The Reasonableness File: A Three-Hour Board Drill for Failure-to-Prevent Fraud Assurance

The failure to prevent fraud offence has been part of the UK corporate landscape since September 2025. By November 2026, the question for boards of large organisations is no longer whether the offence exists. It is whether the organisation can produce a coherent, current and tested account of the procedures it relies on if an associated person commits a specified fraud offence intending to benefit the business.

That shift matters. The statutory defence is not a statement of intent; it is a defence of reasonable fraud prevention procedures. A board that cannot show how those procedures operate in practice is exposed, even if its policy library looks comprehensive. At 3HR plc, we therefore recommend a 180-minute board drill that treats the reasonableness file as an evidence set to be examined, not a document to be approved.

Why the board, and why three hours

The offence is directed at organisations, but the assurance question lands in the boardroom. Directors are asked to oversee risk, set tone and satisfy themselves that controls are proportionate. The 180-minute format is deliberate: it is long enough to test evidence across the main control areas, yet short enough to be scheduled before the next audit committee cycle and repeated annually.

The drill is not a legal audit and does not replace advice on the statutory defence. Its purpose is to identify where the organisation would struggle to explain, document and rehearse its procedures. That is the territory in which prosecutors, auditors and regulators tend to ask their first questions.

The first 45 minutes: risk assessment that is fraud-specific

Many risk registers contain fraud as a line item. Far fewer show which fraud offences are relevant to which parts of the business, which associated persons are involved, and what has changed since the last review. The board should ask for the fraud risk assessment in its current form and test three things.

First, is the assessment specific to the offences within scope rather than a general misconduct review? Second, does it distinguish between risks arising through employees, agents, intermediaries and subsidiary operations? Third, does it record decisions about proportionality, including where controls have been strengthened and where residual risk has been accepted?

A useful challenge is to select two business units or two third-party relationships and trace the risk assessment through to a named control owner. If the trail ends at a template, the board has found a gap. If it ends at a dated decision with supporting evidence, the file is beginning to look reasonable.

The second 45 minutes: associated persons and due diligence

The offence turns on associated persons. Boards should therefore ask how the organisation identifies those who perform services for or on behalf of it, and how due diligence is calibrated to risk. The drill should sample the highest-risk relationships rather than review the policy in isolation.

For each sample, directors should see the rationale for the relationship, the checks undertaken, the approvals recorded and the frequency of review. They should also test whether due diligence is refreshed when ownership, geography or contractual scope changes. A common weakness is a well-populated onboarding file that is never revisited.

The board should also examine how joint ventures, acquisitions and intermediaries are brought into the framework. In UK groups with complex supply chains, the reasonableness file is often thinnest at the perimeter. That perimeter is precisely where an associated person may sit.

The third 45 minutes: training, communication and comprehension

Training records can create false comfort. Attendance logs show that people were invited; they do not show that they understood the risk. The board should ask for completion rates alongside evidence of comprehension, such as targeted assessments, scenario-based sessions or manager attestations for higher-risk roles.

Directors should also test whether training is tailored. A procurement team, a sales function and a subsidiary finance team do not face identical fraud risks. If the same module is used everywhere with no role-specific content, the organisation may struggle to explain how its procedures are proportionate.

Communication from the top matters, but it should leave a trace. Board minutes, chief executive messages, town halls and supplier communications can all form part of the evidence set. The question is whether they connect to the risk assessment and to actual controls, rather than standing alone as tone-setting material.

The final 45 minutes: top-level commitment and monitoring

The final block should be spent on governance evidence. Is there a named board member or committee with clear responsibility? Are fraud prevention metrics reported regularly? Are near misses, whistleblowing reports and control failures reviewed for patterns? Does the board receive assurance from internal audit or compliance that is independent enough to be useful?

Top-level commitment is often asserted in a policy preface. A prosecutor or auditor will look for something more concrete: a schedule of board oversight, a record of challenge, remediation tracked to completion and evidence that lessons have changed procedures. The board should ask what it would show if it had to demonstrate oversight over the past twelve months, not what it intends to do next year.

The reasonableness test in practice

A concise way to frame the evidence is to ask whether it is specific, current, owned and tested. Specific evidence addresses named fraud risks and named associated persons. Current evidence has been reviewed since the last material change. Owned evidence has a responsible individual and a date. Tested evidence shows that the procedure has been sampled, rehearsed or independently reviewed.

Where any of those four attributes is missing, the board should record a remediation action rather than accept a verbal assurance. The drill should end with a short list of gaps, each assigned to an executive owner and tied to the next audit committee agenda.

Closing the gaps before they are found

The most common weaknesses are predictable: a generic fraud risk assessment, due diligence that is not refreshed, training measured only by attendance, and top-level commitment evidenced by policy rather than practice. Boards that address those points now will be better placed to explain their procedures if a serious fraud allegation emerges.

The 180-minute test is not a guarantee of reasonableness. It is a disciplined way to find the weak points before an auditor, prosecutor or regulator does. For UK boards in 2026, that is time well spent.