Business Law & Compliance

Deciding whether corporate self-reporting is a good idea

9 min read

07 November 2017

If you discover bribery or fraud in your organisation, is it best to notify the Serious Fraud Office, which has long encouraged self-reporting? You might think the answer is straightforward. The reality, however, is more complex and nuanced.

Until relatively recently, the Serious Fraud Office (SFO) promoted the advantages of self-reporting for suspected incidents of corruption. Guidelines published in 2009 sought to encourage it by offering potential civil penalties such as fines instead of criminal prosecution.

While the guidelines warned that the SFO could not make guarantees without knowing the facts of the specific case, it was also made clear there would be attempts to reach a settlement with companies voluntarily reporting wrongdoing. However, this endeavour was met with a series of pitfalls between 2010 and 2012.

Under pressure to take a tougher approach, the SFO issued new guidelines, with self-reporting no longer a shield against prosecution. It was in this climate that Deferred Prosecution Agreements (DPAs) were introduced in an effort to redress the balance in favour of co-operation.

So what is a DPA?

A DPA is a court-approved agreement to suspend prosecution for a defined period (e.g. three years), subject to a company satisfying specified conditions, usually including both financial penalties and monitoring obligations. They can be used by the SFO and the director of public prosecutions, but only the SFO has used them so far.

Whether to offer a DPA is entirely at the prosecutor’s discretion, but the Deferred Prosecution Agreements Code of Practice (DPA Code) sets out various factors which may be taken into account. Co-operation with the prosecuting authorities may increase the likelihood of being offered a DPA whilst a failure to promptly notify the authorities of wrongdoing may be a factor in favour of a decision to prosecute.

The case for self-reporting

Compared to a trial and possible conviction, a DPA offers several advantages. First, the process of negotiating a DPA is likely to be quicker and less costly than going to court. Second, there may be more scope for a company’s particular circumstances to be taken into account.

Ben Morgan, the SFO’s former joint head of bribery and corruption, said in a speech in March that one of the reasons for introducing DPAs was to limit the impact of corporate sanctions on innocent people like employees, pensioners, suppliers, manufacturers or customers. He pointed to the example of XYZ, which was party to the second ever UK DPA in 2016.

XYZ was a small enterprise and the level of fine that, in the SFO’s view, should normally have resulted from its alleged corruption issues would have put the company out of business. The final DPA agreement as approved by the court took a more pragmatic approach: the fine was based on the maximum amount the company could pay while remaining solvent.

Third, the financial penalty can also be reduced in response to a company’s level of co-operation. The courts approved discounts to penalties of up to 50 per cent under DPAs, and self-reporting is one of the factors that can be taken into account. In contrast, the maximum discount for a guilty plea in criminal proceedings is one third.

Fourth, the DPA route is often preferable from a PR and messaging standpoint. Compared to a trial (and possible conviction) it should be easier to control the story and put a positive spin on it. Note though that the SFO is likely to take a negative view of those attempting to brief the media to their own advantage whilst discussions are ongoing.

Finally, it can be good for your organisational culture. It sends a strong message about your attitude towards wrongdoing, and should encourage openness, collaboration and transparency.

Read on to hear the case against self-reporting

The case against self-reporting

Self-reporting does not guarantee DPA negotiations. The SFO may still press ahead with a prosecution. A further hurdle is that any proposed DPA will need to be scrutinised by the courts, who will not approve one unless it is in the interests of justice and its terms are fair.

It is thus important to exude a high level of co-operation. By way of example, Rolls-Royce is reported to have given the SFO unfiltered access to 30m documents from its own records, made available written accounts of its own evidence-gathering interviews, and brought to the SFO’s attention additional areas of concern outside its original scope.

Any company deciding to self-report must take a “leap of faith” by handing over documentation without any guarantee that a DPA will result. If negotiations subsequently break down, documents and information already provided to the SFO could end up being used during any subsequent prosecution, subject to some restrictions.

Moreover, self-reporting and reaching a settlement with the SFO does not necessarily mean the company avoids a penalty – Standard Bank was made to pay a total of $25.2m under its first DPA.

The terms of a DPA may also impose long-term measures such as the appointment of a compliance monitor and reporting obligations for the duration of the DPA. Note that its main advantage is the avoidance of a criminal conviction, which can have practical and legal consequences as well as financial ones.

DPAs are also only available to corporate bodies. Even after a DPA has been approved, individuals implicated in the wrongdoing are at risk of prosecution. Its also will not protect against civil lawsuits from aggrieved third parties or civil or criminal actions in jurisdictions outside the UK.

Just as self-reporting will not guarantee the offer of a DPA, there is also a chance that a business could be offered a DPA without self-reporting. That was the case for Rolls-Royce. It was given a 50 per cent penalty reduction due to “extraordinary co-operation”, even though the initial report concerning the corrupt activities did not come from Rolls-Royce itself.

Finally, a company may prefer to have its “day in court” if it believes strongly that any charges are unfair and that it can successfully defend itself. For instance, a company will have a complete defence against the offence of “failure to prevent bribery” under the UK Bribery Act 2010 if it can show it had adequate procedures in place at the relevant time. This requires high confidence in those procedures and could prove a risky strategy.

To self-report or not to self-report?

The question of whether to self-report is a complex one, and the answer depends on the facts of an individual case. Self-reporting does not necessarily guarantee a DPA offer, and DPAs themselves come with pros and cons.

For SMEs, the possibility of a penalty that is tailored to a company’s resources and tries to ensure it stays in business could be a compelling reason for self-reporting. Even if you decide in favour of it, there is still the issue of when to make the report.

It is unlikely to be in your company’s interests to blow the whistle before you have investigated the matter yourself to the point that you can make an informed decision. An early report that is incomplete or misleading could lead to prosecution.

Matthew Lawson is a partner and Rebecca Dipple a professional support lawyer in the litigation team at Orrick