Failure to prevent fraud: what counts as reasonable procedures?

On 1 September 2025 the failure to prevent fraud offence in the Economic Crime and Corporate Transparency Act 2023 (ECCTA) comes into force.¹ From that date a large organisation can be prosecuted if a person associated with it commits a specified fraud intending to benefit it, unless the organisation can prove it had reasonable fraud prevention procedures in place.² With weeks to go, boards are asking a practical question: what do failure to prevent fraud reasonable procedures look like, and what evidence would stand up if a prosecutor asked to see it? This article works through the six principles in the Home Office’s statutory guidance one at a time, setting out what good evidence looks like and where organisations commonly fall short.³

The reasonable procedures defence

Section 199(4) gives the organisation two routes to a defence. It must prove either that, when the fraud was committed, it had in place such prevention procedures as it was reasonable in all the circumstances to expect it to have, or that it was not reasonable in all the circumstances to expect it to have any prevention procedures at all.² The second route is narrow. The Home Office guidance accepts that in some limited circumstances it may be reasonable not to introduce measures against a particular risk, but it is equally clear that it will rarely be considered reasonable not to have even conducted a risk assessment.³

Three features of the defence shape everything that follows:

• The burden is on the organisation. The guidance confirms that the organisation must prove the defence on the balance of probabilities, and that procedures are judged as they stood at the time the fraud was committed.³ A framework launched after an incident does not help.
• The guidance is not a safe harbour. It is issued under section 204 of the Act, but following it does not guarantee the defence, and departing from it does not automatically mean the procedures were unreasonable.⁴³
• Proportionality cuts both ways. A light framework can be reasonable for a low-risk business; a sophisticated policy suite can be unreasonable if it ignores the risks that matter.

The offence applies only to large organisations: bodies corporate and partnerships that meet two or more of three conditions in the financial year before the year of the fraud, namely turnover of more than £36 million, a balance sheet total of more than £18 million and more than 250 employees.⁵ For a parent undertaking, the test is applied to the group as a whole.⁶

The guidance organises reasonable procedures around six principles: top-level commitment; risk assessment; proportionate risk-based prevention procedures; due diligence; communication (including training); and monitoring and review.³ Anyone who built adequate procedures under the Bribery Act 2010 will recognise the shape, because the Ministry of Justice guidance on that Act is built on six closely matching principles.⁷ That familiarity helps, but it is also a trap: a bribery programme does not address false accounting, misleading sales practices or falsified regulatory returns.

Failure to prevent fraud reasonable procedures at a glance

The table maps each principle to the procedures we would expect to see and the evidence to retain. It is a working summary, not a checklist that guarantees the defence.

Principle	Practical procedures	Evidence to retain
Top-level commitment	Board-approved anti-fraud statement; named accountable executive; head of ethics and compliance (or equivalent) with direct access to the board or CEO; ring-fenced budget	Board and committee minutes; terms of reference; signed statement; budget papers; board management information on fraud risk
Risk assessment	Documented assessment of fraud for the organisation’s benefit, by associated person type and base offence, using opportunity, motive and rationalisation	Dated, approved risk assessment; workshop records and data sources; scoring rationale; record of risks accepted, with the name and position of the approver
Proportionate procedures	Controls mapped to each priority risk; review of incentives and targets; conflicts, access and segregation-of-duties controls; disciplinary consequences	Risk-to-control mapping; control test results by people independent of the design; incentive scheme reviews; disciplinary records
Due diligence	Inventory of everyone who performs services on the organisation’s behalf; risk-tiered checks; contract clauses; fraud checks in mergers and acquisitions	Third-party register with risk tiers; onboarding and refresh files; contract clause tracker; acquisition due diligence and integration plans
Communication and training	Role-based training for high-risk posts; messages from senior and middle management; third-party communication; independent speak-up channels	Training needs analysis; completion and assessment data by role; communications log; whistleblowing management information
Monitoring and review	Detection analytics; investigation protocol; periodic formal review of the whole framework, internal or external	Monitoring plan and results; investigation log and lessons learned; review reports with tracked actions; board reports

Top-level commitment

The guidance is direct about where responsibility sits.

Responsibility for the prevention and detection of fraud rests with those charged with the governance of the organisation.

Home Office, guidance to organisations on the offence of failure to prevent fraud

It expects senior leaders to communicate and endorse the organisation’s stance against fraud, to set clear governance for the prevention framework, to commit to training and resourcing, and to lead an open culture in which people speak up. Formal statements might include a commitment to reject fraud even where that costs business in the short term, the names of the people and departments responsible, and the consequences of breaches. Governance should allocate named responsibility for activities such as risk assessment approval, prevention, detection, testing, investigations and whistleblowing, and the head of ethics and compliance (or a similar person) should have direct access to the board or CEO. The guidance also expects decisions and actions to be minuted and resources to be sustained over the long term.³

What good evidence looks like: minutes showing real board discussion and approval of the risk assessment and framework; a named executive owner; a sustained budget line; and regular board reporting on fraud committed for the organisation’s benefit as well as fraud against it.

Common gaps:

• The board’s fraud agenda is built entirely around the organisation as victim. This offence concerns the opposite case: fraud committed to benefit the organisation or its clients.
• Ownership is split between legal, compliance, finance and risk, with no one accountable for the framework as a whole.
• A tone-from-the-top statement exists, but nothing shows that it reached the business or that leaders challenged the “everyone does it” rationalisations the guidance warns about.

Risk assessment

The guidance expects a risk assessment that is dynamic, documented and kept under regular review. It suggests starting with the types of associated person, such as agents, contractors providing services and staff in sensitive roles, and then using the fraud triangle to ask where the opportunity, motive and rationalisation for fraud exist. It points to emergency scenarios as a source of risk and asks organisations to classify inherent risks by likelihood and impact, with reasons. Assessments are typically repeated at consistent intervals, annually or once every two years, and external developments may trigger an earlier or partial review. Any decision not to implement procedures against a specific risk should be documented, together with the name and position of the person who authorised it.³

The assessment needs to be anchored to the base offences in Schedule 13 of the Act, which include fraud by false representation, failing to disclose information and abuse of position, false accounting, false statements by company directors, fraudulent trading and cheating the public revenue.⁸ In practice, that means asking where people acting for the organisation could mislead customers, investors, funders, regulators or counterparties to win or keep business.

What good evidence looks like: a dated, approved assessment listing risks by business area and associated person type; workshop notes and data sources; a short rationale for each score; and a record of the risks accepted and who accepted them.

Common gaps:

• The existing fraud risk register is relabelled. It covers payment fraud, theft and cyber attacks, but little about mis-selling, misleading product claims, manipulated performance data or falsified compliance returns.
• Third parties are missing. Agents, introducers, outsourced service providers and subsidiaries are often outside the scope of the assessment, even though they can be associated persons.
• Motive is ignored. Sales targets, bonus metrics and funding deadlines are rarely examined, even though the guidance names them explicitly.

Proportionate procedures

The third principle, which the guidance calls proportionate risk-based prevention procedures, expects procedures that are clear, practical, accessible, effectively implemented and enforced. The guidance groups them around the fraud triangle: reducing opportunity (for example through vetting, procurement controls, segregation of duties, conflict of interest management and access controls over sensitive data), reducing motive (for example by reviewing bonus structures and managing unrealistic time pressure), and reducing rationalisation. It describes “ethical fading”, where one-off frauds become normalised as people rationalise them over time. It also expects clear consequences for breaches, plans for emergency measures, and testing of the prevention plan by people who were not involved in writing it. Compliance with other regulation may cover some fraud risks, but being regulated is not in itself enough.³

For listed companies, the guidance notes the overlap with the UK Corporate Governance Code, under which boards will be expected to declare the effectiveness of material controls for reporting years beginning on or after 1 January 2026. Controls assessed for that purpose need not be duplicated, but compliance with the Code is not sufficient on its own.³

What good evidence looks like: a mapping from each priority risk to the controls that address it; policies and procedures that staff can actually follow, written for the process rather than for the file (our policies, procedures and SOPs work focuses on exactly this); test results from someone independent of the design; and records showing that incentive schemes were reviewed through a fraud lens.

Common gaps:

• A policy library that does not map to the risk assessment, so nobody can show which control addresses which risk.
• Controls designed to stop money leaving the organisation, with few designed to stop misleading information leaving it.
• Disciplinary consequences that exist on paper but are applied inconsistently.

Due diligence

A person is associated with an organisation if they are an employee, agent or subsidiary, or otherwise perform services for or on its behalf, judged on all the relevant circumstances rather than only the contract.² The guidance clarifies that supplying goods does not make someone an associated person, and that providing services to the organisation, as external lawyers or auditors do, is not in itself enough.³

Due diligence should be risk-based. The guidance mentions tools such as third-party risk platforms, screening, internet searches, trading history, checks on professional status and vetting where appropriate. It expects contracts with those who provide services on the organisation’s behalf to include compliance obligations and termination rights, and suggests monitoring the wellbeing of staff and agents where stress, targets or workload could drive fraud. For mergers and acquisitions, it suggests checking for criminal or regulatory charges, reviewing tax documentation, assessing the target’s fraud prevention measures and integrating them after completion, noting that a target below the large-organisation threshold may not have relevant procedures.³

What good evidence looks like: a single, risk-tiered inventory of those who act on the organisation’s behalf; onboarding and refresh files proportionate to each tier; a tracker of which contracts carry the new clauses; and acquisition files showing fraud prevention was considered before and after the deal.

Common gaps: procurement due diligence focused on solvency rather than conduct; legacy agent and introducer contracts that will not be renewed for years; and no clear view of which subsidiaries’ employees could act to benefit the parent.

Communication and training

The guidance expects prevention policies to be communicated and understood throughout the organisation, with messages coming from middle management as well as the top. Training should be proportionate to risk, with extra focus on the highest-risk posts, and should cover the nature of the offence and the organisation’s procedures. Third parties should be trained or should have their own arrangements, effectiveness should be monitored, and content should be kept current. On whistleblowing, the guidance points to board-level accountability, independent reporting channels, training for managers who receive concerns, prompt investigation, protection against victimisation and feedback to the person who raised the concern.³

Speak-up arrangements matter because they are one of the main ways fraud comes to light. The Association of Certified Fraud Examiners’ 2024 Report to the Nations, based on 1,921 cases from 138 countries and territories, found that 43% of frauds were detected through tips.⁹

What good evidence looks like: a training needs analysis linking roles to risks; completion and assessment results by role; a log of management communications; and whistleblowing data showing reports, outcomes and timeliness.

Common gaps: generic e-learning assigned to everyone; no communication to agents and contractors; and speak-up channels framed around harassment or theft, so staff do not realise that pressure to misstate results or mislead customers is something they can report.

Monitoring and review

The final principle has three strands in the guidance. Detection includes analysis of procurement, payments and invoicing, monitoring of unauthorised data access, and consideration of data analytics and AI, with someone named to collate and verify fraud management information for the board. Investigations need defined triggers, clear authorisation, documented decisions, independence and reporting to the board, with lessons learned fed back. Review covers staff feedback, investigation and whistleblowing outcomes, relevant prosecutions and deferred prosecution agreements, and formal periodic reviews with documented findings, which may be carried out internally or by an external party.³

Internal audit is well placed to give independent assurance over the framework, whether the function is in-house or outsourced; we compare the two models in our article on outsourced versus in-house internal audit. Where a concern does arise, an independent fraud investigation protects the integrity of the findings, particularly where senior people may be implicated.

What good evidence looks like: a monitoring plan with results; an investigation log that records decisions and lessons; a formal review report with actions, owners and dates; and board papers showing that the actions were followed up.

Common gaps: analytics aimed only at duplicate payments and supplier fraud; no protocol for deciding when to bring in external investigators; and no one responsible for reviewing the framework as a whole. Because the defence is judged at the time of the fraud, a framework that is reasonable in September 2025 may not be two years later if the business has changed and the assessment has not.

How we can help

Our fraud risk management service helps large organisations build and evidence reasonable procedures: a fraud risk assessment anchored to the base offences, a gap analysis against the six principles, and a practical improvement plan. We also draft clear policies, procedures and SOPs, carry out independent fraud investigations, and support corporates and listed companies with independent internal audit. If you want a second opinion before 1 September, book a free 20-minute call.

This article is general guidance, not legal advice. Take advice on your organisation’s specific circumstances.

Frequently asked questions

What are reasonable procedures for the failure to prevent fraud offence?

They are fraud prevention procedures that it was reasonable in all the circumstances to expect the organisation to have in place when the fraud happened. The Home Office guidance organises them around six principles: top-level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication including training, and monitoring and review. What is reasonable depends on the risks the organisation actually faces.

When does the failure to prevent fraud offence come into force?

The offence in section 199 of the Economic Crime and Corporate Transparency Act 2023 comes into force on 1 September 2025. Organisations are judged on the procedures they had in place at the time a fraud is committed, so procedures need to be operating, not just planned, from that date.

Does following the Home Office guidance guarantee the defence?

No. The guidance states that it is not a safe harbour, and departing from it does not automatically mean that procedures were unreasonable. The organisation must prove on the balance of probabilities that its procedures were reasonable, which is why documented evidence matters as much as the procedures themselves.

References

1. legislation.gov.uk (The National Archives), 13 March 2025. The Economic Crime and Corporate Transparency Act 2023 (Commencement No. 4) Regulations 2025 (SI 2025/349)
2. legislation.gov.uk (The National Archives), 26 October 2023. Economic Crime and Corporate Transparency Act 2023, section 199: Failure to prevent fraud
3. Home Office, 6 November 2024. Economic Crime and Corporate Transparency Act 2023: guidance to organisations on the offence of failure to prevent fraud
4. legislation.gov.uk (The National Archives), 26 October 2023. Economic Crime and Corporate Transparency Act 2023, section 204: Guidance about preventing fraud offences
5. legislation.gov.uk (The National Archives), 26 October 2023. Economic Crime and Corporate Transparency Act 2023, section 201: Meaning of large organisation
6. legislation.gov.uk (The National Archives), 26 October 2023. Economic Crime and Corporate Transparency Act 2023, section 202: Meaning of large organisation: parent undertakings
7. Ministry of Justice, 11 February 2012. Bribery Act 2010 guidance
8. legislation.gov.uk (The National Archives), 26 October 2023. Economic Crime and Corporate Transparency Act 2023, Schedule 13: Failure to prevent fraud: fraud offences
9. Association of Certified Fraud Examiners, 20 March 2024. ACFE Report to the Nations: Organizations Lost an Average of More Than $1.5M Per Fraud Case