Incident Reporting, Investigation, Escalation and Corrective Action Procedure

1. What must be reported

• Work-related injury or illness, however minor, including psychological injury.
• Near misses: events that could have caused injury, illness or damage.
• Hazards and unsafe conditions, at a client site or a home workspace.
• Bullying, harassment, sexual harassment, discrimination or other disrespectful conduct.
• Suspected fraud, bribery, corruption or a conflict of interest that has not been declared.
• Security incidents: loss of a device or document, unauthorised access, mishandling of classified or official information, or a breach of client security rules.
• Privacy incidents: unauthorised access to, disclosure of, or loss of personal information.
• Any direction from a client that a worker believes is unsafe or unlawful.

2. How to report

1. If anyone is in danger, call 000 and follow the site emergency procedure first.
2. Report to Axiom Data as soon as practicable and in any case within 24 hours: by phone to the Director, by email to [email protected] with "INCIDENT" in the subject line, or using the incident report form on the Employee Resources page. Anonymous reports are accepted.
3. If the incident occurred at a client site, also report it to the client's nominated manager and through the client's own incident system, and tell Axiom Data that you have done so.
4. Preserve evidence: do not disturb the scene of a serious incident, and keep emails, screenshots or documents that relate to the matter.

A report should state what happened, when and where, who was involved or witnessed it, what injury, damage or exposure occurred, what was done immediately, and what the reporter thinks could prevent a recurrence.

3. Classification and escalation

4. Investigation

1. The Director appoints an investigator who was not involved in the incident. If the Director is involved, the company's external adviser appoints one.
2. The investigator gathers facts: statements from those involved and witnesses, documents, system logs, site conditions and client reports.
3. Causes are analysed, looking past the immediate cause to the underlying failures in process, training, supervision, equipment or culture.
4. Findings and recommended corrective actions are documented in an investigation report, proportionate to the seriousness of the matter.
5. For conduct matters, the person complained about is told the substance of the allegation, given a fair opportunity to respond, and may have a support person present. Confidentiality is maintained to the extent possible.
6. The reporter is told the outcome, to the extent that is appropriate.

Investigations into critical matters are completed within 20 business days unless the Director records a reason for extension; major matters within 10 business days; minor matters within five.

5. Corrective and preventive action

Every investigation produces at least one corrective action, assigned to a named person with a due date and recorded on the corrective action register. Actions follow the hierarchy of controls where the matter is a safety hazard. The Director reviews the register monthly; an action is closed only when the Director has verified it was done and was effective. Patterns across incidents are reviewed at the annual WHS review and feed into the risk register and this policy pack.

6. Records

Incident reports, investigation reports, regulator and client notifications, and the corrective action register are kept for at least five years, or longer where a workers' compensation claim, legal matter or client contract requires it. Records involving personal or health information are stored securely with access limited to those who need it.

7. No reprisal

No one will be disadvantaged for reporting an incident, hazard or concern in good faith, or for taking part in an investigation. Reprisal is a breach of the Code of Conduct and will be dealt with as such.

8. Review

This policy is owned by the Director and is reviewed at least annually, and sooner if legislation, a client requirement or an incident shows the need. The current version, effective date and next review date are recorded in the policy register on the Employee Resources page.