Skip to main content
NFRisk Non-Financial Risk advisory Start a Conversation
NFR-0015 Evidence-controlled risk scenario

Rolls-Royce plc

When intermediary governance failed across businesses and borders

The court-approved DPA documented bribery-related conduct spanning three business divisions, seven jurisdictions and more than two decades.

Financial Crime & Control Integrity Conduct & Governance Risk Bribery & corruption

Documented impact

Legal or enforcement outcome Court-approved UK Deferred Prosecution Agreement
£497.3m £497.25 million disgorgement and financial penalty, plus £13 million costs

Authoritative findings

The documented event

On 17 January 2017, the High Court approved a Deferred Prosecution Agreement between the Serious Fraud Office and Rolls-Royce plc and Rolls-Royce Energy Systems Inc. The suspended indictment contained 12 counts covering conspiracy to corrupt, false accounting and failure to prevent bribery. The conduct resolved by the DPA spanned seven jurisdictions, three Rolls-Royce business divisions and more than 20 years. The UK financial terms included disgorgement of £258.17 million, a financial penalty of £239.08 million and £13 million towards the SFO's costs.

Hypothetical institutional scenario

How might the same control pattern appear?

Intermediaries are engaged across businesses and jurisdictions, while due diligence, payment approval, escalation and central visibility are fragmented enough for improper conduct to persist.

Stress-test questions

Questions for challenge and assurance

  1. Risk committee

    Can every intermediary payment be traced to approved services and independent evidence?

  2. Operations

    Where are red flags aggregated across divisions and jurisdictions?

  3. Audit

    Who can stop payment or renewal when due diligence is incomplete?

NFRisk practitioner interpretation

Control implication

NFRisk view: intermediary control must join appointment evidence, beneficial ownership, service substantiation, payment logic, red-flag escalation and cross-business aggregation. Longevity alone is not evidence of integrity.

Framework relevance

Explicitly labelled analytical mappings

NFRisk analytical mapping

COSO ERM lens: Governance & Culture

Conduct spanning 24 years and three business divisions, implicating senior management per the sentencing judge, reflects a sustained governance and culture failure rather than an isolated control gap. NFRisk analytical reading; the judge's own remarks do not use COSO terminology.

Enterprise Risk Management - Integrating with Strategy and Performance · Committee of Sponsoring Organizations of the Treadway Commission (COSO)

Evidence register

Primary and supporting sources

  1. High Court of Justice of England and Wales

    Serious Fraud Office v Rolls-Royce plc and Rolls-Royce Energy Systems Inc — Approved Judgment (opens in a new tab) 17 January 2017 · Authoritative primary source

  2. UK Serious Fraud Office

    SFO completes 497.25m pound Deferred Prosecution Agreement with Rolls-Royce PLC (opens in a new tab) 17 January 2017 · Authoritative primary source

Publication note

A documented external event—not an NFRisk client engagement.

The named organisations are included because authoritative sources document the event. Their inclusion does not imply that they are or were NFRisk clients, that they endorse this analysis, or that NFRisk participated in the event or response. Framework relevance and NFRisk practitioner interpretation are analytical layers applied after the event.

Return to the Risk Scenario Library

From scenario to mandate

Test the equivalent control assumption in your environment.

NFRisk can use this scenario as a starting point for a focused structural diagnostic, risk-architecture review or delivery-assurance discussion.

Start a conversation