Internal controls must be tailored, proportionate, and risk-based — not just a “paper exercise”.
By Erin Brown Jones, Clare Nida, and Matthew Unsworth
Last week, the UK Serious Fraud Office (SFO) published its updated “Guidance on Evaluating a Corporate Compliance Programme” (the Guidance). The agency’s previous guidance was published in 2020 as an eight-page segment in the SFO Operational Handbook. The latest iteration is very much public-facing, with a helpful FAQ section and updates to reflect the “failure







