Corporate Responsibility and Criminal Liability: Where Should the Line Be Drawn?

The Crime and Policing Act 2026 has now received Royal Assent and the controversial provision expanding the ‘senior manager test’ (section 250), which makes organisations criminally liable for any offence committed by a senior manager while acting within the actual or apparent scope of their authority, will come into force on 29 June 2026. 

Much commentary has focussed on the surprising ways in which corporate criminal liability will be expanded for a range of offences in areas as diverse as competition law, modern slavery, and data protection. The drafting even leaves open the possibility of organisations being prosecuted for driving or sexual offences albeit that such prosecutions can be expected to fail (courts have repeatedly held that offences requiring physical acts, such as driving or sexual offences, can only be committed by natural persons).

The more fundamental criticism is that the reform is unprincipled and will increase costs and burdens for businesses while doing little to tackle crime. Legislators have been preoccupied with how to expand corporate criminal liability: the fundamental question is why should organisations be held responsible for another person’s crime? 

Corporate criminal liability

As Lord Morris said in Tesco v Nattrass [1972]: ‘In general, criminal liability only results from personal fault. We do not punish people in criminal courts for the misdeeds of others.’

Historically, corporate criminal liability attached to organisations via two main routes. The ‘directing mind’ principle is a legal presumption that a company can be held liable for an offence involving a mental element (e.g. fraud) if proved to have been committed by the company’s ‘directing mind’. Such a person has been described as ‘the very ego and centre of the personality of the corporation’ and must usually be a board director and/ or acting with full authority of the board: a company would usually not be liable for wrongdoing by a mere employee or agent.

‘Strict liability’ offences provide that if a prohibited event occurs (e.g. unsafe conditions) the organisation is liable without any requirement to prove wrongdoing by any particular individual. Such offences often include a statutory defence, such as having exercised all reasonable due diligence. The legal justification for strict liability offences is pragmatic: the most effective method of deterrence is to place upon the employer the responsibility of doing everything within its power to prevent employees from committing an offence. 

However, per Lord Diplock in Tesco v Nattrass: ‘this rational and moral justification does not extend to penalising an employer or principal who has done everything that he can reasonably be expected to do.’

Reform

From the 1990s, there developed a broad consensus that the criminal law did not adequately hold corporates to account. Reforms included an exponential increase in fines for offending companies, including fines for strict liability offences which were traditionally viewed as much less serious; and in 2008 the introduction of a new statutory corporate manslaughter offence which removed some of the limitations of the ‘directing mind’ principle for the manslaughter offence. 

In 2010, the ‘failure to prevent’ (FTP) model was introduced, applying ‘regulatory’ principles to economic crimes. Applying to bribery, facilitation of tax evasion, and now fraud offences for ‘large’ organisations, in broad terms, when certain conditions are met, the FTP model makes commercial organisations ‘strictly liable’ for the wrongdoing of persons providing services on their behalf, unless the organisation can prove that it had in place ‘reasonable procedures’ designed to prevent the offending. 

Not only must organisations implement effective systems to avoid inadvertent harm such as pollution or safety risks from arising during the conduct of their operations, they must now also have effective systems to prevent individuals providing services on their behalf from intentionally committing criminal offences. Only if they have reasonable procedures in place to prevent such harms will they have a defence. This brings us to the ‘senior manager test’.

Senior managers

The ‘senior manager test’ is in the same terms as the Economic Crime and Corporate Transparency Act 2023, which made organisations criminally liable for specified economic crimes committed by ‘senior managers’ within the scope of their authority. ‘Senior manager’ was so broadly defined as to potentially include department heads, for example. 

For those economic crimes covered by the FTP model such organisations were already liable for wrongdoing by senior managers via the relevant FTP offence. The key difference being that liability via the senior manager test does not have a reasonable procedures defence. Even organisations with reasonable procedures designed to prevent wrongdoing may be liable for wrongdoing by senior managers. 

In reality, however, this anomaly arises only in theory. The chances of an organisation being able to rely on a reasonable procedures defence when there has been wrongdoing by a senior manager are slim. The real point is that the senior manager test removes any pretence that the organisation is being found liable for its own culpable failings, namely for failing to prevent someone else’s wrongdoing. This is simply vicarious liability for wrongdoing by a ‘senior manager’ – and this approach is now to be extended haphazardly to any offence.

Arguments as to why organisations should be held liable for wrongdoing by senior managers include that it is fair to assume that conduct of a senior manager reflects corporate policy or decision-making. The counterargument is that it is not fair to assume for the purpose of criminal liability, that the conduct may be committed by a rogue individual (potentially a mere department head) and have nothing to do with, or even be starkly contrary to, corporate policy or decision-making by the board of directors. 

Another argument is that the senior manager test closes the gap between liability for large and small companies, which is to ignore the principled justification for the directing mind principle and preference equality of outcome. This idea is allied to the notion that large companies have been somehow ‘getting away with it’ either because law enforcement couldn’t find the evidence to implicate directing minds (evidence is quite important!) or because there was a feeling that it was really the company which was to blame.

This latter idea is fundamental. We have grown used to thinking of companies as having cultures, personalities of their own, which somehow have moral agency independent of their employees or other agents. Hence, if wrongdoing occurs, we can assume that this wrongdoing reflects the organisation’s procedures, processes and culture.  

Finding a culpable individual is considered secondary, and maybe even misses the point. Even good people may be corrupted by the corporate culture. We should punish the corporate and remove its incentive to work against the public interest by putting a cost on unethical corporate behaviours. The precise method of holding corporations criminally liable is, therefore, besides the point. What matters is making it easier to prosecute organisations – hence the senior manager test.

Corporate personality

There is an irony to the ‘corporate personality’ approach.  It was rejected by the Law Commission and has not been adopted in legislation. We do not have, as the Australians do, a method of attributing the offence using the corporation’s culture (for example, by proving that a corporate culture existed that directed, encouraged or tolerated or led to non-compliance with a relevant provision). Nevertheless, this is exactly the approach adopted by the courts.

For environmental or safety breaches, or in the context of FTP offences, with the benefit of hindsight there will almost inevitably be red flags that were missed, controls that proved ineffective, and measures that could have been implemented but were not. The reason for such failures will involve interesting questions about how humans think and make decisions, about group behaviours, and about the role of leadership. The criminal justice system however is neither equipped to, nor interested in, answering these questions. Instead, in all but the most exceptional cases you can expect principles of ‘strict liability’ to be applied alongside largely unexamined notions of corporate culture. 

The Airbus deferred prosecution agreement (in relation to FTP bribery offences) is a good example. Airbus implemented an award-winning anti-bribery compliance programme. Dishonest individuals (mostly outside the company) used sophisticated methods, including the creation of false documentation, to deliberately circumvent procedures. Some might have turned a blind eye. After a period the company spotted issues, stopped payments and strengthened the systems. The outcome was the company being penalised €991 million in the UK alone because ‘there existed a corporate culture which permitted bribery,’ while the allegedly guilty individuals walked away scot-free. The deterrence value of such an approach is uncertain!

Where now?

We don’t hold organisations criminally liable for offences such as dangerous driving or sexual offences because we cannot imagine an organisation committing such an offence (or at least must admit that it would be absurd to do so), while the paying of bribes, making false representations, or committing competition law violations which also require physical acts are exactly the kinds of offences we can imagine organisations committing. 

In part this is because we imagine corporate policies, systems, shadowy committees – a corporate culture – which contributes to such conduct and thereby justifies liability. This assumes, once again, that the established culpability of one individual implies broader corporate culpability. Dangerous driving or sexual offences, by contrast, do not allow this assumption: they’re traditionally viewed as the acts of individuals acting alone. This could change, however.

There has been a private member’s bill, for example, which sought to expand the scope of health and safety legislation so that it unambiguously imposes a duty on employers to implement reasonably practicable measures to prevent harassment and sexual violence in the workplace. It is arguable that such a duty already exists. 

This is the new frontier of the expansion of corporate criminal liability. What harms should we expect organisations to prevent, where failure may justify criminal liability? This is the FTP model being applied to an expanding range of economic crimes – never mind that the expectation placed on corporations is, in the real world, incapable of being met. This is the senior manager test being applied to any offence committed by a senior manager while acting within the actual or apparent scope of their authority, without even the pretence of a reasonable procedures defence.