firm; our role is to build and run the response operating system, evidence the corrective action and verify that it works, alongside the employer's legal advisers rather than in place of them.

Finally, do not treat silence as closure. Sending documents, completing tasks or hearing nothing further does not close a matter. Record whatever formal close-out evidence the applicable regime provides — the regulator's written confirmation, a compliance certificate or clearance where one exists, or the correspondence confirming the requirement has been satisfied. Retain the notice, all correspondence, the response schedule, the index of material produced, the decisions taken and why, the corrective-action evidence, the verification results and the lessons learned, under a defined retention period and access rule. Feed verified lessons into the ongoing compliance framework, and do so by adding to the record rather than editing the historical response.

Example A — a Fair Work compliance notice alleging underpayments. A national services employer receives a compliance notice naming one operating entity and alleging that a cohort of employees was paid below the applicable classification rate over a defined period. Within the first hour, payroll is instructed to apply the higher rate prospectively for the cohort while the historical position is examined, so the alleged shortfall stops accruing. A hold is issued over payroll extracts, time and attendance data, rosters, contracts, position descriptions and the configuration change log. The response owner builds a schedule from the face of the notice: the remedy required, the evidence required, the date, and the review information the notice states. Legal advice is obtained on the classification assumption underlying the alleged contravention, on whether the entity named is the correct employer, and on the scope of what must be produced. Recalculation is performed independently of the payroll officer who configured the original rule, and a sample is re-tested by a second reviewer before any payment is made. Affected employees are told factually what is being corrected and how the amount was calculated. The notice is treated as satisfied only when the evidence has been produced in the required form by the required date and the organisation holds a record of what was provided. Even then, the employer records that the FWO's stated position relates to the contraventions specified in that notice, and that other periods, other cohorts and employee-initiated claims remain separate questions.

Example B — a safety notice affecting an operation. A manufacturer receives an inspector's notice concerning a guarding and isolation practice on a production line. The activity described is stopped immediately, the machine is isolated and physically tagged, and a supervisor is made accountable for ensuring it does not resume by default across shift changes. Where preservation is required, the area is secured, photographed and logged, and cleaning and maintenance in that zone are suspended. The instrument is read against the enacted Act of the issuing jurisdiction rather than against model-law assumptions, and jurisdiction-specific advice is obtained the same day on any display duty and on the review pathway and its timeframe — noting that in Victoria the WorkSafe internal-review process applies rather than any model-law equivalent. Health and safety representatives and affected workers are consulted as the applicable law requires, and are told what has stopped, what is being done and what interim arrangements apply. Corrective action addresses both the specific guarding fault and the systemic question of whether the same isolation practice exists on comparable lines. Effectiveness is verified by observing the isolation procedure in use across two shifts, by a person independent of the maintenance team that implemented the fix. The matter is treated as closed only where the applicable regime provides for formal written confirmation, certification or clearance and that document is held, and the employer notes separately that closure of the notice does not resolve any other exposure arising from the same facts.

AWS works with employers on the parts of this that are operational rather than legal: classifying and mapping the instrument, standing up the response structure, running preservation and the response schedule, designing corrective action that addresses the system rather than the symptom, and verifying independently that controls operate. Where the underlying issue points to a broader gap, that work connects to workplace advisory and compliance support and, where the organisation wants obligations, controls and evidence held in one place over time, to GRC technology. Legal questions go to the employer's legal advisers.