The Fraud Offence Maturity Test: What ‘Reasonable Procedures’ Really Demand of UK Boards in 2026

From policy project to board assurance

The failure to prevent fraud offence has now settled into the compliance calendar of large UK organisations. For boards, the important question is no longer whether a policy exists. It is whether the organisation can demonstrate that its procedures are reasonable, proportionate and actually operating. That shift in emphasis is uncomfortable for some boards because it turns fraud prevention from a document-management exercise into an assurance discipline.

The offence, introduced through the Economic Crime and Corporate Transparency Act 2023, applies to large organisations meeting the statutory size thresholds. The reasonable procedures defence is familiar in outline, but it is often interpreted through an anti-bribery lens. That is a mistake. Fraud risk is broader and more dispersed than bribery risk. It can sit in procurement, payroll, expenses, revenue recognition, claims handling, customer refunds, inventory, third-party intermediaries and internal reporting. A generic anti-bribery policy will not, on its own, answer the questions a board should be asking in 2026.

Why borrowed frameworks create false comfort

Many organisations have adapted anti-bribery procedures because they are readily available, well understood and supported by existing controls. That is a sensible starting point, but it is not a substitute for a fraud-specific assessment. Bribery risk tends to concentrate around interactions with public officials and intermediaries. Fraud risk is more likely to be embedded in routine financial processes, delegated authorities and performance pressure.

The practical danger is false comfort. A board may see a policy, an annual e-learning completion rate and a third-party due diligence process, and conclude that the defence is in place. A prosecutor or regulator may ask different questions. Was the fraud risk assessment specific to the business model? Were high-risk processes tested? Did the board receive meaningful management information? Were red flags escalated and remediated? Did smaller suppliers receive proportionate scrutiny, or were they assumed to be low risk because of their size?

A four-part stress test for 2026

1. Risk assessment with commercial specificity

A credible fraud risk assessment should identify typologies that matter to the organisation, not just categories copied from a template. It should map fraud risk by business unit, geography, process, system and third-party relationship. It should consider internal fraud, external fraud, procurement collusion, payment diversion, invoice manipulation, payroll fraud, expense abuse, asset misappropriation and financial reporting pressure.

The board should be able to see which risks are rising, which controls are relied upon and where residual risk has been accepted. A useful test is whether the assessment would change if the business entered a new market, acquired a subsidiary or changed its commission structure. If it would not, it is probably too static.

2. Due diligence that follows the risk

Due diligence should be proportionate, but proportionality is not an excuse for a tick-box exercise. High-risk intermediaries, agents, suppliers and acquisition targets should be subject to enhanced checks. Lower-risk relationships can be handled through lighter-touch screening, but the rationale should be documented.

The supplier dimension deserves particular attention. Larger organisations are increasingly asking smaller suppliers to evidence their own fraud controls. That cascade is understandable, but it can become unhelpful if it produces a mini anti-bribery questionnaire for every low-value supplier. A better approach is to tier suppliers by fraud exposure, ask focused questions about payment controls and ownership, and use contractual rights where appropriate. Smaller suppliers should not be treated as inherently risky, but neither should they be exempt from proportionate enquiry.

3. Training that tests judgement, not memory

Annual e-learning has its place, but completion rates are weak evidence of a functioning control. Training should be role-based and scenario-driven. Finance teams need to recognise payment diversion and invoice fraud. Procurement teams need to understand collusion and conflicts of interest. Customer-facing teams need to spot application fraud and refund abuse. Senior managers need to understand escalation, investigation and remediation.

Boards should ask whether training content reflects actual incidents and near misses. They should also ask whether staff know how to raise concerns without fear of retaliation. A whistleblowing channel that is technically available but practically unused is not a strong assurance signal.

4. Board oversight with an evidence trail

The board does not need to run the fraud programme, but it does need to own the tone and receive credible assurance. That means a named executive owner, clear reporting lines, regular management information and a documented challenge process. The audit committee or risk committee should see trends in incidents, investigations, control failures and remediation. Board minutes should show that fraud risk was discussed, not merely noted.

A useful stress test is to ask what evidence the organisation could produce within five working days if challenged. Could it show the risk assessment, the control testing results, the training approach, the due diligence methodology, the incident log and the board discussion? If the answer depends on assembling documents from different teams after the question is asked, the procedures may be less mature than the board believes.

The supplier cascade and the evidence chain

Smaller suppliers are now being drawn into the fraud-prevention conversation because large organisations cannot fully outsource their risk. A supplier that handles payments, customer data or procurement decisions can create exposure for the larger counterparty. The response should be calibrated. Focus on the fraud risk that the relationship actually creates, rather than on the size of the supplier.

Practical steps include risk-tiered questionnaires, targeted contractual warranties, payment verification controls and, where appropriate, a right to audit or request evidence of internal controls. Large organisations should also avoid duplicating requests that suppliers already face from other customers. A shared, proportionate approach is more likely to produce meaningful responses than a long form that encourages copy-paste answers.

Common failure points

The most common weaknesses are predictable: policies that are not owned by anyone; risk assessments that are not refreshed; due diligence that stops at onboarding; training that is measured by completion rather than understanding; and board reporting that is long on activity and short on outcomes. Another frequent gap is the absence of a clear investigation and remediation process. If a red flag is raised, who investigates, by when, and what happens to the finding?

Boards should also be wary of treating fraud as purely a financial crime issue. It can be a conduct issue, a data issue and a reputational issue. The reasonable procedures defence is not a guarantee of immunity, but a well-evidenced programme can demonstrate that the organisation took its responsibilities seriously. In 2026, that evidence should be tested before it is needed, not after.