How director liability works when outsourcing fails

Outsourcing is a standard way for growing Australian businesses to cut costs, tap specialist skills and keep the team focused on core work. Payroll, IT, manufacturing, cleaning, logistics and even whole compliance functions are handed to outside providers. The contract says the provider is responsible for the work. What it does not say is that the provider has taken the directors' legal duties along with it.

When an outsourcing arrangement fails, the fallout can become personal. Unpaid tax or super, a workplace injury on a provider's site, a data breach, a supplier left unpaid: each can pull the people running the company personally into the picture, even though a third party did the work. This article explains how that happens. It maps the duties that survive an outsourcing contract, the triggers that convert a company failure into a personal liability, and the steps that keep the risk low. It is written for directors and owners of small to medium Australian businesses.

Before looking at the triggers, it helps to know who is in the picture:

The company: owes the underlying obligations, such as tax, superannuation, workplace safety and its contracts. It is the primary target of any claim or penalty.
The directors: owe duties to the company under the Corporations Act and, in specific situations, owe personal statutory liabilities that follow the outsourced work.
The provider: does the work under contract. Its failures create the risk, but its own insolvency or misconduct does not absorb the directors' exposure.
The enforcers: the ATO issues director penalty notices, ASIC and liquidators enforce directors' duties and insolvent trading rules, and workplace safety and environmental regulators pursue officers of the business that procured the work.

The duties that survive the outsourcing contract

The starting point is Chapter 2D of the Corporations Act 2001 (Cth). s 180(1) requires every director or officer to exercise their powers and discharge their duties with the degree of care and diligence that a reasonable person would exercise in the corporation's circumstances and in the same office. It is a civil penalty provision, which means a breach can attract penalties and compensation orders.

In an outsourcing context the duty of care has a practical shape: make an informed decision. A director deciding whether to outsource, and to whom, must understand what the provider will actually do, the terms of the contract, the risks the arrangement creates for the company and its reputation, and how performance will be monitored. s 181(1) adds a separate obligation to act in good faith in the best interests of the corporation and for a proper purpose.

The business judgment rule in s 180(2) protects directors who do this properly. A director who makes a business judgment is taken to meet the care and diligence requirement if the judgment is made in good faith for a proper purpose, the director has no material personal interest in it, they inform themselves about the subject matter to the extent they reasonably believe appropriate, and they rationally believe the judgment is in the company's best interests. Choosing a provider and signing an outsourcing contract is a business judgment. The rule protects the director who genuinely informs themselves and reasons the decision through. It gives no comfort to a director who signs without looking.

ASIC v Cassimatis (No 8) [2016] FCA 1023 shows what can go wrong. The Federal Court found the directors of Storm Financial breached s 180(1) by failing to consider the risk their business model posed of serious harm to clients and, through them, to the company. The failure was one of consideration: the decision exposed the company to a risk the directors never properly weighed. The same logic applies to an outsourcing decision that commits the company to an arrangement whose risks the board never examined.

Delegation hands over the work, not the responsibility

Outsourcing is, in legal terms, a form of delegation, and the Corporations Act is blunt about what delegation does and does not do. s 198D lets directors delegate their powers to a committee of directors, a director, an employee or any other person. But s 190 provides that when directors delegate a power, a director is responsible for the exercise of that power by the delegate as if the directors had exercised it themselves.

The escape hatch is narrow. A director escapes responsibility only if they believed on reasonable grounds, at all times, that the delegate would exercise the power in conformity with the directors' duties, and believed in good faith, on reasonable grounds and after making proper inquiry if the circumstances indicated a need, that the delegate was reliable and competent in relation to the delegated power.

Two points follow for an outsourcing arrangement. First, the belief in the provider's reliability must be reasonable and, where circumstances call for it, grounded in actual inquiry. A director who never checks the provider's financial position, compliance record or capacity cannot claim a reasonable belief. Second, the belief must be maintained: information that a provider is failing to remit tax, missing safety obligations or underpaying staff destroys the foundation of the defence, and continuing to rely on the provider after that point is where personal exposure is built.

Trigger one: the ATO director penalty notice system

The most mechanical route to personal liability runs through the Taxation Administration Act 1953 (Cth). Under Division 269 of Schedule 1, when a company fails to pay amounts withheld under PAYG, net amounts under the GST system or superannuation guarantee charge, its directors come under a personal obligation to cause the company to pay. The obligation continues until the company complies, an administrator or small business restructuring practitioner is appointed, or the company begins to be wound up.

If the company does not comply, the Commissioner can issue a director penalty notice. The notice gives the director a short window to act: cause the company to pay the amounts, or end the obligation by putting the company into administration, restructuring or winding up. If the obligation ends before the notice period runs out, the penalty does not become payable. If it does not, the unpaid amounts become a personal debt of the director. No fault, dishonesty or bad faith needs to be shown: the penalty follows from the company's failure and the director's failure to act within the notice period.

This is why outsourcing payroll, bookkeeping or superannuation administration does not remove the exposure. If the provider collects the money but does not remit it, the company still owes the ATO, and the directors remain personally obliged to make the company pay. The Act provides limited defences, and the onus of establishing one falls on the director. For many directors, the first they know of the problem is the notice itself, which is why monitoring remittances directly, rather than assuming the provider has handled them, is a practical priority.

Trigger two: insolvent trading

s 588G of the Corporations Act imposes a duty on directors to prevent the company from trading while insolvent. It applies where a director is in office when the company incurs a debt, the company is insolvent at that time or becomes insolvent by incurring the debt, and there are reasonable grounds for suspecting the company was insolvent or would become so.

Outsourcing contracts create exactly the kind of recurring debts this section is concerned with. Monthly service fees, minimum volume commitments, equipment leases and lock-in clauses all count as debts each time they are incurred. If the company's financial position deteriorates while it is locked into a costly arrangement, every new payment obligation incurred while there are reasonable grounds for suspecting insolvency extends the directors' exposure. When the company ultimately fails, the liquidator can pursue the directors personally for compensation in respect of the debts incurred during that period.

A director can defend a claim in limited circumstances, for example where there were reasonable grounds to expect the company was solvent, or where the director took reasonable steps to prevent the company incurring the particular debt. The practical point for outsourcing is that a contract signed when the company was healthy can still create liability later: the duty is assessed at the time each debt is incurred, not at the time the contract was signed.

Trigger three: workplace safety and environmental liability

Workplace health and safety law is another zone where the duty follows the work. Under s 27 of the Work Health and Safety Act 2011 (Cth) and the equivalent state and territory laws, if a person conducting a business or undertaking owes a safety duty, each officer of that business must exercise due diligence to ensure the business complies with it. The officer's duty is not discharged by hiring a provider to do the risky work. Due diligence in this context means actively checking that the business understands and meets its safety obligations, including how outsourced work is supervised, rather than assuming the provider has it covered.

Environmental protection legislation in most states and territories takes a similar approach, with executive-liability provisions that can make directors personally liable for offences the company commits with their authorisation, consent or involvement. A provider that disposes of waste unlawfully, or that carries out work without required approvals, can therefore create exposure for the directors of the business that engaged it, particularly where the directors knew of the practice or turned a blind eye.

Regulators in both areas look through the contract to the officers of the business that procured the work. The provider may also be prosecuted, but that does not stop the directors being pursued as well.

Trigger four: accessory liability for involvement

The fourth route is accessory liability. s 79 of the Corporations Act defines when a person is involved in a contravention: aiding, abetting, counselling or procuring it; inducing it; being knowingly concerned in it or party to it; or conspiring to effect it. Where the company itself breaches the law through an outsourcing arrangement, the directors who knowingly assisted, or who were knowingly concerned in, the breach can be liable alongside the company. s 181(2) makes a person involved in a contravention of the good faith duty liable in their own right.

In practice this route bites in two situations. The first is structuring: putting an arrangement in place to avoid legal obligations, such as using a provider to do work the company could not lawfully do itself. The second is knowledge: ignoring clear warning signs about a provider's conduct. Directors do not need to authorise the breach in writing; being knowingly concerned in it, including by omission where they turned a blind eye, can be enough.

Where the risk concentrates

Some situations concentrate the risk more than others:

Related-party outsourcing: where the provider is a related company and the same people sit on both boards, directors face exposure on both sides of the arrangement. A director who effectively runs the provider's affairs can also find themselves treated as a de facto or shadow director of it, with the same duties attached.
Offshore providers: enforcement against an overseas provider is harder, which increases the chance that a regulator or court looks to the Australian company and its directors. The duties do not change because the provider is in another country.
Personal guarantees: banks, landlords and equipment lessors routinely ask directors to guarantee the company's outsourcing-related debts. That liability is contractual rather than statutory, but it is personal all the same and survives the company's own failure.
Long-standing trust: a decade of trouble-free dealings with a provider does not by itself make the s 190 belief in reliability reasonable. The belief must be maintained and, where circumstances indicate a need, refreshed by proper inquiry.

When a lawyer earns their fee

Most outsourcing-related liability is preventable, and the point at which a lawyer adds the most value is before the risk crystallises:

Before signing: a review of the outsourcing contract for termination rights, audit access, service levels and indemnities, and advice on the governance the arrangement will require, such as board papers and reporting lines.
On warning signs: when a provider misses remittances, fails safety audits or falls behind on its own obligations, advice on how to respond and what to document. This is also the moment to check the company's own solvency position.
Immediately on receiving a director penalty notice: the notice period is short and the options are time-limited, so a director who seeks advice in the first days has far more room to move than one who waits.
After a failure: defending or negotiating claims from the ATO, ASIC, liquidators or regulators, and assessing insurance, indemnity and recovery options.

A commercial lawyer in this space will review the relevant contracts and board records, map the director's exposure across the four routes above, and advise on the response that protects the director personally as well as the company. D&O insurance can help with defence costs, but it does not remove the underlying exposure, and it is best arranged before a problem arises.

The failure that turns a company problem into a personal one

The director penalty notice system is the route that most often turns an outsourcing failure into a personal liability, because it needs no proof of fault: the company did not pay, the director did not act within the notice period, and the amounts become the director's own debt. The other routes all require a finding about the director's own conduct, whether a failure of consideration, knowledge of a breach or continued trading while insolvent.

The common thread is oversight. Directors who inform themselves before signing, document their reasoning and monitor what the provider actually does keep themselves inside the protection of the business judgment rule and the s 190 defence. Directors who sign and step away hand the ATO, ASIC or a liquidator a case that is already made. If the company uses outside providers for anything that touches tax, superannuation, safety or significant cost, an early conversation about how the arrangement is governed, before a failure occurs, is a small price against the alternative.