File No. 2026-003 - The Kitchen Sink

How an Investigation Undermined a Bulletproof Case.

The investigator reviewed the access logs.

The employee was on extended leave. Yet, the system showed he had entered a restricted facility.

His security pass had expired. But he had simply "tailgated" his way through the security gates, following a co-worker inside.

But that wasn’t the most alarming discovery.

A forensic review of his workstation revealed a massive data transfer. More than 30,000 files had been quietly siphoned from the organisation's network onto a personal USB drive.

Among the copied files was a highly sensitive document detailing emergency responses, security intelligence, and entry and exit protocols.

When questioned, his story evolved. At first, he claimed he was only on-site to scan a document. Later, he admitted to the data copy, pointing to an IT email from months prior that he claimed authorised the mass download.

He wasn't an outsider. He was a trusted, highly skilled technician who had been with the organisation for more than eight years. He knew the systems and the people.  He also knew the limits of those systems and their vulnerabilities.

You would think this was an open-and-shut case. A massive data breach and a deliberate physical security violation.

The employer thought so too. They promptly terminated his employment.

But when the case went to a tribunal, the employer lost. The dismissal was ruled unfair, and the organisation was ordered to pay compensation.

When people hear stories like this, they often ask the wrong question. "How could someone steal 30,000 files and win an unfair dismissal claim?"

The more important question is:

How did an investigation undermine its own rock-solid case?

The answer isn't a lack of evidence. It's overzealousness.

When investigators uncover a smoking gun, the temptation is to keep digging for more ammunition. Instead of relying solely on the evidence supporting the alleged serious misconduct, the investigation lost its focus.

It began dragging in historical grievances to pad the allegation sheet. A late-night, emotional email sent months prior. An old, inappropriate joke email sitting dormant in his inbox. An emotional outburst at a colleague's funeral.

What should have been a focused inquiry into a serious security breach morphed into a sprawling, twelve-point list of allegations.

The tribunal saw this not as an objective fact-finding mission, but as a "kitchen sink" approach. What it saw was a retrospective witch-hunt aimed at piling on reasons to justify a predetermined outcome.

By trying to make the case invincible, the investigators diluted the gravity of the core impropriety and made the entire process appear vindictive.

And so the dismissal was ruled unfair.  The investigation was a spectacular failure.

There is a crucial lesson hidden inside this ruling.

An investigation's strength is not measured by the sheer volume of allegations it can produce. It is measured by its objectivity, focus, and fairness.

A targeted investigation into a massive data breach commands respect. A sprawling indictment featuring years-old emails looks like a vendetta.

Rather than asking how many policies an employee has breached, ask:

• Are we focusing on the core allegations, or are we throwing in the kitchen sink?

• Are historical or minor allegations relevant, or does it compromise our objectivity?

• If an external tribunal reviews our process, will they see a fair inquiry or a retrospective witch-hunt?

  
  

And most importantly:

• Are we investigating to find out the truth, or are we engaging in a process to support a decision that has already been made?

This story is adapted from a real Fair Work Commission ruling to highlight lessons in workplace investigations and governance.

Michael Riches is a Director at Lift Strategic, advising leaders and boards on governance, integrity, risk management, and regulatory scrutiny.