Policy paper

Counter fraud, bribery and corruption strategy (accessible)

Published 21 October 2026

Applies to England

Executive summary

Ofqual is committed to protecting public funds, safeguarding information and maintaining public confidence through effective management of fraud, bribery and corruption risks.

This strategy establishes the framework through which Ofqual will prevent, detect, investigate and respond to fraud, bribery, corruption and related misconduct. It aligns with Government Functional Standard GovS 013: Counter Fraud, Public Sector Fraud Authority (PSFA) guidance and wider legislative requirements.

The strategy adopts a prevention-first approach, supported by a strong culture of integrity, effective governance, proportionate controls, proactive detection and continuous improvement. Success will be measured not only through fraud identified and losses recovered, but through stronger controls, better risk awareness, earlier detection, effective responses and reduced opportunities for fraud.

The strategy covers the period 2026 to 2029 and will be supported through annual action plans, regular fraud risk assessments, targeted assurance activities and governance reporting.

1. Introduction

Ofqual is committed to maintaining a strong counter-fraud culture in which fraud, bribery and corruption are actively prevented, detected, investigated and appropriately addressed.

The organisation adopts a zero-tolerance approach to deliberate fraud, bribery and corruption while ensuring that controls remain proportionate, risk-based and operationally effective. Protecting public money and maintaining public confidence are fundamental responsibilities for everyone working for, or on behalf of, Ofqual.

2. Purpose

This strategy establishes a coordinated framework for preventing, detecting and responding to fraud, bribery, corruption and related misconduct in the context of Ofqual’s own activities. This is separate from work Ofqual performs in its regulatory role to prevent fraud within the qualifications and assessments system.

It sets out how Ofqual will:

• identify and assess fraud risks

• design and maintain effective controls

• undertake proactive detection activities

• investigate allegations and incidents

• recover losses where appropriate

• promote a culture of integrity and accountability

• learn lessons and continuously improve

• meet government counter-fraud expectations and standards

3. Strategic context

Government Functional Standard GovS 013 sets out expectations for the management of fraud, bribery and corruption risk across government departments and arm’s-length bodies. Ofqual will use GovS 013 as the principal benchmark for its counter-fraud arrangements.

The Government Counter Fraud Functional Strategy 2024-2027 highlights the importance of prevention, capability, data, technology, intelligence-led action and cultural change. This strategy supports those priorities.

The fraud threat is evolving through:

• digital transformation

• artificial intelligence-enabled fraud

• social engineering and phishing attacks

• business email compromise

• identity fraud

• procurement and supplier fraud

• insider threats

• misuse of organisational data and systems

• increased interconnectivity of third-party services

Ofqual will adopt a risk-based and intelligence-led approach to understand and respond to these threats.

4. Legislative and regulatory framework

This Strategy has regard to the requirements and principles of:

• Government Functional Standard GovS 013

• public sector fraud authority guidance

• managing public money

• HM Treasury Orange Book

• Bribery Act 2010

• Fraud Act 2006

• Theft Act 1968

• Criminal Finances Act 2017

• Proceeds of Crime Act 2002

• Economic Crime and Corporate Transparency Act 2023

• Public Interest Disclosure Act 1998

• UK GDPR and Data Protection Act 2018

• Computer Misuse Act 1990

• public procurement requirements

• Ofqual’s code of conduct

• conflicts of interest policy

• gifts and hospitality policy

• disciplinary and HR policies

5. Definitions

Fraud

Deliberate dishonest behaviour intended to obtain a financial or non-financial advantage, or cause loss to another party.

Bribery

Offering, promising, giving, requesting or accepting an advantage intended to influence improper conduct or decision-making.

Corruption

Abuse of entrusted authority, position or power for personal or organisational gain.

Attempted fraud

Conduct intended to facilitate fraud that does not result in successful completion.

Error

An unintentional act or omission. Although distinct from fraud, errors may indicate control weaknesses and require management attention.

6. Strategic vision

Vision

To maintain an organisation that is resilient to fraud, bribery and corruption, protects public resources and information, promotes ethical behaviour and responds effectively to suspected wrongdoing.

Actions that we take to support the vision

Ofqual will continue to:

• strengthen and mature its counter-fraud governance arrangements

• maintain and regularly review an Enterprise Fraud Risk Assessment (EFRA)

• embed counterfraud-by-design principles into relevant business change and transformation activities such as implementation of finance systems

• implement effective fraud prevention and detection controls

• maintain robust reporting, escalation and response arrangements

• ensure access to appropriate investigation capability and expertise

• operate effective processes for the recovery of losses arising from fraud

• apply structured lessons learned processes to drive continuous improvement

• demonstrate compliance with Government Functional Standard GovS 013: Counter Fraud

7. Strategic principles

Ofqual’s counter-fraud approach will be guided by the following principles:

1. 1. prevention first

2. 2. risk-based

3. 3. proportionate

4. 4. intelligence-led

5. 5. whole organisation responsibility

6. 6. zero tolerance for fraud, bribery and corruption

7. 7. fairness and due process

8. 8. continuous improvement

9. 9. transparency and accountability

10. 10 public value and stewardship

8. Strategic objectives

Objective 1: governance and leadership

Provide clear leadership, accountability and oversight for fraud, bribery and corruption risks.

Objective 2: risk understanding

Maintain a comprehensive understanding of fraud threats through risk assessment, intelligence gathering and horizon scanning.

Objective 3: prevention

Embed effective and proportionate controls into systems, processes and organisational change.

Objective 4: detection

Use management information, analytics and targeted reviews to identify fraud risks and suspicious activity promptly.

Objective 5: response and recovery

Respond effectively through investigation, escalation, reporting and loss recovery where appropriate.

Objective 6: culture and continuous improvement

Promote ethical behaviour, strengthen awareness, protect whistleblowers and continuously improve capability.

9. Governance and accountability

Ofqual board

The Board is responsible for approving this strategy and providing strategic oversight of fraud risk management. This may be achieved through the appropriate subcommittee, i.e. the Audit Risk and Assurance Committee (ARAC).

Audit and risk assurance committee (ARAC)

The Audit Risk and Assurance Committee provides challenge and assurance over the effectiveness of counter-fraud arrangements and receives reports on fraud risks, incidents and improvement actions.

Senior officer accountable for counter fraud

Provides executive leadership, ensures adequate resources are available and promotes effective implementation across the organisation.

Counter fraud lead

Coordinates the counter-fraud programme, maintains the EFRA, oversees investigations, supports reporting, awareness and assurance activities, and acts as the key liaison with external bodies.

Finance

Maintains financial controls, supports fraud prevention and detection activities, and assists with loss measurement and recovery.

Procurement

Maintains supplier and procurement controls and escalates suspected fraud concerns.

Human resources

Supports investigations involving employees and manages disciplinary action where appropriate.

Internal audit

Provides independent assurance regarding the effectiveness of controls and governance arrangements.

All staff

Are responsible for acting with integrity, protecting public resources, reporting concerns promptly and complying with relevant policies and procedures.

10. Fraud risk management framework

Fraud risk assessment and intelligence

Ofqual will maintain an enterprise fraud risk assessment covering internal and external fraud threats.

Assessments will consider:

• likelihood and impact

• control effectiveness

• residual risk

• opportunities and vulnerabilities

• financial, operational and reputational impact

• emerging threats

Fraud risks will be reviewed regularly and incorporated into the wider corporate risk management framework.

Fraud prevention and fraud by design

Fraud prevention will be embedded into business operations through:

• segregation of duties

• delegated authorities

• independent approvals

• due diligence

• access controls

• verification processes

• reconciliations

• audit trails

• training and awareness

Fraud risks will be considered during system implementation, organisational change, procurement activity and process redesign.

Fraud detection, data and analytics

Ofqual will use proportionate and lawful detection methods including:

• data analytics

• exception reporting

• duplicate payment reviews

• trend analysis

• supplier testing

• conflict-of-interest reviews

• user access monitoring

• intelligence-led reviews

• anomaly detection

Detection activity will focus on higher-risk areas and emerging threats.

Incident reporting, investigation and response

Accessible reporting channels will be maintained through management, whistleblowing arrangements, the counter fraud lead, HR, Finance and other approved routes.

All allegations will be:

• logged and assessed

• subject to initial triage

• escalated where necessary

• supported by evidence preservation

• investigated proportionately

• recorded and reported appropriately

Where necessary, specialist investigators or external authorities may be engaged.

Loss recovery and redress

Where appropriate and proportionate, Ofqual will seek recovery through:

• repayment arrangements

• contractual remedies

• civil recovery

• criminal compensation orders

• asset recovery mechanisms

• insurance claims

11. Key fraud risk areas

Bribery, corruption, conflicts and gifts

Ofqual will maintain robust arrangements for managing conflicts of interest, gifts and hospitality, ethical conduct and decision-making transparency.

Procurement, supplier, payment and payroll fraud

Controls will address risks including:

• supplier fraud

• duplicate payments

• invoice manipulation

• payroll fraud

• procurement collusion

• contract manipulation

• unauthorised payments

Information and cyber-enabled fraud

Fraud risk will be incorporated into information security arrangements, including controls for:

• phishing

• identity theft

• business email compromise

• social engineering

• data manipulation

• insider threats

Third-party and outsourced services

Counter-fraud expectations will be incorporated into contracts, due diligence processes, monitoring arrangements and supplier assurance activities.

12. Culture, awareness and whistleblowing

Ofqual will promote a culture where everyone understands their responsibility to protect public money and organisational integrity.

Training will be:

• risk-based

• included within induction

• refreshed periodically

• tailored for higher-risk roles where necessary

Whistleblowers raising concerns in good faith will be supported through appropriate confidential reporting arrangements and protected from retaliation.

13. Collaboration and external engagement

Ofqual will work closely with the Department for Education as its sponsoring department to manage fraud risks effectively and share relevant information where appropriate.

The organisation will also engage with:

• public sector fraud authority

• government counter fraud profession

• HM Treasury

• law enforcement agencies

• auditors

• other government departments and arm’s-length bodies

Collaboration supports intelligence sharing, capability development and continuous improvement.

14. Future strategic risks and challenges

The organisation recognises that fraud risks and challenges will continue to evolve due to changes in technology, working practices, organisational structures, and the external threat landscape. Increasingly sophisticated fraud methods, including cyber-enabled and technology-assisted fraud, may present new risks that require enhanced preventative and detection measures.

Internal changes, such as business transformation, new systems, process redesign, workforce changes, or resource constraints, may also create vulnerabilities if fraud risks are not identified and managed effectively. The organisation will therefore consider fraud risks as part of major change programmes and strategic decision-making.

In addition to potential financial losses, fraud incidents may result in operational disruption, reputational damage, and reduced stakeholder confidence. To remain resilient, the organisation will maintain a risk-based approach, regularly review emerging threats, monitor changes in its operating environment, and use lessons learned, assurance activities, and sector developments to continuously strengthen its counter fraud arrangements.

15. Performance management and reporting

Strategic outcome measures

Performance indicators may include:

1. 1. Fraud loss rate

2. 2. High-risk controls operating effectively

3. 3. Training completion rates

4. 4. Proactive detection activity undertaken

5. 5. Investigation timeliness

6. 6. Recovery rates

7. 7. Implementation of recommendations

8. 8. GovS 013 compliance outcomes

Success will not be measured solely through detected fraud cases but through reduced opportunities and stronger prevention arrangements.

Board and the Audit Risk and Assurance Committee reporting

Regular reporting will include:

• fraud risks

• significant incidents

• confirmed losses

• attempted and prevented fraud

• recovery activity

• control weaknesses

• emerging threats

• assurance outcomes

• annual counter fraud plan and progress

16. Counter-fraud assurance and continuous improvement

Lessons learned

Ofqual will conduct lessons-learned reviews for significant incidents, attempted frauds, near misses and major control failures.

Improvement actions will be tracked through to completion.

Annual assurance programme

An annual programme of assurance will assess:

• compliance with this strategy

• GovS 013 alignment

• prevention controls

• detection activities

• reporting arrangements

• investigations

• loss recovery processes

• training and awareness

Counter-fraud assurance

Ofqual will maintain an annual counter-fraud assurance programme covering compliance with the strategy, GovS 013, fraud risk assessment, controls, awareness, reporting, investigations, loss reporting, recovery, data analytics, procurement, payment, payroll, conflicts, gifts and hospitality, and lessons learned. Assurance will be risk-based and proportionate.

Maturity model

Level 1 – Initial: reactive and fragmented arrangements.

Level 2 – Developing: basic policies, responsibilities and reporting.

Level 3 – Established: consistent risk assessment, prevention, detection, response and assurance.

Level 4 – Advanced: embedded controls, data analytics and proactive detection.

Level 5 – Leading: integrated intelligence, predictive risk management and continuous improvement.

Ofqual’s objective is to maintain at least Level 3, with targeted progression towards Level 4 in higher-risk areas.

17. Resources and capability

Ofqual will ensure that counter-fraud arrangements are supported by appropriate:

• people

• skills

• training

• technology

• data

• funding

• specialist expertise

External specialists may be used where additional expertise is required.

18. Records and management information

Ofqual will maintain records of:

• allegations

• investigations

• confirmed fraud

• attempted fraud

• losses and recoveries

• fraud risk assessments

• training

• assurance activities

• lessons learned

Management information will support governance, assurance and decision-making.

19. Risk appetite

Ofqual has a low tolerance for fraud, bribery and corruption.

All allegations will be considered appropriately regardless of value. Responses will remain proportionate, evidence-based, legally compliant and aligned with the public interest.

20. Annual counter fraud action plan

The strategy will be supported by an annual action plan, to be presented for review by ARAC, setting out:

• priority activities

• accountable owners

• target dates

• success measures

• delivery status

21. Annual counter-fraud cycle

Understand

• refresh EFRA

• review incidents

• assess threats

• agree priorities

Prevent

• review high-risk controls

• conduct thematic assessments

• deliver awareness activities

Detect

• undertake proactive detection activity

• perform data analytics

• complete targeted reviews

Respond and improve

• evaluate performance

• review lessons learned

• undertake assurance activities

• agree priorities for the following year

22. Review of strategy

This strategy will be formally reviewed annually and refreshed at least every 3 years, or sooner following:

• significant fraud incidents

• major organisational change

• significant system changes

• legislative developments

• material assurance findings

• emerging fraud threats

Annex A – GovS 013 compliance statement

This strategy supports compliance with GovS 013 through clear governance, accountability, fraud risk assessment, prevention, detection, response, investigation, recovery, assurance, reporting, capability development and continuous improvement.

Evidence supporting compliance will be maintained through an assurance evidence pack.

Annex B – Counter-fraud success statement

Counter-fraud success will not be measured by identifying more fraud.

Success will be demonstrated through fewer opportunities for fraud, stronger controls, improved staff awareness, earlier detection, effective responses, appropriate recovery of losses, better decision-making and continuous improvement in fraud resilience.

Annex C – Counter fraud document framework

S/n	Document
1.	Counter fraud, bribery and corruption strategy
2.	Counter fraud, bribery and corruption policy
3.	Fraud risk assessment
4.	Whistleblowing policy
5.	Gifts and hospitality policy
6.	Conflicts of interest policy
7.	Government counter fraud functional strategy

Annex D – Supporting documents

1. 1. Ofqual’s whistleblowing policy

2. 2. Ofqual’s disciplinary policy

3. 3. CIPFA Code of Practice on Managing Fraud and Corruption

4. 4. The 7 Principles of Public Life

   1. First outlined by Lord Nolan in 1995, the 7 principles remain the expected standard for everyone working in the public sector.

5. 5. Economic Crime and Corporate Transparency Act 2023

6. 6. Guidance on the Economic Crime and Corporate Transparency Act 2023