The business community needs to be educated extensively on how to tackle cyber threats such as ransomware, according to a trustee of the Fraud Advisory Panel (FAP).

Speaking at the body’s AGM at Chartered Accountants’ Hall on 24 June, Barclays International Fraud Risk Strategy Director Lee Fitzgerald reflected on initial work that the FAP has undertaken as part of its Business Fraud Alliance campaign, which Barclays sponsors.

“I recently went to see a client that supplies Marks & Spencer, which in April was subject to a ransomware attack,” she said. “If you think about the thousands of suppliers that work with M&S, every single one of their data systems has been compromised. So, in terms of all the additional businesses that now have to protect themselves, it’s a growing web. Looking at the work that’s required to educate clients on that front, there’s so much going on at the moment stemming from just that one incident. If you add all the businesses that have been harmed by ransomware in separate attacks, the workload is endless.”

Stepping it up

Fitzgerald pointed out that fraudsters were able to regain an advantage over businesses in the wake of COVID-19. Amid a hectic climate of staff churn during and after the pandemic, many businesses found that they were “almost starting afresh” on their fraud awareness drives, working with substantial numbers of new employees. “It didn’t take long for fraudsters to resume their activities and catch up,” Fitzgerald noted.

In the post-pandemic phase, the FAP launched its Love Business Hate Fraud campaign to help companies tackle that challenge. For Fitzgerald, in terms of reminding businesses about the various threats they face, that effort was a massive success. “Now we have the Business Fraud Alliance, we need to step it up a bit,” she said. “There’s more work that we can do to make the FAP stand out as an organisation. And there’s a lot of education we need to do with businesses.”

ICAEW Director, Trust and Ethics, Laura Hough – also an FAP Trustee – said: “To see this investment in a campaign with an emphasis on business is fantastic. In the past, broad strategies from the government have focused very heavily on the individual consumer and the business is often forgotten. From an ICAEW perspective, many of our members work in businesses: they’re the CFOs, or they’re in the finance team. So, it’s great that we can support our members through this new campaign.”

A regime with bite

In an earlier address, FAP Patron Lord Garnier highlighted what he considers a much-overlooked business impact of the 2023 Economic Crime and Corporate Transparency Act (ECCTA). 

“A lot of people I talk to focus on the Failure to Prevent Fraud offences that came through with ECCTA,” he said. “What they seem to have forgotten is that Section 196 – the new Senior Management Regime, which replaces the old principle for finding corporate liability in crime – came into effect on Boxing Day 2023. So, it has been in force for well over a year.”

He noted: “That is going to have a much more fundamental effect on how we think about our clients’ behaviour, and how clients should think about their own behaviour. So, please bang the drum for the new Senior Management Regime, because it’s there – and it will bite.”

Garnier also hailed the appointment last year of Nick Ephgrave as Director of the Serious Fraud Office. “The impression I get is that there will be much more activity at the organisation,” he said.

‘Sharper, faster casework’

That point was confirmed in a keynote speech from Ephgrave himself, who said that the SFO is now “bolder, stronger, more proactive and more ambitious than it’s ever been before.”

Outlining plans to maintain and enhance that trend, Ephgrave said that under his leadership, the SFO will base its actions on the catchphrase, ‘Sharper, faster casework’. “We need to be much quicker at getting through investigations and bringing prosecutions,” he said. “Justice delayed is justice denied. So many of our cases have thousands of victims. We can’t leave all those people hanging on for 10 years while we boil the ocean on investigations. We need to understand what the answer is, focus on it and, as quickly as we reasonably can, bring prosecutions that we think will be successful.”

Like Garnier, Ephgrave is excited about Section 196 of ECCTA. “It used to be very difficult to make a corporate liable for the actions of its senior people, unless we could prove that those people were the ‘directing mind and will’ of that organisation,” he said. “That’s all gone. ECCTA has replaced that test with simply this: they just need to be a senior manager.”

Ephgrave expressed strong support for a wider use of deferred prosecution agreements to wrap cases up. He also welcomed the current independent review by Jonathan Fisher KC of whether the UK should actively consider an incentivisation programme for whistleblowing, to help uncover more cases of organisational corruption.

On that very topic, a final panel session looked at the current state of fraud-fighting efforts on the part of individual employees. Cicely Fraser, Policy Officer at specialist whistleblowing charity Protect, pointed out that 70% of the people her organisation speaks to feel forced to resign after raising concerns. Amid those pressures, Fraser noted, many large organisations are trying to adopt softer phrases – such as ‘speak up’ – to encourage staff to step forward. In Protect’s view, that is a mistake.

“We want to destigmatise ‘whistleblowing’ as a term,” Fraser said. “We think that trying to introduce these new terms will only add more confusion. It’s a recognised term that’s used in the news, so we’re working hard to destigmatise it by delivering cultural training to organisations and trying to combat reluctance that way.”