Two of three, and you have a criminal offence to defend.

Run the test before reading anything else, because if you fail it the rest is background reading and if you pass it the rest is a deadline you have already missed.

Two of three is the part that surprises people. A firm with a £40m turnover and 260 staff is large even if its balance sheet is thin. So is a property business with a heavy balance sheet, a modest turnover and 300 people on the books.

What the offence actually is

It is not a duty to prevent all fraud, and it is not liability for fraud committed against you. It is committed when an associated person — an employee, agent, subsidiary or someone else performing services for the organisation — commits a specified fraud intending to benefit the organisation, and the organisation had no reasonable prevention procedures.

Three consequences follow from that wording and they are worth separating.

1. Nobody senior has to know. That is the point of a failure-to-prevent offence. The old identification doctrine required a directing mind; this does not.
2. The fraud has to be aimed at benefiting you. An employee defrauding their own employer is not this offence. An employee inflating a claim, misleading a customer or cooking a tender to win work is.
3. Your procedures are the defence, and they have to exist before the event. A policy written after an incident is evidence of nothing except the date it was written.

The six principles the defence is measured against

Home Office guidance sets out six: top level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication and training, and monitoring and review.

Four of those six are documentation exercises that a firm either has or does not. Two of them — risk assessment and monitoring — are the ones that need to produce a dated artefact on a recurring basis, and they are the two most likely to be missing. A risk assessment done once in 2025 and never revisited satisfies neither.

The practical form this takes in a business of that size is a register: what could an employee do that would benefit us dishonestly, what stops it, who checks, and when was that last checked. If that document does not exist, the defence has nothing to point at.

Where the fraud risk actually sits now

There is a specific modern version of this worth naming: a system that generates output on the organisation's behalf. If your software writes quotes, claims, tender responses or customer-facing statements, and it overstates something in a way that wins you business, the question of who committed the fraud gets complicated — but the question of whether you had procedures to prevent it does not.

That is a variant of the problem in automated decisions about people and the reason we keep arguing for an audit layer: a record of what the system was shown and what it produced is the only thing that turns "we do not know what happened" into evidence.

What this does not tell you

It does not list the specified frauds. The offence attaches to a defined schedule of base offences and whether a given incident is one of them is a legal question about facts we do not have.

We are not lawyers and this is not legal advice on your exposure. What we would say is that the size test is a five-minute exercise with three numbers you already have, and that a firm which has not run it is not making a judgement — it is deferring one. The same is true of the thresholds in the eleven-duty grid, and the size test itself is a free calculator.