Health and Safety Due Diligence: What the Gibson Decision Means in Practice
Health and safety due diligence is no longer something New Zealand executives and directors can treat as background noise. Gibson v Maritime New Zealand [2026] NZHC 813 didn't set an impossible standard, however it confirmed what the standard actually is and made clear that good intentions, a large safety team and active board oversight aren't enough if the information reaching decision makers isn't the right kind of information.
If you haven't read my full breakdown of the case, I published a detailed analysis on LinkedIn when the appeal was dismissed. This article is about what comes after you understand the ruling: what I've been seeing in real businesses since the High Court handed down its judgment and what it means if your board is in the position the Ports of Auckland board was in.
Quick Answer on Officer Due Diligence
Health and safety due diligence under the Health and Safety at Work Act 2015 requires officers to take reasonable steps to verify that critical controls are actually working in practice, not just that a safety system exists on paper. The Gibson decision confirmed that monitoring activity levels isn't the same as getting credible information about real operational risk. Boards and executives need reporting that shows what's actually happening, not just what the system says is happening.
What the Gibson Ruling Actually Confirmed
Anthony Gibson wasn't a bad chief executive and the courts went to some lengths to acknowledge what he did right: an expanded health and safety team, external audits, a health and safety steering committee, health and safety leadership training, a computerised reporting system and Have Your Say workshops with staff. The trial judge accepted those initiatives were positive and that he was considered "a good leader who was dedicated to the port and its staff".
A 31-year-old stevedore was killed at the port on 30 August 2020 when a container came loose during a twin lift. Mr Gibson was convicted in the District Court, fined $130,000 and ordered to pay $60,000 in costs. The High Court dismissed his appeal against both conviction and sentence on 31 March 2026.
The courts focused on the gap between what the system said was happening and what was actually happening on the ground. The port had a rule keeping workers three container widths clear of an operating crane, however the training and documents explaining it were confusing and inconsistent and non-compliance was widespread on the night shift. Safety observations were being done, yet the trial judge found observation of night shift workers was sporadic at best even though around half the port's work happened at night. My sense is that Mr Gibson was tracking whether observations were happening, not whether they were showing him the real picture.
That gap between work as imagined and work as done is what this case is about.
The trial judge set out the standard plainly. An officer can't simply assume the information they get from the people below them is accurate and sufficient: they must be "in a position to properly monitor, verify and interrogate the information they receive". Presence in the business doesn't meet that standard and neither does activity data, only credible information about whether critical controls actually work.
The Due Diligence Gap Most Boards Have Not Closed
Here's the specific failure the Gibson case identifies and the one I see repeated across New Zealand businesses of all sizes.
The board's job isn't to audit the hazard register, it's to define the standard the hazard register is scored against.
Plenty of businesses have never formally decided what an acceptable level of residual risk looks like for their operations. They have risk scores, matrices and reports, however nobody has ever asked at what point they'd stop an operation because the residual risk was too high.
That question about where the board's risk tolerance sits is the most powerful governance lever a board has. Without an answer every risk score in the business is measured against an undefined standard. The number is real, the benchmark isn't.
My view is that Gibson makes this an officer-level accountability question as well as a management one. If the board hasn't defined the threshold and the reporting isn't designed to show whether it's being breached, I don't believe the due diligence obligation under HSWA is being met.
Common Mistakes New Zealand Boards Make With Health and Safety Reporting
Most boards aren't failing because they're indifferent to safety, they're failing because their reporting was never designed to answer the questions that matter.
The most common mistakes I see include:
Receiving activity data and treating it as risk intelligence. Knowing that 14 inspections happened last month isn't the same as knowing whether those inspections are finding what matters.
Approving systems without ever verifying they've been implemented. A board that approves a management system and doesn't track whether it's actually in place hasn't met its obligation.
Never defining what level of risk is tolerable. If the board hasn't said what an unacceptable residual risk looks like, every risk score in the business is measured against nothing.
Accepting documents as evidence that a risk is controlled. A signed document isn't a controlled risk, as the Gibson case shows.
Having no critical risk framework at all. If the business has never formally identified the risks that could kill someone it can't prioritise its controls and the board can't ask the right questions about them.
Excluding the safety function from decision-making. When the H&S advisor has no seat at the table and no authority pathway, the information that should reach the board gets filtered out before it arrives.
Three Questions Your Board Should Ask of Every H&S Report
If your board can't answer these three questions from its current reporting, the reporting isn't fit for purpose.
Does this report tell me what might go wrong next or only what happened last month?
What's the highest uncontrolled risk in this business right now and what's being done about it?
Is the residual risk on our most critical operations within the threshold we have defined as acceptable?
The third question is the one most boards can't answer. The information usually exists somewhere in the business, however the reporting was never designed to bring it to governance level.
The Advanced Safety View
I work with boards and executive teams across New Zealand and Australia who are doing a great deal right. Since the Gibson ruling I've had a lot of calls from organisations that believe they're compliant and want to be certain.
What I consistently find isn't negligence, it's the same gap the court identified in the Gibson case. The system produces information without producing intelligence, so activity data reaches the board while emerging risk doesn't.
The Gibson standard is now set and the question isn't whether your board intends to meet it. It's whether your current reporting gives you any way of knowing if you are.
Frequently Asked Questions About Officer Due Diligence and the Gibson Decision
What did the Gibson ruling actually decide? The High Court dismissed Anthony Gibson's appeal in Gibson v Maritime New Zealand [2026] NZHC 813 and upheld his conviction for failing to meet his due diligence duty as an officer under the Health and Safety at Work Act 2015. The courts accepted he'd done a lot for health and safety, however found he hadn't taken reasonable steps to ensure an effective exclusion zone around operating cranes or to verify that it was being followed in practice.
Does the Gibson ruling mean I can be prosecuted even if I have a safety system in place? Yes, having a safety system doesn't on its own satisfy the due diligence duty. The courts acknowledged Mr Gibson's extensive safety initiatives and still upheld his conviction because the systems weren't picking up what was really happening on the night shift. This is general guidance only and businesses should get specific advice on their own obligations.
What is the difference between monitoring safety activity and obtaining credible information? Monitoring activity means tracking whether safety processes are happening: inspections completed, training finished, observations logged. Obtaining credible information means checking whether those processes are actually revealing and controlling real risk. The Gibson case turned on that distinction.
What should health and safety reporting to a board include? Board reporting should go beyond activity data. It should identify the highest uncontrolled risks in the business, explain whether critical controls are working in practice, surface emerging risk patterns and make clear whether residual risk is within the organisation's defined tolerance. If it doesn't cover those things it isn't giving officers the credible information the due diligence duty calls for.
What is a critical risk framework and does my board need one? A critical risk framework identifies the specific risks in your business that could cause a fatality or serious harm if left uncontrolled. Without one the board has no basis for prioritising its attention or defining an acceptable level of residual risk. Gibson shows boards need structured, credible information about those risks, not just activity summaries.
What to Do Next
The Gibson judgment isn't a warning to reckless organisations, it's a signal to well-run ones that good intentions aren't the same as due diligence.
If your board is receiving reports full of activity data and has never asked whether those reports tell you what might go wrong next, you have the same gap the court identified. It's worth closing before it becomes a legal question.
This article is general guidance only and isn't legal advice. Businesses should get specific professional advice when applying health and safety duties to their own operations.
About the Author
Matt Jones is the founder of Advanced Safety and a HASANZ-registered health and safety consultant. He's a Professional Member of NZISM and holds a Graduate Diploma in Occupational Safety and Health.
Keep reading
Latest update: 5 November 2026
