We aim to make this site as accessible as possible and therefore have provided the settings below to use if you are finding it difficult to view this website. See the SFO Accessibility Statement for more information.

Where it is appropriate to provide a Welsh translation, you can switch to Cymraeg. See the Welsh Language Commissioner website for more information.

Use the settings button in the bottom right corner of the page to access these settings again.

Change to normal text size A Change to medium text size A Change to large text size A Adjust Text Size

We would like to use Analytics Cookies on our website. 

Turn these on below if you are happy with us collecting information on how our site is used, in order for us to improve the overall experience of our website. 

All other cookies are necessary and therefore by continuing to browse this website, you are agreeing to the usage of these cookies.

 See the SFO Privacy Policy for more information. 

Analytics Cookies

Corporate criminal liability and Deferred Prosecution Agreements

26 Mawrth, 2014 | Areithiau

Alun Milford, General Counsel, at the Annual Employed Bar Conference.

You all know of the passing into law of the Bribery Act 2010 and the creation of the new form of corporate liability in section 7. Indeed, without that section on the statute book, I do wonder what the level of interest in an SFO speaker would have been at a conference of this kind. You also know, of course, about the coming into law of the Crime and Courts Act and, with it, the court’s power to sanction deferred prosecution agreements. You know that sentencing guidelines are now in place, with the position of corporate defendants specifically catered for, and you know of the recently issued Code of Practice on DPAs. Much has changed in the last three years therefore, and your employer is exposed to a greater risk of criminal liability arising from the conduct of its business than it was when the identification principle was the sole basis on which a conviction could be secured, at least in an SFO case.

For my part, it is right that I recognise that in response to those changes there has been a lot of effort in industry to ensure that compliance arrangements are fit for purpose. Indeed, to the extent that section 7 was aimed at improving corporate culture, commentators regard its effect as positive.

But let us imagine that, notwithstanding all the good work that has been undertaken, you receive a call at work one day – probably a Friday afternoon just before you are due to go on holiday – notifying you of a corruption problem concerning how your employer secured an overseas contract. No doubt you will activate the contingency arrangements you might have put in place and, as part of those arrangements, you will call in your external lawyers. At the very outset, you will want to discuss with them likely outcomes. That then will lead directly to the decision whether or not to notify the SFO. I know that some lawyers tend to advise against doing so. Whether you choose to follow such advice is, of course, a matter for you. It might be that you are lucky, and word of your problem does not get out as so often it does, eventually. On the other hand, you might decide, on advice, to notify the SFO and to co-operate with any investigation we might undertake. You will not be surprised to hear me say that this would be a wise course of conduct.

It is wise for this reason. Whatever the offence under investigation, there can be no prosecution unless the two stage test set out in the Code for Crown Prosecutors is met. First, there must be sufficient evidence for a realistic prospect of conviction. If there is not, then that is the end of the matter. If there is, then the prosecutor must consider the public interest. A prosecution will only take place if it is in the public interest, and the Code sets out various common public interest factors for and against prosecution. In seeking to brush the bad news under the carpet, you gamble that it will not leak: that no-one in the company will act as a whistle-blower; that a disgruntled business rival won’t tell us; that the person who accepted the bribe will not be exposed; that news of the transaction will not be picked up by the network of intelligence which we plug into. If we do find out about a company’s misconduct in such a way, we will open an investigation. Assume that investigation produces sufficient admissible evidence of criminality by the company and others to permit a prosecution. On the application of the public interest test, the weight of public interest reasons against prosecution will be light indeed. But if we hear of the misconduct from the company, which then goes on to co-operate in a transparent and proactive manner, then plainly the public interest factors pointing against prosecution will be more substantial and more weighty. In some cases, they will make all the difference.

Reporting to us is not the end of the matter. There can be no guarantee at the outset of an investigation of any particular outcome and in particular of a deferred prosecution agreement as an alternative to a prosecution. That is so for two reasons. First, as a simple matter of public law, we cannot pre-judge our decision whether to offer a deferred prosecution agreement until we have been able to make our own assessment of the case, including not just its nature and seriousness but also the extent to which we have actually received the prompt and proactive co-operation called for in the policy documents we have to apply. No fettering of discretion, therefore. The second reason is that a deferred prosecution agreement is not entirely in our gift. No such agreement can have effect unless and until a judge is satisfied that, in the circumstances of the particular case, it is in the interests of justice and, if so, the particular terms agreed are fair. I’m as interested as you are in how the judiciary will approach this.

We’ll all know better after we have made the first application to the court. My own thoughts on what we will have to establish on any such application are these.  It is clear from the legislative scheme that the judges are required to cast an independent eye over the proposed arrangements: Parliament created their role in this process to help secure public confidence in any agreement reached. Bearing in mind that the application for judicial approval of a DPA is hardly likely to be adversarial, I imagine that the judge dealing would want to enquire into what happened and to satisfy him or herself that the application is well-founded. This will be very different to a consent order in civil proceedings, therefore. If I am right in this, then it will be important to demonstrate the extent to which the company’s version of events when reporting to the prosecutor withstands independent scrutiny, so that the judge can be confident about the nature and seriousness of the conduct in question. I imagine also that the judge will want carefully to review the conduct of both parties to the proposed agreement during the course of the investigation, to be clear that public policy factors weighing against a prosecution have been applied properly. As Thomas LJ made clear in Innospec, to corrupt a foreign government official is to commit a serious crime and it will be a rare case which is appropriate for a civil recovery order. As a prosecutor, I anticipate also being asked to answer questions about how we intend to deal with the other (human) suspects in the investigation, as how we deal with them may affect the public interest in how the company is dealt with.

You will not be surprised to learn that every corporate investigation report we receive is sent to us under cover of a letter describing it as a self-report. Similarly, it well come as no shock to you that every defence lawyer acting for a company assures us of his client’s genuine desire to cooperate with us. But in the hands of lawyers such simple concepts as self-report and cooperation acquire an elastic quality. I thought I might helpfully use the rest of my time here to tell you what we, in the SFO, understand by them.

Self-report first. To us, the report part of self-report means telling us about something we do not already know. We sometimes receive the fruits of an internal investigation after we have contacted the company to enquire about allegations of wrongdoing we have learned of from sources other than the company. Plainly a company which only provides information to us after we have raised concerns with it cannot derive the same level of credit – if any – as a company which, of its own volition, notified us of something which we did not already know about.

More generally, we sometimes find that companies supply us with the product of a corporate investigation, badged as a self report, in which the company accepts that there may have been wrong-doing by people associated with it but denies corporate liability. It will be obvious to you that such a report cannot, as a matter of simple logic, be regarded as a self-report. It is instead a report by a person, the company, into wrongdoing by others, namely some of its employees and agents. It means that we are being offered assistance into an investigation into others’ criminality, for the company has none. This is the company as a concerned, good citizen therefore. This has implications for us at the start of the investigation: it can impact on our identification of suspects and the strategy we adopt in pursuing our investigation. Of course, if at the conclusion of our investigation, having followed all reasonable lines of enquiry, we decide that the company was right in its stance, then there can be no question of its prosecution on the basis that there is indeed no realistic prospect of conviction. If, however, our investigation leads us to the conclusion that the evidential sufficiency test is met against the company, it would be difficult to see how its stance in denying responsibility for its actions, blaming others – typically junior staff, when the conduct was sanctioned at the very top – and putting us in the position of having to build the case against it should be a public interest factor against its prosecution.

A self-report carries with it an acceptance of wrong-doing. I accept that this means that the company is taking a material risk in deciding to be frank with the SFO, because it invites our attention onto the company as a suspect. Equally, however, this is precisely why co-operation of this kind weighs in the public interest against prosecution. Sometimes it can be the single most important factor in a decision not to prosecute. But much also rests on the level of cooperation we receive after the report of wrongdoing has been made.

I have mentioned that sometimes the report of wrongdoing, whether by third parties to the company or the company itself, is accompanied by a detailed corporate investigation report, often prepared by a firm of solicitors. Typically such reports comprise a narrative and a selection of underlying, pre-existing documents. Typically also the narrative is supplied to us subject to a limited waiver of privilege.

Such reports can be helpful in informing us about the case and in providing a basis for the Director to open an investigation. But the manner of their preparation and the rights claimed over aspects of it can create real problems for us to the extent that the company’s conduct, taken as a whole, becomes unhelpful.

It is clear that we cannot accept such reports at face value, especially where the company denies any wrongdoing on its part. Even in the case of a self-report, we will need to conduct our own, independent investigation into the extent of the wrongdoing not least because, if on initial review the case seemed right in principle for a DPA disposal, we would need to satisfy ourselves and possibly also a judge that the extent of what was reported was accurate. If, on embarking on our investigation, we find evidence trails disturbed, witnesses tipped off and their first accounts denied us, then we will find it hard to regard the company’s conduct in the preparation of the report as anything other than unhelpful, not least as we will in all probability have identified key individuals within the company as suspects who we might wish to prosecute. It is for that reason that we encourage companies to report early to us and to agree with us whether and, if so, on what terms they might commission a corporate investigation.

The way in which data is collected is vitally important. Care needs to be taken not to tip off in particular data custodians who are also suspects. Given the access potential suspects might have to the company’s IT system, corporate-wide data preservation notices might sometimes better be called a data destruction notice because that might well be the effect they have. Data collection should be prompt, covert, co-ordinated and simultaneous. Collection of digital material needs to be forensically sound, with whole images being taken of digital collections which are then preserved. Back-up tapes should be preserved, and any rolling destruction processes stopped.   Process methodology should be recorded. Those who gather data should record the steps they took personally to secure it.  The methodology should be disclosed fully to the SFO, and be supported by witness statements.

Where the company interrogates the digital material it gathers, it must record the methodology, its search terms and the reasons they were chosen. The methodology, including the instructions given to reviewers on the criteria they should apply in determining relevance, should be disclosed to us. These processes should also be supported by witness statements.

There is then the issue of whether and, if so, how to question witnesses. We do understand that it may sometimes be difficult immediately to identify whether a particular individual is likely to have information, to have contravened internal processes or to have been complicit in unlawful conduct. It is for that reason that we encourage companies to come to us early so that we can help resolve these issues with them. If a company decides not to involve us at the outset but decides to plough its own furrow in gathering accounts of witnesses and suspects, then we will view adversely any prejudice caused thereby to our criminal investigation when evaluating the level of a corporate’s co-operation.

It is worth recording why witness accounts are so important to us. People who give an account to an internal investigation are likely to be witnesses in our criminal investigation into both individuals and the company. In considering the evidence witnesses might give us, we are duty-bound to assess its accuracy and integrity. So fundamental to prosecutors is that duty that it is set out in the Code for Crown Prosecutors. An important way in which accuracy or integrity is tested is by reference to first accounts.

Frequently, we are confronted by an assertion of privilege over such first accounts as may have been taken. The assertion of privilege over witness first accounts is unhelpful and, frankly, impossible to reconcile with an assertion of a willingness to cooperate.

I repeat the point I made earlier: we will be investigating both the company and individuals associated with it or its business. At the conclusion of the investigation, we will apply the test in the Code for Crown Prosecutors against each individual suspect. That entails a consideration both of the admissible evidence against each and of the public interest in each of their cases. If the company’s stance in asserting privilege over part of its fact-finding exercise makes it harder for us to build a sustainable case against other suspects, I cannot see how that stance can possibly contribute to the public interest case against prosecuting the company, not least when, rather than engage constructively with us, the company chose instead to instruct lawyers to speak to witnesses before us and thereby set out to throw an impenetrable web of confidentiality all over the evidence they generated. The position is even starker if the company’s stance is that it has no criminal liability and that it is simply trying to assist our investigation into others.

We do not necessarily accept that assertions of privilege are well-founded. Like everything else in the law, all depends on the facts of the case. Where we do not accept that the claim is well-founded, we are prepared to litigate. Of course, any such litigation would be a last resort: we want our focus to be on the investigation, not satellite litigation. Even if we do accept that the facts of the case point to privilege attaching, we see nothing objectionable in principle in inviting a company to waive this privilege and this privilege alone. For the avoidance of any doubt, we are not interested in seeing the advice clients received from their lawyers. We just want accurate and complete first accounts of witnesses, and we do not understand why a truly cooperative company would deny us them. It is unhelpful of your clients to put their interest in civil proceedings ahead of assisting our criminal investigation.

Our model for DPAs is unique to our jurisdiction, and companies who wish to benefit from its availability will have now to model their approach to how they engage with us and the way they conduct corporate investigations on its requirements. This means that the list of changes I began with is far from complete. It was ever thus, I suppose. Writing about two and a half thousand years ago, the Greek philosopher Heraclitus declared, “There is nothing permanent except change”. How right he was.