Part 2 - What About Fraud, SIRA?

And What About Fraud?

There’s another part of this that I can’t pass over.

Fraud.

SIRA says it has “zero tolerance to fraud.”

Its current Fraud Framework describes three pillars: deter, detect and respond. It refers to tip-offs, data analytics, significant-matter notifications, regulatory investigations, prosecutions and referrals to other regulators. 

But reading those words after everything I’ve been trying to report raises a question that makes me deeply uncomfortable.

Whose fraud are we looking for?

Because when workers compensation fraud is discussed publicly, it can so easily conjure the image of the dishonest worker: somebody exaggerating an injury, working while receiving benefits, submitting a false certificate or otherwise dishonestly obtaining compensation.

And certainly, worker fraud exists and should be investigated.

But workers are not the only people capable of defrauding a workers compensation scheme.

SIRA itself says so.

——

SIRA Expressly Recognises Employer Fraud

SIRA’s current workers compensation fraud information contains separate sections dealing with employer fraud, worker fraud, health professional fraud and other fraud.

And among the examples SIRA currently gives of employer fraud is this:

“failure to pass on workers compensation to the intended recipient”

SIRA also identifies conduct including supplying false information concerning insurance, falsifying documents, and working with other people to provide false documentation relating to a claim. It says employers can be investigated and prosecuted for workers compensation fraud. 

That stopped me, because:

• I have spent years reporting what happened to me.
• I have records.
• I have repeatedly raised the failure to pass on workers compensation benefits.
• I have raised withholding of information.
• I have raised continuing adverse conduct after my psychological injury and after the people responsible for managing the workers compensation process knew about my concerns.
• I have raised the failure of injury management and return-to-work processes.
• I have raised the continuing financial consequences.

Those matters don’t establish fraud merely because I allege them. Nor am I in a position to make a criminal finding against another person or organisation.

That is what investigation is for.

The question I’m entitled to ask is:

Why wasn’t the information I supplied assessed to determine whether any of the conduct I was reporting amounted to fraud, another offence, or serious regulatory non-compliance?

——

Fraud Doesn’t Stop Being Fraud Because the Alleged Wrongdoer Has Institutional Power

This matters to me enormously.

An injured worker and a large institution don’t enter this system with equal power.

An employer may have human resources departments, lawyers and executives.

An insurer or specialised insurer has claims professionals, compliance systems, legal advisers and an established relationship with the regulator.

The injured worker has herself.

That inequality makes independent regulation more important, not less important.

A zero-tolerance approach to fraud has to operate in every direction.

It cannot mean rigorous scrutiny when the suspected offender is an injured worker while alleged misconduct by powerful scheme participants is treated primarily as a customer-service problem, a dispute between parties or something to be referred elsewhere.

I’m not saying that SIRA’s published framework says that should happen. It doesn’t.

I’m asking whether the regulatory practice experienced by injured workers matches the regulatory principle.

——

Who Investigates the Insurer?

There’s an even more troubling question in SIRA’s current framework.

SIRA requires regulated entities to notify it of significant matters.

Those matters can include legal matters, privacy and information breaches, breaches of regulated-entity obligations and investigations. SIRA says these notifications allow it to respond to matters that have caused, or potentially could cause, harm to scheme participants or affect the regulated entity’s ability to comply with its statutory obligations. 

The definition goes further.

SIRA’s published significant-matter information expressly contemplates a matter involving:

“the regulated entity (or its employees or representatives) having engaged in conduct constituting gross negligence, intentionally misleading or deceptive conduct or fraud.” 

Read that again.

The significant matter can concern alleged fraud or intentionally misleading conduct by the regulated entity itself.

So I have a very simple question.

What happens when the organisation expected to notify SIRA of a significant matter is itself the organisation whose conduct constitutes the alleged significant matter?

Is the regulatory system really expected to wait for an insurer to report itself?

Of course, SIRA’s framework does provide other routes. Its Fraud Framework says investigations can arise from public tip-offs, analytics, significant-matter referrals, systemic notifications from insurers and referrals from other regulators. And SIRA separately provides a mechanism for members of the public to report suspected workers compensation fraud. 

That means insurer self-reporting is not supposed to be SIRA’s only source of intelligence.

Which brings me straight back to my experience.

I was providing intelligence.

I was reporting what was happening.

I was asking for intervention.

So what happened to that information?

——

“I’m Not Here to Play He Said, She Said”

There’s a sentence that’s stayed with me.

A SafeWork inspector told me:

“I’m not here to play he said, she said.”

But this was precisely why I needed regulators.

I wasn’t asking somebody to referee an argument between two people.

I was reporting matters capable of being checked against records, statutory obligations, claims files, communications and the conduct of the organisations involved.

I had even drafted my own return-to-work plan.

Having a document is not the same thing as verifying that it was operationally implemented.

Receiving an allegation isn’t the same thing as investigating it.

And recording a complaint isn’t the same thing as testing what actually happened.

An injured worker can’t compel an insurer to hand over its internal records.

An injured worker can’t audit an employer.

An injured worker can’t examine communications between institutional parties.

An injured worker can’t compel evidence.

A regulator can.

Indeed, the 2017 Compliance and Enforcement Policy expressly contemplated investigations arising from formal complaints or intelligence and described substantial information-gathering powers available to SIRA.

That’s why reducing serious allegations to “he said, she said” is so inadequate.

Investigation exists precisely because conflicting accounts need to be tested against evidence.

——

What If the Allegation Is That Powerful Parties Acted Together?

There’s another question I have to frame carefully.

I have long had serious concerns about the relationships and conduct I observed among different organisations and individuals involved in what happened to me.

I’m not going to declare publicly that there was criminal collusion. That’s a conclusion for an appropriately empowered and independent investigation based upon the evidence.

But neither should I be required to pretend that the possibility cannot be investigated.

Where information supplied to a regulator raises a reasonable concern that more than one scheme participant may have participated in, facilitated, concealed or failed to report potentially unlawful conduct, who investigates the relationship between those actions?

That’s the point at which independent regulation becomes indispensable.

The regulated party cannot be the final judge of whether its own behaviour requires investigation.

The employer cannot be the final judge of its own conduct.

The insurer cannot be the final judge of its own conduct.

And an injured worker shouldn’t have to prove a criminal offence before the regulator will investigate whether one may have occurred.

——

The 2017 Policy Understood This

This is where the old Compliance and Enforcement Policy becomes important again.

It didn’t say SIRA could only act when an insurer volunteered information about itself.

It said an investigation could arise from:

“a formal complaint, data analysis or intelligence obtained by SIRA.”

And its risk-based approach expressly identified severe effects on groups, vulnerable people, systemic non-compliance and recidivism, public interest and risks to community confidence as considerations when allocating regulatory resources.

That’s why I keep returning to the same question.

What was I meant to do?

• Report it? I did.
• Document it? I did.
• Ask for intervention? I did.
• Ask for compliance? I did.
• Ask who was enforcing the legislation? I did.
• Keep records while my own life was being overwhelmed by the consequences? I did that too.

At some point, responsibility has to pass from the injured person reporting suspected wrongdoing to the public authorities possessing the statutory powers to determine what actually happened.

——

Zero Tolerance Has to Mean Zero Tolerance

SIRA’s current regulatory priorities continue to proclaim “zero tolerance to fraud.” 

Then let’s take those words seriously.

Zero tolerance when a worker commits fraud.

Zero tolerance when a health provider commits fraud.

Zero tolerance when an employer commits fraud.

And zero tolerance if evidence establishes fraud, intentionally misleading conduct or other serious wrongdoing by an insurer or another regulated entity.

Not because every allegation is true.

But because the identity, wealth, institutional status or regulatory relationship of the person or organisation accused should not determine whether credible evidence is investigated.

That’s equality before a regulatory system.

And perhaps the most important distinction of all is this:

I was never asking SIRA to accept my allegations as findings of fact.

I was asking the regulator to investigate the facts.

There’s an enormous difference.

After reading SIRA’s own current fraud material alongside its 2017 Compliance and Enforcement Policy, I’m left wondering why that distinction seemed so extraordinarily difficult to make when the person asking for the investigation was the injured worker.

——

So Where Is the Current Compliance and Enforcement Policy?

This is where my questions move from 2022 into the present.

The document I have is the SIRA Compliance and Enforcement Policy, July 2017.

SIRA has since published a broader Regulatory Framework and its current Fraud Framework.

But I have been unable to locate a subsequently published policy specifically replacing the July 2017 Compliance and Enforcement Policy.

Even more confusingly, current SIRA material continues to refer to that July 2017 policy.

So I think the public is entitled to some very simple answers.

Is the July 2017 SIRA Compliance and Enforcement Policy still operative?

If not:

When was it withdrawn or superseded?

What replaced it?

Where is the current publicly accessible Compliance and Enforcement Policy?

And most importantly for injured workers:

What is SIRA’s current documented pathway for assessing allegations of non-compliance by insurers and other scheme participants and escalating those allegations to investigation and enforcement?

——

Regulation Cannot Be a Relationship With the Regulated

I understand that regulators engage with the industries they regulate.

The 2017 policy itself contemplated education, engagement and voluntary compliance.

There’s nothing inherently wrong with that.

But engagement can’t become the end point when serious non-compliance is identified.

The policy itself recognised that.

It said the response should be determined by risk and potential harm and that escalation didn’t necessarily have to occur in a linear way.

That leaves me with another uncomfortable question after everything I experienced:

Does the regulatory system make it easier for an insurer to engage with its regulator than for an injured worker to have alleged insurer non-compliance meaningfully investigated by that regulator?

I can’t answer that question for every worker or every insurer.

I can only document what happened to me.

But I can ask it.

There has to be a difference between supervising insurers and simply maintaining relationships with them.

There has to be a difference between receiving intelligence and filing it.

There has to be a difference between acknowledging a complaint and regulating.

And there has to be a difference between having enforcement powers written into legislation and policy and injured people actually seeing those powers used when the evidence warrants it.

——

I Was Asking for Regulation

I wasn’t asking SIRA to automatically believe every allegation I made.

I was asking for scrutiny.

I was asking for investigation where investigation was warranted.

I was asking for compliance where there was non-compliance.

I was asking for enforcement where enforcement was warranted.

And above all, I was asking the regulator to use the information I was giving it to protect the integrity of a statutory scheme that exists for injured people.

The language was already there in SIRA’s own policy.

Compliance.

Risk.

Vulnerability.

Systemic non-compliance.

Investigation.

Enforcement.

Deterrence.

Public interest.

Community confidence.

I didn’t invent those concepts.

SIRA published them.

So the question that remains for me, years later, is painfully simple:

What happened when I needed those words to become action?

——

https://www.sira.nsw.gov.au/workers-compensation/fraud

https://www.sira.nsw.gov.au/resources-library/regulation-and-fraud/preventing-fraud/fraud-framework 

https://www.sira.nsw.gov.au/resources-library/across-schemes/significant-matter-notifications