Govt’s fraud prevention guidance not comprehensive enough

The new criminal offence of failure to prevent fraud is the most important development this century in corporate criminal liability. The offence is narrowly drafted in terms of who can commit it (only large organisations). But it is broadly drafted in terms of how it can be committed. The fraud offences that must be prevented by large organisations are numerous and wide-ranging in scope. They can be committed at every level of a large organisation, in every sphere of commercial activity, by associated persons internal or external to the organisation, whether inside or outside the UK. There can be no doubt that this poses an immense compliance challenge.

So one would expect Government guidance about this offence to be legally accurate, comprehensive and to provide clarity. The guidance published last week makes no legal errors, but whether it is comprehensive or clear is open to question.

First, given the broad remit of the offence, the guidance should have done more than give only eight examples of how it can be committed. Yes, examples are only ever illustrative. And yes, the nature of an organisation’s business will determine the practical scenarios where they are most at risk. But whereas the parameters of bribery and tax evasion (the subjects of previous corporate failure to prevent offences) are narrow and usually well understood, fraud is anything but. Nothing emphasises the amorphous nature of fraud than numerous and detailed examples of when, and how easily, it can be committed. Comprehensive guidance would have done this.

Second, the offence hinges on two ambiguous concepts which the statute leaves undefined. The organisation is only guilty if the person committing the fraud “intends to benefit” the organisation, but the organisation is not guilty if it was the “actual or intended victim” of the fraud. Organisations are entitled to expect clarity about the circumstances in which they can become criminally liable. But the guidance devotes a mere page to attempting to explain these two critical concepts. It says nothing about the (relatively frequent) scenarios where organisations are both an intended beneficiary and an actual victim of another person’s conduct. These are difficult legal issues, to be sure, but that is precisely why they require exposition and clarity.

Third, whilst this type of guidance should not be prescriptive, it is remarkable how tentative some of it seems. The guidance is clear that organisations “must” do certain things to avail themselves of the reasonable prevention procedures defence. It also tells us that organisations “should” do certain things. Then, at other points, we are told only that organisations “may wish to consider” particular measures, or that those measures “might need” to be considered. Yes, reasonable prevention procedures will always be tailored to the specific risk profile of an organisation, but the guidance is sometimes frustratingly impressionistic about whether the procedures being discussed are genuinely regarded as reasonable.

In summary, the guidance is welcome as far as it goes, but it dodges some difficult bullets, with the result that it is not as comprehensive or clear as it should have been. It is instructive to compare it to the recent guidance published by the Equality and Human Rights Commission on the new duty on employers to prevent sexual harassment. The EHRC guidance is nearly double in length, with over 50 practical examples of when sexual harassment can arise and what employers are expected to do to prevent it, despite sexual harassment being less nebulous than fraud. In guiding large organisations as to how they should prevent fraud, the Government should have taken a leaf out of the EHRC’s book.

First published in FT Adviser on 20th November 2024.