Proving Prevention: The Fraud-Assurance File UK Boards Need to Keep Current

Fraud prevention has moved from the compliance annex to the board agenda. Since the failure-to-prevent fraud offence under the Economic Crime and Corporate Transparency Act 2023 came into force in September 2025, large UK organisations have had to demonstrate that their controls are more than a collection of policies. The offence turns on whether an associated person — an employee, agent or subsidiary — committed fraud intending to benefit the organisation, and whether the organisation had reasonable fraud prevention procedures in place. The legal test is not simply whether fraud occurred. It is whether the board can show, with evidence, that the organisation was reasonably prepared.

For directors, the practical consequence is a shift in the evidence burden. A policy library may show intent. It does not show operation. The reasonable procedures file should be the board's evidence trail: a coherent account of how fraud risk has been assessed, who owns it, how third parties are controlled, how people are trained and how the board has challenged the system. The file need not be vast. It must be traceable.

The file is a chain, not a folder

Too many organisations treat the reasonable procedures file as a repository. Documents are added, policies are refreshed and training certificates are filed. The result is a folder that proves activity but not assurance. A defensible file should work as a chain: the risk assessment identifies a risk; a named owner is accountable for it; controls are designed in proportion; evidence shows the controls operating; and board minutes show that directors have tested the chain rather than merely received it.

If any link is missing, the board should know before a regulator, auditor or counterparty asks. The file should be indexed, dated and version-controlled, with a clear owner in the company secretariat or legal function. It should also be readable. A new director joining the board should be able to understand the organisation's principal fraud risks and the board's response within an hour.

Five pillars of a defensible file

Risk assessment. The assessment should be specific to the business model. Generic lists of fraud types add little. Boards should expect to see risks mapped to payment flows, procurement, sales channels, third-party intermediaries, subsidiary jurisdictions, high-risk projects and any area where discretion is exercised without a second pair of eyes. Each principal risk should have an owner, a rating, a control description and a review date. The board should record where it challenged the assessment and what changed as a result.

Top-level ownership. Responsibility should sit with a named executive and a board committee. In many companies this will be the audit committee, working with the chief financial officer, general counsel or head of risk. The important point is not the label. It is that the board can identify who is accountable, what they report, how often and to whom. 'The tone at the top' is not a substitute for a task at the top.

Third-party due diligence. Fraud risk rarely stops at the company's own payroll. Agents, distributors, subcontractors, introducers and joint-venture partners can create exposure. Due diligence should be risk-based and proportionate: basic checks for low-risk suppliers, enhanced checks for high-risk intermediaries, and ongoing monitoring rather than a one-off onboarding exercise. The file should show red flags, decisions taken, contractual rights to audit or terminate, and evidence that monitoring actually happened.

Training. Annual e-learning has its place, but it is weak evidence on its own. Training should be role-based and scenario-based, with additional depth for finance, procurement, sales, internal audit and anyone managing third parties. The file should show completion rates, but also test understanding. Boards should ask whether the training reflects the risks in the current risk assessment, and whether staff know how to raise a concern without fear of retaliation.

Board challenge. Minutes are one of the most revealing documents in the file. Do they record approval, or do they record questions? A strong minute might note that the board pressed management on why a particular third-party population had not been reviewed, or asked for a near-miss analysis after a control failure. Challenge need not be adversarial. It must be visible.

The quarterly test

The board does not need to review the entire file every quarter. It needs a repeatable test that shows the system is alive. A 60-to-90-minute exercise, run by the audit committee or the full board, can be built around four verbs: sample, trace, challenge and record.

Sample. Select three live third parties and one high-risk transaction or payment flow. Ask management to produce the relevant risk assessment entry, due diligence record, contract clause and monitoring evidence. If the trail cannot be produced quickly, that is itself a finding.

Trace. Follow one training requirement from the risk assessment to the target audience, the completion data and a sample of individual records. Check whether the content matches the risk. Check whether high-risk roles received more than the standard module.

Challenge. Ask who owns each risk, when it was last reviewed, what has changed since and what would happen if the control failed tomorrow. Review the whistleblowing log, investigation summaries and near misses. Look for patterns rather than isolated events.

Record. Capture gaps, actions, owners and dates in a short board log. Re-test a sample of the previous quarter's actions at the next meeting. The record should show progress, not just activity.

Common failure modes

Three weaknesses recur. The first is a policy library mistaken for procedures. The second is a risk assessment written for external consumption rather than internal use. The third is a board that receives assurance without testing it. Each can be corrected, but only if directors treat the file as a live governance instrument rather than a compliance artefact.

A defensible reasonable procedures file will not eliminate fraud risk. It will give the board a coherent account of what the organisation knew, what it did and how it checked. In an environment where the evidence burden has shifted towards the board, that account is not a bureaucratic extra. It is the assurance itself.