Reasonable Procedures, Defensible Records: A Director's Fraud Prevention Audit for 2026

The failure to prevent fraud offence, introduced by the Economic Crime and Corporate Transparency Act 2023, has been part of the corporate landscape since 1 September 2025. The novelty has worn off; the questions have not. For boards in Leeds and London, the practical issue in 2026 is less whether a policy exists than whether it would hold up if someone asked a straightforward question: what did you actually do, and why?

The offence applies to large organisations meeting two of three thresholds relating to turnover, balance sheet total and employee numbers. It captures a body corporate where an associated person — an employee, agent, subsidiary or other person performing services — commits a specified fraud offence intending to benefit the organisation. There is a defence: having in place such fraud prevention procedures as it is reasonable in all the circumstances to expect.

That defence is where the board's attention belongs. What follows is a framework of questions, not a template. That distinction matters: a duplicated policy document demonstrates diligence far less convincingly than a record of decisions taken in response to identified risk.

Question one: have we identified our risk, or merely asserted it?

The published guidance is explicit that procedures should be proportionate to risk. Proportionality presupposes a risk assessment. Boards should ask which parts of the business could realistically produce a fraud for the organisation's benefit: sales teams under pressure on targets, procurement functions dealing with intermediaries, financing arrangements, grant or subsidy applications, regulatory submissions, and any operation that relies on agents overseas.

A useful test is whether the assessment distinguishes between business lines. If the same document is said to apply equally to a high-volume consumer operation and a small advisory team, the analysis has probably not been done. The record should show which risks were ranked higher, what changed since the last review, and who signed it off.

Question two: do our third-party controls bear scrutiny?

Associated persons are the heart of the offence. Due diligence should therefore be evidenced at the point of appointment — ownership and control, adverse media, sanctions exposure, the basis of remuneration, and the nature of the services actually rendered. Beyond onboarding, boards should ask about the controls that operate during the relationship: periodic refresh for higher-risk counterparties, contractual rights of audit, clarity on who may commit the organisation, and a route to terminate.

Two further tests are worth applying. First, can the business identify who acts for it in each market without consulting an out-of-date spreadsheet? Second, are payments to intermediaries authorised by someone with the information to question them?

Question three: is training evidenced, or merely delivered?

Most organisations can produce a slide deck. Fewer can show completion rates by function, attendance by senior management, and follow-up where a team's engagement was poor. Training should be differentiated: a sales director and a finance analyst face different risks and should not be trained identically.

Board members should consider whether they themselves have received training. It is difficult to maintain that procedures are reasonable where those accountable for them have not participated in them.

Question four: where does a concern go, and who decides?

A whistleblowing channel that exists only in a policy is not a control. Directors should test the route in practice: is it accessible, independent of line management, capable of preserving confidentiality, and does it reach someone with authority to act? Equally important is the escalation path when a concern involves a senior individual or a significant commercial relationship.

The governance question is who makes decisions on the difficult cases, on what criteria, and how those decisions are minuted. A named committee with a defined escalation standard is generally more defensible than a general statement that concerns will be investigated.

Question five: what does our documentary trail actually show?

The offence is not proven by intent to defraud; it turns on procedures. In practice, this means the evidence a regulator or prosecutor would review consists of board minutes, risk registers, due diligence files, training records, monitoring outputs, and the record of any incidents and remedies.

Boards should commission a short file review on that basis and ask a simple question of each document: does this tell a reader what we decided, when, and with what information? Generic papers that note a policy was approved, without discussion of the underlying risk, are thin.

Turning paper into governance

The most common weakness is not a missing policy but an untested one. A half-day exercise in which the board takes three plausible fraud scenarios — a distributor with an unusual commission structure, an undisclosed relationship between a procurement manager and a supplier, an inaccurate application for a government-backed scheme — and traces the response through the existing procedures will reveal more than another document review.

Where the exercise exposes gaps, the remedy should be recorded with an owner and a date. That record is itself part of the defence.

How counsel can assist without taking ownership of the risk

The obligation is the board's, and it should remain so. Legal advisers can add value by stress-testing the risk assessment, reviewing third-party due diligence against the identified risks, drafting or refining escalation protocols, and advising on document retention and privilege where an internal review is contemplated.

There is a sensible line to be drawn. Counsel should not be positioned as the function that owns compliance, nor should their involvement be presented as a substitute for management action. What counsel can do is make the reasoning visible — and ensure the governance record reflects decisions that were genuinely taken rather than decisions that were assumed.

For directors in Leeds, London and elsewhere, the fair question to ask in 2026 is not whether the organisation is compliant, but whether it could demonstrate the basis on which it reached that conclusion. The answer should be found in the files, not in the policy library.