Guidance

Best practice statement: Forensic auditing

Updated 8 February 2023

1. Outline

Statement of the Groceries Code Adjudicator (GCA) understanding of best practice in relation to forensic auditing, under paragraph 3 of the Groceries Supply Code of Practice (the Code): Variation of Supply Agreements and terms of supply, paragraph 5 of the Code: No delay in payments, paragraph 14 of the Code: Due Care to be taken when Ordering for Promotions, each read together with paragraph 2 of the Code: Principle of fair dealing.

2. Relevant Code provisions and existing associated GCA guidance

Annex 1 sets out relevant Code provisions and existing associated GCA guidance.

3. GCA consideration of the issue

In Autumn 2020, as part of the regular engagement meetings with the Designated Retailers’ Code Compliance Officers (CCOs) the GCA indicated that issues concerning forensic or recovery audits were being raised and that further information was requested on the number of, and way in which, such audits were being undertaken. At the regular CCO meetings held in March 2021, after having seen further evidence of issues regarding the way in which such audits were being undertaken, the GCA raised the issue again. Although the GCA recognised that the complexity in the number of SKUs (stock keeping units), numbers of promotions, multiple types of deals, mechanics and calculation methodologies used in the Grocery sector had reduced over time and thereby reduced the risk of errors, and that Designated Retailers had made progress in moving towards in year recovery audits as well as reducing the number of audits and monies recovered from suppliers, there remained a number of issues, which were continuing to be reported, representing thousands of claims and £ms every year.

Annex 2 sets out the issues which had been reported to the GCA.

4. GCA statement of best practice: Forensic auditing

The GCA has requested that Designated Retailers consider what improvements they could make to the transparency of their processes for recovery audits (including counterclaims raised by suppliers in response to a recovery audit initiated by a Designated Retailer (Counterclaim(s)) and their settlement. This would allow the risks that suppliers agreed to take on when the supply agreements were entered into to be settled independently of current and future trading arrangements and commercial negotiations. Suppliers, especially smaller suppliers with limited resources, would then be able to anticipate and calculate the full costs of supply. The objective is to reduce the number of invalid claims, the number of claims where the supplier feels unable to defend the claim because of the resources required and the fear of retaliation (including paying invalid audit claims as part of the cost of doing business) as well as to speed up the time taken to settle both claims and Counterclaims.

The GCA did not find the same degree of issues reported in respect of standalone counterclaims made by a supplier where there was no associated recovery audit by the Designated Retailer (Standalone Claims). However, the GCA considers that the same overarching principles should apply to the settlement of Standalone Claims whilst recognising that each Designated Retailer will have its own processes for concluding such claims.

The GCA has indicated that this may be achieved by:

i. Supply Agreements, supporting documentation and data: no cherry-picking

Although Recommendation 4 set out in the report of the investigation into Tesco (as set out in Annex 1) was clear, the GCA considers that it is worth repeating in full in the present context:

The methodology for calculating any money due from suppliers, whether for promotional funding, short deliveries, service level charges, customer complaints, forensic audit claims or penalties, should be clear and explained in the supply agreement. This will allow the supplier to understand, predict and be in a position to challenge charges.

This recommendation should apply equally to claims and Counterclaims so that parties to the supply agreement are clear on the methodology to be deployed. This would be enhanced if Designated Retailers ensured that all documents evidencing the supply agreement, the subject of the recovery claim, are made freely available to the supplier. Many Designated Retailers are already making such information available (or are moving towards making such information available) on a supplier portal hosted by the Designated Retailer, which is considered to be best industry practice. This should include joint business plans, promotional agreements, terms and conditions, and so on, whether comprised in static documents, emails, letters or otherwise. A link to, or the provision of, all relevant documents should be included in the claim pack issued to the supplier at the beginning of the recovery audit so that the supplier is able to consider all the relevant material upon which the claim is based. This should include the free provision of adequate sales data to verify the accuracy of the claim for retrospective or trigger funding of promotional activity. It is unreasonable for the retailer to withhold such information on the basis that it is for some reason not permitted to share the data with the supplier when, at the point of contracting with the supplier, it made no mention of such potential difficulty and entered into the promotion agreement based on the sales to be made without further qualification.

Retailers should present data in a standardised way in support of claims and in a format that enables the supplier to easily understand what is being presented. Information should be presented in a standardised way that sets out the full terms of the supply agreement between the parties in connection with the recovery audit and does not seek to cherry-pick data. Retailers should highlight the specific information and documents on which reliance is placed for the claim. The intention is to make it easier and quicker for suppliers to respond and to reduce costs of defence to create a more even playing field.

ii. Buying teams should not pursue claims or deal with Counterclaims

Retailers’ finance teams should pursue claims and deal with Counterclaims and agree settlements of the amounts claimed. Buying team members should not make decisions about claims but should be consulted to ensure that the finance team is in possession of all the relevant information on which a claim/Counterclaim is based. Retailers should consider how their buying and finance teams are remunerated to ensure that such arrangements do not incentivise inappropriate behaviour.

The finance team dealing with the settlement of the claim should ensure that payments for Counterclaims are made no later than 30 days after agreement is reached. Where a supplier agrees a claim the payment period should be no shorter than the time allowed in the supply agreement or 30 days if the supply agreement is silent. If settlement is to be effected by way of an offset rather than by way of a payment, then retailers are urged to use the same periods of time (or sooner for agreed Counterclaims).

Finance teams should ensure that express agreement has been received in writing to the settlement of a claim so that there can be no dispute about what has been agreed with the supplier. Retailers should not accept silence in response to a notification of a proposed deduction as express consent and should seek to constructively engage if the supplier does not respond to the notification or the claim generally. It is reasonable for the retailer to apply the proposed deduction if the supplier fails to constructively engage, despite repeated attempts, for 60 days after the notice of proposed deduction has been given, provided that the claim has been properly detailed and all of the relevant data has been provided to the supplier.

iii. Proper assessment of claims to be undertaken before a claim is issued

Finance teams should undertake a robust scrutiny (or commission the undertaking of a robust scrutiny) of all claims, the associated supply agreement and data (e.g. sales figures) before launching a claim or passing it over to a Consultant (as defined in Annex 2) to pursue. In order for it to be clear to the supplier with whom it is dealing, no member of the retailer’s team should use the Consultant’s email address where a Consultant has been retained to pursue a claim/defend a Counterclaim. Similarly, the Consultant should not use the retailer’s email address unless (a) before the audit/defence of a Counterclaim commences the retailer has notified the supplier that it has appointed the Consultant to act on its behalf who will then use the retailer’s email address for future correspondence in respect of the claim/Counterclaim; and (b) the Consultant makes it clear in such correspondence that it is a third party acting for the retailer.

iv. No conflation of the settlement of claims and Counterclaims with current or future trading

Retailers should ensure that relevant members of the finance and buying teams are trained not to conflate issues with current or future trading and that finance teams should operate independently of buying teams to ensure that there can be no link to current or prospective trading arising out of the settlement of a past recovery audit matter. Retailers currently undertake whole house compliance to ensure that all their colleagues who are involved in any way with the Code are trained. There should be regular reminders of the need not to conflate issues as part of the whole house approach to compliance.

v. A timetable for resolution should be set at the outset

Retailers should set out a time within which they expect audit claims and Counterclaims arising as part of the audit claim to be concluded: the objective should be to ensure that the resolution timetable is reasonable and neither seeks a very quick settlement by the retailer nor allows the claim to remain outstanding for long periods of time which could influence current or future trading negotiations and induce a settlement that might not otherwise be entertained. The expectation is that matters should be concluded within 60 days provided that both supplier and retailer are properly and actively engaged in resolution of the issue. Retailers should include information in the claims pack that is presented to suppliers at the beginning of a recovery audit the name and contact details of a senior member of the finance team with whom the supplier can discuss any issues or delays that arise as part of the recovery audit process, and who is empowered by the retailer to invigorate the process of resolution.

vi. Consultants: remuneration, oversight and training

Retailers are encouraged to consider whether the current contingency fee model which has been adopted remains the appropriate way in which to remunerate Consultants – Designated Retailers should annually reconsider the way in which Consultants are remunerated.

Designated Retailers should undertake regular robust audits of the way in which the Consultants’ work is executed to ensure that audits are being conducted fairly within the Code, and that the audit is being conducted in a way that matches the constructive tone in which retailers wish to engage with their suppliers. This does not mean that suppliers should not pay what is properly due to the retailer. Retailers should consider contractually requiring Consultants to train the staff that they use in the pursuit of an audit on the Code to ensure that they know the parameters within which they are working, which may not be the case if those staff are used to pursue claims on behalf of retailers who are not subject to the Code or who are otherwise inexperienced.

This best practice statement was agreed by the 13 Retailers designated at the time of its publication on 30 September 2021 and by Amazon UK (Amazon.com, Inc. was designated by the Competition and Markets Authority with effect from 1 March 2022) from 16 December 2022. It is intended to promote better working practices by the Designated Retailers, in the spirit of continuous improvement. For the avoidance of doubt, approaches in individual circumstances may differ depending on retailers’ and suppliers’ interpretation of relevant competition law.

GCA 8 February 2023

5. ANNEX 1: Relevant Code provisions and existing associated GCA guidance

5.1 Relevant Code provisions

Paragraph 2 of the Code deals with the overarching principle of fair dealing as between Designated Retailers and their direct suppliers, as follows:

A Retailer must at all times deal with its Suppliers fairly and lawfully. Fair and lawful dealing will be understood as requiring the Retailer to conduct its trading relationships with Suppliers in good faith, without distinction between formal or informal arrangements, without duress and in recognition of the Suppliers’ need for certainty as regards the risks and costs of trading, particularly in relation to production, delivery and payment issues.

Paragraph 3 of the Code deals with variations to Supply Agreements between Designated Retailers and their direct suppliers, as follows:

(1) Subject to paragraph 3(2), a Retailer must not vary any Supply Agreement retrospectively, and must not request or require that a Supplier consent to retrospective variations of any Supply Agreement.

(2) A Retailer may make an adjustment to terms of supply which has retroactive effect where the relevant Supply Agreement sets out clearly and unambiguously:

• any specific change of circumstances (such circumstances being outside the Retailer’s control) that will allow for such adjustments to be made; and
• detailed rules that will be used as the basis for calculating the adjustment to the terms of supply.

(3) If a Retailer has the right to vary a Supply Agreement unilaterally, it must give Reasonable Notice of any such variation to the Supplier.

Paragraph 5 of the Code deals with delays in payment between Designated Retailers and their direct suppliers, as follows:

A Retailer must pay a Supplier for Groceries delivered to that Retailer’s specification in accordance with the relevant Supply Agreement, and, in any case, within a reasonable time after the date of the Supplier’s invoice.

Paragraph 14 of the Code deals with ordering for promotions and associated transparency in Supply Agreements between Designated Retailers and their direct suppliers, as follows:

(1) A Retailer must take all due care to ensure that when ordering Groceries from a Supplier at a promotional wholesale price, not to over-order, and if that Retailer fails to take such steps it must compensate that Supplier for any Groceries overordered and which it subsequently sells at a higher non-promotional retail price.

(2) Any compensation paid in relation to paragraph 14(1) above will be the difference between the promotional wholesale price paid by the Retailer and the Supplier’s non-promotional wholesale price.

(3) A Retailer must ensure that the basis on which the quantity of any order for a Promotion is calculated is transparent.

5.2 Existing associated GCA guidance

GCA Tesco investigation

On 26 January 2016, the GCA published a report into its investigation into Tesco plc. Findings under paragraph 5 of the Code included:

…delay in payments was a widespread issue that affected a broad range of Tesco suppliers on a significant scale. The delay in payments had a financial impact on suppliers, was an administrative burden to resolve, detracted from the time available to develop customer-focussed business and had a detrimental impact on some suppliers’ relationships with Tesco”.

[There was]… evidence of unilateral deductions being made by Tesco for historic claims, also referred to as forensic audit claims. Tesco used third party auditors to review its accounts for historic invoicing errors or omissions that would provide evidence that suppliers had previously underpaid Tesco. These were then claimed even when suppliers believed that they had made payments to “close” previous financial periods. ….. [U]nilateral deductions from suppliers were made based on historic claims and these resulted in delay in payments to suppliers. Unilateral deductions for historic claims are unreasonable.

One of the key cultural factors which contributed to delay in payments was the apparent reluctance of some Tesco buyers to pro-actively engage in the resolution of payment disputes. There were times when Tesco did not appear to even attempt to resolve supplier concerns before unilaterally deducting money from suppliers. ….. [T]he delay that resulted from a failure by Tesco to fully engage in resolving difficulties [was] unfair and unreasonable. Buyers frequently sought to use money owed to a supplier as leverage in negotiations for future agreements or promotions. … Tesco acted unreasonably when seeking to bring the resolution of debts into other commercial negotiations and delaying payment of monies owed until other negotiated terms were agreed.

One of the recommendations made in the report (Recommendation 2) was that Tesco should not make unilateral deductions and should provide time for proposed deductions to be challenged together with an explanation of the proposed deduction, referring to the supply agreement methodology. The recommendation concluded that Tesco should not deduct the disputed sum from the supplier’s trading account or otherwise from money owed to the supplier for goods supplied where the supplier challenges the proposed deduction.

Another recommendation made in the report (Recommendation 4) was that the methodology for calculating any money due from suppliers, whether for promotional funding, short deliveries, service level charges, customer complaints, forensic audit claims or penalties, should be clear and explained in the supply agreement. This will allow the supplier to understand, predict and be in a position to challenge charges.

Code clarification: requests for lump sum payments (June 2016)

On 20 June 2016, the GCA issued points of Code clarification arising from Wm Morrison Supermarkets Plc’s requests for both retrospective and prospective lump sum payments from suppliers which dealt with paragraphs 2 and 3 of the Code. A key point for clarification was that:

Requests for retrospective lump sum payments not explicitly agreed in the Supply Agreement are in breach of the Code. Requests for lump sum payments relating to future business not explicitly agreed in the Supply Agreement are potentially an attempt by the retailer to vary the Supply Agreement. While retailers retain the right to vary a Supply Agreement unilaterally, there must be provision for this in the Supply Agreement and reasonable notice must be given to the supplier.

Code clarification: variation of supply agreements (September 2017)

On 4 September 2017, the GCA issued points of Code clarification arising from Asda Stores Limited’s implementation of Project Renewal (a project designed to deliver cost price savings and range reductions) which dealt with paragraphs 2 and 3 of the Code. Key points for clarification included:

1. Requests for prospective investments not explicitly agreed in the Supply Agreement are potentially an attempt by the retailer to vary the Supply Agreement. While retailers retain the right to vary a Supply Agreement unilaterally, there must be provision for this in the Supply Agreement and reasonable notice must be given to the supplier.

2. In this situation, the negotiation was not positioned as such. a) Aggressive tactics, such as inflexible demands to be made by Asda buyers and very short time periods for suppliers to respond, with the threat of de-listing in the background, all point to its being more unilateral than consensual; b) This was underlined by the threat of de-listing felt by suppliers and supported by the Project Renewal materials seen by the GCA, in which it was clearly implied if not expressly stated.

3. Retailers need to be particularly careful when engaging third parties to work on their behalf. The reputational and compliance risks remain with the regulated retailer in these circumstances. Providing incentives to third parties to generate income or cost savings for the retailer may encourage behaviour inconsistent with Code compliance and the retailer’s values. Retailers need to balance these competing interests and ensure robust governance is in place to mitigate Code-compliance risks, in particular.

4. Retailers should ensure that their legal, compliance and audit functions are sufficiently connected to commercial initiatives that they work effectively together to ensure Code compliance.

GCA voluntary commitment on forensic auditing (updated February 2023)

On 31 March 2021, the GCA published an updated version of the voluntary commitment on forensic auditing which confirmed that all Designated Retailers had agreed to the commitment (from 6 March 2022 for J Sainsbury plc and from 16 December 2022 for Amazon UK (Amazon.com, Inc. was designated by the Competition and Markets Authority with effect from 1 March 2022)) which limits the time for which audit claims may be made to the current financial year and the previous two financial years, provided that this is on a reciprocal basis. The voluntary commitment had been introduced in 2014 as the GCA had heard that some Designated Retailers had been using the legal ability to make claims up to six years back against their direct suppliers for historical invoicing errors and omissions, which became difficult to resolve after such long periods of time had elapsed.

Suppliers were being asked for significant sums of money with the burden of proof falling on them to show that any discrepancies were not valid claims. The documentary audit trail was often complex and difficult to piece together after a long period of time. Suppliers reported that deductions would be applied by retailers with little or no notice.

GCA best practice statement: forecasting and promotions (June 2018)

On 25 June 2018, the GCA issued a best practice statement on forecasting and promotions, which built upon a statement of best practice issued in March 2016. The GCA noted that all of the Designated Retailers were striving for continuous improvement in forecasting practice and activity in relation to promotions but given the continued reporting of issues had decided to update the guidance. One of the improvements the best practice statement identified was:

Ensuring that suppliers are able to access adequate sales data to verify the accuracy of any deduction proposed for retrospective or trigger funding.

6. ANNEX 2: Issues reported to the GCA

The reported issues included:

1. The use of cherry-picked data by Designated Retailers to support retrospective claims and, in some cases, a complete lack of data.

2. Data that was manipulated in a way that suppliers (especially smaller suppliers) found confusing to understand (e.g., reconstituting data into formats not used or recognised by suppliers, changing nomenclature, etc). In some cases, the sheer quantity or paucity of data (e.g., including potentially misleading extracts from emails) meant that the supplier is required to spend resources trying to understand what is being presented, what is relevant to the claim being made and mounting an appropriate defence. The methodology to be used by the Designated Retailer in calculating the recovery claim, or in defence of a counterclaim raised in reaction to a claim, especially in relation to overbuys in respect of promotions, is often not well defined in the supply agreement, allowing much to be determined on a case-by-case basis resulting in delay, increased costs, confusion and treating suppliers unequally. This is especially concerning for smaller suppliers who are less likely to have the detailed understanding of a retailer’s systems and processes to understand the claim being made. This may lead to inaccurate and invalid claims being made, which suppliers, who fear for their relationships with retailers or are otherwise unaware, unwilling or unable to challenge an audit claim, accepting claims that they would not normally accept. This is clearly contrary to the principle of fair dealing read with paragraphs 3 and 5 of the Code.

3. There was evidence of an imbalance between the strong pursuit of claims by Designated Retailers to reach a resolution of a claim they initiated and the lack of equivalent vigour to resolve counterclaims made by suppliers as part of the forensic auditing process. Claims made by suppliers, outside of a recovery audit situation, seemed to be dealt with in a more appropriate and timely manner. There appeared to be a lack of recourse to a more senior person when an impasse is reached and a tendency to use the Recommendation 2 (see Annex 1) 30-day challenge period (which has become the norm in the sector) in an arbitrary way – allowing the supplier to continue to challenge if it engaged with the retailer in a way that the retailer believed was subjectively appropriate rather than applying a more objective test of whether the supplier explicitly agreed with the proposed deduction. In the former case there was evidence that some Designated Retailers would apply the deduction at the end of the 30-day challenge period where the supplier had not engaged with the retailer’s process and had not expressly agreed to the proposed deduction – silence being taken as explicit consent or agreement to the proposed deduction. Some retailers, however, actively sought to engage a supplier who had not responded to a proposed deduction notification and only progressed the deduction after several attempts had been made to engage the supplier in a settlement discussion.

4. There was some evidence that retailers were using their terms and conditions to seek settlement of claims by pointing to terms which allow for claims to be offset against other amounts due to the supplier. However, offsetting can only be appropriate where the audit related claims have been agreed and should also take into account the value of counterclaims made by the supplier so that only undisputed sums are set off.

5. There was evidence that some Designated Retailers’ buyers were using aggressive tactics to link the settlement of a recovery audit claim, or concessions on a counterclaim, to current and/or future trading with threats of delisting expressed or clearly implied. In the Code clarifications issued in 2016 and 2017 the GCA noted that nuanced conversations which were designed to imply detriment if requests were not met could be indirect requirements contrary to paragraph 3 of the Code both in respect of retrospective and prospective requests. In the 2016 report into the investigation of Tesco the GCA found that it was unreasonable to seek to bring the resolution of debts into other commercial negotiations or to delay the payment of monies owed to a supplier until other negotiated terms were agreed. Such a conflation of issues is contrary to the paragraph 2 principle of fair dealing as well as contrary to paragraphs 3 and 5 of the Code.

6. Some Designated Retailers required the costs of any agreed counterclaims to be absorbed by their current year buying team budgets; yet claim proceeds would not benefit those budgets thereby creating a disincentive for agreeing to counterclaims.

7. Many Designated Retailers continue to use third party consultants (Consultants) to conduct their recovery audits, although there is some evidence that some of these functions are being brought in house. The Consultants all have contracts with the Designated Retailers who use their services which set out how the Consultant should conduct the recovery audit, intended in part to ensure that the Consultant is upholding the ethos of the Designated Retailer, as it is effectively acting in the name of, and on behalf of, the retailer. It appeared that, almost universally, the Consultants are remunerated by the retailers on a contingency fee basis. Designated Retailers seem not to have considered, or recently considered, the appropriateness of this method of remuneration, which encourages the maximisation of volumes and values of claims, perhaps without regard to whether the claims are valid. Whilst most retailers confirmed that they would ask their finance teams to conduct a robust pre assessment of claims prior to contact with suppliers, the remuneration model does not support this. Consultants’ maximisation of their own revenue streams often results in the use of inexperienced staff or contract labour (not trained on the Code) who are remunerated on a commission basis to conduct the actual recovery audit, which has exacerbated problems. Consultants confirmed that counterclaims raised as part of a recovery audit might not be dealt with by the finance team at the retailer responsible for the original claim so there was some disconnect between the claim and the counterclaim. Retailers are generally aware of the risk of using Consultants and have implemented measures which seek to create accurate reporting by the Consultants, sample testing of emails and so on to ensure that the recovery audit is being conducted in a way in which the retailer wishes. However, there was some evidence that the audits conducted on the Consultants might not be sufficiently robust or took place too infrequently to ensure that the affected suppliers were being treated fairly. There is some evidence that retailers’ teams use the email addresses of the Consultants (or vice versa) to increase the pressure on suppliers to settle claims. This is contrary to the principles set out in the Code. It is well established that the reputational and compliance risks of using Consultants remain with the retailer and that, as seen in the 2017 Code clarification in relation to Project Renewal at ASDA Stores Limited, providing incentives to third parties appointed by retailers to generate revenue for the retailer may encourage behaviour inconsistent with the Code and the retailer’s own values.