Name: It’s All GERC to Me | ECCTA, One Year On: Is Your TPRM Program Board-Ready or Still Catching Up?
Uploaded: 2026-09-17T15:46:09.215Z
Duration: 29 min 41 s
Description: It’s All GERC to Me | ECCTA, One Year On: Is Your TPRM Program Board-Ready or Still Catching Up?

Transcript for "It’s All GERC to Me | ECCTA, One Year On: Is Your TPRM Program Board-Ready or Still Catching Up?": Welcome everyone. This is yet another, Mitratech webinar. It's all Gerg to me. It's all governance, ethics, risk, and compliance to me. And in the coming thirty minutes we will discuss a specific topic and today that is ECTA the the new act in The UK. What does it mean? We've seen it already for one year. What does it mean? What does it mean for your third party risk management program? And are you actually still, up to date with it because we've seen some different levels of I adoption across the industries. And I'm not alone today. I'll first ask our guest, Maria, to introduce yourself please. was gonna say your morning, but it's not the morning. Thank you, Ian, and thank you, for having me, on this session. So I'm a partner in Peters & Peters. We're a a UK, firm that specializes in in all things fraud, whether on the criminal side or on the civil side, but my specialism is on the criminal side. So this is, very much something we deal with day to day. Yeah. Maria, thank you so much for being with us during the coming minutes and sharing your insights. My name is Jan. I am EVP at Mitratech. One of the aspects that is really important for us is to make sure that you do not just get great GRC software, but also the know how, the insights, the experience to get the best out of that software. And I'm part of a team that enables you to do exactly that. So let's move on to the first question. We, prepared a couple of questions for this webinar. By the way, if you have any questions, audience, that you would like to ask us, if you have any doubts, queries, anything you would like to call it, please let us know because this is all happening live, and we'll be very keen on hearing from you and actually answering your questions live. But the first question, Maria, to you, as I said, ECTA has been around already for one year. We've had this failure to prevent fraud offense, a lot of talk around that offense. But could you please go through what what what what what were the actual changes? What didn't change that much? Because we get a lot of, uncertainty. We see a lot of uncertainty around that in the market. Very good question. And just... I mean, it's nearly a year to the day, so the timing of this is, very apt. But by way of recap as to what it actually is and what is the failure to prevent fraud offense, Well, it can be committed, by a large organization either because that organization meets the relevant threshold or because a parent company, meets the various thresholds. And the various elements of the offense are where an associated person, that can be an employee, subsidiary, an agent, or person acting on behalf of the entity commits a specified fraud offense. And either the person did so with the intention of benefiting, the relevant body directly or indirectly, or the person did so with the intention of benefiting any entity, which the person provides services to. So in a commercial context context that means clients. But it can also be committed by a body corporate that isn't a large organization and doesn't meet the threshold where an employee of that, entity, commits a relevant offense with the intention of benefiting, the relevant body directly or indirectly, and that organization is a subsidiary of a large organization or of a parent undertaking. So in other words, a subsidiary that isn't, a large organization can be prosecuted for the acts of its employees, regardless of whether it itself meets the definition of large organization. And it's worth remembering as well that any criminal conduct, that's committed by a senior manager now acting in his or her, visual capacity, can create corporate criminal, liability regardless of the failure to prevent fraud offense. But luckily luckily, as with the failure to prevent fraud, bribery offense, there is a defense if a, an organization has reasonable fraud prevention procedures in place. So that is kind of in a nutshell what the offense, actually looks like. Yeah. Yeah. And I can... Thank you. So yeah. Go. ahead, please. No. I was gonna... I just explained what that means really in in in practice because, obviously, that's a very technical kind of analysis of of what the offense is. What it means in practice, most organizations, large organizations, multinationals will already have extensive policies and procedures in place to prevent bribery, money laundering, terrorist financing, tax evasion, sanctions, and so forth. So what ECTA really, requires for organizations is to consider whether it has adequately assessed the broader fraud risk. And the trickiest part, I think, of of Hector or one of the tricky parts of Hector is the the wide scope of corporations that potentially fall within, its ambit, what associated persons means in practice, and what reasonable procedures are going to look like as well from a a prosecution perspective. Yeah. I think that a lot of organizations also struggle with that topic of adequacy. What is adequate? It goes far beyond just checking the box or even worse, checking a general list of boxes. It really has to be fitting and specific to the organization. Another question that we received a lot and we found interesting to add to this webinar is, if we look at where third party risk management programs, cover certain topics on paper because we hear very often from organizations, oh, another third party risk management regulation. We're doing great. We have this great third party risk management program in the company, and it's so robust, we're not really worried about any new regulation. Is there an actual gap? I can already answer that question. Yes. How big is that gap between what companies think is a one size fits all TPRM program and what's actually required under Acta? So, there is guidance, and the guidance is necessarily, generic, as you rightly say. Yeah. And it really depends on the organization, the complexity of of, the sector, the, kind of risk, involved in particular organizations. And so, you know, you're absolutely right. It's not a tick box exercise. It's principles based. It's really focused on identifying the risks. And most, organizations will already have, existing anti fraud measures in place, but those fraud measures will be focused on preventing fraud committed against the organization and not, committed by the organization. And and the real difficulty for companies is really identifying where those risks lie, adequately assessing those, and revisiting and reviewing those risks. Because, of course, you know, the the best policies in the world only work, if they are effective in practice. And I think it's it's worth remembering that no policy will eradicate risk and the purpose really is to make companies alive to those to be thinking about them and to be broadening the scope. Is also worth remembering and it's always, worth keeping this in the in in the kind of, proportionality aspect of any, compliance program that's put in place is that for a successful prosecution of a failure to prevent fraud, these prosecutions still have to prove that the fraud offense was committed. So there are two elements that, firstly, to the criminal standard, whether the fraud offense was committed. And then the secondary point is, well, were there procedures in place that were reasonable to prevent those, those acts from being committed? And I think it's, you know, companies are well versed now to assessing risk. But what I think here is the difficulty in some of the blind spots is that the scope is potentially so much broader. And and some of the examples given by the guidance, I think really demonstrate that. So you can have a company that has nothing... No causal connection to, your organization. But if it is perceived to be providing services for and on behalf of your company and they commit fraud, whether it is, you know, doctoring data so that it's more beneficial to your product, whether it is misleading in terms of your ESG ratings or greenwashing risk, whether it's, you know, financial data, you are potentially on the hook as an organization if you have not anticipated what those risks might look like. And given the multinational, kind of complex structures that companies have in place, identifying those more remote risk is gonna be more difficult. And part of the exercise will be identifying really those entities over which a company has more control and influence in order to mitigate against those risks, whether it's contractual terms, whether it's, you know, signing up to orders, whatever those... It might look like, but it's it's gonna be a dynamic, approach and evolving as you identify more risk. Yeah. Yeah. Yeah. And. each step maybe also to add because it's very obvious, but still we see organizations basically forgetting it, work on that audit trail. It actually and maybe that's too much of a progressive approach, but I tend to say it doesn't matter that much what you decide to do as long as you explain why you took that decision. That might help you, that's likely to help you if you ever have to explain anything and and will work much better than saying, well, this is the outcome and, yeah, we cannot prove why we why we reached that outcome. So please keep that in mind at every step. Next question. And this is actually a question that we cannot answer for the audience, but we wanted to share or actually ask Maria to share a couple of takeaways, what to think of when answering the question. Well, if there will be an investigation, failure to prevent fraud, how do you survive that? How do you position yourself optimally for such an investigation? So so this is very practical. Maria, what what are your, tips in this regard? Well, there are a number of different steps. So firstly, in terms of investigation, there is the fact finding, element to it. You know, what has happened, you know, where, how, who, the the usual, in terms of setting up that investigation and setting up so that the company can be best advised as to the options it has available, to it, whether that is gonna be a self report, whether that's just gonna be remediation, whether it actually is, you know, it it is something different in terms of money laundering risk or or other risks that need to be considered. So the... So there's the fact finding exercises to what has happened and setting up that investigation so that you understand, really, the exposure that you have and what the options are that are available to you. But there's also the, I hate this term, but it's it's the remediation aspect of it. So whatever you decide to do as a... As an entity and whatever option you go for in terms of whether you're self reporting or whether you are, just, kind of identifying the risk and and, taking that forward in terms of mitigating, you need to remediate that risk. So no compliance program is going to be risk free. What, what the government and what the legislation imposes is, you know, for the companies to identify those risks, mitigate those risks, and then guard against them. So it's the remediation that really, is gonna be key to demonstrating firstly that your procedures are there to identify the risk. You've identified it. You've mitigated it, and you're preventing it going forward. So if you are able to demonstrate that, you're in a very good position, if someone comes knocking saying, we understand that. And that, I think, is is key to any compliance program, whether it it relates to fraud and bribery. I think ECTA is more difficult because of the the broad scope, of the the legislation and and the way in which it's drafted, but ultimately the the goal is gonna be the same. Compliance procedure has to be effective in practice. That doesn't mean you will eradicate risk. That means you identify the risk and you remediate it. Yeah. Thank you very much. And maybe that's a nice bridge actually to a more in-depth question that we received from the audience. So, please keep those coming. What approach are most firms taking with third party supplier contracts? Are they revising their standard terms across the board? Are they distinguishing between ordinary vendors and third parties that are considered associated persons? Or anything else? What do you see in your practice? yeah, I'm not, happily, I would say. I'm not a commercial lawyer, but I think it's standard practice, to be including terms in in contractual provisions. I don't think that, eradicates the risk, because it doesn't matter whether or not a contract is in place or not for, an organization to be deemed an associated person. So what you will be thinking more about is your firstly identifying whether or not an associated person, and and, the question is is a very good one that, actually, are they, just providing goods, or are they providing services, or are they providing goods and also services on behalf of of, the company? So identifying what the risk is first of that entity. And then once you've identified the risk, then you can conduct, adequate due diligence and and a risk assessment as to likely risks associated with that organization. And, of course, that's not gonna be possible on every, entity that you're dealing with, but there has to be a process by which, a risk assessment is made as to the higher risk entities that you're dealing with and addressing those. You know, those you're dealing with on a one off occasion, I think, for lower. Those you're dealing with, you know, on a day to day basis are gonna be higher up the, the ranking. So you... It it is gonna have to be proportionate, and I, you know, the goal of this, piece of legislation is is to effectively make companies police, police, fraud, you know, on behalf of the state. So, you know, you're not expected to identify every fraud that that is committed. But what you are supposed to be doing is thinking about and assessing the risk of who you do business with. Hopefully, that, answered the question partly. Yes. I mean, we'll see if more questions come in, from from this person, then maybe we can go even deeper. But what I wanted to do, we also receive a lot of questions that are very practical from a organization organizational point of view. If organizations, have to deal with ACTA, what do you see in practice? What works best? Whose whose desk should this be on or should it actually be a multidisciplinary approach? What do you see that actually tackles the obligations of Agta best from an organizational perspective? Well, I think you want... It really depends on who understands the business best in terms of who you want involved. If you've got a multi jurisdictional, structure, you're gonna want to deal with the kind of global, kind of head of of that structure to make sure that you've adequately identified those in scope because that is gonna be a difficulty in terms of which entities fall within scope, which entities have a nexus with The UK. And and it's worth also reminding that, you know, there has to be a UK nexus for the events to bite, in The UK. So whether that's because the clients are in The UK or the customers are in The UK or whether it's because there's a subsidiary in The UK or the intended benefit, is felt in The UK. So the... You know, all these things of identifying where the scope is is is gonna be best dealt with by someone within the business who really understands the global reach of of the structure. Then you're gonna want to deal with those within the business to understand the business risk because there is no point someone in the head office identifying what they think the business risks are without any regard to, you know, what is on the ground. Because on the ground, someone in the sales team might say, well, I have all these targets that I have to keep be... Meeting, and sometimes, you know, I have to push the product in a particular way to get these targets. So, you know, that's an obvious risk in terms of, misrepresentations and and making increased sales that eventually will benefit, the company. So, you know, understanding where those risks are is is gonna be a collaboration between the business and the compliance team. Yeah. That that sounds really good. While we are going to the last slide, those questions are actually coming in already. And please don't be shy. We still have a little over eight minutes left. So this is your chance to, get questions answered live. Question. Are there practical ways to reduce the burden of gathering third party information needed for due diligence and criticality assessment when onboarding new parties and to do the ongoing monitoring? Oh, that's such a good question. I mean, it... There... It is going to be, prioritization. You know, it... You cannot, scrutinize every entity in this... You know, to the same level. But what you can do is say there are some high risk, categories that we do need to scrutinize, and these are the criteria that we identify for identifying the the higher risk, and this is the approach we're taking. And, Jan, as you said at the outset, it's about documenting your process, you know, what you've done, how you've done it. And it it is... The the guidance does allow for, you know, the possibility that it may not be reasonable for, reasonable procedures to be, to be put in place. I think that's going to be very rare. I think what they are looking for is, you know, you may not have identified that that subsidiary needed the same policies as that... As the head, or the corporate entity that is actually, within scope. And therefore, it might be reasonable that not all entities, you know, can't... Conduct it in the same way, conduct their due diligence and their steps in the same way. And there all also might be jurisdictional issues. Issues. You know, the guidance allows for the fact it might not be possible to implement policies in the same way in every jurisdiction. So it is going to be about prioritization and making sure that you've identified those risks in The UK kind of, potential scope, and documented that in a way that you can defend. And going back to what I said earlier, you know, there is... It is a matter for the prosecution to prove that that there there was a fraud in the first place and that those procedures were not, reasonable in all the circumstances. And there is very little and there has been very little, inter... By way of prosecution that has really identified what the scope of of that means to date. Largely because most, most, kind of criminal cross... Well, criminal investigations into failure to prevent offenses ends up in... With a deferred prosecution agreement. So it's, you know, it's worth remembering these are all about, you know, companies trying to put in the reasonable procedures in a proportionate way, and they are not gonna get it perfect because there's no such thing in the compliance world. Yeah. On that positive note, I also wanted to, to to bring in, to that last question, the possibility, of course, of software. And we're not during this webinar speaking about the actual solutions out there, but I just want to say we see virtually no organizations anymore that don't use software to scan their third party environment on a live basis. Some do it still on an, I don't know, periodical basis. But more and more organizations are seeing the benefits of software to scan, to keep track of what the developments are in your vendor environment, third party environment. So, definitely, this is really something where software can help. And if you're interested in how Mitratech can help you do that, then please do book a demo with one of my colleagues. We have four minutes left. Maria, I have one last question for you. Have we seen any first signs of enforcement under ECTA? You already touched on that a little bit. Could you elaborate perhaps? The the answer is not yet. So it wouldn't necessarily surprise me. I also think we are, in terms of our enforcement agencies, very stretched in terms of, investigations, and they can take many years. I think that the key is if you have identified a risk is to get advice as to what, whether or not that risk is a concern to the company, whether it falls within scope, and and mitigating that risk. So whether that is a self report or simply tightening up your procedures, because, certainly, if you are going to be, putting forward an argument that you had reasonable procedures and and relying on on the defense, you know, the first thing, that you'll be asked is, well, when did you last review and update your procedures? What, you know, what instances, have you found of fraud as a result of the controls and and systems you've got in place, and what have you done about it? You know, they will want to see that those procedures have been tested in some form. And if you haven't tested them, then, you know, you are in some difficulty, in in terms of, you know, identifying reasonable procedures. Yeah. Sorry. Thank sound. very negative one. I didn't mean to sound negative. No. That's perfect. What I wanted to ask, because this was a question from the audience, what I want to ask now we are discussing ECTA, but actually, I'm very against a per regulation or per standard or per framework approach. There are various anti fraud, anti corruption, frameworks out there. And I believe that organizations can work much more efficiently when they identify the common denominators across various obligations and understand that if, for example, they would start with ECTA, typically, they would have started with something else. But let's say they start with ECTA and you identify which elements come back in other regulations, you don't need to do all of that work from scratch. Do you have any advice for organizations who are also interested in such a more, how should I say it, inclusive approach? Yeah. I mean, organizations will already have conducted extensive risk assessments in in various different ways. I don't think you have to reinvent the wheel. I think what you need to do is simply incorporate additional fraud risk, into your consideration. And that might not result in any changes to procedures at all. And it... I don't think it it requires an overhaul at all, but I think it requires, you know, some thought, and demonstrating that that has happened and why you haven't changed procedures because, you know, the controls are already there. So I don't think... I think you're right, Jan. You're not doing a a kind of isolated, you know, risk assessment just for each, for each separate area. What you're constantly doing is adding to that and and thinking, are there additional risks? How do I incorporate that into the system? And and a compliance system that, you know, identifies, you know, in a kind of comprehensive and and cohesive, manner, the risk is gonna be much more alive to them and and much easier to understand from from a company level, and a training perspective than than one that has, you know, twenty, eighty policies for different risks. Yeah. Perfect. Thank you so much. On that note, I will thank you, Maria, for sharing your valuable insights with us, with the audience today. If you, audience, are interested or in need of getting really expertise, advice, please do reach out to Maria directly or to us in order to get that connection. If you're interested in understanding how software can help you with Acta compliance, do reach out to us as well. We will have the next It's All Governance, Ethics, Risk, and Compliance to Me webinar in the at the end of October, so please do register for that one. And it will also concern something about third party slash vendor risk. So we continue talking about this topic. It will not be about ECTADO. Thank you so much for your time. Thanks. Very nice seeing you here. And, Maria, thank you again for your time today and sharing your insights. Looking forward to the next event. Thank you. Bye bye. Thank you, Jan. Thank you.