Corporate criminal responsibility 

A corporation has no mind and takes no physical action. Everything it does is done by human beings, and the whole of this subject concerns the rules by which those human acts and states of mind become the acts and states of mind of the company itself. That process is called attribution, and it must be worked through before any question of liability arises.

Why attribution is necessary

A corporation is a separate legal person. It can own property, contract, sue and be sued, and it can also be prosecuted. But the elements of an offence — conduct, and usually a state of mind — cannot be satisfied by the corporation directly. The prosecution must therefore show a rule that treats some individual's conduct or mental state as the corporation's own.

This is not the same as holding the individual liable. Both may be prosecuted, and the individual's own liability is unaffected by whether attribution succeeds. Nor is it the same as vicarious liability in tort, which imposes liability on the employer for a wrong that remains the employee's. Attribution makes the conduct the company's own.

The directing mind and will

The general law approach identifies the persons who may be said to embody the company — its directing mind and will. The acts and knowledge of those persons are the company's acts and knowledge; the acts of ordinary employees are not.

Who qualifies depends on the company's constitution and the way it actually distributes authority. The board plainly qualifies. So may a managing director, and so may a senior officer to whom the relevant function has been delegated. A branch manager or a supervisor ordinarily does not.

The doctrine has an obvious weakness. The larger and more decentralised the corporation, the harder it becomes to find a directing mind who knew the relevant facts — with the result that the most complex organisations, where systemic failures are most likely, were the hardest to prosecute. Diffused responsibility operated as a defence.

Attribution for physical elements

Where the offence has a physical element only, attribution is broader. Conduct engaged in by an employee, agent or officer acting within the actual or apparent scope of their employment or authority is attributed to the corporation. The company cannot escape by pointing out that the board did not know.

This is why strict and absolute liability regulatory offences — occupational health and safety, environmental protection, consumer protection — have historically been the main vehicle for corporate prosecution. They avoid the attribution problem by removing the fault element.

The corporate culture provisions

Part 2.5 of the Criminal Code Act 1995 (Cth) addresses the weakness directly.¹ For Commonwealth offences, where intention, knowledge or recklessness is an element, that fault may be attributed to the corporation if it expressly, tacitly or impliedly authorised or permitted the offence. Authorisation may be established by:

• proof that the board or a high managerial agent carried out the conduct or authorised it;
• proof that a corporate culture existed that directed, encouraged, tolerated or led to non-compliance; or
• proof that the corporation failed to create and maintain a corporate culture requiring compliance.

"Corporate culture" is defined to mean an attitude, policy, rule, course of conduct or practice existing within the body corporate generally or in the part where the offence occurred. Evidence may include whether authority to offend was believed to exist and whether the corporation's own compliance requirements were in fact enforced.

The significance of this is that a prosecution need not find a guilty individual at all. A pattern of tolerated non-compliance, a compliance manual that nobody applied, or a reporting system that reliably buried problems, can each supply the fault element.

Where a corporation would be liable for negligence but no individual employee's conduct is negligent, the Code permits negligence to be established by aggregating the conduct of employees — inadequate management, control or supervision, or a failure to provide adequate information.

Sentencing a corporation

A corporation cannot be imprisoned, so the penalty provisions convert terms of imprisonment into fines by a statutory multiplier. Other orders are frequently more significant than the fine:

• adverse publicity orders, requiring the corporation to disclose the offence;
• community service and remedial orders directed at the harm caused;
• disqualification of the individuals involved from managing corporations;
• licence conditions or cancellation in regulated industries; and
• compensation to those affected.

Alternatives to prosecution

Regulators rarely prosecute corporations as a first response, and the alternatives shape practice more than the criminal provisions do:

• Enforceable undertakings, in which the corporation commits to remedial measures, compensation and compliance programs, enforceable by court order if breached.
• Infringement notices for lower-level contraventions, paid without admission.
• Civil penalty proceedings, which avoid the criminal standard of proof and the attribution problems, and which carry substantial pecuniary penalties. Many statutory regimes are drafted so the same conduct supports either a civil penalty or a criminal charge.
• Deferred prosecution agreements, available in some regimes, suspending a prosecution while the corporation meets agreed conditions.

A problem question that ends at the criminal analysis has usually missed the more likely outcome.

Applying this in a problem question

1. Identify the offence and separate its physical elements from its fault element, because different attribution rules apply to each.
2. Determine the jurisdiction, since Part 2.5 governs only Commonwealth offences and the states differ.
3. For physical elements, ask whether an employee, agent or officer acted within actual or apparent authority.
4. For fault, try the directing mind route first — identify a specific senior officer and what they knew — and if that fails under a Commonwealth offence, turn to corporate culture.
5. Where culture is relied on, point to concrete evidence: unenforced policies, tolerated practices, reporting lines that suppressed information.
6. Address the individual's separate liability, and do not assume the two rise and fall together.
7. Deal with penalty by reference to the multiplier and the non-financial orders.

Self-check

• Have I identified an attribution rule rather than asserting that the company "did" the act?
• Have I checked whether the offence is a Commonwealth one before invoking corporate culture?
• Have I distinguished attribution from vicarious liability in tort?
• Have I kept the individual's liability separate from the corporation's?
• Have I addressed penalty beyond the fine?