Corporate criminal liability: a guide for boards and senior management

What kind of individual wrongdoing could cause a corporation to be held criminally liable? 6 min read

Australia continues to strengthen and modernise its corporate criminal laws. The impact of a criminal conviction can be severe, with the potential for financial penalties, operational sanctions and considerable damage to a company’s reputation. Below, we explore corporate criminal liability in Australia, to help corporations understand and manage their risk.

For international businesses, being aware of current global trends and corporate criminal liability in different jurisdictions is key to managing corporate risk. For a comparative review of corporate criminal liability across 21 other jurisdictions, see Linklaters' Corporate Criminal Liability guide.

Can companies be criminally liable for wrongdoing?

Criminal liability of corporate legal persons has been recognised in Australia for over a century. Principles governing corporate criminal liability mainly derive from the common law, as well as a range of statutes, as explained below.

For what kind of wrongdoing can a company be held criminally liable?

A company may be subject to criminal liability for any offence unless the definition or subject matter of the offence indicates the contrary. For example, a body corporate may be found guilty of any offence in Australia’s federal Criminal Code (the Code), including one punishable by imprisonment. In relation to white-collar crime, notable criminal offences that companies can be held criminally liable for include bribery of foreign public officials, bribery of a Commonwealth public official, money laundering, contravening sanctions laws and false accounting offences. Other areas in which criminal liability can arise include under environmental protection laws, occupational health and safety laws, competition laws and corporations laws.

Criminal liability usually only results where both the physical element and the fault element (such as intention, knowledge, recklessness or negligence) of the offence are satisfied. For instance, the offence of bribery of a foreign public official requires both conduct and intention. There is an exception from satisfaction of the fault element for offences of strict or absolute liability. For instance, the offence of contravening a sanctions law for a body corporate is one of strict liability so that there is no need to prove the fault element.

Under the Code, the physical element of an offence will be attributed to a body corporate where it is committed by an employee, agent or officer acting within the actual or apparent scope of his or her employment (s12.2 of the Code). The fault element of intention, knowledge or recklessness will be attributed to a company if the 'company expressly, tacitly or impliedly authorises or permits the commission of an offence' (s12.3 of the Code). A company may expressly, tacitly or impliedly authorise or permit the commission of an offence where it is proved that:

• the corporation’s board of directors intentionally or knowingly carried out the relevant conduct or expressly, tacitly or impliedly authorised or permitted the commission of the offence;
• a high managerial agent of the corporation intentionally or knowingly engaged in the relevant conduct or expressly, tacitly or impliedly authorised or permitted the commission of the offence;
• a corporate culture existed within the body corporate that directed, encouraged, tolerated or led to non-compliance with the offence provision; or
• the body corporate failed to create and maintain a corporate culture that required compliance with the relevant provision.

'Corporate culture' is defined in the Code to mean an attitude, policy, rule or practice existing in the corporation generally or in the part of the corporation where the relevant offence was committed. This notion of corporate culture underlines the value of robust policies and compliance program.

Under the Code, where it is necessary to establish the negligence of a body corporate, the conduct of any number of its employees, agents or officers can be aggregated. Negligence may be evidenced by the fact that the prohibited conduct was substantially attributable to inadequate corporate management, control or supervision of the conduct of one or more of its employees, agents or officers or a failure to provide adequate systems for conveying relevant information to the relevant persons in the body corporate.

How far does criminal liability extend?

The general principle at common law is that a corporation is 'personally' liable for the mental state and conduct of a 'directing mind' (the board of directors, managing director or another person to whom a function of the board had been fully delegated) acting on the corporation’s behalf.

In addition, where an employee or agent acting within the actual or apparent scope of his or her employment commits the physical element of the offence, a company may be held criminally liable if it had expressly, tacitly or impliedly authorised or permitted the commission of the offence. The term 'agent' is not defined. However, it may be interpreted broadly to include individuals who are held out by the company to have its authority 'to act in some way'.

Does criminal liability extend to foreign companies?

Criminal liability will extend to a foreign company under the Code in circumstances where the necessary nexus is established. Territorial jurisdiction applies in relation to most Code offences. However, extraterritorial jurisdiction applies on the basis of nationality in relation to certain enumerated offences (such as foreign bribery). As a result, for a foreign company to be subject to the Code, the conduct constituting the alleged offence, or a result of that conduct, must occur wholly or partly within Australia. A foreign company would also be subject to the Code were it found to have engaged in an ancillary offence (for instance, aiding and abetting the primary offence) where the conduct constituting the ancillary offence occurred wholly outside Australia but the conduct constituting the primary offence occurred wholly or partly within Australia (s14.1 of the Code).

Criminal liability may also extend to foreign companies operating in Australia under environmental protection laws, occupational health and safety laws, competition laws and corporations laws. This will depend on the scope of the relevant statutory provisions and the extent of the company’s operations in Australia.

Is the company legally obliged to disclose criminal offences to the competent prosecution authorities?

Although it is not an offence under the Code if the company fails to report a suspicion or knowledge of an offence, in general, if improper conduct has been identified, it is usually in the interests of the company to self-report by disclosing and then cooperating with the relevant authorities. The approach adopted by the Australian Federal Police (the AFP) and the Commonwealth Director of Public Prosecutions (the CDPP) in relation to self-reporting is considered below. Other regulators are also likely to look favourably upon a company that self-reports.

In relation to knowledge of potential future criminal conduct, the company may be found guilty of an ancillary offence such as complicity if it is shown that knowledge existed before commission of the offence. The Code provides that a person who aids, abets, counsels or procures the commission of a principal offence by another person is taken to have committed that offence (s11.2 of the Code).

Are prosecution authorities legally obliged to conduct a criminal investigation into corporate wrongdoing?

The AFP, the body responsible for investigating potential or actual criminal conduct regulated by the Code such as bribery, exercises discretion in the way in which it engages with the CDPP, the prosecuting body. Although the AFP is not legally obliged to investigate criminal wrongdoing, it is very likely to do so where sufficient evidence of criminality exists and it is in the public interest to investigate. The same applies to the Australian Securities and Investments Commission, Australia’s integrated corporate, markets, financial services and consumer credit regulator, and the Australian Competition and Consumer Commission, Australia’s competition regulator. Decisions
on whether to prosecute offences under the Code are made by the CDPP using similar criteria.

What is the position of the defendant company in criminal proceedings?

As a company is an artificial entity, there will be a number of differences between a criminal proceeding involving a natural person and one involving a body corporate. For example, a corporation cannot give, or be required to give, evidence as a witness except through its officers. Furthermore, a corporation does not have the benefit of the privilege against self-incrimination. Therefore, a corporation must comply with a lawful order or requirement to produce documents or information even though to do so might tend to incriminate the corporation. However, there is no need to convict an individual perpetrator in order to be able to prosecute the company and the criminal action against the company is usually conducted as a separate proceeding.

Is the company legally obliged to cooperate with the prosecution authorities?

There is no 'one size fits all' approach to responding to a regulatory investigation as the company must be responsive to the particular circumstances of the investigation, including:

• the nature of the allegations made by the regulator;
• the intensity of the investigations by the regulator;
• the stage at which the investigations are at; and
• any indication that court proceedings are being contemplated.

As noted above, a corporation must comply with a lawful order or requirement to produce documents or information even though to do so might tend to incriminate the corporation.

Where a company is the subject of regulator interest, it is free to cooperate with the relevant authorities on a voluntary basis. More often than not, a company gains significant legal and commercial benefits from cooperating with the investigation of a regulator.

In late 2017, the AFP and CDPP released Best Practice Guidelines on Self-reporting Foreign Bribery and Related Offending by Corporates. The Guidelines are aimed at encouraging self-reporting and cooperation by corporates and specify that self-reporting is treated as a significant public interest factor against prosecution. Also, the CDPP’s Prosecution Policy expressly takes cooperation into account when considering whether to prosecute, the charges to be laid, mode of trial and related issues. Cooperation will also minimise the risk of the AFP exercising its powers of compulsion, for instance by issuing warrants for search and seizure of evidence, which can be invasive and resource-intensive for the target company and its personnel.

What kind of sanctions can be imposed on companies?

Fines are the main form of criminal sanctions imposed on companies. For example:

• following the landmark Financial Services Royal Commission, Parliament significantly increased penalties for serious criminal offences under Australia’s corporations and consumer credit protection legislation to A$9.99million, three times the value of the benefit obtained, or if that value cannot be determined, up to 10% of annual turnover during the 12 months preceding the offence, whichever is greater (s1311C of the Corporations Act 2001 (Cth), s93E of the Australian Securities and Investments Commission Act 2001 (Cth), s288D of the National Consumer Credit Protection Act 2009 (Cth));
• for bribery of foreign public officials and Commonwealth public officials, the penalty is a fine not exceeding A$22.2million, three times the value of the benefit obtained, or if that value cannot be determined, up to 10% of annual turnover during the 12 months preceding the offence, whichever is greater (s70.2 and 141.1 of the Code); and
• for money laundering, the range of penalties that may be imposed for such an offence depends upon the relevant circumstances, the fault element standard to be applied and the value of the money or property involved. As an example, where the money being dealt with is the proceeds of crime and is worth A$1million or more, a company may be liable for a fine of up to A$333,000 (s400.3 of the Code).

Penalties under the Proceeds of Crime Act 2002 (Cth) may also apply. This Act establishes a scheme for confiscating the 'proceeds' of crime.

Moreover, serious offences may lead to a company being wound up (s461 of the Corporations Act).

Sanctions other than criminal punishment can be imposed on the company depending on the nature of the offence. For example, certain government contracting agencies have special rules in their contracting processes for companies convicted of foreign bribery. The Department of Finance has indicated that if a company were convicted of an offence relating to the foreign bribery provisions, this would be sufficient ground for an agency to consider refusing to award a public procurement contract to that company.
Other consequences include civil litigation brought by shareholders, reputational damage and investigations costs.

What is the relevance of an effective compliance system?

When considering what action to take, prosecuting authorities are very likely to take into account whether a company can prove that it has sufficient control mechanisms in place to prevent wrongdoing when considering what action to take. The impact of a robust and appropriately tailored compliance system can be significant.

For offences such as bribery, where the requisite fault element is one of intention, knowledge or recklessness, adequate compliance structures are likely to weigh against a finding that the company expressly, tacitly or impliedly authorised or permitted the commission of an offence. Conversely, inadequate compliance structures may go towards a finding that the company expressly, tacitly or impliedly authorised or permitted the commission of an offence. Further, it is a defence to offences such as contravening a sanctions law if the company can prove that it took reasonable precautions, and exercised due diligence, to avoid contravening the law (s16(7) of the Autonomous Sanctions Act 2011 (Cth)). Regulators look at substance over form when determining whether to prosecute, and the courts do the same when determining liability.

How are criminal proceedings against companies conducted in practice?

Generally, the direction of proceedings against companies is managed by the prosecuting agency at the federal or state level. It is becoming increasingly common practice for companies to negotiate outcomes with police and prosecution agencies.

Likely future scope and development?

Following the Financial Services Royal Commission, ASIC took a hard-line tone in connection with its investigation and enforcement activity and adopted a 'why not litigate?' stance, however it stepped back from this position in its 2021-2025 Corporate Plan. Legislation creating a consolidated and strengthened whistleblower protection regime for corporate misconduct in the Corporations Act, as well as a broadly equivalent taxation whistleblower protection regime in the Taxation Administration Act 1953 (Cth) was also passed by Parliament. Legislation to significantly strengthen Australia’s foreign bribery laws and to create a deferred prosecution agreement scheme for resolving corporate criminal misconduct was introduced to Parliament during the previous two terms and may be reintroduced during the next term.

In addition, the Australian Law Reform Commission (the ALRC) recently undertook a comprehensive review of the corporate criminal responsibility regime. The ALRC recommended wide-ranging reforms to the regime, including a 'clean up' of the deferral statute book embodying a more principled approach to criminalisation, the adoption of a new method of corporate criminal attribution, and the consideration of new 'failure to prevent' offences (such as prohibitions on the failure to prevent tax evasion, modern slavery, terrorism financing and other human rights offences).

While these recommendations have not been implemented by the Federal Government, we expect that Australia will continue to modernise and strengthen its corporate criminal laws and enforcement mechanisms over the short to medium term.