Share with your friends

Charting the right path to compliance

Charting the right path to compliance

With CCO legislation fresh on the books, we share key insights from having worked with clients across industry.


Also on

Corporate Criminal Offences (CCO) – Recent insights - Ship on dock

Core CCO insights

Formulating and progressing a suitable response to the CCO takes longer than expected. The key challenge here is around timing, co-ordination and prioritisation. Organisations can quickly get into difficulties if they focus either on the immediate goal of completing a risk assessment without thinking through the methodology and approach, or rush controls into business as usual (BAU) without properly understanding the risks. The driver to get something in place quickly to satisfy HMRC is understandable, but the end result must be coherent, considered and proportionate.  Our experience with clients is that a pilot works well to introduce the topic, educate the business and test the methodology while providing a quick snapshot of risk within the organisation. This in turn can be used to formulate a coherent and effective action plan through to BAU. 

Governance is difficult to get right but critical to success. Although some organisations continue to see CCO as a tax issue and are recruiting into tax departments to fill new roles, we are increasingly seeing organisations leading CCO risk management from the compliance department. This makes sense, as there are distinct similarities in the risk management of CCO and other compliance areas (particularly ABC). The challenge is to ensure that the right stakeholders are engaged in the topic, with both the tax and compliance functions having an important role to play, and that CCO risk will continue to be effectively governed and monitored in the longer term. Experience with clients is that compliance functions’ familiarity with systems and controls is a key success factor when transitioning from the risk assessment phase into implementation of identified actions, while tax teams are invaluable in providing SME insight across the process.

Non-UK risks cannot be overlooked. The majority of organisations are currently focusing on the UK offence, as opposed to the foreign offence. There is a good rationale for focusing on UK-based activities as an initial step: firstly, the risk of prosecution is arguably greatest in respect of UK facilitation; and secondly, this allows important learnings from the UK work to be leveraged in later global work. The challenge is for companies to ensure, having completed the UK part of the work, that they do not then allow other priorities to detract them from this next crucial stage. Our experience is that clients often struggle to develop engagement and support from teams and departments outside the UK, in respect of CCO, on the basis it is UK legislation. One way to tackle this is to focus this on the broader risks presented by tax evasion facilitation, as opposed to the particularities of the UK legislation.

So more than six months in, how far along the road should you be with your CCO compliance programme?

A proportionate and timely response

Our view is that proportionate action at this stage will, as a minimum, include having:

  • conducted a risk assessment in order to understand your organisation’s risk environment, and where risk is greatest across your business activity
  • put in place a response plan, detailing implementation required to update controls and procedures in light of the new offence
  • started the process of remedying any identified gaps in your current control framework
  • commenced a training and awareness programme covering all relevant staff & departments

Referring back to the common trends, thought should also be given to next steps, including:

  • adoption of CCO controls within BAU processes and platforms, ensuring ongoing monitoring and review is effective and embedded
  • documented and sustainable governance of CCO risk management, with sufficient senior management engagement
  • a proportionate but comprehensive global phase of work (where relevant), addressing high risk countries / divisions and including a clear plan through to BAU


Based on the above, how confident are you that your procedures measure up against the benchmark that the courts are starting to set? And where will that benchmark be in several years’ time, when HMRC may come knocking?KPMG’s CCO response is multi-disciplinary, and so we are able to offer Risk consulting, Tax and Legal services in a cost effective and joined up manner. For more information, please contact Annabel Reoch, Chris Davidson or Henry Campbell-Smith.

Connect with us


Want to do business with KPMG?


loading image Request for proposal