Why This Matters
The UK Serious Fraud Office (SFO) has released guidance to help companies self-report fraud, bribery, and corruption. This includes a new email address for corporate legal representatives to contact the SFO's director of legal services and updates to the Corporate Cooperation Guidance from April 2025. The SFO aims to streamline the process for entering deferred prosecution agreement (DPA) negotiations. Matthew Wagstaff, the SFO's director of legal services, emphasized that a quicker, clearer path benefits everyone involved.
For internal auditors, the key takeaway is that a faster route to DPA negotiations benefits organizations that can make quick, informed decisions. It penalizes those that delay. Your role isn't to decide on self-reporting; that's for the board and legal counsel. Your job is to ensure the organization can execute that decision effectively. This guide will help you prepare.
Preparing for Implementation
Before you start building your readiness plan, gather the following:
- Written Authority: Obtain sign-off from general counsel and, ideally, the audit committee chair to confirm you're developing a readiness protocol.
- Current Guidance: Secure the SFO's updated self-reporting guidance and the April 2025 Corporate Cooperation Guidance as controlled documents.
- External Counsel on Call: Confirm which firm handles SFO-related matters and ensure engagement terms are in place.
- Whistleblower Hotline Data and Procedures: You'll need these for testing in step 3.
- Policy Exception Registry: Have your fraud, bribery, and corruption policies ready for the Policy Gap Analysis in step 2.
- Access to Your GRC Platform: Ensure all evidence, owners, and timestamps are documented in one governed location.
Step-by-Step Implementation
Step 1: Define and Document the Decision Chain
Create a one-page escalation protocol. Identify who receives initial allegations, who decides on escalation, who instructs external counsel, and who contacts the SFO. Record specific roles and deputies, not just titles.
Ensure the SFO contact decision rests with legal and the board, not audit or compliance alone. Internal audit should provide facts and evidence under legal privilege.
Store this protocol in your GRC Platform as a controlled document with an owner and review date.
Step 2: Conduct a Policy Gap Analysis
Review the Corporate Cooperation Guidance and list all cooperative behaviors. Create a matrix with expected behavior, supporting internal processes, evidence of operation, and any gaps.
Treat this as Control Objective Mapping. Assign each cooperation expectation a control objective, owner, and test. Log gaps as findings with a remediation plan and deadlines.
Step 3: Test Preservation and Collection Capability
Cooperation credit relies on intact, retrievable evidence. Conduct a tabletop exercise with legal, IT, and HR using a hypothetical scenario, like a suspected improper payment. Record:
- How quickly a legal hold is issued
- Suspension of auto-deletion for named custodians
- Retention of departing-employee devices and mailboxes
- Device imaging and chain of custody logging
Check retention policies on messaging platforms. Discovering a 30-day chat purge during a live matter is problematic.
Step 4: Pre-Stage the Internal Investigation Workflow
Document how investigations start, who leads them, how privilege is protected, and how interview records are handled. Ensure investigators are independent of the business line under review. Define a standard evidence index format for easy packaging for counsel.
Link your Whistleblower Hotline triage rules to this workflow, including Retaliation Protection safeguards for reporters. A cooperative posture is quickly undermined if reporters are mistreated.
Step 5: Prepare the Communication Protocol for the New Email Route
The new email address changes first contact procedures, making discipline essential. Establish these rules:
- Only authorized legal representatives contact the SFO.
- A second lawyer reviews every outbound message.
- Initial contact is factual and limited. Counsel decides on scope and withholding information until facts are verified.
- Log all correspondence with date, sender, recipient, and a controlled copy in the matter file.
- Internal audit, compliance, and business staff should not contact the SFO independently.
Keep the contact address in a controlled reference, verified against the SFO's published guidance.
Step 6: Brief the Board and Audit Committee
Provide a concise readiness summary: the protocol, gap findings, tabletop results, and remediation dates. Boards that have seen this information before an incident can decide faster during one. Record the briefing in committee minutes.
Validation: How to Verify It Works
- Tabletop Re-Run: After remediation, repeat the exercise with a different scenario and compare timings for hold issuance, custodian coverage, and escalation.
- Access Test: Confirm that every named role in the decision chain is current, reachable after hours, and has a trained deputy.
- Evidence Sampling: Select closed hotline cases and verify they can be reconstructed end to end from your records.
- Control Testing: Apply standard test steps to each control objective from step 2 and document results. Align with your existing COSO Internal Control-Integrated Framework if applicable.
- Independent Challenge: Have external counsel review the protocol and tabletop outputs for blind spots.
Maintenance and Ongoing Tasks
- Quarterly: Verify decision chain roles and contact details; review hotline trend data for patterns.
- On SFO Guidance Changes: Re-run the step 2 gap matrix and update the controlled document.
- Annually: Repeat the tabletop with a new scenario and test legal hold and retention settings after platform changes.
- After Real Investigations: Conduct a lessons-learned review and update the protocol.
- Continuously: Keep the Policy Exception Registry clean. Long-lived exceptions to anti-bribery controls attract scrutiny.
Readiness is about having evidence you can produce on demand. If the protocol exists only in a lawyer's head, it's not a control.
