Internal Investigations in the UK: Self-Reporting, Cooperation and Record-Keeping Under the SFO’s Corporate Guidance

In April 2025, the UK’s Serious Fraud Office (SFO) published new guidance on how it treats companies that self-report and cooperate. Its message is clear: companies who come forward promptly and cooperate fully will be invited to negotiate a deferred prosecution agreement (DPA), unless exceptional circumstances apply.

With the failure to prevent fraud offence now in force and the SFO signalling more proactive enforcement, how you run internal investigations matters more than ever. This blog looks at what the guidance says, what cooperation means in practice and how your case management process can help.

What the Guidance Says

The guidance sets out a clearer route for companies who discover wrongdoing:

• companies who promptly self-report and cooperate fully will be invited to negotiate a DPA, unless exceptional circumstances apply;
• companies who fail to self-report can still obtain a DPA, but only with exemplary cooperation, and
• the SFO aims to respond to a self-report within 48 hours, decide whether to open an investigation within six months and conclude DPA negotiations within six months of an invitation.

The guidance does not define “promptly”, but the expectation is that companies report within a reasonable time of having reasonable suspicion, not after a lengthy internal investigation has been concluded.

The SFO also recognises that the decision to self-report is a serious one. Companies are not expected to report every suspicion, but are expected to take a considered decision quickly and to be able to show how and when that decision was made.

What Cooperation Looks Like

The SFO expects cooperating companies to:

1. Proactively preserve relevant digital and physical documents
2. Engage with the SFO early about the internal investigation
3. Give advance notice of investigative steps, such as interviews
4. Provide timely updates as the investigation progresses
5. Share interview notes and explain the basis of any claim to legal privilege
6. Provide details of the compliance programme and any remediation

Legal privilege remains one of the more sensitive areas. The SFO does not require companies to waive privilege, but where privilege is claimed it expects the basis to be explained. Keeping privileged material clearly identified and separate within the case file makes those conversations much easier.

The guidance does not sit alone. The SFO’s November 2025 guidance on evaluating compliance programmes says it will “dig behind” high level assertions. The same applies to investigations: the SFO will want to see how decisions were made, not just what was concluded.

Read more: New SFO Push for Incentivising Whistleblowers in the UK

Where Case Management Fits

Many of these expectations are about records. Your case management process is where those records are created or lost.

Bringing every allegation into one system, irrespective of the intake channel, means the clock starts at the right point. A report stuck in someone’s inbox can turn a prompt self-report into a late one.

Recording triage decisions, including who decided to investigate, escalate or report, and why, shows that the company responded promptly to reasonable suspicion.

Logging every investigative step, from document collection to interviews, makes it easier to give the SFO advance notice and timely updates. It also shows that nothing was done to prejudice the SFO’s own investigation.

Keeping evidence and correspondence in a secure case file, with controlled access, supports the duty to preserve documents and helps you manage privileged material separately.

Finally, tracking remediation as part of the case, such as disciplinary action, control changes and training, shows the SFO that lessons were learned and acted on.

Five Practical Tips

How Case IQ Can Help

Case IQ's case management solution brings reports from every channel into one secure, centralised system. Highly configurable workflows guide investigators through each case with clear actions and tasks to ensure consistency and accuracy. Evidence, tasks and communications are consolidated in one place, with a complete audit trail of every action. And with Clairia, the leading AI assistant for investigations, case managers receive relevant insights and recommendations at every step, right when they need them.

Book a call with a Case IQ expert today to get a personalised demo of our suite of compliance and risk management solutions.

Important: This post is for informational and educational purposes only. This post should not be taken as legal advice or used as a substitute for such. You should always speak to your own lawyer.

Frequently Asked Questions (FAQs)

1. What is the SFO's corporate guidance on self-reporting and cooperation?

The UK Serious Fraud Office's April 2025 corporate guidance explains how the agency assesses companies that voluntarily report suspected wrongdoing and cooperate with investigations. Companies that promptly self-report and fully cooperate will generally be invited to negotiate a deferred prosecution agreement (DPA), unless exceptional circumstances apply. The guidance emphasises timely disclosure, preservation of evidence, transparency and meaningful remediation.

2. When should a company self-report suspected wrongdoing to the SFO?

The SFO does not prescribe a fixed deadline for voluntary self-reporting. However, companies are expected to act promptly once they have reasonable suspicion of wrongdoing rather than waiting until a lengthy internal investigation is complete. Organisations should assess the available evidence, document their decision-making process and seek appropriate legal advice when determining whether and when to report.

3. What is a deferred prosecution agreement (DPA) in the UK?

A deferred prosecution agreement is a court-approved arrangement between a prosecutor and an organisation under which criminal prosecution is suspended subject to agreed conditions. These may include financial penalties, cooperation requirements, remediation and improvements to compliance controls. The SFO's guidance provides a clearer pathway to DPA negotiations for companies that promptly self-report and cooperate fully, although an invitation does not guarantee a final agreement.

4. What does the SFO consider full cooperation during an internal investigation?

Full cooperation involves proactively preserving relevant evidence, engaging with the SFO early, providing timely updates and notifying the agency in advance of significant investigative steps, such as employee interviews. Companies may also be expected to provide interview notes, explain claims of legal privilege, and demonstrate how compliance weaknesses have been addressed. The SFO evaluates the substance and timeliness of cooperation rather than relying solely on a company's assurances.

5. Does a company have to waive legal privilege to cooperate with the SFO?

No. The SFO's corporate guidance does not require companies to waive legally privileged material to demonstrate cooperation. However, organisations claiming privilege should be prepared to explain the basis of those claims. Maintaining clear records, restricting access to sensitive documents and keeping privileged materials appropriately identified can help companies manage disclosure obligations while protecting their legal rights.

6. How should companies document internal investigations to meet SFO expectations?

Companies should maintain a clear, chronological record of each investigation, including the initial allegation, triage decisions, evidence preservation, interviews, investigative findings and remediation. Records should identify who made key decisions, when they were made and the information considered. Secure case files and consistent audit trails help organisations demonstrate that investigations were conducted promptly, thoroughly and responsibly.

7. How does the UK's failure to prevent fraud offence affect internal investigations?

The failure to prevent fraud offence, introduced under the Economic Crime and Corporate Transparency Act 2023 and in force since September 2025, increases the importance of effective fraud prevention controls for organisations within its scope. Internal investigations can help identify suspected fraud, uncover weaknesses in prevention procedures, and document corrective actions. Maintaining reliable investigation records also helps organisations demonstrate how they respond to potential misconduct and improve their compliance programmes.

8. How can Case IQ help organizations meet SFO investigation and record-keeping expectations?

Case IQ's case management software helps organizations centralise allegations, standardise investigative workflows, and maintain secure records throughout the investigation lifecycle. With configurable workflows, audit trails, case linking and reporting capabilities, compliance teams can document decisions, preserve relevant information, track remediation and prepare consistent investigation reports. These capabilities help organisations demonstrate a structured and defensible approach to internal investigations and regulatory cooperation.