Tesco's £326m Hole Wasn't a Rogue Trader. It Was Designed In.

On 22 September 2014, Tesco told the market a sentence no FTSE 100 company ever wants to write: it had overstated its expected half-year profit, 'principally due to the accelerated recognition of commercial income and delayed accrual of costs.'¹ In plain English, the supermarket had booked money from suppliers before it had truly earned it, and pushed costs into the future — flattering a number the City was watching closely against a guided trading profit of around £1.1bn.¹ Shares cratered. The Serious Fraud Office moved in. And the press settled on a familiar plot: a few bad executives cooked the books.

That story is comforting because it is contained. Find the culprits, prosecute them, move on. But it is the wrong story. The scandal was not something a handful of people did to Tesco. It was something Tesco's own structure made almost certain to happen — and then made almost impossible to see.

Here is the thesis, stated plainly: Tesco didn't suffer a rogue-trader fraud. It built a profit-recognition machine with a hidden lever, told its people to hit aggressive numbers, and removed the one alarm that might have caught the abuse. The fraud was practically engineered in — and it stayed invisible until a single insider broke the circuit.

The lever everyone could pull and no one had to record

Supermarkets don't just sell to you. They sell to their suppliers — charging for shelf space, promotions, volume rebates, listing fees. This is 'commercial income,' and for a retailer it can be enormous. The trouble is that it's judgment-heavy: when, exactly, has the income been earned? At the start of a promotion? When a volume target is hit? At year-end? Move that recognition forward a few weeks across thousands of supplier deals and you can manufacture profit out of timing alone. No fake invoices, no shell companies — just the calendar, nudged.

That is precisely what happened. The SFO's court-approved Statement of Facts found the Commercial Food margin in the first half of 2014/15 was overstated by roughly £246m, caused by income being pulled forward — a misstatement large enough to be a material audit risk in its own right. A 'legacy paper' laying out that figure was prepared and shown up the chain.² The genius and the danger of the lever is the same fact: pulling it leaves almost no fingerprint. It looks like an accounting opinion until the moment it doesn't.

The alarm was wired up — then switched off in the minutes

Here is the detail that turns a fraud story into a governance story. The risk was not missed. Tesco's own 2014 annual report and its statutory auditor flagged commercial income as an area of audit focus, and named the reason out loud: 'the judgement required... and the risk of manipulation.'⁸ The smoke detector went off before the fire was reported. And then the board-level record did something remarkable: the Audit Committee's own report stated it did not consider commercial income 'a significant issue for disclosure.'⁸

Sit with that. The professionals paid to find the soft spot pointed straight at it and said, in effect, this is where someone could cheat. The committee whose job is oversight read that warning and downgraded it to a non-event in the document everyone relies on. The detector was beeping; the committee filed the beep as ambient noise. That is the moment the fraud went from possible to invisible — not because nobody saw the risk, but because the body charged with watching it formally decided it wasn't worth watching.

It took one insider, not one auditor

If the formal controls had been working, an audit cycle would have caught it. Instead the circuit was broken from the inside. Dave Lewis had been scheduled to take over as CEO on 1 October 2014, but started a month early, on 1 September.⁷ Barely two and a half weeks into the job, on 18 September 2014, an employee — anonymised in the court documents as 'Employee A' — walked a written report to Tesco's legal department. Lewis was told the same day, and a review by the statutory auditor and Tesco's own internal audit began immediately.⁷ Four days later the company went public.¹

The sequence is the whole point. The institutional machinery — audit committee, statutory audit, board oversight — had had the risk in front of it and let it pass. The thing that actually stopped the overstatement was a person deciding to carry a document down a corridor. A £326m problem was caught not by the system built to catch it, but by the one variable no org chart controls: an individual's conscience.⁶

Who actually paid — and who walked

The reckoning was real but oddly asymmetric. The corporate entity settled: in April 2017 Tesco Stores Limited entered a Deferred Prosecution Agreement with the SFO, paying a £129m penalty plus the SFO's costs — and earning a 50% discount on what the court would otherwise have imposed for false accounting.³ Then the FCA did something it had never done before. Rather than fining Tesco for market abuse over the 29 August 2014 update, it used its powers under section 384 of FSMA to make the company compensate harmed investors directly — a scheme estimated at around £85m plus interest — and declined to levy its own penalty on top.⁴

And the individuals? The three executives the press dubbed the 'Tesco Three' faced criminal trial — and not one was convicted. In November 2018 the judge ruled that Bush and Scouler had 'no case to answer,' calling the evidence 'weak,' and the Court of Appeal upheld it. The case against Rogberg was abandoned on 23 January 2019 when the SFO offered no evidence. The prosecution simply could not prove the individuals had acted dishonestly.⁵ The company admitted enough to settle; the men charged with doing it walked. That gap is not an accident — it is the signature of a structural failure rather than a personal one.

Isn't 'it was the system' just letting people off?

The fair objection is that 'structural failure' is the excuse every scandal reaches for. Numbers don't move themselves; someone pulled income forward, someone prepared the legacy paper, someone presented it. Calling it a governance problem can sound like absolving the humans who did the deed. It's a real challenge, and worth taking head-on.

The honest answer is that the two are not in tension — and the courts made the point for us. The collapse of all three criminal cases on the question of dishonesty is the tell. A jury never got to decide that any individual acted with criminal intent, because the SFO couldn't establish it; the judge called the evidence weak.⁵ When you cannot pin dishonest intent on the people closest to the lever, the more likely explanation is not a brilliant conspiracy but a culture in which aggressive targets and a manipulable metric quietly normalised the pulling-forward — until it crossed a line nobody had clearly drawn. The point isn't that no one is responsible. It's that the responsibility sits with the design that made the line invisible, and the committee that was warned and looked away.

The lasting lesson of Tesco 2014 has nothing to do with supermarkets. It's that the most dangerous risk in any company is the one your own people have already named — and your governance has already filed as immaterial. The auditor saw it. The annual report printed it. The audit committee read it and shrugged. The fraud didn't slip past the controls; it walked through the gate the controls held open. A risk that has been flagged and dismissed isn't a risk you've managed. It's a risk you've documented your way into.