ECCTA’s Corporate Offence for Fraud guidelines: How to review your existing fraud and control framework

The ‘base fraud’ offences that come under ECCTA are broader than the three offences under the Fraud Act 2006.  These include:

The committing of any of these by an associated person in a way which intends to confer a relevant benefit is likely to come under the FtPF offence. Does your fraud risk and control framework account for all of these offences?

The FtPF offence is not intended to penalise firms when a fraud is committed against it, but only where a fraud includes an actual or potential intended benefit to the firm or to clients to whom the associated person provides services for or on behalf of the firm arising from the fraud.

The intention to benefit does not have to be the sole or even the dominant motivation for the fraud. For example, a relationship manager may misrepresent the benefits and / or risks an investment product in order to increase sales and their bonus payment.  The increased sales also bring a benefit to the company and so the offence would apply.

Please note that this is based on the circumstances at the time the fraud was committed.  If the firm is statutorily required at a later date to reimburse clients who have been the victims of misselling, this will not be relevant to the benefit arising at the time the fraud was committed.

Does your fraud risk and control framework include the identification, assessment and control of ‘benefit’?

Two key control issues are particularly relevant:

1. Identifying who is an ‘associated person’; and
2. Understanding when it is relevant

An employee, agent or subsidiary of an organisation is automatically an ‘associated person’ for the purposes of the FtPF offence. A person who provides services for or on behalf of the organisation is also an associated person while they are providing those services. It is important to note that ‘providing services for or on behalf of an organisation’ does not include providing services to the organisation.

An associated person is defined by reference to all the circumstances, and substance over form is to be applied.  A person may be an associate based on what they do, even if there is no formal contract.

Does your fraud risk and control framework adequately identify associates of your firm?

The actions of the associated person must have a UK nexus to trigger the FtPF offence. This means one of the following:

• One of the acts of base fraud must have taken place within the UK; and/or
• The related gain or loss must have occurred in the UK. This must be actual gain or loss, not just intended loss.

This means that, if an associated person based in Johannesburg commits a base fraud that benefits a firm in the UK, a UK nexus will have been achieved.

It is also worth noting that even an overseas based firm could commit the FfPF offence if one of its associated persons committed a base fraud, either in the UK, or that created a gain or a loss in the UK, in which case the whole organisation might be prosecuted.

Is your fraud risk and control framework equipped to identify all the possible situations that might create a UK fraud nexus?

The fraud prevention framework put in place by relevant organisations should be informed by a number of principles.

Top-level commitment

This requires a proactive approach from Senior Management across the firm, in particular those charged with governance.

There is strong emphasis on the role of top-level management in creating an appropriate fraud prevention culture. This includes:

• Communicating and endorsing the organisation’s stance on fraud, including articulating the consequences for anyone carrying out a fraud
• Making a case for the importance of and advantages of good anti-fraud compliance. This should include identifying and countering any arguments which might seek to undermine this
• Ensuring clear governance
• Providing a strong commitment to training
• Ensuring appropriate resourcing, and leading by example

Can your Senior Management demonstrate that it is actively involved in preventing fraud?

Risk Assessment

Due to the breadth and potential complexity of defining an ‘associated person’, the Home Office Guidance suggests that an organisation’s fraud risk assessment begins by identifying all associated persons of the organisation.

The Guidance provides extensive examples of risk best practice in the context of fraud (which cannot be reproduced here, given the volume of Guidance). 

Senior Management may consider taking third party advice on fraud typologies, as these typologies require a detailed understanding of the motives for fraud, the methods that are used and the mentality of different types of fraudsters.  Fraud today is very different to fraud of only a few years ago.

Other issues to consider include:

• Areas of higher fraud risk, both from inside and outside the firm, cyber enabled and non-cyber frauds
• Identification of associated persons, including those who may be de facto associated by their role but non formally under contract
• Assessing the risk of associated persons and a realistic assessment of controls that may be applicable

Senior Management should review these requirements against any existing fraud risk assessments and consider any required additions or changes.

Proportionate risk-based fraud prevention procedures and due diligence

An organisation’s procedures to prevent fraud by associated persons should be proportionate to the nature, scale and complexity of the organisation’s activities, and the fraud risk it faces. They must also be clear, practical, accessible, effectively implemented and enforced.

Given the importance of fraud prevention controls, rigorous testing may be appropriate.

If controls already exist that achieve what is needed to provide a suitable defence to the FtPF offence, there is no need to duplicate them.

Proportionate procedures may include:

• Identification and mitigation of motivation, rationalisation and opportunities for fraud
• Identification and control of ‘one-off’ frauds which may lead to the normalisation of fraud
• Putting in place appropriate consequences for committing fraud
• The use of appropriate technologies
• The development and use of management information, including KPIs linked to the prevention and detection of fraud

Does your fraud risk and control framework cover these issues and any others that might be relevant?

Communication (including training)

Senior Management should ensure the provision of risk-based, proportionate training to all relevant staff and other associated persons.  In particular specific, tailored training might be appropriate for associated persons who perform tasks or occupy roles with a higher risk of opportunities for relevant fraud.

Senior Management should ensure that staff and other associated persons are familiar with the firm’s whistleblowing policies and procedures.  Whistleblowing is one of the most effective controls for detecting potential or actual fraud. 

Do you have an appropriate, risk-based training programme so that all relevant staff are aware of the fact and implications of fraud risk and your firm’s approach to mitigation?

Monitoring and review

Organisations must monitor and review their fraud detection and prevention procedures and make improvements where necessary. This includes learning from investigations and whistleblowing incidents

It also includes reviewing information from its sector-specific analysis of fraud trends and typologies.

Monitoring and review of fraud prevention measures might include:

• Monitoring financial controls
• Collecting data in relation to fraud prevention training courses (and any test results)
• Reviewing procedures (for example, due diligence procedures) and updating them where necessary
• Monitoring contractual arrangements with associated persons
• Reviewing fraud detection analysis and management information on the effectiveness of fraud prevention measures

Do you have an appropriate, programmes to monitor and review your fraud prevention controls?