We're changing the way Sapphire looks
Same platform, new visual identity. Learn more: Sapphire is becoming NHMRC Grant Management System.
We're changing the way Sapphire looks
Same platform, new visual identity. Learn more: Sapphire is becoming NHMRC Grant Management System.
NHMRC is serious about preventing, detecting and responding to fraud and corruption and is committed to high ethical, moral and legal standards.
A key focus of this framework is to raise awareness of fraud and corruption among NHMRC employees and other people who deal with NHMRC, and to assist in the prevention, detection and reporting of suspected fraud and corrupt conduct.
The National Health and Medical Research Council (NHMRC) is serious about preventing, detecting and responding to fraud and corruption and is committed to high ethical and legal standards. All officers of the NHMRC are expected to act with honesty and integrity and uphold the values of the Australian Public Service (APS) in their dealings with stakeholders.
The NHMRC Fraud and Corruption Control Framework 2026–2028 (the Framework) outlines NHMRC’s approach to managing fraud and corruption risks. It assists in the prevention, detection, response and reporting of suspected fraud and corruption against NHMRC.
NHMRC’s Framework is supported by a Fraud and Corruption Control Plan (the Plan), which is NHMRC’s detailed response to identified fraud and corruption risks. The Plan, which includes Fraud and Corruption Risk Assessments, allocates risks to control owners, ensuring there is oversight and management of identified risks.
The Commonwealth Fraud and Corruption Control Framework 2024 defines fraud against the Commonwealth as:
Dishonestly obtaining (including attempting to obtain) a gain or benefit, or causing a loss or risk of loss, by deception or other means. The conduct does not need to represent a breach of criminal law.
A benefit or loss is not restricted to a material benefit or loss, and may be tangible or intangible. A benefit may also be obtained by a third party.
Fraud requires intent. It requires more than carelessness, accident or error. When intent cannot be shown, an incident may be non‑compliance rather than fraud.
Examples of fraud against the Commonwealth include (but are not limited to):
NB. While they are not substantiated fraud, allegations or suspected fraud need to be reported and managed in accordance with this Framework.
For the purposes of the Commonwealth Fraud and Corruption Control Framework 2024, corruption in relation to an entity is defined broadly consistently with the NACC Act and is:
Any conduct that does or could compromise the integrity, accountability or probity of public administration. This includes:
Corruption may be criminal or non-criminal in nature and may affect any aspect of public administration. For example, an official being offered or accepting a bribe, or engaging in fraud against the entity.
For the purposes of NHMRC, this definition ‘a staff member of a Commonwealth agency’ includes members appointed to NHMRC committees, including peer reviewers.
Examples of corruption include:
The benefits referred to in the above definitions are not limited to material assets, but can also be intangible, such as the misuse of privileged information.
Fraud and corruption can be perpetrated by NHMRC staff, NHMRC committee members or contractors (internal fraud), or by people external to NHMRC (external fraud). It may also be committed jointly between a staff member and an outsider. Offences of fraud and corruption against the Commonwealth can also constitute offences under the Criminal Code Act 1995 or the Crimes Act 1914.
Non-compliance is a broad term for any failure to comply with legal requirements. These requirements may be in the form of legislation, regulation, funding agreements, administrative rules, and licensing conditions. One example is the requirement for all APS employees to act in accordance with the APS Code of Conduct, which is set out in section 13 of the Public Service Act 1999. Non-compliance includes where parties try to comply but make mistakes (accidental non-compliance) or where parties exploit ambiguities or opportunities that are non-compliant (opportunistic non-compliance).
NHMRC has assessed its exposure to fraud and corruption as most likely to arise from actions of staff, actions by members appointed to NHMRC committees, and actions taken by people seeking or receiving research funding from NHMRC.
The key fraud and corruption enterprise risks in the Corporate Plan relate to:
The Commonwealth Fraud and Corruption Control Framework 2024 supports Australian Government entities to effectively manage the risks of fraud and corruption. It consists of the Fraud and Corruption Rule (section 10 of the Public Governance, Performance and Accountability (PGPA) Rule 2014), the Fraud and Corruption Policy, and Fraud and Corruption Guidance. Section 10 of the PGPA Rule provides a legislative basis for the Commonwealth’s fraud and corruption control arrangements and sets out fraud and corruption control requirements to assist Accountable Authorities to meet their obligations under the PGPA Act. Breaches of the Rule may attract a range of criminal, civil, administrative, and disciplinary remedies (including under the PGPA Act, the Public Service Act 1999, the Criminal Code Act 1995 and the Crimes Act 1914). A number of other pieces of legislation, external standards and NHMRC policies and procedures are relevant (see below).
| Key Legislation | External Standards and Guides | Policies and Procedures |
|---|---|---|
National Health and Medical Research Council Act 1992 Public Governance, Performance and Accountability Act 2013 (particularly PGPA Rule s10) Public Service Act Privacy Act 1988 Public Interest Disclosure Act 2013 Crimes Act 1914 Criminal Code Act 1995 National Anti-Corruption Commission Act 2022 | Commonwealth Fraud and Corruption Control Framework 2024 Australian Government Investigation Standards Prosecution Policy of the Commonwealth Australian Government Protective Security Policy Framework ASNZ ISO 31000:2018 Risk Management – Guidelines AS 8001:2021 – Fraud and Corruption Control | NHMRC Fraud and Corruption Control Framework (the Framework) NHMRC Fraud and Corruption Control Plan (the Plan) including risk assessments NHMRC Funding Agreement NHMRC Research Integrity and Misconduct Policy and Australian Code for the Responsible Conduct of Research NHMRC Risk Management Policy NHMRC’s Accountable Authority Instructions, HR delegations and HR policies and processes |
NHMRC will review both this Framework and its Plan at least once every two years or when there is a substantial change in the structure, activities, or functions of the agency.
The NHMRC fraud and corruption control strategy is built around the three basic principles of prevention, detection, and response, which are underpinned by foundations of both internal and external controls.
NHMRC actively pursues improvements, such as strengthening internal controls, enhancing reporting mechanisms, and improving training and awareness, to minimise risk, promote transparency, and safeguard integrity. The performance of a regular fraud and corruption risk assessment also provides the opportunity to assess our progress in managing fraud and corruption and to identify the effectiveness of our strategy.
NHMRC identifies fraud and corruption control actions that will be implemented to reduce fraud and corruption risk (see sections 3-5 below for the main control strategies). These specific actions align with NHMRC’s general objectives for the prevention and detection of fraud and corruption, including:
All NHMRC officials have a shared responsibility to detect, report and prevent fraud and corruption. Senior management has a significant role in the development of an effective anti-fraud and corruption culture at NHMRC.
NHMRC officials will incorporate fraud and corruption risk consideration when planning, designing, implementing or delivering high-risk projects, government initiatives or significant new investments, demonstrating NHMRC’s commitment to continuously and proactively reviewing its fraud and corruption control arrangements.
Specific responsibilities are described in Table 2.
| Role | Responsibilities |
|---|---|
Chief Executive Officer (CEO) (NHMRC’s Accountable Authority) | Implement NHMRC’s Fraud and Corruption Control Framework in accordance with section 10 of the PGPA Rule. This includes fostering an environment that makes active fraud and corruption control a responsibility of all staff. Report significant issues to the Minister for Health and Ageing. Decide on matters to be referred to law enforcement or integrity agencies. Certify in NHMRC’s Annual Report that they are satisfied that the agency has appropriately assessed its fraud and corruption risk and has a fraud and corruption control plan in place to help prevent, detect and investigate fraud and corruption occurrence. Name the Fraud and Corruption Control Officer. |
| Executive Board | Provide advice to the CEO on fraud and corruption control and make decisions, subject to the agreement of the CEO. |
| Audit and Risk Committee | Advise the CEO on the appropriateness of NHMRC’s system of risk oversight and management, including process for developing and implementing the entity’s fraud and corruption control arrangements consistent with the Commonwealth Fraud and Corruption Control Framework. Satisfy itself that NHMRC has adequate processes for detecting, capturing and effectively responding to fraud and corruption risks, and managing cases of suspected internal and external fraud and corruption. |
Program Management Committee (PMC) and Portfolio Investment Committee (PIC) | Consider whether targeted fraud and corruption risk assessments should be undertaken when considering:
|
| Deputy CEO and Executive Directors (Risk owners) | Foster an environment that makes active fraud and corruption control a responsibility of all staff and support a culture of integrity, including by demonstrating the highest level of integrity. Identify, manage and control fraud and corruption risks within areas of responsibility on an ongoing basis, including embedding fraud and corruption risk management into day-to-day processes and planning. |
| Control owners | Implement and maintain fraud and corruption controls, including conducting reviews of controls. |
| Fraud and Corruption Control Officer (FCCO) | Reporting to the Deputy CEO, oversee day to day implementation of NHMRC’s Fraud and Corruption Control Framework, including:
|
| Executive Director, Research Quality and Advice | Management of:
|
| People, Property and Security Section | Management and reporting of potential breaches of the Australian Public Service (APS) Code of Conduct, which can include corruption and internal fraud. |
| All NHMRC officials | Act in a professional and ethical manner, in good faith and for proper purposes, follow legal requirements and in a manner that enhances the reputation of NHMRC. Participate in annual mandatory staff training(s) and be aware of what constitutes fraud and corruption, and responsibilities in managing it. Raise any concern, suspicion (red flag), or information of any suspicion of fraudulent, corrupt or improper conduct to the FCCO. |
As part of its commitment to integrity and accountability, NHMRC will consult with, or refer matters to, other entities where fraud and corruption risks or incidents are likely to impact on the responsibilities of the other entity, e.g. the Department of Health, Disability and Ageing. This may include sharing data, information and intelligence in accordance with relevant legislation, policies and protocols. By consulting with other entities, the NHMRC aims to enhance its fraud and corruption prevention, detection and response capabilities and contribute to the protection of public resources and trust in government. NHMRC will also participate in relevant inter-agency networks, forums or training, with opportunities to learn and share information on common fraud and corruption risks and trends.
Prevention strategies include actions taken to prevent fraud and corruption through the promotion of a high level of ethics and accountability in relation to fraud and corruption control. At NHMRC, prevention activities include those listed below.
Integrity and organisational culture - The principal influence on organisational culture is ethical conduct by management, and in particular by the Chief Executive Officer (CEO). A fundamental strategy in controlling the risk of fraud and corruption is the development and maintenance of a culture of integrity, underpinned by effective and continuous communication of the expectations of employee conduct within NHMRC, including examples set by management.
Fraud and corruption control planning - To maintain better practice in its fraud and corruption risk management strategies, NHMRC is committed to the following:
Fraud and corruption awareness training - All staff need to be aware of fraud and corruption control issues and actively implement fraud and corruption reduction strategies in the execution of their day-to-day activities. NHMRC promotes various learning and development initiatives, including fraud awareness, Code of Conduct and risk management training, to cultivate a knowledgeable and vigilant workforce dedicated to preventing, detecting, and addressing fraud and corruption.
Internal controls - Internal controls are often the first line of defence against fraud and corruption. NHMRC will ensure the maintenance of a strong internal control system and the promotion and monitoring of a robust internal control culture. NHMRC promotes an internal control culture through a process of:
Fraud and corruption risk assessment - NHMRC will conduct an assessment of fraud and corruption enterprise risk regularly (i.e. every two years) and at times of significant change, as required by the Commonwealth Fraud and Corruption Control Framework 2024. Additionally, the CEO, Deputy CEO, or Audit and Risk Committee may request that the enterprise fraud and corruption risk assessment be updated at any time. The fraud and corruption risk assessment will be contained within the Enterprise Risk Register.
The Plan will contain targeted fraud and corruption risk assessments, and associated controls. Risk owners ensure that the strategies developed during the assessment process are reviewed for effectiveness and additional risk treatments implemented, as needed.
Internal audit program - The NHMRC internal audit program is an important element in reviewing risk management strategies and the effectiveness of the governance controls, policies, and procedures in place. The primary purpose of the internal audit program is to provide an independent and objective review and assurance to the CEO and the Audit and Risk Committee that NHMRC’s internal controls are designed to manage the organisation’s risks and achieve the entity’s objectives, and that they are operating in an efficient, effective and ethical manner.
Employee screening and supplier vetting - NHMRC applies screening procedures in accordance with the Protective Security Policy Framework for APS officials. Supplier vetting procedures will be included in contractual documentation, where appropriate.
Declaration of interests - NHMRC maintains a declaration of interest (DOI) process for employees.
Detection strategies include actions taken to detect fraud and corruption early and to limit exposure where it does occur. NHMRC may use any or all of these techniques in detecting or investigating potential fraud or corruption.
Fraud and corruption reporting channels - NHMRC has a range of reporting channels that support staff, stakeholders and the public to report suspected fraud and corruption. All officials have a responsibility to advise the CEO, via the FCCO, of any concern, suspicion, or information about fraudulent, corrupt or improper conduct, and to encourage others to do the same. This includes all actions that may appear, or may be an attempt, to dishonestly obtain a benefit or cause a loss, by deception or other means, or which may be an abuse of office or a breach of public trust. Further information about reporting mechanisms is below and in Section 7.
Reports are assessed by the FCCO to determine if a formal investigation and/or compliance action is required or if fraud or corruption prevention strategies need to be applied.
Any person (including members of the public and public officials) can voluntarily refer a corruption issue, or provide information about a corruption issue, to the NACC.
Note that:
Whistleblower reports and Public Interest Disclosures - People who are prepared to speak up about suspected wrongdoing in the Commonwealth public sector are vital in ensuring its integrity and accountability. Whistleblowing is the act of reporting suspected wrongdoing or risk of wrongdoing.
The Public Interest Disclosure (PID) scheme provides a legislative framework for reporting and investigation of allegations of serious wrongdoing in the Commonwealth public sector. NHMRC has PID procedures that apply to disclosure, assessment, investigation and response. The PID Act has provisions that provide protection for employees who make whistleblower reports of suspected misconduct, which are reflected in NHMRC’s PID procedures. Employees who report a suspected wrongdoing to a person authorised to receive the report must not be victimised or discriminated against because they made such a report.
Complaints management - The NHMRC Complaints Policy sets out NHMRC’s formal procedures for responding to complaints about its activities, policies or decision-making. Complaints can be made anonymously. Complaints that may relate to fraud or corruption are reported to the FCCO and considered in accordance with this Framework.
Grants’ compliance monitoring - Fraud and corruption can undermine the objectives of NHMRC’s grants, diverting resources from supporting health and medical research. NHMRC is responsible for protecting taxpayer funding by ensuring that its use is in line with its intended purpose. Accordingly, provision of grant funds is a key fraud and corruption risk area for NHMRC. Active monitoring of grant funds expended can be effective in identifying fraudulent activity by internal actors or external providers and ensuring accountability for the use of Commonwealth funds.
It is the responsibility of the CEO and the Executive, with advice of the Audit and Risk Committee, to determine which monitoring procedures may be required to manage the fraud and corruption risks associated with the provision of grant funds.
Administering Institutions have obligations under this Framework and the NHMRC Funding Agreement to notify NHMRC in relation to responding to fraud (see Appendix B).
Notifications under the NHMRC Research Integrity and Misconduct Policy - NHMRC receives notifications from Administering Institutions about institutional investigations of potential breaches of the Australian Code for the Responsible Conduct of Research, in line with the requirements of the NHMRC Research Integrity and Misconduct Policy. Members of the public, peer reviewers and other stakeholders also sometimes raise concerns with NHMRC about research integrity matters or make allegations of research misconduct. NHMRC is not responsible for investigating allegations of research misconduct or potential breaches of the Australian Code for the Responsible Conduct of Research but is notified of matters in accordance with the policy. Some breaches may include behaviours that fall within the definition of alleged or suspected fraud or corruption (e.g., data falsification, provision of false or misleading information to NHMRC, misuse of grant funds for a gain). If this occurs, it is reported to the FCCO and considered in accordance with this Framework (see Section 5.5).
Appendix B (NHMRC research funding: responding to fraud) provides additional information about the responsibilities of Administering Institutions and how allegations about potential breaches of the Australian Code for the Responsible Conduct of Research may overlap with allegations of potential fraud.
Data mining analysis - Data mining is a process of uncovering patterns and relationships in datasets that are not otherwise apparent. Data mining uses databases to search for accounting anomalies or unusual relationships between numbers, people, and entities. For example, this might include such tests as searching accounts payable data for repeated invoice numbers to identify duplicate payments or analysing payments of claims for milestone payments by grant recipients.
Post-transaction reviews - A review of transactions after they have been processed can be effective in identifying fraudulent activity. Such a review may uncover altered or missing documentation, falsified, or altered authorisation or inadequate documentary support. In addition to the possibility of detecting fraudulent transactions, a review can also have a significant fraud prevention effect as the threat of detection may be enough to deter an employee who would otherwise be motivated to engage in fraudulent or corrupt conduct.
Management accounting reporting review - Using techniques in analysing NHMRC’s management accounting reports, trends that may be indicative of fraudulent conduct can be identified and investigated.
External audit- External audit function is an important control in the detection of fraud and corruption, which impacts on the financial statements. The CEO and CFO may consider discussions with the Australian National Audit Office (ANAO) to ensure that due consideration is given by the auditors to their consideration of fraud in the Financial Statements audit.
Information and Communications Technology (ICT) systems audit - NHMRC uses a range of sophisticated software tools to monitor all activities on the NHMRC ICT system. The tools are capable of detecting a range of potentially fraudulent and corrupt behaviours, including misuse of ICT resources and wrongful use of Commonwealth information. ICT systems used to apply for and deliver research funding are also monitored, and particular transactions or modifications are logged and audited.
NHMRC takes all allegations of fraud and corruption seriously. The primary objective of NHMRC’s response to possible incidents of fraud and corruption is to ensure perpetrators are identified and appropriate remedies are applied, to achieve a deterrent effect and to recover losses.
Consideration of fraud and corruption reports and allegations - All potential fraud and corruption incidents are considered to determine the appropriate response, which may include:
Investigations - NHMRC can undertake or commission investigations where the potential fraud or corruption is significant. If the CEO determines that an investigation is required, the following may occur:
Following an investigation, for possible criminal prosecution, the CEO may refer the matter to the Commonwealth Director of Public Prosecutions (CDPP).
If an allegation of fraud or corruption is investigated by NHMRC, the FCCO will be responsible for facilitating the investigation, having regard for the Australian Government Investigations Standard (AGIS), except for those matters referred to the AFP or NACC.
Referral to the Australian Federal Police - The AFP has the primary law enforcement responsibility for investigating criminal offences against Commonwealth laws. Under the Commonwealth Fraud and Corruption Control Framework 2024, agencies must refer all instances of potential serious or complex fraud offences to the AFP.
Referral to the National Anti-Corruption Commission - Consistent with the NACC Act, the NACC holds the power to investigate suspected cases of either serious or systemic corruption that involves, or could involve, a public official. Under the NACC Act ‘Public Officials’ are members of the Australian Parliament and ministers in the Australian Government, and the people who work for them and staff members of Commonwealth agencies including employees of Commonwealth government agencies, Commonwealth companies and statutory bodies and contracted service providers.
NHMRC complies with mandatory referral obligations under the NACC Act to refer conduct that could be either serious or systemic corrupt conduct to the NACC Commissioner.
NHMRC would refer grant corruption matters to NACC, in line with its remit. For corruption matters occurring in most Administering Institutions, NHMRC expects that the AI would refer the matter to their relevant jurisdictional corruption body in accordance with that body’s scope and powers.
Referral to the Commonwealth Director of Public Prosecutions (CDPP) - The Office of the Commonwealth Director of Public Prosecutions (CDPP) is an independent prosecution service established to prosecute alleged offences against Commonwealth law. Where an investigation gathers enough evidence to substantiate a criminal charge, NHMRC may refer the matter to the CDPP to consider taking prosecution action.
Civil and administrative remedies - There are various civil and equity law remedies and administrative processes available to NHMRC to deal with people who engage in unethical or unlawful behaviour (be it fraud, corruption or misconduct).
Internal fraud and corruption
As well as potential prosecution under the Criminal Code, APS officials who commit fraud or corruption are in breach of the APS Code of Conduct. For this internal fraud and corruption, NHMRC may take administrative action under the Public Service Act 1999. Remedies available include, but are not limited to:
External fraud and corruption
For fraud or corruption committed by an external party (that is, external fraud), NHMRC may take action against individual researchers, Administering Institutions, contractors, or other third parties. This may include, but is not limited to:
NHMRC Administering Institutions assist in responding to this risk of fraud and corruption, by reporting and, where relevant, investigating and responding to fraud. Further information, including the overlap between fraud and research misconduct, is at Appendix B.
Post-incident reviews - At the conclusion of a fraud and corruption investigation, incidents will be reviewed to identify risk, control or program deficiencies. The relevant risk assessment will be reassessed and amended as needed. Similarly, the circumstances that allowed the fraud and corruption to occur will be considered in the context of the wider NHMRC operations, and additional risk assessments conducted or amended as required.
In each instance where fraud and corruption is detected, NHMRC will reassess the adequacy of the internal control environment (particularly those controls directly impacting on the fraud and corruption incident and potentially allowing it to occur) and consider whether improvements are required.
In addition, for internal fraud or corruption, exit interviews and exit checklist procedures should be performed in the event of dismissal from NHMRC for fraud, corruption or misconduct. This is necessary to ensure those factors that contribute to the dismissal can be managed as a process of mitigating fraud and corruption risk.
Insurance - NHMRC will continue to maintain annual insurance policies issued through Comcover.
Crisis and media management - NHMRC is committed to preserving its reputation in the event of a fraud or corruption allegation concerning NHMRC entering the public domain. Should fraud and corruption be detected, the FCCO, in conjunction with the CEO, should assess communication needs in relation to the fraud and corruption. This may involve notifying the Minister if it is a significant fraud or corruption event and undertaking communication activities with the research sector, parliament or media, as appropriate. Where external investigative agencies are involved, NHMRC will consult those agencies in relation to the communication activities.
In all other circumstances, the receipt of a fraud or corruption allegation, or conduct of a fraud or corruption investigation, will be treated in confidence to ensure procedural fairness and the integrity of the investigation.
Reporting - Regular reporting and monitoring provides assurance over the effectiveness of NHMRC’s control arrangements in preventing, detecting and responding to fraud or corruption.
NHMRC’s reporting includes:
All NHMRC fraud and corruption management activities are recorded according to NHMRC record-keeping policies and procedures, ensuring appropriate security classification is applied to fraud and corruption-related documents which may contain personal or sensitive material.
NHMRC staff, committee members, contractors and Administering Institutions must report incidents of suspected fraud and corruption. Reports remain confidential. NHMRC also provides for anonymous reporting and supports the PID scheme to offer further protections and support.
Allegations or suspicions of fraud and corruption should be reported as soon as practicable.
The details below show the ways that suspected fraud or corruption can be reported.
Staff wanting to report suspected fraud or corruption can discuss the matter with their manager in the first instance. If you do not wish to report to your manager, then please use one of the following means of alerting the Fraud and Corruption Control Officer.
If you do not feel comfortable with these channels, you can make a Public Interest Disclosure.
Or you can make an Anonymous tip-off online via the Contact us page navigate to the Contact Form and select ‘Complaints and reports’ then ‘Anonymous report’).
If you would like to report an instance (or suspicion) of fraud or corruption at NHMRC or concerning NHMRC funding, please use one of the following methods:
Anonymous tip-offs can be made online via Contact us (navigate to the Contact Form and select ‘Complaints and reports’ then ‘Anonymous report’).
Reports of suspected fraud or corruption are carefully considered and treated as strictly confidential. Reports will be assessed by NHMRC and investigated as appropriate, which may involve referral to agencies such as the Australian Federal Police or the National Anti-Corruption Commission (NACC).
Due to a range of reasons, including confidentiality, privacy obligations and maintaining the integrity of the investigation, feedback or the outcome of NHMRCs assessment may not be provided to the individual making the report. In particular, please note that if the allegation involves another individual, NHMRC may not be able to give you any information about the conduct or outcome of the investigation due to its obligations under the Privacy Act 1988.
The NHMRC FCCO is the Director, Governance and Legal. To contact the FCCO, please email governance@nhmrc.gov.au.
Support for this function is provided by the Governance and Legal Section.