"He said there were no indications of "systemic malpractice up to board level""
It does not matter if the nice board member took you to a Good Lunch or not, the directors have responsibility for all of their employees (unless, as per Joel v Morrison they are on a frolic of their own). The odd thing you can forgive, but systematic leads to a conclusion of a fundamental failure in the control process, the responsibility of which lies with the directors. You can bet that if every prisoner was really on time and correct the Board would be responsible for it, so they are responsible for the alleged fraud too.
Don't merely hand over "profits" on some weird accounting basis, fine them significant proportions of the contract value.
£2M profit sounds light - SERCO has a 5% net profit margin, so there should be about 5% of 2.5/7 (that's how much of the contract has gone) of £285 million at the very least, so more like £5M. Of course, "net profit" includes all the overhead costs that would exist whether or not SERCO did the contract. So they should be lost. More realistic therefore is the gross profit margin of 15%, so more like £15million. I could understand a number bigger than five but less than fifteen, but two? It's not worth getting out of bed for that.
Who in Whitehall sense checks this stuff?