A written anti bribery and corruption policy isn't enough for most UK SMEs. A defensible anti bribery and corruption framework must show that the business identified its actual exposure, checked the people and organisations acting on its behalf, managed conflicts of interest, trained relevant staff and tested whether controls worked in practice. The right question for a board isn't “do we have a policy?” It's “could the business evidence how the policy prevented, detected or escalated a concern?”
That distinction matters because the UK combines a strong statutory framework with uneven practical execution. A policy that sits in a shared folder won't protect a business if a sales director approves an opaque intermediary, a finance team can't trace a commission, or nobody updates a conflict-of-interest register. For owners, finance directors, solicitors, insurers and individuals, the framework should be treated as a control system supported by reliable records, not as a document produced for an annual compliance exercise.
Table of Contents
- UK Bribery Enforcement: What Compliance Looks Like in Practice
- Understanding the Bribery Act 2010 and Adequate Procedures
- Conducting a Proportionate Bribery Risk Assessment
- Implementing Due Diligence and Conflict of Interest Controls
- Embedding the Framework Through Training and Monitoring
- Addressing Common Concerns About Scope and Independence
UK Bribery Enforcement: What Compliance Looks Like in Practice
A board-approved anti-bribery policy can create false confidence. The document may be polished, signed and circulated while the business still lacks evidence that high-risk transactions, intermediaries and personal relationships are controlled. The execution gap is usually clearest in two areas: conflicts of interest and third-party due diligence.
The UK's policy design is relatively strong. The OECD's 2024 UK country fact sheet says the UK meets 80% of OECD criteria for the quality of its strategic framework and 50% for practice. The gap is sharper for conflicts of interest, where the UK meets 33% of regulatory criteria and 22% of practice criteria. Those figures indicate a weakness in applying controls, rather than a shortage of formal rules.
Enforcement does not remove the need for controls
Government data indicates that bribery remains a commercial risk. The Home Office Economic Crime Survey 2024 estimated that about 1 in every 35 businesses with employees experienced a bribery incident during the previous 12 months. It also estimated that UK businesses or individuals offered roughly 117,000 bribes, with a combined value of more than £300 million. These are estimates, not a record of every undiscovered incident. They still challenge the assumption that bribery affects only large multinationals. (UK Anti-Corruption Strategy 2025)
The same government source records a financial response in the year ending March 2026. Bribery and corruption cases accounted for £33.2 million of assets restrained, £287,000 of assets denied, and £388,000 recovered through confiscation and forfeiture powers. Criminal enforcement is only one exposure. An internal investigation, regulatory inquiry, contract termination, insurer dispute or shareholder claim can create serious consequences before a prosecution concludes.
Practical rule: Design the framework to withstand an evidence review, not merely a policy review.
Boards should ask whether approval records, payment data, due diligence files and conflict declarations show how decisions were made. A third party should not pass review solely because a business sponsor recommends it. The file should show who checked the relationship, what risks were identified, which safeguards were imposed and when the assessment will be revisited.
Corporate cooperation, remediation and documented controls may also affect how a matter is handled. Lighthouse's practical background is set out in its article on deferred prosecution agreements.
Understanding the Bribery Act 2010 and Adequate Procedures
A well-written policy can still leave a company exposed. The practical test is whether people identify conflicts, assess third parties and escalate concerns before a payment or appointment creates a problem.
The Bribery Act 2010 came into force on 1 July 2011, replacing an earlier patchwork of offences with four core offences. These cover offering, promising or giving a bribe, requesting, agreeing to receive or accepting a bribe, bribery of a foreign public official, and a corporate offence for failing to prevent bribery by associated persons. The legislation itself should be read alongside Ministry of Justice guidance. The statute defines liability, while the guidance explains practical prevention principles.
The corporate offence matters particularly to mid-market companies. An organisation can face liability if an associated person bribes someone to obtain or retain business, or a business advantage, for the organisation. Senior management do not need to have authorised the conduct for exposure to arise. Individuals convicted under the Act can face up to 10 years' imprisonment plus unlimited fines, subject to the statutory process and facts of the case (Bribery Act 2010).
What adequate procedures mean in practice
A section 7 defence does not prevent scrutiny. The organisation must show that it had adequate procedures designed to prevent associated persons from undertaking bribery. The Ministry of Justice says those procedures should be proportionate to the bribery risks, the organisation's business, and its scale and complexity. (Bribery Act 2010 guidance)
The six principles form a practical operating model:
- Proportionality means matching controls to actual exposure. A domestic consultancy without intermediaries will need a different process from an exporter using agents in several jurisdictions.
- Top-level commitment requires directors and senior managers to set expectations through decisions, budgets and escalation behaviour, not only policy signatures.
- Risk assessment identifies where bribery could occur, who could facilitate it and how the business would detect it.
- Due diligence covers people and organisations performing services for or on behalf of the company. It should test ownership, relationships, capability and payment arrangements.
- Communication turns policy into usable guidance for staff who negotiate contracts, approve expenses or manage public-sector relationships.
- Monitoring and review tests whether controls operate as intended and whether changes in markets, products, ownership or personnel create new exposure.
Conflict declarations need the same operational discipline as third-party checks. A declaration that sits unread in a register offers little protection. Assign an owner, record the decision, document any recusal or safeguard, and revisit the position when the relationship changes.
Automated monitoring can support this control environment when configured around documented risks and followed by human review. An automated compliance monitoring resource may help identify gaps, but software does not replace judgement, investigation or board accountability.
Conducting a Proportionate Bribery Risk Assessment
A generic policy downloaded from the internet can't establish proportionality. The assessment should begin with how the business wins work, delivers services, pays third parties and interacts with decision-makers. That usually requires input from finance, sales, procurement, operations, legal and senior management rather than a desk exercise completed by one person.
The assessment should identify both inherent risk, before controls are applied, and residual risk, after existing controls are considered. A low-risk label shouldn't be accepted because a policy exists. It should be supported by evidence that the relevant activity is limited, transparent and subject to effective approval.
A practical assessment sequence
-
Map commercial activity. List the products, contracts, markets and routes to revenue. Mark activities involving public officials, regulated customers, public procurement, licences, permits, customs, sponsorships, gifts or charitable contributions.
-
Map relationships. Identify agents, introducers, distributors, consultants, subcontractors, joint venture partners and other associated persons. Record who appoints them, who pays them, what services they perform and whether their remuneration can be connected to an outcome.
-
Map payment routes. Review commissions, success fees, rebates, cash payments, expense claims, refunds, credits and unusual bank instructions. The assessment should explain how the finance team verifies the service and the commercial basis for the payment.
-
Consider geography and access. Overseas activity can create additional exposure, but a domestic transaction can also carry risk where an intermediary controls access to a customer or public decision-maker. The issue is the relationship and conduct, not just the country label.
-
Score and prioritise. Use clear qualitative categories for likelihood and potential impact. High-priority risks should receive deeper diligence, stronger approval, more frequent monitoring and a named owner.
-
Record the rationale. The file should explain why a risk was rated as it was, what controls already exist, what remains uncertain and when the assessment will be revisited.
The Ministry of Justice's proportionality requirement is the foundation for this approach. The UK fraud risk assessment checklist can provide a related prompt for identifying weak points, although bribery risk still needs to be assessed against the organisation's own activities and associated persons.
Evidence that makes the assessment credible
Useful evidence includes an organisation chart, revenue and procurement maps, the third-party master file, payment extracts, approval matrices, gifts and hospitality records, whistleblowing records, contract templates and previous internal audit findings. Interviews can expose workarounds that won't appear in policy documents, particularly where sales targets or operational pressure influence approval decisions.
A risk assessment is useful only when it changes a decision, such as whether to appoint an agent, alter payment terms, require additional approval or stop a transaction.
Implementing Due Diligence and Conflict of Interest Controls
Third-party due diligence is often treated as a form to complete before a contract is signed. That approach creates a file, but it may not create knowledge. A more reliable process connects the proposed relationship to the service, ownership, payment, decision-makers and ongoing conduct.
The first review should verify the third party's registration details, legal name, trading identity, address and stated business activity. The organisation should then assess beneficial ownership, identify relevant management and consider whether the proposed contact has a personal, family or commercial connection to the customer or public official involved. Sanctions and other restricted-party screening should be documented, with a clear process for resolving a potential match rather than only recording that a search occurred.
A control design that survives scrutiny
A risk-based process can separate routine relationships from those requiring enhanced review. Higher-risk indicators may include an unexplained request for urgency, an unusually high commission, vague deliverables, payment to an unrelated account, reluctance to provide ownership information, insistence on cash, or a close connection to a decision-maker. None of these indicators proves bribery, but each should trigger questions and a documented response.
Contracts should describe the services, remuneration, records to be maintained, audit rights, compliance obligations and termination rights. Payment should follow evidence of work performed and approval by someone who isn't responsible for originating the relationship. Procurement teams may find this guide for procurement teams useful when defining the information required before a vendor relationship proceeds.
Conflict-of-interest controls deserve the same attention as third-party checks. A workable register should capture the person making the declaration, the relevant outside interest, the relationship or transaction affected, the date, the reviewer, the mitigation and the next review date. A declaration with no recorded decision is incomplete.
The process should also answer practical questions:
- Who must declare? The scope should cover directors, employees and contractors whose roles expose them to purchasing, sales, hiring, customer selection or public-sector interaction.
- When must declarations be made? Use onboarding, role changes, new transactions and periodic attestations, with an immediate escalation route for new concerns.
- Who decides? Allocate approval to an independent manager or committee with authority to remove the conflicted person from the decision.
- What happens next? Record whether the interest is permitted, managed through safeguards, transferred to another decision-maker or rejected.
The OECD assessment identifies conflicts of interest as a material execution gap in the UK framework. Registers should therefore be maintained as live control records, not archived declarations gathered for appearances. Lighthouse's anti-bribery and corruption due diligence service describes a process for identifying, assessing and documenting bribery risks before a relationship or transaction is approved.
A short training video can help procurement and finance staff recognise the difference between a completed form and a documented control decision.
Embedding the Framework Through Training and Monitoring
A framework becomes credible when employees use it during ordinary commercial decisions. A policy that describes prohibited conduct but doesn't tell a project manager how to handle an urgent request, a supplier referral or an expensive hospitality invitation will fail at the point where risk arises.
Training should be role-specific. Finance staff need to understand payment descriptions, supporting documents, unusual bank instructions and approval segregation. Procurement staff need to recognise ownership gaps, undisclosed relationships and pressure to bypass onboarding. Sales and operations staff need practical guidance on intermediaries, gifts, hospitality, charitable contributions and dealings with public officials.
Replace attendance with evidence of understanding
Scenario-based sessions are more useful than a general reminder that bribery is prohibited. A business might ask participants to decide how they would respond when an intermediary requests a revised commission, a customer asks for an informal payment, or a colleague discloses a family relationship with a supplier. The training record should capture the audience, topics, attendance, questions raised and any control changes that followed.
Communication also needs to reach people outside the organisation. Contracts, onboarding materials and supplier communications should explain expected standards and reporting channels. The message should be consistent with actual commercial behaviour. A company that says compliance matters but rewards staff for bypassing review creates a conflict between written expectations and operational incentives.
Monitoring should combine preventive checks with testing after a transaction has occurred. Suitable techniques include sample-based review of commissions and expenses, review of changes to supplier bank details, examination of manual journal entries connected to third-party payments, checks of hospitality records and comparison of contract terms with invoices. Testing should be designed around the risk assessment, rather than selecting convenient files.
Build a review cycle
Management should define indicators that prompt investigation, such as overdue due diligence, missing declarations, repeated exceptions, split payments, unusual credit notes or approvals made after payment. The indicator isn't evidence of misconduct by itself. It tells the responsible person where the underlying records need examination.
Internal audit or an independent reviewer can test whether controls operate consistently across business units. The review should distinguish between a control that exists and one that has been performed, evidenced and escalated when it failed. Findings should have an owner, an action, a target date and a method for confirming closure.
The framework should be revisited after acquisitions, new markets, significant changes to the sales model, new intermediaries, control failures or allegations. A static document can't reflect a changing business. A monitored framework can show the board where exposure has changed and whether resources remain proportionate.
Addressing Common Concerns About Scope and Independence
Boards often hesitate because they expect a full review to disrupt operations or produce an open-ended project. The better response is disciplined scoping. The first stage can focus on the highest-risk revenue streams, third-party population, payment types and conflict-of-interest processes, with expansion only where the evidence justifies it.
Cost should be assessed against the decision the work needs to support. A board may need assurance over a control environment, a finance director may need transaction testing, a solicitor may need an independent factual analysis, and an insurer may need loss quantification linked to a specific allegation. Those are different assignments and shouldn't be priced or managed as though they require the same evidence.
Define the assignment before collecting records
A clear scope should state:
- The question: whether the business needs prevention advice, an investigation, transaction testing or financial quantification.
- The period: the relevant dates and the reason for selecting them.
- The population: entities, accounts, third parties, contracts, payments or individuals included.
- The output: a control assessment, factual report, schedule of transactions, investigation report or expert analysis.
- The limitations: incomplete records, unavailable witnesses, restricted systems access or assumptions requiring confirmation.
The evidence plan should preserve original records where possible and document how exports, emails, accounting data and interview notes were obtained. Reconciliations between invoices, contracts, bank records and general ledger entries can reveal whether a payment has a genuine commercial basis. Missing records shouldn't automatically be treated as proof of bribery, but their absence should be recorded and its effect on the conclusion explained.
Independence matters most where allegations involve senior employees, important customers, related parties or an internal control owner. The person reviewing the matter should not have approved the transaction, designed the challenged control or benefited from the outcome. An external forensic accountant can provide an independent analysis of financial records and discrepancies, but that work isn't legal representation and doesn't guarantee recovery, a prosecution or a court outcome.
Confidentiality and privilege need careful handling
Confidentiality depends on the engagement structure, the people involved, the systems used and the purpose of the work. Legal privilege is a legal issue that should be considered with the organisation's solicitors before interviews, document reviews or reports begin. A forensic report should avoid making legal conclusions outside the agreed role and should separate verified facts, assumptions, analytical findings and unresolved questions.
A proportionate review can still be rigorous. It might begin with a control map and targeted sample, then move to expanded transaction testing if red flags emerge. It might instead identify that a process is sound and close the work with improvements that management can implement. The decision should follow the evidence, not a pre-set assumption that every concern requires a full investigation.
Board question: Can the organisation show who approved the relationship, what was checked, what service was delivered, how the payment was justified and what happened when an exception appeared?
Lighthouse Consultants offers forensic financial analysis, anti-bribery and corruption investigations, due diligence, risk assessments and internal audits within an agreed scope. The work can examine transactions, trace fund movements and document discrepancies, while the engagement structure addresses records, independence, confidentiality and reporting expectations.
Lighthouse Consultants can help boards, finance directors, solicitors and insurers scope an anti bribery and corruption review around the relevant transactions, third parties and control questions. To discuss the records available and the proportionate next step, visit Lighthouse Consultants.
