A UK business can have a signed anti-bribery policy, annual training and an approval process, yet still be unable to explain who stands behind an overseas agent, why a success fee was paid or whether a third party has political connections. Anti bribery and corruption due diligence is the process of identifying, assessing and documenting those risks before a relationship or transaction is approved. It matters because the United Kingdom's enforcement record shows that bribery risk is active, while the gap between reported incidents and prosecutions means directors, investors, solicitors, insurers and counterparties can't wait for public enforcement to expose a problem.
The practical question is not whether an organisation has a policy. It's whether the organisation can prove that it understood its third-party exposure, applied proportionate checks, challenged unexplained findings and retained an audit-ready decision trail. The approach should be scaled to the business, sector, geography, transaction and intermediary involved. A small business and a multinational won't need identical procedures, but both need a defensible explanation for what they checked and why.
This guide focuses on UK businesses and advisers, with the legal discussion centred on England and Wales. The Bribery Act 2010 applies across the UK, but wider criminal, regulatory and procedural issues can differ between England and Wales, Scotland, and Northern Ireland. The guide covers legal foundations, risk classification, screening, questionnaires, document review, red flags, contractual protections, monitoring and practical escalation.
For recruitment or onboarding decisions, a separate resource on OSINT due diligence for hiring can help readers think about how publicly available information should be gathered, assessed and recorded. That same discipline is useful when reviewing people who may act for, represent or influence a commercial organisation.
Table of Contents
- Introduction to Anti Bribery and Corruption Due Diligence
- How UK Law Shapes Your Due Diligence Duties
- Building a Proportionate Risk Framework
- Third Party Screening Questionnaires and Document Review
- Spotting Red Flags and Deciding What to Do Next
- Remediation Contractual Protections and Ongoing Monitoring
- Sector Considerations and Your Next Steps with Lighthouse
Introduction to Anti Bribery and Corruption Due Diligence
The problem a policy cannot solve
A policy states what the organisation expects. Due diligence tests whether a proposed relationship fits those expectations. The distinction becomes important where a third party will contact officials, secure permits, win public contracts, introduce customers, manage customs activity or receive a commission linked to success.
A business may know the intermediary's trading name but not the individuals who control it. It may receive a clean questionnaire but no explanation for a large round-sum invoice. It may approve a joint venture because the commercial case appears attractive, without examining payments routed through connected entities. These are not automatically signs of bribery, but they are reasons to ask better questions before commitment.
The UK Anti-Corruption Strategy 2025 states that 117,000 bribes were offered to UK businesses with employees by other UK businesses or individuals in a 12-month period. The strategy is available on GOV.UK. That figure describes the domestic risk base, not merely conduct involving overseas markets.
What a defensible file contains
An audit-ready file usually shows:
- The business rationale: why the third party, investment or transaction is needed.
- The risk profile: relevant sector, location, role, ownership, payment structure and public-sector exposure.
- The checks completed: screening, ownership verification, adverse information searches, questionnaire responses and document review.
- The unresolved points: missing records, inconsistent explanations and limitations on the work.
- The decision trail: who reviewed the findings, what conditions were imposed and who approved the relationship.
Independence also needs careful definition. Financial analysis can identify payment patterns, relationships and inconsistencies, but it isn't legal representation and doesn't replace advice from a solicitor on privilege, reporting duties, disclosure or litigation strategy. Confidentiality arrangements should be agreed at the outset, particularly where advisers, insurers, lenders or potential litigants will receive the work.
Practical rule: A proportionate review is not the shortest review. It's the review that can explain why its scope matched the risk.
The next question is how UK law evaluates those procedures, particularly where a company's associated person creates exposure that senior management didn't directly authorise.
How UK Law Shapes Your Due Diligence Duties
The UK Bribery Act 2010 remains the central legal foundation for anti-bribery and corruption due diligence. Official government guidance describes it as the first UK law to create a corporate “failure to prevent” offence, which means an organisation may face exposure where an associated person bribes another person to benefit the organisation, subject to the statutory framework and available defence.
The government guidance sets out six core compliance principles:
- Proportionality: procedures should match the organisation's size, structure, activities and risk.
- Top-level commitment: directors and senior leaders should set expectations and support an ethical culture.
- Risk assessment: the organisation should understand the nature and extent of its bribery exposure.
- Due diligence: checks should be applied to people and organisations performing services for or on behalf of the business.
- Communication and training: policies need to reach the people expected to follow them.
- Monitoring and review: controls should be tested and improved as circumstances change.
The full principles and explanatory material appear in the official Bribery Act 2010 guidance.
Associated persons in practical terms
An associated person can include a commercial agent, consultant, distributor, joint venture participant, contractor or another person performing services for or on behalf of an organisation. The label matters less than the function. If the person can affect a business outcome and receives value from the organisation, the relationship deserves a risk-based assessment.
A small company doesn't need to copy the compliance architecture of a large corporate group. It does need a credible process for identifying its intermediaries, understanding their role, checking ownership and recording approval. A larger organisation may need central registers, specialist reviews, training records and periodic monitoring across several business units. Both organisations need evidence that the process operated in practice.
Why evidence matters more than the policy
A policy can be produced after an allegation. A dated review file, approval record and documented rationale are harder to reconstruct. Evidence should show what information was available before the decision, which risks were identified, what questions were raised and how management responded.
Practical controls might include payment approval rules, conflict declarations, restrictions on cash or unusual commissions, audit rights and escalation routes. These controls should connect to the actual relationship. A generic form that never asks who owns the intermediary or why the fee is commercially justified won't demonstrate much risk understanding.
For businesses operating in regulated financial services, the FCA financial crime guide is relevant to the expectation that third-party due diligence should be risk-sensitive and should consider negative allegations and political connections. Operational checks, such as automated VAT checks, may support identity and transaction validation, but they're only one part of an anti-bribery assessment.
UK organisations also need to understand the consequences of weak procedures, which are discussed in Lighthouse's resource on non-compliance with the UK Bribery Act. The central lesson is straightforward. Compliance is demonstrated through decisions, controls and records, not through a document that sits unused.
Building a Proportionate Risk Framework
A useful framework starts with inherent risk, meaning the exposure present before controls are applied. It then considers the quality of existing controls to determine residual risk. This prevents two common errors, treating every third party as identical and treating a low-risk label as permanent.
Start with the relationship, not the form
The first assessment should ask what the third party will do. A supplier delivering ordinary goods under transparent pricing presents a different exposure from an agent who will meet officials and receive a commission for securing licences.
Relevant factors include:
- Sector: activities involving public procurement, construction, extractives, logistics, customs or permits may require closer attention.
- Geography: the operating location, ownership links and payment destinations can affect the level of review.
- Transaction: complexity, unusual structures, urgency and the commercial rationale should be documented.
- Intermediary role: an agent with discretion and limited supervision creates a different risk from a supplier with a defined deliverable.
- Ownership and connections: opaque control, political relationships and negative allegations should trigger further questions.
The FCA's risk-sensitive approach is especially useful here. Screening should not be limited to sanctions or identity. It should also consider adverse information and political connections where relevant to the relationship.
Set decision points before findings arrive
A risk framework should define what happens when information is incomplete or concerning. For example, a high-risk relationship might require enhanced ownership verification, independent confirmation of services, senior approval and contractual payment controls before onboarding. A refusal to provide basic information may itself justify escalation, even if no adverse record is found.
The framework should also record who can approve an exception. Without that step, commercial urgency tends to become an informal override.
Choosing Your Due Diligence Depth
| Risk Tier | Proportionate Checks | Evidence and Sign Off |
|---|---|---|
| Lower | Confirm identity, business purpose, ownership information and standard payment terms | Completed review record, rationale and responsible manager approval |
| Moderate | Add adverse information checks, conflict questions, references and review of the proposed contract and remuneration | Findings log, unresolved questions, finance or compliance approval |
| Higher | Verify ownership through independent records, examine political connections, test service justification, review payment routes and obtain enhanced senior approval | Full file, limitations, conditions, escalation record and documented decision |
| Very high or unresolved | Pause commitment while management obtains specialist advice, resolves material gaps or considers an alternative structure | Written hold or rejection rationale, decision-maker sign off and preservation of relevant records |
A framework should be reviewed when ownership, geography, role, payment arrangements or transaction purpose changes. Lighthouse's guidance on building a risk assessment framework can help directors structure that process without turning it into a generic checklist.
Third Party Screening Questionnaires and Document Review
Screening, questionnaires and document review answer different questions. Screening searches available information. A questionnaire obtains explanations and declarations from the third party. Document review tests whether those explanations align with contracts, invoices, ownership records and approval evidence.
Screening establishes leads
A proportionate search may consider company identity, directors, beneficial ownership, sanctions exposure, political connections, litigation information where relevant, regulatory action and adverse media. A search result isn't proof of misconduct. Names can be similar, information can be incomplete and allegations may be untested.
The file should therefore record the search date, identifiers used, sources considered, relevant findings and limitations. A clean search doesn't prove that a third party is low risk. It shows only what the selected checks did or didn't identify.
Questionnaires test the explanation
A useful questionnaire asks questions that management can assess, rather than collecting declarations that nobody reviews. It should address:
- Ownership and control: who owns, controls or benefits from the entity?
- Role and necessity: what services will be provided, and why is the intermediary needed?
- Remuneration: how was the fee calculated, and what evidence supports it?
- Conflicts: does anyone involved have personal, family, political or commercial connections relevant to the engagement?
- Public dealings: will the third party interact with officials or public bodies?
- Subcontracting: may the third party appoint another person to perform the work?
- Records: can the third party provide invoices, deliverables and supporting documentation?
Non-response should be treated as information. It doesn't automatically establish bribery, but it can prevent the organisation from reaching a reasonable conclusion. The resulting decision might be to pause, narrow the scope, impose conditions or reject the appointment.
Documents test the commercial story
Contracts should describe services, territory, remuneration, approval requirements, records and termination rights. Invoices should identify the work performed and link payment to an agreed deliverable. Ownership documents should support the stated control structure.
Triangulation is the important step. If a questionnaire says the agent performed market development, but invoices contain round sums with no work product and the contract allows unrestricted subcontracting, the inconsistency deserves escalation. The review should record the fact, the question asked, the response received and the conclusion reached.
Lighthouse's information on politically exposed person screening is relevant where political connections form part of the risk assessment. Confidentiality should be managed through controlled access, clear purpose limitation and an agreed record-retention approach. Duplicate requests from legal, finance and compliance teams can create confusion, so one controlled evidence register is usually preferable.
Spotting Red Flags and Deciding What to Do Next
A red flag doesn't prove that bribery occurred. It signals that the existing explanation isn't strong enough to support approval. The right response is proportionate escalation, not automatic accusation or automatic acceptance.
Hypothetical worked example
A UK SME proposes appointing an overseas sales agent to help secure contracts with customers that include public-sector bodies. The agent is commercially plausible, but the ownership chain stops at a corporate vehicle, the proposed remuneration is an unusual success fee, invoices are expressed in round sums and the agent is reluctant to provide supporting documents.
None of those facts proves an offence. Together, they create a material uncertainty that should prevent a routine approval.
A disciplined response would be:
- Pause commitment: no appointment or payment should proceed until the outstanding issues are assessed.
- Verify ownership independently: request corporate records and test the stated ownership against reliable independent information.
- Clarify the service: require a written description of the work, expected deliverables, territory and contact with public officials.
- Test remuneration: compare the fee structure with the actual service and require evidence supporting the calculation.
- Investigate connections: check for political relationships, conflicts and negative allegations relevant to the individuals and entities involved.
- Escalate the decision: refer unresolved issues to the designated senior decision-maker, with reasons recorded.
- Apply conditions or reject: possible conditions may include restricted payment routes, documented deliverables, no subcontracting without approval and enhanced monitoring.
Decision point: If the business can't explain the service, ownership and payment with evidence, commercial urgency shouldn't convert uncertainty into approval.
Preserve the record when concerns arise
The Serious Fraud Office's corporate guidance says organisations seeking exemplary cooperation should proactively and promptly preserve digital and hard-copy material likely to be relevant to an investigation. The SFO corporate guidance makes preservation an immediate issue once concerns arise, not an administrative task to postpone until a formal investigation begins.
The organisation should identify relevant email accounts, messaging records, accounting data, contracts, invoices, approval records and investigation notes. Access should be controlled, alterations avoided and the preservation steps documented. A financial investigation can help trace payments and test explanations, but it doesn't determine legal privilege, reporting obligations or the correct response to enforcement contact.
The following video can provide a general visual introduction to the subject. It shouldn't be treated as a substitute for a fact-specific legal or forensic assessment.
An audit-ready file should allow a later reviewer to understand the starting facts, the checks completed, the limitations encountered, the escalation route and the final decision. It should also distinguish verified facts from allegations, assumptions and unanswered questions.
Remediation Contractual Protections and Ongoing Monitoring
A concerning finding doesn't always require immediate termination. The response depends on the seriousness of the issue, the reliability of the explanation, the organisation's influence and the risk of continuing. Remediation should have an owner, a timetable, defined evidence and a clear consequence if the third party fails to respond.
Close the control gap
A remediation plan might require corrected ownership records, a revised fee structure, additional approval, staff training, restricted authority or an independent review of prior payments. It should state what must be produced and who decides whether the issue is closed.
Contracts can support the process through:
- Warranties: the counterparty confirms relevant ownership, authority, compliance and disclosure information.
- Audit rights: the organisation can inspect appropriate records connected with the services and payments.
- Payment controls: payment follows verified deliverables, approved invoices and defined bank-account requirements.
- Subcontracting restrictions: another intermediary can't be appointed without prior approval.
- Termination triggers: material misrepresentation, refusal to cooperate or breach of anti-bribery obligations has a defined contractual consequence.
These provisions won't prevent every act of misconduct. They improve visibility, create accountability and make escalation easier when facts change.
Monitor what could change
Monitoring should reflect the risk. It may involve periodic ownership checks, review of invoices and deliverables, confirmation that services were performed, renewed conflict declarations and targeted screening when an event occurs. The organisation should also revisit the assessment after a change in ownership, management, territory, payment arrangements or public-sector role.
The Bribery Act guidance's monitoring and review principle supports this emphasis on living procedures rather than static policies. The wider enforcement environment also makes evidence important. The bribery enforcement tracker records 11 bribery prosecutions and 7 convictions in 2024/25, while noting that prosecutions peaked at 27 in 2018/19 and fell to 9 in 2023/24. Those figures are set out in the bribery enforcement tracker. Public enforcement volume isn't a reliable substitute for internal detection.
Costs will depend on the number of entities, jurisdictions, records, interviews, specialist searches and reporting requirements. Independence should be agreed before work begins, including who instructs the reviewer, who receives the report and how conflicts are managed.
Sector Considerations and Your Next Steps with Lighthouse
The same framework needs different emphasis in different settings. Construction and extractives may involve permits, public procurement, agents and subcontractors. Logistics can involve customs intermediaries and time-sensitive payments. Public-sector supply chains require careful attention to tender contacts, conflicts and deliverables. Investments and joint ventures call for ownership analysis, governance rights, connected-party review and testing of the proposed commercial rationale.
Before commissioning work, directors and advisers should clarify:
- Scope: which entities, people, transactions, jurisdictions and periods are included?
- Records: what accounting data, contracts, invoices, emails and ownership documents are available?
- Independence: who will instruct the work, and are there any conflicts?
- Confidentiality: who may access the material, and how will sensitive findings be handled?
- Output: is the requirement a screening note, risk assessment, forensic analysis, investigation report or expert evidence?
Lighthouse Consultants can provide due diligence and financial analysis and investigate allegations through its bribery and corruption service. Its work can examine ownership, payments, supporting records, controls and decision trails. The work remains distinct from legal representation, and any required legal advice should come from the instructed solicitor.
A discovery discussion is most useful when the reader has the proposed relationship or transaction documents, a basic organisation chart, known concerns, payment information and a clear decision deadline. Readers can book a discussion with Lighthouse Consultants to scope the records, independence requirements, confidentiality arrangements and proportionate next steps.
Lighthouse Consultants offers independent forensic financial analysis, due diligence and risk assessment for organisations examining third-party bribery and corruption exposure. Visit Lighthouse Consultants to discuss an evidence-led review that turns fragmented records and unresolved concerns into a clear, defensible decision trail.
