Your compliance program is now your defence

Why the adequate procedures defence, and a genuine culture of compliance, do double duty under Australia’s foreign bribery regime.

By Bill Doogue, Director and Accredited Criminal Law Specialist, Doogue + George

Most of the discussion about the AFP’s April 2026 guideline is about what happens after something goes wrong: self-reporting, cooperation, civil resolution. The more valuable conversation, for any board, is about what happens before. Under Australia’s foreign bribery regime, a company’s compliance program is no longer just good governance. It is the only defence to the corporate offence, and it is a factor that shapes whether the company gets a civil resolution if a problem ever surfaces. It does double duty, and that changes the calculation on what to invest in it.

The only defence to the failure-to-prevent offence

Since 8 September 2024, an Australian company can be liable for failing to prevent foreign bribery by an associate under section 70.5A of the Criminal Code. It is an absolute liability offence. The company can be liable for bribery by an employee, contractor, agent or subsidiary even if it knew nothing about it. There is one way out. The company has a defence if it can prove, on the balance of probabilities, that it had adequate procedures in place designed to prevent that conduct.

Two features of that defence are easy to miss and important to grasp. The burden is on the company, not the prosecution. And it is judged as at the time of the offending, not at the time of the trial. A compliance program built in a hurry after a problem emerges does not assist. The procedures have to be there, and have to be working, before anything goes wrong.

What “adequate” means

The Attorney-General has published guidance on adequate procedures, built around a set of principles. In broad terms, an adequate program is expected to address: proportionate, risk-based procedures; genuine commitment from the top of the organisation; a real risk assessment; due diligence on third parties and associates; communication and training so people actually understand the rules; and monitoring and review so the program keeps pace with the risk.

The recurring theme in the guidance is that policies on paper are not enough. “Adequate” is about whether the procedures are proportionate to the company’s actual risk, embedded in how the business operates, and tested. A glossy code of conduct that no one applies will not establish the defence. A leaner program that genuinely reflects and manages the company’s real exposure may.

The second benefit: it shapes the resolution

Here is the part that ties back to the AFP guideline. If something does go wrong, the company’s compliance culture is one of the public interest factors the AFP weighs when deciding whether a civil resolution is the optimal outcome. The AFP looks at whether the company had adequate procedures, the tone from the top, its approach to third parties, its reporting and whistleblower channels, and whether the misconduct can fairly be seen as the act of a rogue individual against an otherwise sound framework, or as a symptom of the culture itself.

So a strong, genuine compliance program works at both ends. Before a problem, it is the defence to the offence. After a problem, it is evidence that pushes towards a civil resolution rather than a prosecution. The same investment protects the company twice.

This changes the investment case

Boards have often treated anti-bribery compliance as a cost centre, a defensive overhead with no visible return. The current regime reframes it. A program that is proportionate, embedded and provable is now a legal asset. It is the difference between a complete defence and absolute liability for conduct the company never authorised. And if a matter ever reaches the AFP, it is part of what separates a civil resolution from a criminal prosecution, with everything that follows from a conviction for a corporation: the penalty, the collateral consequences for contracts and licences, and the reputational damage. Measured against those outcomes, the spend on a genuine program is modest, and it is one of the few compliance investments that can be shown to have prevented a defined and very large liability.

A board checklist for adequate procedures

A board does not need to be expert in compliance to ask the right questions. The following are a reasonable starting set:

1. Risk assessment. Have we actually assessed our foreign bribery risk, by market and by relationship, and is it current?
2. Proportionality. Are our procedures proportionate to that risk, rather than a generic head-office policy applied everywhere?
3. Top-level commitment. Is the commitment to preventing bribery visible and real at board and senior management level, not just in the code?
4. Third parties. Do we conduct risk-based due diligence on agents, intermediaries and joint venture partners, particularly in higher-risk markets?
5. Communication and training. Do the people who face the risk actually understand the rules and how they apply to their work?
6. Reporting. Are there secure, trusted channels for people to report concerns, and are reporters protected?
7. Monitoring and review. Do we test the program and update it as the business and its risks change?
8. Evidence. Could we prove all of the above, with documents, if we had to establish the defence?

That last point is the one boards most often overlook. The defence is only as good as the company’s ability to prove it. Procedures that exist but are undocumented are hard to rely on when it matters.

Doogue + George advises companies on foreign bribery exposure and on whether their procedures would stand up as a defence. If you want your program assessed against the offence and the AFP’s expectations before a problem arises, we can help.

Frequently asked questions

What is the defence to failing to prevent foreign bribery?

The company has a defence if it can prove, on the balance of probabilities, that it had adequate procedures in place designed to prevent the conduct. The burden is on the company.

Is a written compliance policy enough?

No. The guidance is clear that policies on paper are not enough. Procedures must be proportionate to the actual risk, embedded in the business, and working.

When does the program need to be in place?

Before the conduct. The defence is judged as at the time of the offending, so a program built after a problem emerges does not assist.

Does good compliance help even if something goes wrong?

Yes. The company’s compliance culture is one of the factors the AFP weighs in deciding whether a civil resolution, rather than a prosecution, is the optimal outcome.

About the author

Doogue + George has acted in some of Australia’s most significant bribery and corruption matters. Bill Doogue is ranked by Doyle’s Guide as one of the preeminent criminal defence lawyers in Australia and is listed in Best Lawyers for criminal law.

Bill Doogue is a consultant for Lewing Lowing Sullivan in Port Moresby in relation to bribery and corruption and transnational crime, advising on the Australian and cross-border dimensions of regional white collar matters.