Counter Fraud Policy

4.1 Scope
This policy applies to all staff and associated persons (anyone acting on behalf of the University), including (but not limited to):
●    employees and workers (whether casual, temporary, fixed-term, permanent or on open-ended contracts), agency workers, seconded workers, volunteers or interns; and
●    associated persons, including (but not limited to):

          ○ agents, contractors, associates, consultants, third-party representatives and business partners, suppliers, donors, sponsors, or any other person associated with the University wherever located;
          ○ external members of Council and University committees, panels or boards if they perform services for or on behalf of the University;
          ○ researchers and academic visitors  whether self-funded or employed by other entities (such as other funders, universities or Oxford colleges), and retired members of staff, if they perform services for or on behalf of the University;
          ○ University subsidiary companies and joint venture entities where the University wholly owns or controls the entity unless separate policies have been formally approved and adopted by the Boards of those companies and endorsed by Council’s General Purposes Committee. This covers the joint venture partners and, where applicable, those companies conducting services on behalf of the joint venture;
          ○ Kellogg, St Cross and Reuben Colleges, which are societies of the University of Oxford, but not to other colleges, which have their own policies; and.
          ○ students (i.e. anyone who has a contract for study with the University) when employed by or otherwise acting on behalf of the University, e.g. as members of committees or when representing the University in sports or other competitions. 

This policy has been adopted by the Council and applies throughout the University apart from Oxford University Press, which has its own policy and procedures for the prevention and detection of fraud. This policy applies in full to majority and wholly owned subsidiary companies unless separate policies have been formally approved and adopted by the Boards of those companies and endorsed by Council’s General Purposes Committee.

The University expects Third Parties acting for or providing services to the University not to commit fraud and will take appropriate measures and action should it discover that third parties are engaging in fraud.  Third parties are advised, therefore, to make themselves fully aware of the provisions of this policy and, in particular, the standards relating to fraud. Where appropriate, the University will include contractual obligations in respect of adherence to this policy in its agreements with third parties.

4.2 Responsibilities
Every member of staff and associated persons who act on behalf of, or provide services to, the University is responsible for ensuring that they comply at all times with the Counter Fraud Policy. This involves maintaining and monitoring compliance with internal controls and agreed policies and procedures; immediately reporting details of any suspected fraud, whether by an employee or an external organisation, and assisting in the investigation of suspected fraud.

Responsibilities for the effective management of fraud risk within the University are organised along a three lines of defence model. The model aims to provide assurance to Council, which is responsible for the administration of the University and for the management of its finances and assets, that risks are being managed. Council is also responsible to the Office for Students for meeting its conditions of registration, which include operating comprehensive corporate risk management and control arrangements. 

The Audit and Scrutiny Committee is responsible for overseeing the adequacy of the University's arrangements to prevent and detect irregularities, fraud and corruption, to include being notified of any action taken under the University's policy.

The components of the three lines of defence model are as follows:
 

4.2.1 First line of defence
Relevant Service Heads are responsible for managing risks of fraud within their respective functional areas (Finance, People, Research Services, Estates, etc.), and for developing, implementing and maintaining adequate control frameworks.

Heads of Division, Heads of Department (including Faculty Board Chairs), and Heads of University Services (UAS and GLAM) are responsible for ensuring that adequate systems of financial management and internal control to mitigate/minimize the risk of fraud and detect fraud are operating in their divisions, departments or sections (as appropriate) and that staff, affected students, and other associated persons are made aware of the Counter Fraud Policy and associated explanatory guidance. Heads of Department (HoDs) also have specific responsibilities for ensuring their staff comply with the relevant policies and for supporting appropriate reporting, investigations of instances of fraud, and near misses. (See Financial Regulations which set out the responsibility to operate systems of internal control).

Relevant directors in majority and wholly owned subsidiary companies of the University are responsible for ensuring that the Counter Fraud Policy, or an alternate policy that is approved by Council’s General Purposes Committee, is implemented and maintained within those companies, and that staff and other associated persons are made aware of the policy and associated explanatory guidance.

4.2.2 Second line of defence
The Counter Fraud team is responsible for developing and delivering a strategy to ensure that effective fraud risk management arrangements are in place. They are responsible for supporting the University to identify and assess key fraud risks and controls, ensuring that arrangements are regularly reviewed, and providing reporting and assurance over them.

4.2.3 Third line of defence
Internal Audit is responsible for providing independent, objective assurance that arrangements for managing fraud risk are well designed and operating effectively.

Prior to undertaking an internal audit review of the investigations process, the University will assess whether or not there are any perceived and/or actual conflicts of interest, as a result of the Head of Internal Audit’s role in supporting investigations into fraud or financial misconduct. Where potential conflicts are determined, other independent parties will be appointed to undertake and / or oversee this audit.

This policy interacts and overlaps with a number of other University policies and procedures: 
•    Anti-Bribery Policy; 
•    Financial Regulations and supporting Financial Processes; 
•    Policy on Conflict of Interest;
•    Gifts and Hospitality Policy; 
•    Anti-Facilitation of Tax Evasion Policy; 
•    Information Security Policy and implementation guidance; 
•    Code of Practice on Academic Integrity in Research; 
•    Public Interest Disclosure (whistleblowing) Code of Practice; 
•    Student admissions policies and procedures; 
•    Staff recruitment policies and procedures; 
•    HR policies, including staff disciplinary procedures; and 
•    Student disciplinary procedures.

This policy also takes account of the University’s wider legislative obligations and provisions pertaining to fraud and associated behaviour as set out in but not limited to:
•    The Fraud Act, 2006;
•    The Bribery Act 2010; 
•    The Terrorism Act, 2006; 
•    The Proceeds of Crime Act, 2002; 
•    The Criminal Finances Act 2017; 
•    Public Interest Disclosure Act 1998; 
•    The Computer Misuse Act, 1990; 
•    U.S. Foreign Corrupt Practices Act 1977; 
•    The Economic Crime (Transparency and Enforcement) Act 2022;
•    Economic Crime and Corporate Transparency Act (ECCTA) 2023 and
•    EU Whistleblowing Directive 2021.

Procedures for reporting and investigating suspected instances of fraud are described in the University’s “Public Interest Disclosure (whistle-blowing) Code of Practice” and “Procedures for reporting and investigating suspected instances of fraud and financial misconduct”.

Where fraud is suspected, responsibilities for managing an investigation include:
The Counter Fraud Team will triage queries and reports received via the Counter Fraud inbox and Suspicious Activity Report. High risk reports will be referred to the Financial Misconduct Review Group (FMRG). Other incidents may be referred for further action under various polies such as staff and student disciplinary or academic misconduct policies.

The Financial Misconduct Review Group (FMRG), convened and chaired by the Registrar, oversees the investigations into high risk alleged fraud and bribery.

The Head of Internal Audit is responsible for assisting with/undertaking investigations into suspected cases of bribery and fraud, as directed by the FMRG.

Investigations commission by FMRG may result in disciplinary action under People, Academic Misconduct or other relevant policies, referral to the Proctors, reporting to funders and/or referral to other bodies including the police as set out in section 3.

This policy will be reviewed at least every 3 years. 

This policy may also be reviewed and updated as required to incorporate learning from instances of fraud and near misses and changes to the organisation.

Risk assessment
The identification of key, inherent, external and internal, fraud risks is key to the effective design of processes and controls to detect and prevent fraud. 

The assessment will reflect the financial and non-financial impact of potential fraud risks across the University.

The University does not tolerate fraud within the business and aims to promote an environment that is hostile to the exploitation of the University through fraudulent activity. However, it acknowledges that the risk of fraud will be present as a result of its ongoing activities. This is reflected within the fraud risk assessment where it is acknowledged that a level of residual risk remains after controls are applied.

The risks of fraud will be reviewed on an annual basis, alongside the wider risk assessment undertaken by management within the various divisions, departments and committees. This process will be overseen by the Director of Finance Operations and Counter Fraud Team.

See Appendix 2 of the Procedures for reporting and investigating suspected instances of fraud and financial misconduct for the fraud risk assessment criteria used by the University as part of this assessment.

Fraud prevention and detection 
In order to promote an environment that reduces the risk of internal and external fraud, the University will maintain a proportionate control framework that protects the business, while supporting its purpose and goals.

This control framework includes a combination of preventative and detective controls, communications and training, and planned monitoring and oversight activities to ensure that the processes and controls in place are operating effectively. 

Communication and training
The University will provide all staff with mandatory induction on compliance with all policies, including the Counter Fraud policy. The Counter Fraud Team uses various methods to communicate the importance of understanding, managing and reporting fraud risks and issues, as well as highlighting legislative changes and emerging concerns through the Finance Community, Finance Bulletins, Process Oversight Groups and broader stakeholder engagement.

Monitoring and oversight
The University monitors the effectiveness of the controls and processes in place to manage fraud risk using the “three lines of defence” model as described in paragraph 4.2.

Management Reporting
The Audit and Scrutiny Committee (A&SC or Committee) will receive regular reports, at least termly, on the following:
•    Number of High and Low/Medium risk category reports received in the period; 
•    An overview of the investigation status for all ongoing investigations; 
•    For High risk reports, further detail may be provided in the report to the ASC, including: 
          o A description of the actions taken to date; 
          o Details of the reports made to the University’s auditors, regulators and / or law enforcement; 
•    A summary of the findings and remediation activities taken for completed investigations. 

On at least an annual basis a report on the University’s fraud risks, including the adequacy of the University's arrangements to prevent and detect irregularities, fraud and corruption will be provided. The report will reflect the nature and type of fraud risks reported in the period, to allow an assessment of trends which may require updates to the underlying assessment and control environment, including targeted training and communication. The Committee will determine, in coordination with the Counter Fraud Team, if an interim report is required, including the contents and frequency of such report. See the ‘Procedures for reporting and investigating suspected instances of fraud and financial misconduct’ for further information on the reporting of investigations.