An accounts executive receives a vendor invoice for monthly software support. The vendor's name is almost identical to the real supplier. The bank account is new. The approver is travelling and the request says urgent. Fraud usually arrives looking ordinary, and what stops it is a rule that nobody can pay a changed account without a callback to a known number.
An anti-bribery and anti-fraud policy sets out what dishonest conduct looks like, what controls make it harder, how people report it and how the company investigates. It goes alongside the conflict of interest policy, the procurement and vendor policy and the whistleblower policy. Drafting these together is part of our HR policies and governance work.
Say what you mean by each term
- Bribery: offering, giving, asking for or accepting something of value to influence a decision.
- Facilitation payment: a small unofficial payment to speed up a routine service. Decide whether it is banned outright.
- Kickback or secret commission: a hidden return paid to someone who steers business.
- Fraud: deliberate deception for gain, such as fake invoices, false reimbursement claims or manipulated records.
- Payroll and attendance fraud: ghost employees, inflated overtime, or logging in for someone else.
- Misappropriation: taking or misusing company assets or money.
The policy opens with a commitment from the top: the company does not tolerate these acts and will not penalise anyone who refuses to take part, even if it costs a deal. Zero tolerance is a strong phrase. Say what it means in practice, so that it is applied fairly.
Controls that make fraud harder
A policy that only lists offences does little. The controls are what matter. Segregation of duties means the person who raises a purchase request is not the one who approves it, receives the goods or releases payment. Where the team is too small for that, a second person reviews the monthly bank statement and the vendor master list.
- Expense approval thresholds: each level of approver and the amount each may approve, set by management.
- Callback check before changing any vendor bank account.
- Two signatories or two approvals for payments above a set level.
- Receipts or supporting documents for every reimbursement claim.
- Periodic checks of the vendor list, payroll list and attendance records for duplicates or names that should not be there.
- Gifts and hospitality register, aligned with the conflict policy.
- Rules for political and charitable contributions: who may authorise them and how they are recorded.
- Third-party checks: vendors and agents sign the company's code and are asked about their own conduct. Do not rely on trust alone.
Decisions that shape the policy
Four choices need management attention. First, expense approval thresholds: low levels slow work, high levels expose the company. Second, reporting channels: an email box, a phone line, a named senior person and an external option each suit different people. Third, investigation authority: who decides to open a case, and who investigates when the suspect is senior. Fourth, third-party checks: how much scrutiny agents, resellers and large vendors receive before onboarding.
Reporting and investigation
- 1
Report
The employee or outsider reports through any channel in the policy. Anonymous reports are accepted and read.
- 2
Log and assess
The investigation authority logs the report in a restricted register and decides within [number] days whether it needs a full inquiry.
- 3
Preserve evidence
Emails, invoices, access logs and devices are secured before anyone is told. Nothing is deleted, edited or moved.
- 4
Investigate
A small team, free of conflicts, interviews people and reviews records. The person concerned is heard before any conclusion is drawn.
- 5
Decide
The authority records findings and recommends action: disciplinary steps, recovery of loss where lawful, process fixes.
- 6
Report outside
Where the law requires, or management decides, the matter is reported to the proper authorities with legal advice.
- 7
Close and learn
The case is closed in writing, and the control that failed is repaired.
These are confidential cases. They need restricted access and confidential case handling, not an ordinary request queue. Reporters are protected from retaliation, and the policy should state that clearly.
Training, audits and records
Training matters for people who handle money, buy goods, deal with officials or manage vendors. Keep it short, based on real cases and repeated every year. Periodic internal audits test whether the controls are actually used.
- Gifts and hospitality register.
- Fraud and bribery report log.
- Investigation file with evidence list and findings.
- Vendor bank change log.
- Training attendance record.
- Employee acknowledgement: read, understood and accepted, with date and policy version.
1. Commitment: [company name] does not tolerate bribery, corruption or fraud.
2. Scope: employees, directors, agents, vendors and anyone acting for the company.
3. Definitions: bribery, facilitation payment, kickback, fraud, misappropriation.
4. Prohibited acts: the list in section [number].
5. Financial controls: approval limits [to be set], segregation of duties, callback rule.
6. Gifts, hospitality and contributions: limits [to be set], register held by [role].
7. Reporting: channels [list]; protection from retaliation.
8. Investigation: authority [role]; evidence preserved; fair hearing.
9. Consequences: action under [disciplinary policy]; recovery where lawful; reporting to authorities as required.
10. Training, audit, review and version.