Procedures for facilitating and dealing with public interest disclosures relating to NHMRC

1. Introduction

The Public Interest Disclosure Act 2013 (PID Act) promotes integrity and accountability in the Australian Public Service (APS) by encouraging and promoting internal reporting of suspected wrongdoing in public sector agencies. The PID Act protects people who make disclosures and requires agencies to act in relation to a public interest disclosure (PID).

Section 59(3) of the PID Act requires the Chief Executive Officer (CEO), as the Principal Officer under the PID Act, to establish procedures for facilitating and dealing with PIDs relating to the agency.

NHMRC is committed to the highest standards of ethical and accountable conduct and:

• encourages the reporting of suspected wrongdoing
• will act on disclosures where appropriate, and
• will take reasonable steps to protect public officials who make disclosures and NHMRC employees who are involved in disclosure investigations in accordance with the PID Act and these procedures.

2. Scope

These procedures set out the:

• way that NHMRC will deal with PIDs that relate to NHMRC, and
• responsibilities, expectations and obligations on all parties under the PID Act.

Not all disclosures of information that NHMRC may receive will be a PID for the purposes of the PID Act. A disclosure must meet the following conditions under the PID Act:

1. it is made by a current or former public official or someone deemed to be a public official
2. it is made to an appropriate person (generally, their supervisor or an Authorised Officer), and
3. the information tends to show, or the discloser believes on reasonable grounds that the information tends to show, one or more instances of “disclosable conduct”, and the disclosure is not made in the course of performing the discloser’s ordinary functions as a public official.

A disclosure may only be treated as a PID, and the discloser will only receive the benefit of the PID Act protections, if the above requirements are fulfilled. If the discloser has made a false or misleading disclosure, the protections will not apply.

Note: The PID Act sets out four types of disclosure that can be made: an internal disclosure, external disclosure, emergency disclosure and legal practitioner disclosure. Internal disclosures are the most common. More information about the types of PIDs is available on the Commonwealth Ombudsman (Ombudsman).

3. Definitions

4. Corruption

The National Anti-Corruption Commission Act 2022 (NACC Act) established the National Anti-Corruption Commission (NACC), which detects, investigates and reports on serious or systemic corruption in the Commonwealth public sector.

Under the NACC Act, a person engages in corrupt conduct if they:

• are a public official and they breach public trust, abuse their office as a public official, or misuse information they have gained in their capacity as a public official, or
• do something that could cause a public official to behave dishonestly or in a biased way when they carry out their official duties.

Public officials can choose to refer a corruption issue directly to the NACC or they can make a disclosure to an Authorised Officer under the PID Act.

If the Authorised Officer suspects the disclosure involves serious or systemic corrupt conduct, the Authorised Officer must refer the corruption issue to the NACC. Following the referral of a corruption issue to NACC, the Authorised Officer is still required to handle the internal disclosure under the PID Act, unless the NACC Commissioner has issued a stop action direction.

5. Making and responding to Public Interest Disclosures

As outlined above, a PID generally occurs when a current or former public official discloses to an Authorised Officer, or their supervisor, information which tends to show (or the discloser believes on reasonable grounds tends to show) one or more instances of disclosable conduct.

In certain circumstances, where a person does not want to lodge a disclosure with the appropriate people within NHMRC, a disclosure may be made to an external body such as:

• an Authorised Officer in another agency
• the Ombudsman
• the Inspector-General of Intelligence and Security (IGIS), for intelligence related disclosures.

5.1 Step 1: Making a disclosure

A disclosure may be made:

• to an Authorised Officer or supervisor
• orally or in writing
• anonymously or using a pseudonym (this may be appropriate where the discloser is identifiable to their supervisor or the Authorised Officer but decides to hide their identity to others).

However, one of the requirements for making a PID is that the person is, or was, a public official. A person does not have to prove their status; however, they should provide sufficient information that supports that status (for example, explaining how they know about the wrongdoing they are reporting).

Disclosures can be made anonymously. However, prospective disclosers should be aware that this may make it difficult for the disclosure to be properly considered under the PID Act.

A person who has made an anonymous PID may come forward at a later stage to disclose their identity and seek the protections of the PID Act.

5.1.1 Disclosure to a supervisor

At the time a disclosure is made to a supervisor, if the supervisor reasonably believes that:

• a current or former public official under their supervision
• has provided information to them
• which the supervisor reasonably believes could concern one or more instances of disclosable conduct

the supervisor must:

• inform the discloser that the disclosure could be treated as an internal disclosure for the purposes of the PID Act
• explain to the discloser the procedures under the PID Act for such a disclosure to be:
  • given to an Authorised Officer
  • allocated to the discloser's agency or another agency, and
  • investigated by the Principal Officer of NHMRC
• advise the individual about the circumstances (if any) in which a public interest disclosure must be referred to an agency, or other person or body, under another law of the Commonwealth
• explain to the discloser the civil and criminal protections the PID Act provides to protect disclosers, and those providing assistance in relation to such disclosures, from reprisals, and
• give the information to an Authorised Officer of NHMRC as soon as reasonably practicable.

Supervisors should adhere to the confidentiality requirements set out in the PID Act and these procedures when handling PIDs.

5.1.2 Disclosure to an Authorised Officer

At the time a disclosure is made to an Authorised Officer, the Authorised Officer must:

• advise the person that the disclosure could be treated as an internal disclosure for the PID Act
• explain to the person what the PID Act requires for a disclosure to be an internal disclosure
• advise of the circumstances (if any) in which a PID must be referred to an agency, or other person or body, under another law of the Commonwealth, and
• advise the person of any orders or directions that may affect disclosure of the information.

5.1.3 Information to include in disclosure

In making a PID, the discloser should consider providing the following information to assist the Authorised Officer to decide how the disclosure should be handled:

• their name and contact details
• the nature of the suspected wrongdoing
• who they think committed the wrongdoing
• when and where the suspected wrongdoing occurred
• relevant events surrounding the issue
• if they did anything in response to the suspected wrongdoing
• whether others know about the suspected wrongdoing and have allowed it to continue
• whether they believe their information is a PID under the PID Act, and
• if they are concerned about possible reprisal because of making a disclosure.

5.2 Step 2: Assessing the potential PID

Within 14 days of receiving a PID, the Authorised Officer must consider whether the disclosure meets the requirements for a PID, and if so, whether to allocate the PID for investigation (by NHMRC or another agency).

If the Authorised Officer suspects the disclosure involves serious or systemic corrupt conduct, the Authorised Officer must refer the PID to the NACC. This is a mandatory referral.

5.2.1 Consider whether disclosure meets the requirements for a PID

When an Authorised Officer receives a PID, they will consider the information disclosed and determine whether:

• the person making the disclosure is a current or former public official, or the person should be deemed a public official to facilitate the PID, and
• they are satisfied, on reasonable grounds, that:
  • there is no reasonable basis on which the disclosure could be considered an internal disclosure under the PID Act, or
  • the conduct disclosed would be more appropriately investigated under another law or power (this ground only relates to when the conduct disclosed raises a corruption issue).

To avoid doubt, if a disclosure includes information that tends to show (or that may tend to show) disclosable conduct, there might be a reasonable basis on which the disclosure could be considered to be an internal disclosure even if:

a) the disclosure includes other information, and

b) the other information tends to show (or may tend to show) personal work related conduct.

The Authorised Officer may obtain information and may make such inquiries as they think fit to enable them to decide whether the disclosure is an internal disclosure or not.

Before making a decision, the Authorised Officer must consider whether they have satisfied their obligations to provide information to disclosers (see section 5.1.2 above).

5.2.2 No, it is not a PID

If the Authorised Officer is not satisfied the disclosure meets the requirements of the PID Act the disclosure will not be allocated.

If the Authorised Officer decides not to allocate a disclosure, the Authorised Officer must:

• give written notice to the discloser of:
  • the decision not to allocate the disclosure and reasons why it will not be allocated
  • if the Authorised Officer is satisfied on reasonable grounds that the conduct disclosure would be more appropriately investigated under another law or power, the action the Authorised Officer has taken, or will take, to refer the conduct disclosed for investigation under the other law or power, and
  • any other course of action that might be available to the discloser under other Commonwealth laws, and
• give written notice to the Ombudsman (or IGIS if the conduct relates to an intelligence agency, the Australian Criminal Intelligence Commission (ACIC) or the Australian Federal Police (AFP)) of:
  • the reasons why the disclosure has not been allocated, and
  • whether the Authorised Officer has taken, or proposes to take, action to refer the conduct disclosed, or to facilitate its referral, for investigation under another law or power, and if so, details of that action.

A form for notifying the Ombudsman of a decision not to allocate is available.

If the Authorised Officer is satisfied, on reasonable grounds, that the conduct disclosed would be more appropriately investigated under another law or power, the Authorised Officer must, as soon as reasonably practicable, take reasonable steps to refer the conduct disclosed, or to facilitate its referral, for investigation under the other law or power.

Where an Authorised Officer decides not to allocate a disclosure to any agency, the Authorised Officer must ensure that a written record is made of:

• the decision and reasons for the decision;
• where relevant, the other Commonwealth law or power under which the conduct may be more appropriately investigated;
• any steps taken or proposed to refer the matter under that law or power; and
• if no referral is made, any advice provided to the discloser about alternative courses of action.

For further information, see section 8 of the Public Interest Disclosure Standards Determination 2025.

5.2.3 If there is a stop action under the NACC Act

If a stop action direction under the NACC Act prevents the Authorised Officer from allocating a disclosure, the Authorised Officer must give written notice to the Ombudsman or IGIS (if the disclosure concerns conduct relating to an intelligence agency, IGIS, ACIC or AFP in relation to their intelligence functions) of:

• the information that was disclosed to the Authorised Officer
• the conduct disclosed
• if the discloser's name and contact details are known to the Authorised Officer, and the discloser consents to the Principal Officer and the Ombudsman/IGIS being informed – the discloser's name and contact details, and
• the stop action direction under the NACC Act that prevents allocation of some or all of the disclosure.

The Authorised Officer must also notify the discloser of the referral to the NACC as soon as reasonably practicable.

If a stop action direction is received under the NACC Act, the Authorised Officer must consider whether it is appropriate to notify a discloser that a stop action direction has prevented the allocation of the disclosure. The Authorised Officer must carefully consider the terms of any stop action direction and consult with the Principal Officer (who may also consult with the NACC) prior to notifying a discloser.

An appropriate written record must be kept by the Authorised Officer of:

• the decision and the reasons for the decision
• whether notice was given to the discloser, and if not, why not, and
• if notice was given, a copy of the notice given to the discloser must be retained, which includes confirmation of the day and time the notice was given and the means by which the notice was given.

If a stop action direction prevents the allocation of a disclosure to an agency, a written record must be kept of the details of the direction, including when the direction was made and when the stop action direction no longer applies. The written record must also indicate whether the Principal Officer of the relevant agency considers that it is reasonably practicable or appropriate for the discloser to be given a copy of the notice.

A form for notifying the Ombudsman of a stop action direction is available.

5.3 Step 3: Yes, it is a PID

5.3.1 Risk assessment, mitigation and review

Authorised Officers must take reasonable steps to protect public officials from reprisal if the Authorised Officer suspects a relevant PID has been, may have been, is proposed to be, or could be made or given to the Authorised Officer.

If the Authorised Officer is satisfied the disclosure meets the requirements, they must, as soon as practicable after receiving the PID, assess the risk that reprisal/s will be taken against the discloser.

Reprisal risk must be assessed in all cases, however the way a risk assessment is conducted may vary depending on the circumstances. The risk assessment may be a short, early process based on an assessment of risk factors identified through the PID, or it may involve a more detailed assessment, where inquiries need to be made.

Risks will be assessed using the criteria and matrix in Appendix A. Where the risk level is assessed as anything greater than low, the Authorised Officer will develop a risk management strategy. This strategy may include some or all the support measures set out in these procedures.

It is open to the Principal Officer or Authorised Officers, in appropriate circumstances, to remind staff that taking or threatening to take a reprisal against a discloser is a criminal offence.

The Authorised Officer should monitor and review the risk assessment as necessary throughout the investigation process.

5.3.2 Allocation, informing and recording

Before allocating a PID, the Authorised Officer must ask the discloser (where contact details are available) whether they:

• wish the disclosure to be investigated, and
• consent to the Authorised Officer giving the discloser’s name and contact details to the Principal Officer, another Authorised Officer and to any person/s assigned to investigate the PID.

Where a discloser does not respond within seven days to these questions, the discloser is taken:

• not to have consented to the disclosure of their name and contact details to the Principal Officer and the investigator, and
• to wish the disclosure to be investigated.

The Authorised Officer must make a written record of the discloser’s responses (if any).

5.3.3 Allocation

The Authorised Officer will allocate the disclosure for further handling and investigation. Allocation may be within NHMRC or to another agency/agencies where it is determined that the allegations should be reviewed by an external person. Generally, it is likely that PIDs that are made to NHMRC and relate to NHMRC should be investigated by NHMRC.

In deciding where a PID will be allocated, the Authorised Officer will have regard to:

• the principle that an agency should only deal with disclosures that relate to that agency – other than the Ombudsman, the IGIS or an investigative agency prescribed by the Public Interest Disclosure Rules 2019 (PID Rules), and
• such other matters (if any) as the Authorised Officer considers relevant. This includes whether another agency in the same portfolio as NHMRC would be better placed to handle the disclosure, and any recommendation from the Ombudsman or IGIS about the allocation of the disclosure, following a review under s 55 of the PID Act.

An NHMRC Authorised Officer must not allocate a disclosure to another agency unless an Authorised Officer of that agency has consented to the allocation.

5.3.4 Inform relevant persons of the allocation

When the Authorised Officer allocates a PID they must, as soon as reasonably practicable, give written notice to:

• the Principal Officer of each agency to which the handling of the PID is allocated (including where relevant, NHMRC)
• the Ombudsman – if the PID was allocated to an agency other than the Ombudsman, IGIS, an intelligence agency, or ACIC or the AFP in relation to their intelligence functions)
• the IGIS – if the PID was allocated to an intelligence agency or the AIC or AFP in relation to their intelligence functions.

The notice must inform of:

• the allocation to the agency
• the information that was disclosed
• the conduct disclosed, and
• the discloser's name and contact details, if they are known to the Authorised Officer and the discloser consented for their name and contact details to be provided.

A form for notifying the Ombudsman of an allocation is available.

Where the contact details of the discloser are known, and as soon as reasonably practicable after the allocation has occurred (usually within 14 days), provide the discloser with a copy of the notice given to the Ombudsman about the allocation.

5.3.5 Make a record of the allocation decision

When an Authorised Officer allocates the handling of a disclosure to one or more agencies, they must keep an appropriate written record of the:

• decision (including the name of each agency to which the disclosure is to be allocated),
• reasons for the decision, and
• consent provided by the Authorised Officer of the agency to which the allocation is made.

The Authorised Officer must also retain a written record of:

• whether the discloser was informed of the decision to allocate or not allocate the disclosure;
• if not informed, the reasons why;
• the date, time, and method of notification; and
• in the case of a stop action direction under the NACC Act, whether it was reasonably practicable or appropriate to notify the discloser.

These records should be kept confidential.

For further information, see section 9 of the Public Interest Disclosure Standards Determination 2025.

5.4 Step 4: Investigating a PID

The Principal Officer of an agency (at NHMRC, this is the NHMRC CEO) must investigate the PID unless there are grounds for deciding not to investigate.

This process, including any investigation, should be completed within 90 days. Where it is expected that investigation may take longer than this, an application for an extension must be sought from the Ombudsman or, if relevant, the IGIS.

A form for seeking an extension of time from the Ombudsman to investigate a PID is available.

If the period is extended, the Principal Officer must, as soon as reasonably practicable after the extension, inform the discloser of the progress of the investigation.

5.4.1 Consider whether to investigate the disclosure

If a PID is allocated to NHMRC, the Principal Officer will consider whether to investigate the PID.

The Principal Officer may decide not to investigate a disclosure if they consider that:

• the discloser is not, and has not been a public official
• the information does not concern serious disclosable conduct
• the PID is frivolous or vexatious
• the information is the same or substantially the same as information previously disclosed under the PID Act and a decision had been previously made under s48 of the PID Act not to investigate or further investigate the disclosure, or the earlier disclosure has been, or is being, investigated as a disclosure investigation
• the conduct disclosed or substantially the same conduct, is being investigated under another law or power and the Principal Officer is satisfied on reasonable grounds that it would be inappropriate to conduct a PID investigation at the same time
• the conduct disclosed, or substantially the same conduct, has been investigated under another law or power, and the Principal Officer is reasonably satisfied that there are no further matters concerning the conduct that warrant investigation
• the Principal Officer is satisfied, on reasonable grounds, that the conduct disclosed would be more appropriately investigated under another law or power (unless this view is reached because the conduct disclosed raises a corruption issue)
• the discloser, an Authorised Officer of the agency, or a Principal Officer or Authorised Officer of another agency has informed the Principal Officer of NHMRC that the discloser does not wish investigation of the internal disclosure to be pursued, and the Principal Officer of NHMRC is satisfied on reasonable grounds that there are no matters concerning the disclosure that warrant investigation, or
• it is impracticable for the PID to be investigated:
  • because the discloser's name and contact details have not been disclosed
  • because the discloser refuses or fails, or is unable, to give, for the purposes of the investigation, such information or assistance as the person conducting the investigation asks the discloser to give, or
  • because of the age of the information.

If the above circumstances do not apply, the Principal Officer will conduct an investigation.

5.4.2 Notify the discloser and Ombudsman

No, do not investigate under PID Act

If the Principal Officer decides not to investigate a disclosure, they must as soon as reasonably practicable:

• inform the discloser (if reasonably practicable to contact the discloser), that the Principal Officer has decided not to investigate the disclosure, identifying:
  • the reasons for the decision not to investigate (other than those reasons that would cause the document to be exempt for the purposes of Part IV of the Freedom of Information Act 1982 (FOI Act), have or be required to have a national security or other protective security classification, or contain intelligence information), and
  • if the Principal Officer decides to take action to refer the conduct disclosed for investigation under another law or power—details of the following:
    • the other law or power
    • the agency or other person or body to which the conduct has been, or is to be, referred, and
    • the steps taken, or proposed to be taken, for the conduct to be referred or to facilitate its referral, and
• inform the Ombudsman of the decision not to investigate and the reasons for that decision.

A form for informing the Ombudsman of the decision not to investigate is available from the Ombudsman.

5.4.3 If the disclosure cannot be investigated because of a stop action direction

If the disclosure cannot be investigated (or cannot be investigated further) because of a stop action direction under the NACC Act, the Principal Officer must give written notice of the stop action direction to the discloser and the Ombudsman as soon as reasonably practicable.

The Principal Officer must, as soon as reasonable practicable, inform the discloser if the Principal Officer investigates, or further investigates, a disclosure that is no longer the subject of a stop action direction under the NACC Act.

5.4.4 Yes, investigate

If the Principal Officer decides to investigate the disclosure, they will, as soon as reasonably practicable, inform the discloser:

• that they are required to investigate the disclosure
• the estimated length of the investigation, and
• that the discretion to cease investigating (in s48 of the PID Act) remains available.

5.4.5 Conduct an investigation

The Principal Officer must investigate whether there are one or more instances of disclosable conduct. Instances of disclosable conduct may relate to information that is disclosed or information obtained in the course of the investigation, unless the Principal Officer is satisfied on reasonable grounds that such information is tangential or remote to the disclosure.

The Principal Officer may conduct an investigation into a disclosure in any manner they see fit. They may investigate the matter personally, or may refer the matter to an investigator to assist in determining whether there are one or more instances of disclosable conduct.

Despite that a Principal Officer may conduct the investigation as they see fit, investigations must be conducted in a manner consistent with the Public Interest Disclosure Standards Determination 2025 and the principles set out below.

The following principles apply to the conduct of investigations:

• maintain the confidentiality of the discloser's identity unless consent to disclose their identity has been provided
• keep documentation of actions, conversations and decisions relating to a disclosure
• a decision about whether evidence is sufficient to prove a fact will be determined on the balance of probabilities
• a finding of fact will be based on logically probative evidence
• the evidence relied on in an investigation must be relevant to the investigation
• the investigation will be conducted in accordance with the principles of procedural fairness
• a person who is the subject of the investigation will have an opportunity to respond or provide information, and
• if an interview is to be conducted as part of the investigation:
  • it is to comply with the requirements set out in the Public Interest Disclosure Standards Determination 2025 including:
    • informing the interviewee of the identity and function of the interviewer/s
    • informing the interviewee of the process of conducting an investigation
    • informing the interviewee about the Principal Officer's authority and role in the investigation under the PID Act
    • informing the interviewee about the protections in Part 2 of the PID Act
    • ensuring no audio or visual recording of the interview is made without the interviewee's knowledge
    • providing the interviewee with a final opportunity to make a statement at the conclusion of an interview
    • ensuring any such final statement made by an interviewee is included in the record of the interview, and
  • the person being interviewed is to be offered the opportunity to bring a support person with them to the interview.

Despite this, the Principal Officer must act in accordance with any rules relating to fraud that are made for the purposes of the PGPA Act, to the extent that:

• the investigation relates to one or more instances of fraud, and
• those rules are not inconsistent with the PID Act (apart from the requirements above about the conduct of investigations (see section 53 (1) and (2) of the PID Act).

In conducting the investigation, the Principal Officer may adopt findings set out in reports of investigations or inquiries under other Commonwealth laws or executive powers, or other investigations under the PID Act.

5.4.6 Obtaining information

Instances of disclosable conduct may relate to information that is disclosed or information obtained during the investigation rather than information provided in the initial disclosure.

During an investigation, the Principal Officer or investigator may, for the purposes of the investigation, obtain information from such persons and make such inquiries as the Principal Officer or investigator sees fit.

Public officials are required to use their best endeavours to assist the Principal Officer, Ombudsman or the IGIS in the conduct of an investigation under the PID Act.

5.4.7 Referral of information to police and others

If, during an investigation into a PID, the Principal Officer suspects on reasonable grounds that some or all of the information disclosed or obtained during the investigation is evidence of an offence against a law of the Commonwealth, a State or a Territory, the Principal Officer has the following notification obligations:

• if the offence is punishable by a period of imprisonment of at least two years, they must notify a member of the appropriate police force responsible for investigating the offence unless the investigator suspects on reasonable grounds that the relevant information raises a corruption issue and the corruption issue has already been referred to the NACC or IGIS (as relevant) or that agency is already aware of the issue, or
• if the offence is punishable by a period of imprisonment of less than two years, the Principal Officer may notify a member of the appropriate police force.

However, the Principal Officer's power to notify police is not limited by the PID Act.

5.5 Step 5: Finalising the investigation and taking action

5.5.1 Prepare an investigation report

Once the Principal Officer has completed the investigation, they will prepare a report of the investigation.

The Principal Officer must complete the investigation report within 90 days after the disclosure was allocated to NHMRC, unless this period is extended by the Ombudsman.

Content of report

The report must set out:

• the matters considered in the course of the investigation
• the duration of the investigation
• the Principal Officer’s findings (if any)
• the action (if any) that has been, is being or is recommended to be taken
• any claims made about and any evidence of detrimental action taken against the discloser, or any other person, and the agency's response to those claims and that evidence, and

to the extent relevant:

• identify whether there have been one or more instances of disclosable conduct, and
• identify any regulations, rules, administrative requirements or similar matters to which the disclosable conduct relates, and
• explain the steps taken to gather evidence, and
• set out a summary of the evidence, as well as any findings and recommendations made based on that evidence.

5.5.2 Provide report to the discloser and the Ombudsman

Within a reasonable time after completing an investigation, the Principal Officer must give a copy of the report to the discloser and the Ombudsman.

The Principal Officer may delete from the copy of the report given to the discloser any material:

• that is likely to enable the identification of the discloser or another person, or
• would be exempt for the purposes of Part IV of the FOI Act, would require a national security or other protective security clearance, contains intelligence information or contravenes a designated publication restriction as defined in the PID Act.

The Principal Officer may delete from a copy of the report given to the Ombudsman any material:

• that is likely to enable the identification of the discloser or another person, or
• contravenes a designated publication restriction as defined in the PID Act.

If an investigation report contains recommendations, the Principal Officer should ensure that they provide the recommendations to a person within the agency who would be able to consider and address those recommendations.

The form for reporting to the Ombudsman about a finalised PID investigation is available.

6. Rights and support

NHMRC is committed to protecting public officials from detriment related to disclosures made under the PID Act. This protection extends to disclosers, subjects and people involved as witnesses in public interest disclosure investigations.

6.1 Rights of a discloser

A discloser has a right to the protections set out in the PID Act, unless the disclosure does not fall within the PID Act. These protections include:

• protection from the unauthorised disclosure of their identity (confidentiality)
• protection from reprisal, and
• immunity from liability.

6.1.1 Confidentiality

Disclosures should be assessed and investigated discreetly, and in a way that maintains the confidentiality of the discloser and any subjects of a disclosure unless they have given consent for particular information to be disclosed. The PID Act contains offence provisions that apply to the disclosure or use of information that does, or could, identify a discloser.

Accordingly, the Authorised Officer and the Principal Officer will take all reasonable steps to protect the identity of a public official who has made a PID (the discloser).

6.1.2 Protection from reprisal

A reprisal occurs if someone causes, by act or omission, any detriment to another person because they believe or suspect that the person has made, may have made, proposes to make, or could make a public interest disclosure. Reprisal also includes a threat to take reprisal action. Reprisal does not include administrative action that is reasonable to protect the other person from detriment.

The Authorised Officer and Principal Officer will take reasonable steps to protect the discloser from reprisal. The taking of reprisal action against a discloser is an offence under the PID Act and can lead to imprisonment or the imposition of penalties. If a discloser believes they are suffering or have been threatened with reprisal, they may apply to Court for an injunction, or for compensation for loss, damage or injury suffered from a reprisal.

As soon as practicable after receiving a disclosure, the Authorised Officer must assess the risk that reprisals will be taken in relation to a disclosure. Authorised officers should assess the risk of reprisal for the discloser, and any other person (including witnesses and staff) who might be suspected of making a disclosure (see section 5.3.1 and Appendix A).

6.1.3 Immunity from liability

The PID Act provides protection from civil, criminal and administration liability for making a public interest disclosure. This does not protect the discloser from the consequences of their own wrongdoing, including where they have been involved in the misconduct that they are reporting.

6.2 Support for disclosers and witnesses

NHMRC will take reasonable steps to support public officials who make disclosures, and persons who provide assistance in relation to disclosures, consistent with section 11 of the Public Interest Disclosure Standards Determination 2025 and Part 2 of the PID Act.

As outlined above, when an Authorised Officer receives a PID they will conduct a risk assessment in relation to any person (including witnesses and staff) who might be suspected of making a disclosure (see Appendix A). Regardless of the outcome of the risk assessment, the supervisor and Authorised Officer must take all reasonable steps to protect public officials who have made a disclosure from detriment, or threats of detriment relating to the disclosure.

Support offered by NHMRC may also include taking one or more of the following actions:

• appointing a support person, who is responsible for regularly checking on the person’s well-being
• if they are current employees, advising the discloser or witness of the availability of the Employee Assistance Program (EAP)
• if they are current employees and there are any concerns about the health and wellbeing of the discloser or witness, liaising with NHMRC’s work health and safety team on support options (actions taken may include transfer to a different area within the workplace, if there is a perceived risk of reprisal)
• informing the discloser of the progress of the investigation.

6.3 Support for subjects of a disclosure

The Authorised Officer will also take steps to support any employee who is the subject of a disclosure. This may include taking one or more of the following actions:

• advising the employee of their rights and obligations under the PID Act and about NHMRC’s investigation procedures, including the right to procedural fairness, and of the progress of an investigation
• advising the employee of the availability of the EAP
• ensuring that the identity of public officials is kept confidential as far as reasonably practicable
• where there are any concerns about the health and well-being of the employee, liaising with NHMRC’s work health and safety team
• transferring the employee to a different area within the workplace
• advising the employee that it is open to them to seek their own independent legal advice in relation to their rights and responsibilities under the PID Act.

7. Recordkeeping

All persons involved in a public interest disclosure process must keep accurate records in accordance with the PID Act and these procedures.

Details about how and when a PID was made must be recorded and kept in a secure place by the person receiving the disclosure. If the disclosure was made orally, it should be documented by the receiving officer. A copy of all records, file notes or information provided as part of the disclosure must be retained on the file.

Documents associated with a PID do not attract any special exemption from the operation of the FOI Act. Requests for access to documents under the FOI Act must be considered on a case by case basis by an officer authorised under the FOI Act. Any such officer must be aware of the confidentiality and secrecy provisions of the PID Act as they may apply to any FOI request under consideration.

Records must be maintained in a manner that enables NHMRC to comply with reporting obligations under sections 76 and 76A of the PID Act and Part 5 of the Public Interest Disclosure Standards Determination 2025.

8. Responsibilities

8.1 NHMRC employees

Employees are responsible for:

• being aware of the PID Act and these procedures
• undertaking public interest disclosure training as required by NHMRC
• reporting matters where there is evidence that shows or tends to show disclosable conduct
• identifying areas where there may be opportunities for wrongdoing to occur because of inadequate systems or procedures, and proactively raising those with management
• maintaining confidentiality whenever they are aware of the identity of:
  • a discloser
  • anyone against whom an allegation has been made, or
  • anyone who has contributed to a disclosure investigation
• supporting staff known to have made PIDs, and
• reporting to an appropriate person (a supervisor or Authorised Officer) any threats or reprisal action in relation to a disclosure.

All public officials must use their best endeavours:

• to assist the Principal Officer of an agency in the conduct of an investigation
• to assist the Ombudsman in the performance of the Ombudsman’s functions under the PID Act
• to assist the IGIS in the performance of the IGIS’s functions under the PID Act, and
• to assist any other public official to exercise a right, or perform a duty or function, under the PID Act.

8.2 Disclosers

Disclosers are responsible for:

• complying with the PID Act and these procedures when making a PID
• using their best endeavours to assist the Principal Officer and/or Authorised Officer in the conduct of an investigation
• using their best endeavours to assist the Ombudsman or the Inspector-General in the performance of their functions under the PID Act
• reporting to the Authorised Officer any detriment or reprisal the discloser believes they have been subjected to as a result of making the disclosure, and
• cooperating with actions proposed by the Authorised Officer to protect the discloser from reprisals, or the threat of reprisals, or address work health and safety risks.

8.3 Supervisors

Supervisors are responsible for:

• familiarising themselves with the framework of the PID Act and its application, as well as these procedures
• being careful to observe confidentiality requirements
• knowing who NHMRC’s Authorised Officers are, and
• being approachable to staff who may wish to make a disclosure to them.

The specific responsibilities of supervisors upon receiving a public interest disclosure are set out in 5.1.1 above.

8.4 Authorised Officers

Authorised Officers are responsible for:

• providing advice to public officials about the PID process, including how to make a PID, how the protections and immunities apply, and the reprisal risk assessment process
• assessing all allegations of wrongdoing under the PID Act and deciding if they constitute a PID
• obtaining consent to disclose the public official's name and contact details for the purpose of handling the PID and adhering to the PID Act confidentiality and identity protection requirements
• advising the individual about the circumstance (if any), in which a disclosure must be referred
• identifying and addressing any possible conflict of interests that may affect the handling of the PID
• taking reasonable steps to protect public officials who belong to an agency against reprisals that have been, or may be, taken in relation to a PID that has been made, may have been made, are proposed to be made, or could be made to the officer
• allocating the PID to the Principal Officer or an appropriately delegated PID investigator
• notifying the public official, the Ombudsman and the Principal Officer if the matter is a PID and of the allocation decision
• notifying the NACC if, during the course of performing their duties, they become aware of corrupt conduct that is serious or systemic, and
• making appropriate records of their decision making.

8.5 Investigators

Investigators are responsible for:

• promptly informing the discloser that their PID is being investigated and the estimated length of the investigation, and explaining the investigation powers and discretions to not investigate under the PID Act
• identifying and addressing any possible conflict of interests
• investigating and making enquiries as they see fit in relation to the disclosable conduct
• notifying the NACC if, during the course of performing their duties, they become aware of corrupt conduct that is serious or systematic
• ensuring their investigation complies with the PID Act and the PID Standards
• complying with the Commonwealth Fraud Control Policy and Australian Government Investigation Standards if investigating allegations of fraud in non-corporate Commonwealth entities
• ensuring procedural fairness is observed
• adhering to the PID Act confidentiality and identity protection requirements
• alerting the responsible officers if they become aware of any reprisal risks
• communicating with the discloser about the investigation process and keeping them informed of progress, particularly if there are delays
• complying with the time frame of 90 days to complete a PID investigation (or seeking an extension of time from the Ombudsman or the IGIS if required)
• preparing a written report on the outcome of the investigation
• preparing a copy of the report for the discloser - considering whether deletions are appropriate
• providing a copy of the report to the discloser - within a reasonable period after the investigation was finalised
• facilitating provision of a copy of the report and notification that the investigation is finalised to the Ombudsman (or the IGIS), and
• ensuring appropriate records are made throughout the investigation process and that they are appropriately classified and stored so that only officers that are authorised either by the PID Act or another law of the Commonwealth can access the PID information.

NHMRC must retain appropriate written records of:

• decisions to investigate a disclosure
• decisions not to investigate under section 48 of the PID Act
• decisions to cease investigating
• any referral under section 50AA of the PID Act, and
• when and how the discloser was notified of such decisions.

For further information, see section 10 of the Public Interest Disclosure Standards Determination 2025.

8.6 Principal Officer

The Principal Officer is responsible for:

• establishing procedures to facilitate and deal with PIDs
• providing training and education to staff and Authorised Officers and supervisors
• encouraging and supporting staff who make, or are considering making, a disclosure, as well as those who are assisting in relation to a disclosure
• appointing the appropriate number of Authorised Officers to receive disclosures
• delegating powers to investigators for PID investigations
• ensuring disclosures are properly investigated
• protecting disclosers and public officials of the agency from reprisals from making a disclosure
• taking appropriate action in response to an investigation report, and
• providing the required information to the Ombudsman or IGIS to enable reporting on the number and kinds of PID received by Authorised Officers of NHMRC during each financial year.

9. Further Information

NHMRC’s Authorised Officers are listed on Public Interest Disclosure.

You may contact NHMRC about this procedure by emailing publicinterestdisclosure@nhmrc.gov.au

Further information about public interest disclosures is available on the Commonwealth Ombudsman’s website.

10. Version control

This version: April 2026

Previous versions: 2017 – initial version

Appendix A – Risk assessment

The below steps are to be undertaken when conducting a risk assessment:

Identifying the risks

The risk factors relating to a particular disclosure should be identified, taking into account individual and organisation circumstances.

Risks considerations could include, but are not limited to, any threats or past experience that may impact this process, the likelihood that confidentiality may not be maintained, the seriousness of the reported wrongdoing, and the vulnerability of the discloser.

Assessing and analysing the risks

The person conducting the risk assessment should consider the likelihood and consequence of reprisal or related workplace conflict occurring.

In considering consequence, it is important to consider the discloser’s immediate and long term wellbeing as well as any cost to NHMRC.

Controlling the risks

For risks assessed as high, NHMRC must plan to prevent and contain reprisals and related workplace conflict. Any decision affecting the discloser should be made in conjunction with them and should be reasonable and appropriate in all circumstances.

Monitoring and reviewing the risks

Issues and concerns in the workplace can arise at any point after a disclosure has been made, including during an investigation. The risk assessment should be monitored and reviewed regularly, and as necessary, including checking with the discloser to see if reprisals have occurred or been threatened.

Criteria for assessing likelihood of reprisal

When considering the likelihood of a reprisal being taken against a discloser, the CEO should take into account all relevant factors, including to the extent relevant:

• the likelihood of the discloser being identified, which may involve a consideration of:
  • the size of the work area in which the discloser is located, and
  • the number of people who are aware of the information leading to the disclosure
• the number of people implicated in disclosure
• the subject matter of the disclosure
• the number of people who are aware of the disclosure or are likely to become aware of the disclosure (for example, through participation in the investigation as witnesses)
• the culture of the workplace
• whether any specific threats against the discloser have been received
• whether there are circumstances that will make it difficult for the discloser not to discuss the disclosure in the workplace
• whether there are allegations about individuals in the disclosure
• whether there is a history of conflict between the discloser and the subject of the disclosure, and
• whether the disclosure can be investigated while maintaining confidentiality.

Criteria for assessing likely seriousness

In considering the likely seriousness of any potential reprisal against a discloser, the CEO should take into account all relevant factors, including, to the extent relevant:

• the significance of the issue being disclosed
• the likely outcome if the conduct disclosed is substantiated
• the subject matter of the disclosure
• whether the discloser is isolated
• whether the discloser is employed on a full-time, part-time or casual basis
• whether the alleged wrongdoing that is the subject of the disclosure was directed at the discloser, and
• the relative positions of the discloser and the person whose alleged wrongdoing is the subject of the disclosure.

Risk assessment matrix

In assessing the risk of reprisals, the CEO should use the following risk matrix:

Minor: Occasional or one-off action that is likely to have a relatively minor adverse effect on the person (for example, occasional exclusion of the person from a social activity).

Moderate: Repeated action which is likely to have an adverse effect on the person (for example, routinely failing to "CC" the person on work-related emails).

Major: Sustained or one-off action which has a significant impact on the person (for example, consistently excluding the person from team discussions or imposing a negative performance assessment on the person).

Extreme: Action which is likely to have a very severe impact on the person (for example, physical violence or the denial of a promotion opportunity).

Text alternative for Risk assessment matrix

The risk assessment matrix shows the relationship between Likely seriousness of reprisal and Likelihood of reprisal being taken against a discloser, and the resulting risk level.

If likely seriousness is minor:

• and likelihood is almost certain or likely, risk is medium (orange).
• and likelihood is unlikely or highly unlikely, risk is low (yellow).

If likely seriousness is moderate:

• and likelihood is almost certain, risk is high (red).
• and likelihood is likely, risk is medium (orange).
• and likelihood is unlikely or highly unlikely, risk is low (yellow).

If likely seriousness is major:

• and likelihood is almost certain or likely, risk is high (red).
• and likelihood is unlikely, risk is medium (orange).
• and likelihood is highly unlikely, risk is low (yellow).

If likely seriousness is extreme:

• and likelihood is almost certain or likely, risk is high (red).
• and likelihood is unlikely or highly unlikely, risk is medium (orange).