Responding to the new corporate offence, the ‘Failure to Prevent Fraud’ under the Economic Crime and Corporate Transparency Act (ECCTA)
The UK government introduced a new corporate offence, the 'Failure to Prevent Fraud', as part of the Economic Crime and Corporate Transparency Act, which will come into effect from the 1st of September of this year
This offence targets large organisations that meet at least two of the following criteria: they have a turnover of over £36 million, their assets are worth more than £18 million, or they have more than 250 employees.
So, what are the key takeaways from this new corporate offence for a General Counsel in a large organisation? Well, a large organisation can be held criminally liable for fraud committed by their employees, agents, subsidiaries, or other associated persons unless they can prove they had 'reasonable procedures' to prevent fraud.
The UK Government has provided guidance that highlights six key principles for putting those ‘reasonable procedures’ in place.
- First, there’s Top-Level Commitment, meaning that leadership needs to actively promote a zero-tolerance stance on fraud and making sure employees feel safe reporting any concerns.
- Next is Risk Assessment –to pinpoint the specific fraud risks that your organisation faces. To start, the focus should be on what’s known as the “fraud triangle,” which includes the opportunity, motive, and rationalisation behind fraudulent acts.
For the identified fraud risks, your organisation should create an action plan to help mitigate and control those risks. Also, transaction monitoring is crucial for spotting any unusual or suspicious patterns that could suggest fraud.
- Then, we have Proportionate Prevention Procedures; this means developing risk-based prevention plans, aligned with the risk tolerance of your organisation, taking into account the nature, scale and complexity of its operations.
- Due Diligence is also crucial—this involves integrating fraud screening risks into existing processes and reviewing them regularly. Your due diligence procedures should be clearly articulated and should be proportionate to the identified risk.
- Communication and Training come next; it’s important to clearly communicate the risks of fraud both internally, for example, to your employees and externally, such as to your suppliers. It is essential to train your staff so they understand their role in fraud prevention.
- Lastly, Monitoring and Review are essential. Organisations should continuously monitor their fraud detection and prevention procedures as well as make adjustments based on insights from investigations and whistleblower reports.
In essence, the UK government's guidance is closely aligned with best practices in corporate governance and fraud prevention, and reflects a great deal of what most companies are already doing.
But what’s distinctive about the guidance is that it specifies that in the event of a fraud committed within an organisation, its defense must be able to demonstrate that it had reasonable procedures in place to prevent fraud at the time it happened – shifting the focus from an external threat (or people taking money from me) to both internal and external threats.
