Blog, WHS governance, 2026

Officer due diligence in 2026:
what can you actually prove about yesterday?

Australian model work health and safety laws require officers to take reasonable steps to verify that the safety resources and processes they rely on are actually provided and used. The question is therefore bigger than whether a business has a policy, a safe work method statement or a training record. It is whether the business can demonstrate that its controls operated in practice.

Three 2026 cases are useful for understanding that gap. Gibson v Maritime New Zealand examined officer due diligence directly. SafeWork NSW v Boral Cement examined a person conducting a business or undertaking's responsibility when specialist contractors and a changed work method were involved. The Mastermyne Crinum prosecution showed the consequences of failing to manage serious safety risks in a mining operation. They are different cases, but together they offer useful lessons for any business running mobile and outdoor crews.

Published 8 September 2026Reading time 12 minutesSan Rangeon, Director, PocketMode
$7m
fine imposed on Mastermyne Crinum Operations, May 2026, plus $299,000 in costs
6
due diligence obligations on an officer under section 27
1
of those 6 is verification, and it is the one records answer
4yr 7mo
from the death at Crinum mine to the sentence

Key facts

  • Section 27 of the model Work Health and Safety Act places 6 due diligence obligations on an officer. The sixth is to take reasonable steps to verify the provision and use of the resources and processes required by the third, fourth and fifth.
  • Gibson v Maritime New Zealand [2026] NZHC 813 shows that an officer's positive safety initiatives do not necessarily establish due diligence where the officer did not take reasonable steps to verify that critical controls were actually implemented and operating effectively.
  • In SafeWork NSW v Boral Cement Limited (No 2) [2026] NSWDC 88 the court held that engaging specialist contractors did not relieve Boral of its own primary duty, and that when the work method changed it still had to ensure the changed work was reassessed and safely managed.
  • Mastermyne Crinum Operations was found guilty of industrial manslaughter on 30 March 2026 and fined $7 million plus $299,000 in costs on 1 May 2026. The company has appealed.
  • A contemporaneous operational record can provide stronger evidence of what actually happened than a document created or reconstructed later, though its value depends on how it was made and what it establishes.

What does officer due diligence actually require? #

Section 27 of the model Work Health and Safety Act requires an officer to exercise due diligence to ensure the business complies with its safety duties. It sets 6 obligations: keep knowledge of work health and safety matters up to date, understand the operations and their hazards, ensure appropriate resources and processes, ensure processes for receiving and responding to information about incidents, ensure processes for complying with duties, and verify the provision and use of the resources and processes in the third, fourth and fifth.

Two features of the duty do most of the work in practice. The first is that it is personal. An officer, broadly a person who participates in making decisions that affect the whole or a substantial part of the business, holds the duty in their own name. The work of discharging it can be delegated; the duty itself stays with the officer.

The second is the shape of the list. Obligations 1 and 2 are about what the officer knows. Obligations 3, 4 and 5 are about what the business has: resources, processes, more processes. The sixth is different again. It is the only one that asks whether any of it is actually working, and by its own terms it points back at the third, fourth and fifth. Most businesses invest heavily in the having, because that produces documents you can hold up. The verifying tends to become an annual management review. That asymmetry is where the 2026 decisions are most instructive.

The six officer due diligence obligations Obligations 1 to 5 under section 27 of the model Work Health and Safety Act require an officer to do five things: up to date knowledge of work health and safety matters, an understanding of the operations and their hazards, appropriate resources and processes, processes for receiving and responding to information about incidents, and processes for complying with duties. Obligation 6 is different. It requires the officer to verify the provision and use of the resources and processes described in the third, fourth and fifth. Obligations 1 to 5: what the officer must do Obligation 6: verify 1 Keep knowledge of WHS matters up to date 2 Understand the operations and their hazards 3 Ensure appropriate resources and processes 4 Ensure processes for incident information 5 Ensure processes for complying with duties 6 Verification Verify the provision and Use of the resources and Processes in 3 to 5 This is the one Records answer
The officer duty in section 27(5) of the model Work Health and Safety Act. Three of them are about ensuring the business has something. The sixth is separate: to verify the provision and use of what the third, fourth and fifth require. Records are how an officer shows the sixth was attended to.

Why is having a safety system not enough on its own? #

Because the sixth obligation is verification. A documented system shows what the business intended to happen. Verification is about taking reasonable steps to confirm what actually happened. Decisions in 2026 have turned on that distinction, and on whether an officer could point to the confirming steps they took.

The clearest illustration came from New Zealand. In Gibson v Maritime New Zealand [2026] NZHC 813 the High Court upheld an officer's conviction. The case is useful because it shows that an officer's positive safety initiatives do not necessarily establish due diligence if the officer failed to take reasonable steps to verify that critical controls were actually implemented and operating effectively. New Zealand's Health and Safety at Work Act 2015 is built on the same harmonised template as the Australian model Act, so the reasoning is instructive here even though it does not bind an Australian court.

The Australian counterpart arrived through contractors. In SafeWork NSW v Boral Cement Limited (No 2) [2026] NSWDC 88 the court held that engaging specialist contractors did not relieve Boral of its own primary duty as a person conducting a business or undertaking, usually abbreviated to PCBU. When the work method changed, Boral still had to follow its own safety processes and ensure that the changed work was reassessed and safely managed. If you engage labour hire, contract harvesting crews, traffic control or a spray contractor, that reasoning is about you.

A safety system describes work as planned. Verification asks about work as done.

What do the 2026 cases tell Australian officers? #

Nothing has changed in the wording of the duty. What the cases offer is a practical theme: the chronology of risk. What warning signs existed, when they became known, and what the business did in response. Records are what make that chronology legible after the fact.

Graham Dawson, 62, died on 14 September 2021 in a roof collapse at the Crinum underground coal mine near Emerald in central Queensland, while installing roof support on his final night shift. On 30 March 2026 Mastermyne Crinum Operations was found guilty of industrial manslaughter, the first successful industrial manslaughter prosecution under Queensland's mining safety and health legislation since the offence was introduced in 2020. On 1 May 2026 the company was fined $7 million plus $299,000 in costs. Judge Jeffrey Clarke found that the death could have been avoided, that a high risk method had been adopted without adequate consultation, and that clear warning signs had been ignored. The company has lodged an appeal, so the decision is not the last word.

The company's conviction is not the end of it. Two former executives, the underground mine manager and the site senior executive, have each been charged with two counts of failing to discharge a health and safety obligation causing death or grievous bodily harm under the Coal Mining Safety and Health Act 1999 (Qld). The allegation against the site senior executive is that he signed off on the change to the roof support method four days before the collapse, and failed to identify the risks of abandoning the original method of strata support. Those charges have not been determined, and nothing here should be read as a finding against either man. But the shape of the allegation is the point of this article: a decision, a date, and the question of what anyone verified in between.

A separate Victorian workplace manslaughter prosecution, in which a bakery operator was fined $3.4 million, demonstrates the broader consequences of failing to identify and control obvious risks, although it did not concern the officer due diligence duty discussed here. Read alongside Gibson and Boral, the through line is not about mining or baking. It is about what a business knew, when it knew it, and what it did in between.

The chronology of risk Four stages run left to right: warning signs exist, they become known, the business responds, and the response is verified. The 2026 decisions discussed in this article turned on the third and fourth stages. Gibson concerned verification of critical controls, Boral concerned the duty when a work method changed, and Mastermyne concerned the response to a known risk. 01 Warning signs Exist 02 They become Known 03 The business Responds 04 The response is Verified Where the 2026 decisions turned Gibson Verification of critical controls Boral The duty when A work method changed Mastermyne The response to A known risk
An important practical theme across the 2026 decisions is the chronology of risk: what warning signs existed, when they became known, what the business did in response, and whether that response was verified. Records are what make this chronology legible after the fact.

Why this matters to a 20 person crew

These were substantial businesses in high hazard industries with real safety functions. The duty on a director of a landscaping, civil, harvesting or vegetation management business is worded identically. The difference is that a smaller business has far less capacity to reconstruct what happened after the fact, which makes the records it keeps as it goes more useful, not less.

What can you actually prove about yesterday? #

Pick an ordinary working day from last week and try to answer 8 questions about it from your records alone. Most businesses running an outdoor crew can answer 2 or 3. The rest may depend heavily on recollection, which can be harder to test and corroborate than contemporaneous records.

Here are 8 practical questions an officer of an outdoor business should be able to investigate and answer when testing whether its safety systems are actually working.

  1. Who was on site, and when did each of them start and stop? Not who was rostered. Who was actually there.
  2. How long did each person actually work, including the travel and the setup before the nominal start time?
  3. How many consecutive days had each of them worked by that morning?
  4. What were the conditions? Temperature, ultraviolet index and wind at the location, not at the nearest capital city.
  5. Who was inducted or trained for the specific task they were doing that day, and when?
  6. Who was supervising, and were they physically present?
  7. What near misses happened, and would a worker have told you if one did?
  8. What changed on the day from what was planned, who decided it, and was anyone consulted?

Question 8 is often the hardest, and it is where both Boral and Mastermyne have most to say. The plan is written down. The change to the plan is made in a paddock at 7am and lives in nobody's system.

Two kinds of record produced by one working day A single shift runs from 6:02am to 3:34pm. Along the shift, five records are created by the work itself: a geofenced clock-on at 6:02, conditions logged at 9:40 showing 31 degrees and an ultraviolet index of 11, a recorded break at 12:05, a near miss reported at 2:10pm, and a clock-off at 3:34pm recording 9 hours 32 minutes. The roster was published 6 days ahead, it was day 5 of 6 consecutive days, and a supervisor was on site. Below the shift, three records created for an audit sit outside the day entirely: a safe work method statement signed at induction four months earlier, a toolbox sheet filed on Monday, and an annual policy sign-off. The shift 06:02 One working day, one outdoor crew 15:34 Records created by doing the work 06:02 Clock-on, geofenced 12:05 Break recorded 15:34 Clock-off, 9H 32M 09:40 Conditions 31C, UV 11 14:10 Near miss reported And: roster published 6 days ahead / day 5 of 6 consecutive / supervisor on site Records created for an auditor SWMS signed 4 Months ago Toolbox sheet Filed monday Policy sign-off Annual, not this shift
Two kinds of record produced by the same working day. The upper track is generated by the work itself and is time-stamped to the shift. The lower track is generated for an audit and is not tied to the day at all. SWMS is a safe work method statement. Only one of these tracks answers the question section 27 asks, which is whether the officer verified what actually happened.

A record you have to remember to create is a control that decays.

Which records carry weight as evidence, and which are just paperwork? #

A contemporaneous operational record can provide stronger evidence of what actually happened than a document created or reconstructed later. But the evidentiary value depends on what the record establishes, how it was created, its reliability, and whether it demonstrates that the relevant control was actually implemented.

What a record tends to show. Indicative only: value depends on how the record was made and what it establishes
RecordWhat it tends to showIndicative weight
Annual policy sign-offThat a policy exists and was circulatedLimited
Induction register signatureThat a person attended an induction at some pointLimited
Toolbox talk sheetThat a talk was held, and what it coveredPartial
Published roster with its change historyWhat work was planned, what changed, when, and by whomDirect
Time-stamped start and finish at the siteWho was doing the work, and for how longDirect
Conditions recorded against the shiftThe environment the work was performed inDirect
Near miss reports, including anonymous onesWhat warning signs arrived, and whenDirect

The pattern is not subtle. The records that tend to carry least weight are periodic, signed and about people. The ones that tend to carry most are contemporaneous, automatic and about the work, because they are difficult to reconstruct after an incident and they speak to what was actually done rather than what was intended.

What does a practical evidence set for an outdoor crew look like? #

Seven records, kept contemporaneously: the published roster and its changes, actual start and finish at the location, consecutive days worked, conditions at the site, task specific competency, who supervised, and near misses. Together they let an officer investigate all 8 questions above.

  1. The roster as published, with a change history that survives the change.
  2. Actual start and finish, captured at the location rather than typed up on Friday.
  3. Consecutive days and cumulative hours per person, calculated rather than remembered.
  4. Conditions at the work location for the hours worked.
  5. Task specific competency and induction, linked to the person and the task rather than to a folder.
  6. Supervision, recorded as a fact about the shift rather than as a line in a position description.
  7. Near miss and hazard reports, with an anonymous route, because the ones you never hear about are the ones that matter.

None of this requires software. A disciplined supervisor with a spreadsheet and a phone can produce all 7, and some businesses do. What matters is that the record is made at the time, is attributable, and is not easy to reconstruct conveniently after an incident. Those three properties are what give a record evidentiary value.

How do you close the gap without adding administration? #

By generating the records from work people already do, rather than adding forms. Every additional form is a control that competes with the job and decays under pressure. The records that survive a busy season are the ones nobody has to remember to create.

This is where safety technology can go wrong, and it is worth saying plainly. The obvious way to produce continuous evidence about workers is to monitor them continuously, and that trade is a bad one.

New South Wales has passed new legislation specifically addressing risks arising from digital work systems. The Work Health and Safety Amendment (Digital Work Systems) Act 2026 received assent in February 2026 and, once the remaining provisions commence, will require PCBUs to consider risks including excessive or unreasonable workloads, performance metrics, monitoring and surveillance, and discriminatory decision-making arising from digital work systems. As at 8 September 2026 the substantive provisions have not generally commenced and are being prepared for commencement following the development of SafeWork NSW guidelines.

The distinction that keeps this honest is shift bounded and work directed. Collect while the shift is running and not otherwise, record the work rather than the person, and do not rank named individuals. If a record could be used to discipline someone without an independent reason to look, it is the wrong record.

An officer needs reasonable assurance that safety processes are actually operating. Contemporaneous operational data does not create that assurance by itself, but it makes it much easier to demonstrate.

Where PocketMode fits #

PocketMode is a rostering and compliance app built for outdoor crews, and the record set above is what it produces as a by-product of running the roster. Shifts are published and every change is kept. Clock-on and clock-off run through a geofence that is active only for the length of the shift. Consecutive days and cumulative hours are calculated for each worker. Weather and heat conditions are recorded against the shift and alerts go to the manager dashboard. Near misses can be reported anonymously. Timesheets come out the other end ready to approve, which is the reason a crew keeps using it on a wet Tuesday in August.

It is deliberately bounded. There is no camera, microphone or content capture, nothing is collected outside the shift, and the employer view does not rank named individuals. That is the same set of constraints the 7 records above imply, which is not a coincidence: the product was designed from the compliance question rather than retrofitted to it.

PocketMode is pre-pilot. We are placing the app with a small number of Australian outdoor businesses now, and the pilot is free while it runs. If the 8 questions above were uncomfortable reading, that is the conversation to have.

See what a shift record looks like

Rostering, timesheets, conditions and near misses for outdoor crews. 7.5 cents per worker per hour, no lock-in.

Request a pilotRead the research

Questions people ask about officer due diligence #

Who counts as an officer under WHS law? #

An officer is broadly a person who makes, or participates in making, decisions that affect the whole or a substantial part of the business, or who can significantly affect its financial standing. That usually captures directors, company secretaries and senior executives. It does not capture a partner in a partnership or a sole trader, because each of those is a PCBU in their own right rather than an officer of one. A volunteer can be an officer if they sit on a board or committee, although a volunteer officer cannot be prosecuted for failing to comply with the due diligence duty. The title on the door is not what decides it; the decisions the person actually makes are.

Does having a safety management system satisfy due diligence? #

Not on its own. A safety management system helps discharge the obligations about resources and processes. The sixth obligation is separate: to take reasonable steps to verify that those resources and processes are provided and used. Decisions in 2026 have turned on whether an officer could point to the verifying steps they took.

Can an officer delegate due diligence? #

The work of gathering information and running processes can be delegated. The duty itself remains with the officer. That is why the practical question is what the officer can show they were told, when they were told it, and what they did in response.

How long should work health and safety records be kept? #

There is no single retention period for every work health and safety record. Particular laws prescribe minimum periods for some records, including at least 5 years for records of notifiable incidents under the model WHS framework. Other records may be subject to different requirements depending on the jurisdiction, industry and record type. Businesses should establish a retention policy that reflects those requirements and their potential evidentiary needs.

What is the difference between work as planned and work as done? #

Work as planned is what the procedure, the roster and the safe work method statement describe. Work as done is what the crew actually did, including every change made on the day. A gap between them is normal and is not itself a failure. Not knowing whether a gap exists is the harder problem.

Sources #

  1. Safe Work Australia, Interpretive guideline: the health and safety duty of an officer under section 27. safeworkaustralia.gov.au
  2. Comcare, Exercising due diligence: guidance for officers. comcare.gov.au
  3. Gibson v Maritime New Zealand [2026] NZHC 813, Courts of New Zealand. courtsofnz.govt.nz
  4. Norton Rose Fulbright, "Why doing a lot still was not enough: New Zealand High Court upholds landmark officer due diligence conviction". nortonrosefulbright.com
  5. SafeWork NSW v Boral Cement Limited (No 2) [2026] NSWDC 88, discussed in Hamilton Locke, "NSW District Court reaffirms the importance of managing change". hamiltonlocke.com.au
  6. ABC News, "Mastermyne Crinum Operations fined $7m after 2021 on-site death of Graham Dawson", 1 May 2026. abc.net.au
  7. ABC News, "Queensland miner Mastermyne Crinum Operations found guilty over worker's 2021 death", 30 March 2026. abc.net.au
  8. ABC News, "Crinum mine former senior executives to face court over fatal roof collapse", 4 May 2026. abc.net.au
  9. Herbert Smith Freehills Kramer, "Safety update: key developments and trends, January 2026 to June 2026". hsfkramer.com
  10. Work Health and Safety Amendment (Digital Work Systems) Act 2026 (NSW). legislation.nsw.gov.au

Not legal advice

This article is general information about duties that apply differently in each jurisdiction and turn on the facts of each case. It is not legal advice and it is not a substitute for it. If you are an officer trying to understand your own position, take advice from a work health and safety lawyer in your state.

How to cite this page

Rangeon, S. (2026). Officer due diligence in 2026: what can you actually prove about yesterday? PocketMode. https://www.pocketmode.com.au/blog/officer-due-diligence-evidence-australia/

Related reading: The State of Outdoor Work in Australia, Employer Edition, which sets out why most outdoor exposures are decided when the roster is written, and the 2026 numbers. See also The codes stopped being advice, on the section 26A duty that commenced on 1 July 2026.