From Crisis to Culture: Why an Investigation is Just One Element of the Safeguarding Cycle

From Crisis to Culture: Why an Investigation is Just One Element of the Safeguarding Cycle

An investigation can answer important questions: What happened? Who was involved? What evidence supports the allegations? Were policies or professional standards breached

But for organisations working with children and vulnerable people, there is another question that can be just as important: What needs to change so that the same situation is less likely to occur again?

An investigation should not simply result in findings being made and a closed file. It can also provide an opportunity to identify weaknesses in organisational systems, leadership, policies, culture and safeguarding practices, and an opportunity to take steps to strengthen safeguarding structures and prevent future harm to children and young people.

This is particularly important in Australia, where child safety frameworks increasingly focus on organisational culture, governance, prevention and continuous improvement. The National Principles for Child Safe Organisations state that child safety and wellbeing should be embedded in organisational leadership, governance and culture, and that implementation should be regularly reviewed and improved.

For organisations, the challenge is therefore to move from crisis to learning, and from learning to sustainable organisational change.

Why the Conclusion of an Investigation Is Not the Conclusion of Safeguarding

When an investigation concludes, organisations may understandably focus on the immediate outcome.

A finding may lead to disciplinary action, termination, changes to a worker’s responsibilities, additional supervision or other consequences.

These actions may be necessary. However, they do not always address the underlying conditions that allowed the incident to occur.

For example, an investigation may find that a worker breached professional boundaries with a child. The organisation may take appropriate action against that worker. But what if:

• The organisation’s Code of Conduct did not clearly define the relevant boundaries?
• Staff had received little or no training?
• Managers had previously observed concerning behaviour but did not intervene?
• Workers were unclear about how to report concerns?
• Complaints were not being escalated appropriately?
• Supervision arrangements were inadequate?
• Organisational culture discouraged staff from speaking up?

In that situation, removing or disciplining one worker may address the immediate issue without addressing the underlying organisational risk. The investigation has therefore identified more than an individual problem. It has potentially identified a systemic problem.

What Investigations Can Reveal About Organisational Systems

Investigations are primarily designed to establish facts and determine the evidence in relation to the allegations. However, the evidence gathered during an investigation can also provide valuable information about how an organisation operates.

Patterns may emerge around:

• recruitment and screening;
• induction and training;
• supervision;
• professional boundaries;
• complaint handling;
• reporting and escalation;
• management oversight;
• record keeping;
• risk management;
• communication;
• policies and procedures; and
• organisational culture.

This is particularly relevant under Australia’s child-safe framework. The National Principles provide a nationally consistent approach to promoting child safety and wellbeing within organisations. They recognise that child safety involves not just policies, but leadership, culture, participation, complaints, training, safe environments and ongoing review.

An investigation can therefore act as a diagnostic tool. It can show an organisation where its systems worked, where they failed and where there may be a gap between what the organisation’s policies say and how they are implemented in practice.

From Individual Misconduct to Systemic Risk

One of the most important steps after an investigation is distinguishing between individual accountability and organisational accountability.

An individual may have engaged in inappropriate conduct. That does not automatically mean that the organisation caused that conduct. However, organisations should still ask whether their
systems and processes were adequate to identify, mitigate and respond to the conduct and consequent harm. 

Consider the following example:

A worker sends inappropriate private messages to a young person.

The investigation establishes that the worker breached the organisation’s Code of Conduct. 

The immediate response may be disciplinary action.

But a broader review could ask: Why was private communication possible?

Perhaps the organisation had no clear social media policy. Perhaps managers were unaware of the communication. Perhaps staff had never been trained about digital boundaries. Perhaps young people did not know who they could report concerns to.

The investigation has now highlighted potential systemic risks.

This distinction is important because focusing exclusively on the individual can create a false sense of resolution. The worker may be removed, but the same risks may remain. 

The Role of Root Cause Analysis

This is where root cause analysis can become particularly valuable.

Root cause analysis goes beyond asking: “What happened?” It asks: “Why did it happen, and what conditions allowed it to happen?”

For example:

Incident:

A worker repeatedly communicated privately with a child outside approved channels.

Immediate cause:

The worker breached the organisation’s communication policies.

Contributing factors:

Staff were unclear about acceptable communication practices and managers did not consistently monitor compliance.

Systemic issue:

The organisation’s policies, training and supervision arrangements did not adequately manage the risk.

Potential corrective action:

Review communication policies, provide targeted training, clarify supervisory responsibilities and establish monitoring mechanisms.

This approach helps organisations avoid treating every incident as an isolated event.

It also aligns with the broader emphasis on continuous improvement within the National Principles. Principle 9 specifically calls for implementation to be regularly reviewed and improved, rather than waiting for another incident to occur before identifying and mitigating risk.

Turning Investigation Recommendations into Action

An investigation can result in recommendations for the organisation to address systemic risk, but recommendations only have value if they are actually implemented.

Organisations should therefore develop a structured post-investigation action plan. For each recommendation, organisations should consider:

• What exactly needs to change?
• Who is responsible?
• What resources are required?
• What is the deadline?
• What evidence will demonstrate completion?
• How will effectiveness be measured?
• Who will report progress to leadership or the board?

The important point is that “recommendation implemented” is not necessarily the same as “risk addressed”. An organisation may update a policy but still have poor compliance. It may provide training but fail to change behaviour. It may create a new reporting pathway that staff do not actually use. Implementation therefore needs to be followed by review and evaluation.

The National Office for Child Safety’s self-assessment tool similarly encourages organisations to identify priority areas and commit to concrete actions to improve child-safe practices.

Changing Policies, Practices and Behaviours

Real organisational change generally requires more than changing a document. A useful way of thinking about this is: Policy > Practice > Behaviour

Policy

Does the organisation clearly explain what is expected?

Practice

Are managers and staff actually applying those requirements?

Behaviour

Are people consistently behaving in ways that reflect the organisation’s safeguarding expectations?

For example, an organisation might have a policy prohibiting inappropriate one-to-one communication between workers and children. But if staff continue to use personal messaging applications, managers ignore the practice and concerns are not reported, the organisation has a policy-practice gap.

Closing that gap may require

• clearer policies;
• practical training;
• stronger supervision;
• leadership accountability;
• better reporting mechanisms;
• regular audits; and
• consequences for non-compliance.

The goal is not simply to have the right words in a policy. The goal is to implement the expected behaviour into organisational practice.

Embedding Change into Organisational Culture

Culture is often the hardest part of organisational change. An organisation can introduce new policies, deliver training and establish new procedures but that does not automatically result in changes to the underlying culture.

A genuinely child safe culture requires leaders, workers and volunteers to understand that safeguarding is everyone’s responsibility. It should be reflected in everyday decisions.

For example:

• Do managers take concerns seriously?
• Are staff comfortable speaking up?
• Are complaints treated as opportunities to improve?
• Are children and young people listened to?
• Are safeguarding considerations included in decision-making?
• Are leaders held accountable for failures?
• Are inappropriate behaviours addressed even when the person involved is senior, popular or highly valued?

The National Principles place child safety directly within organisational leadership, governance and culture. This means cultural change cannot simply be delegated to a child safety officer or HR department. Leadership must champion it.

How Leaders and Boards Should Monitor Implementation

Senior leaders and boards have an important role after an investigation. They should have sufficient oversight to understand whether identified organisational risks are being addressed.

This may involve regularly reviewing:

• investigation recommendations;
• action plans;
• outstanding corrective actions;
• safeguarding risks;
• complaint trends;
• incident data;
• training completion;
• policy reviews;
• audit results;
• staff feedback; and
• evidence of cultural change.

A board should be satisfied that the child safety incident has been adequately addressed and that the child safety risks have been sufficiently identified and mitigated.

How Can Safe Space Legal Help?

At Safe Space Legal, we work across the full cycle of safeguarding. Our motto is prevent, comply, respond.

An investigation is often only one part of a broader safeguarding response. Once an investigation has concluded, organisations have an opportunity to conduct a root cause analysis and put strategies in place to prevent future harm occurring. This can mean reviewing policies, systems, governance and culture.

Safe Space Legal has extensive experience working with organisations to strengthen their safeguarding systems. Safe Space Legal provides the following services to ensure organisations meet their legal obligations:

• Drafting legally sound policies, procedures, and codes of conduct;
• Providing policy audits and developing safeguarding policies, procedures, and complaint handing processes;
• Providing root cause analysis to identify gaps in policy and/or practice which put organisations at risk of non-compliance with their sector-specific obligations;
• Conducting safeguarding investigations which are compliant with relevant state and territory legislation and regulations;
• Delivering tailored safeguarding training to ensure organisations are aware of their sector-specific requirements and obligations;
• Ensuring that complaints handling and reporting processes are compliant with legal obligations;
• Provide sound legal advice on risk mitigation.

Contact office@safespacelegal.com.au or call (03) 9124 7321 to organise a complementary discussion in relation to your organisation’s child safety and safeguarding needs.