Eunomia helps pharmaceutical and biotech companies in the UK assess commercial compliance risk: anti-bribery and anti-corruption, fraud, HCP and HCO engagement, promotion, third parties and disclosure. We build risk assessments that are documented, prioritised and connected to named owners, controls and follow-up.
Discuss this service
UK expertise · Practical delivery
For compliance and leadership teams in pharmaceutical and biotech companies in the UK: a first ABAC risk assessment, an extension to cover the failure to prevent fraud offence, or a refresh of an established assessment that has stopped reflecting the business.
Many risk assessments are a spreadsheet of scores that nobody uses. They do not say which activity creates the risk, which control addresses it or who is responsible for fixing a gap. We build assessments that start from real activities and end in owned actions.
From requirements to action
We record each activity, country, stakeholder group and specific risk scenario; identify existing controls, their owners and the evidence that they work; rate likelihood and impact consistently; and agree a response with an accountable owner, a target date and a check that the action worked.
We connect the assessment to the programme around it: policies, SOPs, training, monitoring and third-party due diligence. That means the highest risks lead directly to changes in how work is done, not a report on a shelf.
What we can take on
What this gives you
A documented assessment that explains why each risk is rated as it is
Controls and evidence mapped to the highest risks
Actions with accountable owners, target dates and follow-up checks
The rules in the UK
In the UK, risk assessment sits at the heart of both the anti-bribery and the failure to prevent fraud guidance. These are the frameworks we build the assessment around. Each summary links to its official source below.
A commercial organisation assesses the nature and extent of its exposure to potential external and internal risks of bribery by persons associated with it. The guidance describes the assessment as periodic, informed and documented.
Guidance on the ECCTA 2023 offence, in force since 1 September 2025, lists risk assessment among six principles and describes the fraud risk assessment as dynamic, documented and kept under regular review.
Explains how the UK Serious Fraud Office assesses whether a corporate compliance programme works in practice. It is enforcement guidance, not a pharmaceutical certification standard.
Related article
Building a practical pharma compliance risk assessment. Our article on risk assessment frameworks for small and mid-sized pharma sets out how to move from activity and exposure, through existing controls and evidence, to priority, response and follow-up.
More reading: Risk assessment in healthcare and why it matters · Third-party risk management · Pharma Compliance Readiness Checklist
This overview is informational and does not constitute legal advice. Scope and application should be confirmed for the organisation, activity and counterparty in question. Sources checked September 2026.
Questions, answered
The Ministry of Justice guidance on the Bribery Act 2010 lists risk assessment as one of six principles of adequate procedures. It describes the assessment as periodic, informed and documented.
The ECCTA 2023 guidance lists risk assessment among its six principles and describes a fraud risk assessment as dynamic, documented and kept under regular review. It notes that organisations may extend existing risk assessments to cover the fraud risks in scope.
With the company’s actual activities, markets and third parties. Describe what could go wrong, assess the exposure and existing controls, then prioritise gaps with named owners and completion dates.
No. A useful risk register explains decisions and drives action. A score alone does not show that a risk is controlled; the assessment should identify the control, its owner and evidence that it operates in practice.
When activities or risks change, and on a regular cycle. The fraud guidance describes the assessment as kept under regular review, and the bribery guidance as periodic.
Yes. The assessment can be structured by country, with input from our local compliance partners where national law and codes differ.
We will listen, ask a few questions and recommend the right scope—without obligation or pressure.
Start a conversation