Declared Once, Assumed Forever: A Practical Conflicts Register Audit for UK Firms

A conflicts register is often treated as a document to be completed rather than a control to be operated. The annual declaration is circulated, returned, filed and counted. The register is then regarded as current until the following cycle. In practice, the business does not wait for the calendar. Directorships change, shareholdings move, family interests evolve, advisory roles are taken on, and gifts or hospitality are accepted in the ordinary course of commercial relationships. The register may remain tidy while the underlying facts become stale.

The central difficulty is evidentiary. A signed declaration confirms that an individual answered the questions put to them on a particular date. It does not confirm that the questions were adequate, that the answers were tested, or that nothing changed afterwards. A clean register is therefore not proof that no conflict exists. It is proof that a process ran. The compliance question is whether that process was designed to detect the conflicts the firm actually faces.

Start with the declaration cycle, not the register

An audit should begin by reconstructing how declarations are gathered. Review the wording of the annual return, the population to which it was sent, the response rate, the escalation route for non-returns and the treatment of joiners, leavers and role changes. A register that is complete but built on a 70% response rate is not complete. A register that has no mechanism for mid-year updates is a snapshot, not a record.

Test whether the declaration asks open questions as well as closed ones. A form that invites a yes or no answer to “Do you have any conflicts?” places the burden of recognition on the declarant. Many conflicts are not recognised as such by the individual concerned, particularly where the interest is indirect, familial or commercial rather than personal. The audit should ask whether the form prompts for specific categories: directorships, shareholdings, consultancy, family relationships with suppliers or customers, political or public appointments, and outside employment.

Use change events as the trigger for re-testing

The most reliable way to keep a conflicts register current is to link it to events that alter the risk profile. These include appointments and promotions, changes in reporting lines, the award of new contracts, the onboarding of significant suppliers, corporate transactions, restructures and changes to board composition. Each event should prompt a targeted question rather than waiting for the next annual cycle.

The audit can test this by selecting a sample of individuals who have changed role or responsibility during the period and checking whether their declaration was refreshed. The same approach applies to counterparties. If a new supplier was onboarded, was the relationship checked against the register? If a director joined another company, was that directorship captured? The absence of a refresh is not necessarily a breach, but it is a control gap that should be understood and remediated.

Map related parties beyond the individual declarant

Conflicts frequently sit one step away from the person completing the form. A director may have no personal shareholding in a supplier, but a spouse or adult child may. A senior manager may not sit on the board of a customer, but may act as an adviser to it. These indirect interests are difficult to capture through a self-declaration alone.

The audit should therefore compare the register against other available records: Companies House filings for directorships and shareholdings, procurement records for supplier ownership, HR records for family relationships where lawfully held, and board or committee papers that refer to external appointments. This is not an exercise in suspicion. It is a reconciliation of the register against the documentary trail the firm already holds. Where the two do not align, the compliance team has a specific question to ask rather than a general request for reassurance.

Cross-check gifts and hospitality

Gifts and hospitality registers are often maintained separately from conflicts registers, yet they are a practical source of conflict intelligence. A pattern of hospitality from a single supplier, or a series of modest gifts to the same team, may indicate a relationship that should be declared. The audit should sample gifts and hospitality entries and test whether the recipients appear on the conflicts register and whether the entries were reviewed by the appropriate approver.

The cross-check works in both directions. If a conflict has been declared, does the gifts and hospitality record show related activity that was not escalated? If a gift was approved, was the underlying relationship considered? Discrepancies are not automatically adverse findings, but they are evidence that the two registers are not speaking to each other.

Test the board minute against the register

Board and committee minutes are a useful independent check. They record decisions, appointments, related-party transactions and declared interests at the point of decision. The audit should select a sample of minutes and compare the interests declared in the meeting with the entries in the register. If a director declared an interest in a transaction but the register contains no corresponding entry, the register is incomplete. If the minute records no declarations at a meeting where a related-party matter was discussed, the audit should ask why.

This testing also reveals whether the register is used as a decision aid or merely maintained as a filing obligation. A register that is consulted before appointments and transactions is a live control. A register that is completed annually and never opened in between is an archive.

Conclude with a proportionate remediation plan

The output of the audit should not be a pass or fail verdict. It should be a short, evidenced assessment of where the register is current, where it is stale and which gaps matter most. Prioritise by risk: undisclosed interests in significant suppliers, related-party transactions, and interests held by those with approval authority should be addressed first. Record the remedial actions, assign owners and set a review date.

The wider lesson is one of design. A conflicts register is only as good as the questions it asks and the events that refresh it. A declaration signed months ago cannot answer for a business that has changed since. The audit exists to close that gap before the register is relied upon in a decision, a transaction or a regulatory conversation where a stale entry becomes a much larger problem.