A procurement decision is about to be approved, a solicitor has identified a relationship with another client, or a director has realised that a supplier is connected to a family member. The practical question is the same: how can the organisation prove that it identified the conflict, assessed the risk, took a proportionate decision and preserved an independent audit trail? Effective conflict of interest management is the answer, but a signed declaration alone won't usually provide that assurance.
Table of Contents
- What Conflict of Interest Management Covers in the UK
- The UK Legal and Regulatory Framework You Must Work Within
- Running a Five-Stage Conflict Risk Assessment
- Disclosure Templates and Policy Content That Withstand Scrutiny
- Remediation and Escalation Through a Hypothetical UK Scenario
- Monitoring, Audit and Training Controls That Close the Gap
- Practical Checklist and Common Reader Questions
What Conflict of Interest Management Covers in the UK
Conflict of interest management is an auditable control system for identifying, disclosing, assessing, mitigating and monitoring circumstances in which private interests could improperly influence, or appear to influence, an organisational decision. It applies to directors, employees, board members, suppliers, regulated professionals and public-sector decision-makers.
The classification affects the response:
- Actual conflict: A private interest is already relevant to the decision.
- Potential conflict: Circumstances could create a conflict later.
- Perceived conflict: A reasonable observer could question the decision-maker's independence, even where no improper influence occurred.
A declaration is only the starting point. Directors operate under statutory duties, solicitors under professional rules, and public bodies under procurement requirements, including the Procurement Act 2023. One set of facts can therefore create corporate, regulatory, procurement and evidential consequences at the same time.
The National Audit Office's work on managing conflicts of interest shows why monitoring deserves the same attention as disclosure. Its survey found that 96% of departmental public bodies required annual declarations from senior staff, while only 40% required them from all staff. It also found that 71% had no management information on compliance. A register can therefore look complete while the organisation cannot demonstrate whether staff declared, whether reviews occurred or whether controls were followed.
Four controls create an auditable system
A defensible framework connects four building blocks:
- An up-to-date register: It records relevant interests, changes and nil returns rather than relying on informal knowledge.
- A written policy: It covers financial, personal, professional and relational interests, with clear responsibilities and review points.
- A risk-based assessment: It considers the seriousness of the interest, its proximity to the decision and the person's influence.
- An audit trail: It records who reviewed the issue, which safeguards were chosen and whether the decision proceeded.
The register is evidence, not the whole control. A board paper, tender evaluation, client file or approval record should show how the declared interest affected the decision. Lighthouse's guidance on corporate governance, roles, risk and reporting is relevant where governance documents must connect declared interests with board-level accountability.
Practical rule: A declaration starts the assessment. It does not finish it.
The UK Legal and Regulatory Framework You Must Work Within
The legal test depends on the person's role and the transaction. A director's statutory duty shouldn't be treated as interchangeable with a solicitor's professional obligation, and neither should be collapsed into a general public-sector ethics policy.
For directors, section 175 of the Companies Act 2006 requires avoidance of situations in which a director has, or can have, a direct or indirect interest that conflicts, or possibly may conflict, with the company's interests. Section 177 addresses disclosure of an interest in a proposed transaction or arrangement. The statutory framework is concerned with actual and possible conflicts, not only proven misconduct. Directors must also consider the wider duty to promote the success of the company under section 172, including the likely consequences of decisions and the interests of relevant stakeholders. The Companies Act 2006 provisions on directors' duties should be read alongside the company's articles and any board approval requirements.
The Bribery Act 2010 also matters where a conflict creates an avenue for improper influence, concealed payments or preferential treatment. For a commercial organisation, the section 7 failure-to-prevent offence makes the adequacy of procedures relevant to the organisation's position. Conflict controls won't replace an anti-bribery programme, but weak declarations, approval routes and monitoring can form part of the factual picture.
For solicitors in England and Wales, the SRA conflicts guidance states that a solicitor must not act where there is an own-interest conflict, or a significant risk of one. Acting for multiple clients in the same or related matter is also restricted where duties conflict or may significantly conflict. The narrow exception requires substantially common interests or a shared objective, informed written consent, suitable confidentiality safeguards where appropriate, and reasonableness in acting for everyone. Money-handling consequences must also be considered under the SRA Accounts Rules.
Public bodies must apply the applicable procurement regime, including the Procurement Act 2023 and, where relevant, the Public Contracts Regulations 2015. The Transparency International UK review of NHS commissioning found that, in 2018–19, around £1.5 billion was paid to companies partly or wholly owned by members of Clinical Commissioning Group boards, across the 150 groups reviewed. That evidence illustrates the financial exposure created when declarations, recusals and register controls fail in procurement and health governance. The Economic Crime and Corporate Transparency Act guidance provides useful context for the broader compliance environment.
The Nolan Principles remain relevant to public life, particularly integrity, objectivity, accountability and openness. The following table shows the distinction in practical terms.
UK duties by role at a glance
| Role | Primary source | Triggering event | Required action |
|---|---|---|---|
| Company director | Companies Act 2006, sections 172, 175 and 177 | Direct or indirect interest that conflicts or may conflict, or an interest in a proposed transaction | Avoid the situation where required, disclose the interest and follow the company's approval arrangements |
| Solicitor | SRA Code of Conduct and SRA Accounts Rules | Own-interest conflict or conflict between current or prospective clients | Do not act unless the narrow exception applies, obtain informed written consent where relevant and protect confidentiality |
| Contracting authority | Procurement Act 2023 or Public Contracts Regulations 2015 | Conflict affecting a procurement decision or participant | Identify, assess, mitigate and record the conflict and measures taken |
| Public office-holder | Applicable conduct framework and Nolan Principles | Private interest affecting public duties | Declare, withdraw or apply an independent decision route, with records sufficient for review |
Document-heavy legal and procurement work also benefits from controlled conversion, redaction and versioning. A resource on best PDF tools for lawyers may help legal teams organise those records, but a document tool cannot decide whether a conflict is acceptable or whether consent is informed.
Running a Five-Stage Conflict Risk Assessment
A risk assessment should produce a decision, not just a category. The following hypothetical example illustrates the method without treating the numerical scoring model as a statutory test.
A procurement manager's spouse runs a company bidding for a contract. If the manager sits on the evaluation panel, the interest is close to the decision and the ability to influence the outcome is direct. If the manager only logs tenders and has no access to evaluation material, the underlying relationship remains relevant, but the proximity and influence are lower.
The five stages
1. Identify and scope. List the decisions, people, suppliers, clients and approval points in scope. Ask who can influence the decision, who receives information and who benefits from the outcome.
2. Categorise the interest. Use a consistent taxonomy, such as direct financial, indirect financial, familial, professional, secondary employment and post-employment interests. Consistency makes later review easier.
3. Score the risk. A hypothetical internal model might score severity, proximity and influence from one to five. The figures are not legal conclusions. They provide a transparent way to explain why a panel member requires stronger controls than an administrative logger.
4. Select mitigation. Options include disclosure alone, recusal, independent review, contract amendment, withdrawal from the procurement or, in serious circumstances, termination of the relationship. The chosen control should match the risk rather than the convenience of the decision-maker.
5. Sign off and review. Record the reviewer, decision, rationale and review interval. Reassess after a change in ownership, role, tender stage, client instruction or family relationship.
An organisation that handles high volumes of enquiries may separate administrative intake from conflict assessment. Guidance on remote legal intake staffing can help explain that distinction, but outsourced administration doesn't transfer the organisation's responsibility for the conflict decision.
A documented business risk assessment template can provide structure, provided the template is adapted to the relevant statutory, regulatory and procurement context.
Disclosure Templates and Policy Content That Withstand Scrutiny
A policy withstands scrutiny when it tells people what to declare, when to declare it, who decides the response and what evidence must remain. Generic wording about acting with integrity isn't enough if employees can't recognise indirect interests, family connections, outside work or post-employment relationships.
A Companies Act section 175 policy should address at least these matters:
- What counts as a direct or indirect interest.
- Which people and decisions fall within scope.
- Initial, annual and change-based declaration duties.
- The process for recording nil returns.
- Who assesses severity, proximity and influence.
- Available safeguards, including recusal and independent review.
- Approval, escalation and appeal routes.
- Retention, monitoring, training and review responsibilities.
The register should capture enough information for another reviewer to reconstruct the decision.
Conflict Register Entry Mandatory Fields and Worked Example
| Register Field | Purpose Under UK Rules | Worked Example Entry |
|---|---|---|
| Date | Establishes when the organisation received the declaration | 15 September, current procurement cycle |
| Parties | Identifies the decision-maker and connected person or entity | Procurement manager, spouse, bidding supplier |
| Financial interest | Describes the relevant economic connection | Spouse owns and manages the bidding supplier |
| Relationship | Explains the personal or professional connection | Immediate family relationship |
| Mitigation | Records the safeguard applied | Manager removed from evaluation and tender communications |
| Reviewer | Shows independent assessment and accountability | Head of procurement, with compliance review |
Disclosure wording should identify the risk, not merely announce an interest. A workable formulation is:
“The declarant discloses an interest that may conflict, or may be perceived to conflict, with the organisation's interests. The reviewer has considered the nature of the interest, its proximity to the decision and the declarant's influence. The agreed safeguard is recorded below, and the declarant must notify the organisation if the circumstances change.”
Informed consent for a regulated professional matter should be more specific:
“The client has been informed in writing of the relevant duty, the nature of the actual or potential conflict, the material risks to the client and the safeguards proposed. The client consents to the arrangement only after receiving sufficient information to make an informed decision.”
That wording must not be used to manufacture consent where the relationship is structurally unequal. The CLC conflicts guidance directs attention to bargaining-power imbalance, vulnerability and interests that are materially different and cannot reasonably be reconciled. Disclosure may therefore be inadequate where one party lacks understanding or the ability to negotiate meaningfully.
Remediation and Escalation Through a Hypothetical UK Scenario
A Midlands housing association discovers that a tender evaluator holds shares in one of the bidding suppliers. The evaluator says the holding hasn't affected the assessment. That response is relevant, but it doesn't settle the procurement question because independence must be assessed and evidenced, not asserted.
The procurement manager should first pause the affected evaluation activity, preserving the tender documents, scoring records, communications and access logs. The declaration should be entered into the register with the date, parties, interest, decision, reviewer and immediate restrictions. A compliance officer should then assess the matter against the applicable Procurement Act 2023 requirements and the organisation's own policy. Legal advice may be necessary, but forensic analysis isn't legal representation.
The decision might be recusal, replacement of the evaluator, a properly controlled review of unaffected material, or withdrawal and restart of the tender where the process has been compromised. Share divestment could reduce an ongoing interest, but it doesn't erase the historical issue or explain decisions already made. The audit trail should state why the selected remedy was proportionate and who approved it.
Escalation is appropriate where the conflict concerns a material procurement decision, affects multiple awards, involves a senior decision-maker, shows a repeat pattern, creates significant reputational exposure or raises concerns about concealed benefits. The organisation shouldn't invent value bands that aren't supported by its policy or the relevant procurement regime. It should use documented thresholds and seek specialist advice where the legal position is uncertain.
The controls should also test the evidence. A forensic review may compare the register with ownership records, organisational charts, board minutes, approval documents, tender communications and financial disclosures. Lighthouse's forensic accounting service can support that evidential analysis. It doesn't represent the organisation in litigation or guarantee a recovery or regulatory outcome.
The associated training video provides a general visual explanation of the process.
Monitoring, Audit and Training Controls That Close the Gap
Many organisations can produce a policy and a declaration form. Fewer can show whether every relevant person declared, whether changes were reported, whether recusals were implemented and whether remedial actions closed. The NAO evidence makes that weakness concrete. Its survey found that 83% of public bodies had changed their conflict-management systems after the Cabinet Office's June 2022 guidance, yet 71% reported no management information on compliance. The figures indicate a gap between formal policy change and effective assurance. (NAO summary)
Three lines of control
The first line belongs to operational managers and decision-makers. They complete declarations, identify conflicts at the point of decision and confirm that recusals or information restrictions occurred.
The second line belongs to compliance, risk or governance staff. They maintain the register, challenge incomplete declarations, analyse patterns and escalate unresolved cases.
The third line is independent assurance, normally internal audit or an appropriately scoped external review. It tests samples against underlying records rather than accepting the register as conclusive.
For organisations able to share all-staff compliance data, the NAO guidance recorded that four of five organisations achieved compliance rates between 81% and 95% for all-staff declarations or nil returns. (Procurement conflicts guidance) The practical lesson is that population-wide tracking and automated reminders can improve visibility, but the board still needs to understand what the measure covers.
Quarterly Conflict Management KPIs for UK Boards
| KPI | Target Threshold | Source / Owner |
|---|---|---|
| Declarations received within the policy window | The board-approved policy threshold | Compliance owner |
| All-staff declaration or nil-return coverage | The defined population is fully accounted for | HR and compliance |
| Open conflict cases with documented mitigation | No case lacks an owner, decision or review date | Risk owner |
| Recusal and information-barrier completion | Evidence exists for each required safeguard | Decision owner |
| Audit actions closed | Closure by the agreed due date, with validation | Internal audit |
| Training completion | Completion against the organisation's mandatory requirement | Compliance and HR |
These are control measures, not universal statutory targets. The board should see exceptions, overdue actions, repeated declarations involving the same process and cases where a conflict was discovered after a decision.
Training should cover recognition, timing, escalation and record-keeping. Legal teams should align material with the SRA Code, while NHS and public-sector organisations may use relevant counter-fraud learning alongside local procedures. A practical compliance training guide can help structure delivery, testing and evidence of completion.
Practical Checklist and Common Reader Questions
A quarterly review should operate as a control matrix with an owner and evidence for every action.
- Policy review: Confirm that the policy covers the relevant Companies Act 2006 duties, SRA Code obligations where applicable and procurement rules. Evidence should include the approved version and review record.
- Population check: Reconcile the declaration population with HR, board, supplier and matter records. Evidence should show who was required to respond.
- Risk reassessment: Re-score open cases after changes in role, ownership, client, supplier or decision stage. Evidence should state the rationale.
- Remediation testing: Confirm that recusals, independent reviews, information barriers and divestments were implemented. Evidence should include minutes, access restrictions and completion sign-off.
- Decision-trail audit: Test whether the register entry connects to the relevant approval, tender, client or board record. Evidence should allow an independent reviewer to follow the sequence.
- Board reporting: Report exceptions, overdue actions, repeat patterns and post-decision discoveries, not just completion totals.
Common reader questions
Is a nil return acceptable?
Yes, where the organisation's policy permits it and the person confirms that no relevant interest exists. A nil return should be recorded and monitored. Silence isn't a nil return.
What should happen to a historic undisclosed interest?
Preserve the original records, restrict further involvement where appropriate, assess affected decisions and obtain independent advice on disclosure, remediation and reporting. The assessment should distinguish an inadvertent omission from deliberate concealment without assuming either conclusion.
How does a conflict register interact with a GDPR subject access request?
The organisation must handle the request under data-protection law, but a subject access request doesn't automatically require deletion of governance evidence. The response should be coordinated with the organisation's privacy process, confidentiality duties, legal privilege analysis and retention policy.
When should the FRC, SRA or NAO be informed?
There isn't one universal notification rule. The organisation should check the applicable statutory, regulatory, procurement and contractual requirements, then document the decision to notify or not notify. Solicitors should consider SRA obligations, public bodies should follow their governance and procurement routes, and relevant regulated entities should assess applicable FRC expectations.
A finance director, solicitor or governance lead who can't assemble the register, policy, approvals and underlying decision records should treat that as an assurance issue. Lighthouse Consultants can review those records, trace related-party relationships and quantify relevant financial effects as an independent forensic assignment.
Lighthouse Consultants can help test whether conflict declarations connect to ownership records, approvals, board minutes and financial disclosures, while keeping the work scoped and evidence-led. To discuss a specific governance, procurement or professional-services situation, contact Lighthouse Consultants through the firm's book a consultation page.
