How serious is that legal problem? A risk triage guide for Australian businesses

A legal problem has landed on your desk, and your instinct is to ask how to fix it. Ask a different question first: how serious is this? The answer changes everything that follows. Treat a minor paperwork issue like a crisis and you burn time, money and trust. Treat a real exposure like a paperwork issue and it will quietly escalate into something that threatens the business. The skill that separates well-run small businesses from the rest is triage: sizing a problem up accurately, then responding at the right intensity.

How to size up a legal problem before you react

Before you jump into fix mode, run the problem through a few grounding questions. They take minutes, and they stop you from either panicking over nothing or waving through something serious:

• What is the realistic downside? If nothing is done, does this end in a late fee, a refund, a dispute, a regulator penalty, or a criminal matter?
• How likely is it to escalate? Is there a party with a reason to push it forward, like an employee, a customer, a competitor, or a regulator?
• Is there a deadline? Statutory time limits and contractual notice periods run from the event itself, not from the day you notice the problem.
• Who might see this? Customers, investors, insurers and regulators each change the stakes and the story.
• Is anyone personally exposed? Directors and officers can carry personal liability that survives the company, under the Corporations Act 2001 (Cth) and other laws.

Until you have checked the facts, assume the higher level. A problem that looks like a paper cut at 9am can turn out to be a compliance matter by lunchtime once you read the contract or the regulator's letter. Classification is provisional: you revise it as the facts come in.

Both failure modes are expensive. Overreacting spends money, trust and leadership attention on problems that would have resolved themselves. Underreacting lets a deadline pass or a regulator set the agenda. The goal is not to eliminate risk, which is impossible for any operating business, but to match the response to the actual exposure.

Responding to the everyday tier: slip-ups and contract misunderstandings

The lowest tier covers the small operational failures that happen in any busy business: an ASIC lodgement that runs late, a business name renewal missed, a company register left incomplete, an outdated template, an internal approval skipped. On their own these rarely end a business. The danger is the pattern. A series of small failures reads as poor governance, and poor governance surfaces at exactly the wrong moments, during a capital raise, a due diligence process, an insurance renewal, or a regulator enquiry.

The right response to a one-off slip-up is calm and practical: fix the immediate issue, document what you did, and put a simple system in place so it does not recur. This is a sharpen-the-process moment, not a crisis meeting.

A missed renewal is a good example. On its own it costs a late fee and an afternoon. But if the same business has three missed lodgements, an incomplete register and a policy document nobody follows, that pattern is what a buyer's due diligence lawyer or a regulator will notice, and what they notice sets the tone for everything that follows.

Sitting just above that is the contract tangle, where two parties read the same words and hear different meanings. Scope creep, payment timing, deliverables that were never defined, a services agreement that never dealt with change requests, an informal arrangement that stayed informal for years. The problem is rarely bad faith, which is why it responds to a calm approach: go back to the documents and the timeline, identify the ambiguity, and work out what the parties actually intended. Sometimes that means a written variation, sometimes a deed. The point is to reset expectations in writing before the relationship hardens into a dispute, because the real cost of contract disputes is not legal fees. It is leadership time and distraction.

When regulators and employees enter the picture

Contract disputes are between two parties. Compliance issues are different: they involve rules imposed from outside, and you can breach them without meaning to. Privacy obligations under the Privacy Act 1988 (Cth) and its Australian Privacy Principles, data security, marketing and consumer law under the Australian Consumer Law, licensing requirements specific to your industry. These are often slow burns. Nothing dramatic happens at first, then a complaint lands, a regulator starts asking questions, and you lose control of the timing and the narrative.

The stakes are real. A serious interference with privacy can draw a civil penalty of up to $50 million for a body corporate under s 13G of the Privacy Act 1988 (Cth), and regulators can accept enforceable undertakings that bind the business publicly. A data breach carrying a real risk of serious harm must be assessed within 30 days under the notifiable data breaches scheme, then notified to the regulator and affected individuals. Early, transparent remediation is the best response, because many consumer-law and privacy contraventions do not require intent. Not knowing the rules rarely helps, but acting promptly and fixing the problem often does.

Employment issues escalate faster than almost anything else, because they involve emotions and statutory time limits. An unfair dismissal claim can only be brought by someone who has completed the minimum employment period, 12 months with a small business and six months otherwise under s 383 of the Fair Work Act 2009 (Cth), and the application must be lodged within 21 days of the dismissal under s 394. Employees earning above the high income threshold, around $183,100 for 2025-26, and not covered by an award or enterprise agreement, cannot claim unfair dismissal at all.

Some claims in this tier have no service requirement at all. General protections claims, which protect employees from adverse action taken because they have or exercise a workplace right, can be brought from the first day of employment, and a dismissal-related application must be made within 21 days under s 366 of the Fair Work Act. Pay disputes have also gained criminal exposure: since 1 January 2025, deliberately underpaying wages and entitlements is a criminal offence under the Fair Work Act, and the Fair Work Ombudsman can refer matters for prosecution, though employers who self-report can ask for a cooperation agreement that protects them from referral.

The response to a people problem is the opposite of improvisation: slow down, follow your own documented processes, record facts rather than opinions, and treat every email as something you may need to explain later. Handled promptly and consistently, most of these issues stop before they become formal claims.

When the stakes turn serious: money, courts and survival

The middle of the scale is where a single issue starts to cascade. A major contract breach with real damages exposure, a high-value intellectual property dispute, a cyber incident that triggers notification obligations and downstream claims, allegations of fraud or serious financial misreporting. The response shifts from general problem-solving to forensics. Get the facts before narratives harden, preserve records that can withstand scrutiny, and make decisions that are disciplined and traceable.

This is also where businesses accidentally make things worse: missing a notification deadline under an insurance policy, since many policies make notification within a set period a condition of cover, sending the wrong email, or tidying up records in a way that looks suspicious later. Do not improvise at this level.

If the problem crosses into formal proceedings, you are dealing with a different machine entirely: deadlines, pleadings, evidence, witnesses and disclosure, in the Fair Work Commission, state tribunals like NCAT, or the courts. Litigation is also a reputational event, because clients, investors and employees react to how the business behaves while it is happening. Once a dispute is reasonably contemplated, take steps to preserve documents and communications, and avoid creating written commentary that could be misread. Many matters settle, but you want to negotiate from a position of preparation, not panic. In most Australian courts the unsuccessful party usually pays the winner's costs, which is one more reason to get the assessment right before the case starts.

At the top of the scale sit the threats to the business itself: criminal investigations, serious fraud allegations, regulatory action seeking suspension or shutdown, director disqualification, insolvency. Directors who let a company trade while insolvent can be personally liable for debts incurred under s 588G of the Corporations Act 2001 (Cth), and courts and ASIC can disqualify people from managing corporations under Part 2D.6. At this level, governance becomes the priority: board oversight, clear lines of authority, careful documentation, disciplined communications, and senior legal counsel engaged without delay. Crisis communications runs alongside legal strategy, because stakeholder trust is a resource you can run out of.

What misclassification actually costs

The most expensive mistakes are not the original problem but the response to it. The costs are concrete:

• Missed deadlines: Statutory windows run from the event, not from the day you classify it. An ignored dismissal complaint becomes an unfair dismissal application with a 21-day window, and compensation can be capped at half the high income threshold.
• Lost evidence: Documents deleted after a dispute is reasonably contemplated can be attacked, and the business loses its ability to prove its side of the story.
• Gone leverage: A regulator or plaintiff who has been strung along is less willing to settle, and you have less control over timing and narrative.
• Set narratives: The story is often fixed in the first days, when a business is panicking, deleting, or promising things it cannot deliver.

The cascade is familiar: a paper cut ignored becomes a compliance crack, a people problem mishandled becomes a courtroom collision, a money storm treated like a mere dispute becomes an existential threat. Small issues become expensive ones when the level is misread.

When to bring in a lawyer: getting help from Artificer Legal

The judgement calls in this article are exactly the ones a lawyer can help you make. Is a data breach likely to cause serious harm, and therefore notifiable? Is a dismissal defensible, and does the employee's earnings or length of service even let them claim? Will a restraint clause hold up, or is it an unenforceable overreach? Is a director personally exposed, and does the business need to act before a debt is incurred? Is this a case to run, or a settlement conversation to have now?

A lawyer can also do the things this article cannot: review and redraft the contracts, policies and registers that prevent the paper cuts; run the document preservation steps once a dispute is on the horizon; respond to regulator correspondence; and put a variation or settlement in writing. At Artificer Legal we help Australian businesses triage legal issues and respond at the right intensity, so you deal with the problem you actually have, not the one it becomes.

The level you choose is a timer, not a label

The single sharpest point is this: your classification is not a description, it is a clock. From the moment a complaint is made, a dismissal happens, a regulator writes, or a debt is incurred, statutory deadlines and evidentiary clocks start running whether or not you have noticed the problem. The businesses that get this wrong are not the ones with the biggest problems. They are the ones who respond at the wrong intensity, and the level they chose on day one decides the price they pay later. Classify early, revise as facts come in, and escalate when the level rises.

In summary: triage every legal problem before you fix it, using downside, escalation, deadlines, audience and personal exposure. Keep everyday issues in perspective while fixing the pattern behind them. Treat compliance and people issues as early-warning systems and respond early and transparently. Move to a forensic, coordinated response once the stakes are financial or formal. And treat every classification as a timer: deadlines run from the event, evidence decays, and regulators do not wait for your triage to finish.