This Checklist highlights the issues which should be considered when advising on and undertaking an internal investigation into whether criminal conduct by a senior manager may be attributed to an organisation under section 250 of the Crime and Policing Act 2026 (CPA 2026). It should be read in conjunction with Practice Note: Corporate criminal liability—senior manager attribution. The expansion of senior manager attribution is intended to make it easier for prosecutors to investigate and prosecute organisations where suspected criminal conduct involves senior management. It is therefore important that an internal investigation initially considers not only whether an underlying offence may have been committed, but also whether the individual concerned may qualify as a senior manager and whether the conduct occurred within the actual or apparent scope of their authority. The speed, independence and quality of an organisation’s initial response and internal investigation may affect subsequent enforcement decisions, the organisation’s ability to demonstrate co-operation and the prospects of prosecution, civil or regulatory enforcement, or no further action. For guidance on mapping decision-making authority and assessing

The following questions and issues should be at the forefront of a lawyer’s mind when advising in relation to an internal investigation on suspicion of failure to prevent bribery. This Checklist should be read in conjunction with Practice Notes: The Bribery Act 2010—an introductory guide, Failure to prevent bribery—the offence and Self-reporting corporate offences. Initial Considerations Oversight The top-level management of an organisation should be committed to preventing associated persons from engaging in bribery. They should foster a culture within the organisation in which bribery is unacceptable. Consider: • Has the company appointed an officer of sufficient seniority responsible for anti-bribery? • Does the Board, or an appropriately constituted sub-committee of the Board, have oversight of the work of the anti-bribery officer and any investigation arising out of reports of suspected bribery? Internal reporting/whistleblowing • Does the company have a defined whistleblowing strategy? • Is it well-known and enforced throughout the company? • Has your company got clear reporting channels for reporting suspected bribery? • Does the company provide a confidential whistleblowing help line?

This Checklist highlights the issues which should be considered when advising on and undertaking an internal investigation into whether the corporate criminal offence of failure to prevent fraud contrary to section 199 of the Economic Crime and Corporate Transparency Act 2023 (ECCTA 2023) has occurred. It should be read in conjunction with Practice Note: Failure to prevent fraud—the offence. Initial considerations Oversight Government guidance on failure to prevent fraud (FTP fraud) makes clear that those responsible for the governance of a ‘large organisation’ should be committed to preventing ‘associated persons’ from engaging in what it calls ‘base fraud’ (for the benefit of the organisation, or in some circumstances, a client), and top-level management should create and nurture a culture in which fraud is not acceptable. The discovery of a potential ‘base fraud’ by a person associated with the organisation therefore raises the prospect that such efforts have failed. The organisation may be guilty of FTP fraud if the associated person has committed the ‘base fraud’, unless it had ‘reasonable procedures’

This Checklist explains the issues that should be considered when advising on and undertaking an internal investigation into whether the corporate criminal offence of failure to prevent the criminal facilitation of tax evasion has occurred. It should be read in conjunction with Practice Notes: Failure to prevent the criminal facilitation of tax evasion—the offences and Self-reporting corporate offences, as well as the Failure to prevent the facilitation of tax evasion collection. Initial considerations Oversight The top-level management of an organisation should be committed to preventing persons acting in the capacity of a person associated with it from engaging in criminal facilitation of tax evasion. They should foster a culture within the organisation in which tax evasion facilitation is never acceptable. Consider: • has the company appointed an officer of sufficient seniority responsible for compliance and oversight of the company’s risk assessment, and policies and procedures in respect of preventing the facilitation of tax evasion? Internal reporting/whistleblowing An important aspect of an effective strategy to prevent the facilitation of tax evasion is

Law360, London: On April 16 2026, the High Court in Aabar Holdings S.À.R.L. and others v Glencore plc and others [2026] EWHC 1328 (Comm) confirmed that legal advice privilege can extend to intraclient communications created by or exchanged between members of a corporate client group for the dominant purpose of obtaining legal advice. According to the analysis, with contributions from Nicolas Groffman, founder of Harligan Ltd, the ruling strengthens protection for internal investigations but does not create blanket privilege over all internal communications. The key takeaway is that companies seeking to preserve privilege should clearly define their client group, ensure communications are primarily for obtaining legal advice and maintain disciplined investigation structures, as future disputes are likely to focus on dominant purpose and privilege governance.

Legal professional privilege (LPP) protects documents from disclosure to third parties including government agencies, regulators and claimants in civil proceedings. It is important to ensure you preserve legal professional privilege wherever possible when conducting internal investigations. For guidance on maintaining privilege during criminal investigations, see Practice Note: Maintaining privilege during criminal investigations. Types of legal professional privilege There are two types of LPP in England and Wales: Legal advice privilege Litigation privilege Protects confidential written or oral communications between a lawyer and a client for the dominant purpose of giving or receiving legal advice and documents.Advice from an in-house lawyer will be covered provided it is given in the relevant legal context and relates to the legal part of their function (ie it is truly for the purpose of obtaining or giving legal advice). It will not be covered if it relates to their management, compliance and/or other broader functions.For more guidance, see Practice Notes: Legal professional privilege for in-house lawyers and Legal professional privilege in civil proceedings—Legal advice

This Checklist summarises key issues which may need to be considered when commencing an internal investigation into suspected criminal offences. For more detailed guidance on internal investigations, see Practice Note: How to plan and conduct an internal investigation. • What is the purpose of the investigation? The objective should be fact finding rather than to determine liability. • What is the scope of the investigation? Draw up terms of reference • Decide who should undertake the investigation and assign roles within the investigation. If Board members are going to take part, check whether a board resolution is required to authorise this. Consider consulting a lawyer about the issues in respect of Legal Professional Privilege (LPP) that this is likely to raise. • The Board, or an appropriately constituted sub-committee of the Board, should have oversight of any investigation and should be identified as ‘the client’ for the purposes of any engagement letter and/or correspondence with internal and/or external lawyers—written records of these decisions must be kept. • If an internal audit department is

1 Introduction 1.1 This policy sets out the responsibility of employees and management in relation to the investigation of fraud, bribery, facilitation of tax evasion and other business crime (together, ‘financial crime’), within [insert organisation name]. We will not tolerate any level of financial crime and are committed to protecting our assets and promoting honesty and integrity. 1.2 [Insert organisation name] is committed to conducting its business in a transparent, honest and fair manner. All staff and third parties working on behalf of [insert organisation name] are expected to adopt the highest standards of accountability in promoting an ethical culture. 1.3 Where financial crime is suspected, [insert organisation name] will commence an independent investigation of the allegations and remediate appropriately. This may include disciplinary procedures, dismissal and/or the provision of information to relevant criminal prosecution agencies. [Insert organisation name] will, in appropriate circumstances, seek to recover funds lost through financial crime committed or facilitated by employees. 1.4 Common scenarios that may trigger an investigation include: 1.4.1 an individual raising a concern internally via a whistleblowing hotline or otherwise (whistleblower); 1.4.2 a response to a regulatory or criminal agency demand;

As you may be aware, the Company is currently [being investigated by the [insert name of agency] OR conducting an internal investigation] in relation to [insert allegations of fraud, bribery].[ External lawyers have been engaged to assist in the investigation.] The investigation is strictly confidential and we ask that you maintain this confidentiality at all times. I would like you to attend a meeting with our lawyers on [insert date]. We believe that you have information which may assist our understanding of the facts related to the matters under review. The fact that we would like to speak to you does not mean you are the subject of an investigation. Your attendance at this meeting is in keeping with your employment duties and we expect your full cooperation in this regard. This letter provides information about the process. Attendance at the meeting At

1 Decide who should conduct and support the investigation General counsel should decide on how best to conduct the investigation, although they may establish a special committee comprising relevant members of the board or audit committee. Identify who will be the 'client contact'. This is the person within the company who will be the main point of contact. They should be sufficiently senior to be able to give instructions and make decisions on behalf of the company, and should have no involvement in the alleged conduct. Consider whether to appoint: —external legal advisors to enhance the (perceived) independence/integrity of the investigation and provide a stronger case for legal professional privilege (LPP); —an external data vendor to collect and process relevant data and assist with forensic services such as the recovery of deleted data, if required; —media relations experts to help ensure effective messages are issued to the public and monitor the effect of any adverse press. 2 Limit your internal and external communications To preserve the confidential status of any internal communications

Thank you for taking the time to meet with us. As you are aware, we are conducting an investigation on behalf of [insert organisation's name] into events relating to [use general terms to describe the issues]. We believe you may be able to help our understanding of events by providing information which will assist the investigation. As lawyers for [insert organisation's

Please click for the Precedent sample privilege log. Please note that this register has been prepared in Excel and it therefore cannot be downloaded to Word. This Precedent sample privilege log can be used when an organisation conducts an internal investigation. It will allow you to identify and list documents that are subject to legal professional privilege, record whether they have been redacted or withheld entirely, and the reason why. It can also be used when an organisation is subject to an external investigation. Legal professional privilege (LPP) protects documents from disclosure to third parties including government agencies, regulators and claimants in civil proceedings. There are two types of LPP: legal advice privilege and litigation privilege—see Practice Note: Internal investigations and legal professional privilege—Types of legal