The Evidence Behind the Defence: Documenting Fraud Prevention in Advisory Firms

The failure-to-prevent fraud offence has changed the terms of the conversation. Introduced by the Economic Crime and Corporate Transparency Act 2023 and now part of the UK corporate criminal landscape, it asks larger organisations to show that they had reasonable fraud prevention procedures in place. For professional-services firms, the immediate question is not whether a policy document exists. It is whether the firm can produce evidence that the policy was translated into proportionate controls, owned at the right level and tested in practice.

That distinction matters commercially as well as legally. Advisory firms are increasingly asked by clients to confirm their own controls, whether through procurement questionnaires, engagement terms or supply-chain diligence. A credible fraud-prevention file shortens those conversations. A policy PDF with no supporting record does the opposite.

Begin with the risk assessment, not the template

A fraud-prevention file should open with a risk assessment that is specific to the firm. Generic lists of fraud typologies are of limited value. The assessment should identify where the firm is exposed: client money handling, billing and disbursement processes, procurement and supplier payments, payroll, expense claims, referral arrangements, conflicts of interest, data access and the conduct of third parties acting for the firm.

For an advisory business, the most material risks often sit at the edges of the mandate. Who approves write-offs? Who can change bank details for a supplier? What happens when a client asks a junior member of staff to make an urgent payment outside the normal cycle? The risk assessment should record not only the categories of fraud considered but the specific scenarios, the likelihood and impact attached to them, and the controls relied on. It should also show who reviewed the assessment and when.

The file does not need to be elaborate. It needs to be intelligible to someone who was not in the room. A short narrative explaining why certain risks were rated higher, and why others were judged lower, is more useful than a colour-coded matrix with no rationale.

Procedures that match the risk

The second component is a set of procedures that responds to the assessment. This is where many firms overproduce policy language and underproduce operational detail. A fraud-prevention procedure should say what staff are expected to do, who approves exceptions, how concerns are escalated and what records are created.

In practical terms, the file should capture controls such as segregation of duties in payment processes, dual authorisation for bank-detail changes, supplier onboarding checks, expense-claim review, conflict checks before engagement acceptance, and a clear route for reporting suspected fraud. It should also address client-facing risks: false instructions, impersonation, invoice redirection and pressure to bypass normal approval routes.

The test is proportionality. A small advisory firm does not need the control architecture of a bank. It does need controls that are commensurate with the risks it has identified and the size and complexity of its operations. The file should explain the reasoning behind the design, not merely assert that procedures exist.

Board ownership and the minutes that show it

A fraud-prevention file gains credibility when it shows senior ownership. That means more than a statement that the board has approved a policy. The record should show that the board, or a delegated committee, has considered the fraud risk assessment, reviewed the control environment and received information about testing or incidents.

Board minutes do not need to be lengthy. A concise minute recording that the assessment was reviewed, that specific risks were discussed and that management was asked to take particular actions can be persuasive. What undermines the file is a gap between the policy date and any evidence that anyone with authority has engaged with it since.

Ownership also requires clarity about roles. Who is responsible for maintaining the file? Who receives reports of suspected fraud? Who decides whether an incident is escalated to insurers, clients or the authorities? These questions should have named answers, not just departmental labels.

Third parties are part of the perimeter

Advisory firms rely on suppliers, subcontractors, introducers and sometimes client-nominated parties. The fraud-prevention file should show how third-party risk is managed without pretending that every supplier requires the same depth of review. A risk-based approach is more defensible than a uniform questionnaire that no one reads.

The record should include the due diligence applied to higher-risk third parties, the contractual controls relied on, and the monitoring that takes place after onboarding. Where the firm uses referral arrangements or intermediary relationships, the file should show how payments and introductions are checked. These are areas where fraud risk and commercial risk often overlap.

Testing: the difference between assertion and evidence

A policy says what should happen. Testing shows what did happen. The file should contain evidence of periodic checks, even if they are modest. Samples of payment approvals, bank-detail change records, expense reviews, supplier onboarding files or conflict checks can demonstrate that controls operate in practice.

Testing does not need to be presented as an audit. A short record of the sample selected, the exception found and the action taken is enough to show that the firm is not relying on assertion alone. Where no exceptions were found, the file should still record the scope and date of the check. The point is to create a trail that can be followed.

Training records and communications also belong here, but they should be proportionate. A record that all staff completed an online module is weaker than evidence that specific teams discussed particular fraud scenarios relevant to their work.

Keeping the file current

A fraud-prevention file is not a one-off project. It should have a review cycle, a version history and a named owner. Changes in the firm’s client base, payment processes, supplier arrangements or use of technology should trigger a review. Incidents and near-misses should feed back into the risk assessment.

The file should also be stored where it can be produced quickly. A defensible record that takes three weeks to assemble is less useful than a smaller record that can be retrieved on request. Access should be controlled, but the people who need to use it should know where it is.

A practical standard

The standard to aim for is not volume. It is coherence. An independent reader should be able to see what risks the firm identified, what procedures it put in place, who owned them, what was tested and what changed as a result. That is the evidence behind the defence. For UK advisory firms in 2026, building that record now is a more useful exercise than waiting for the first request and reconstructing it afterwards.