Lauren E. Johns, CPA, CFE
A typical organization loses 5 percent of its annual revenues to occupational fraud, a report from the Association of Certified Fraud Examiners (ACFE) concluded. While this figure is down from 7 percent reported in the 2008 report, fraud is still a largely preventable issue affecting many business’ bottom lines.
The report, called the “Report to the Nations on Occupational Fraud and Abuse,” spans December 2008 through December 2009. Of the 1,843 cases of occupational fraud cited, 57 percent of the cases were domestic, with a median loss of $160,000. With the remaining 43 percent of the fraud cases representing foreign countries, it is clear that fraud is a global problem. Of all the companies reporting, private companies made up 40 percent of the victim organizations.
Asset misappropriation, such as theft, forgery and expense reimbursement schemes, was the most common type of fraud noted, making up 90 percent of the cases included in the report. Financial statement fraud, such as asset overstatement, hidden liabilities and commitments and improper disclosures represented only 5 percent of cases, but resulted in a median loss of $4 million per occurrence. Corruption is the remaining category of fraud cited.
So how long does fraud remain undetected? Of the nearly 2,000 cases, the median time period of a fraud scheme was 18 months. Frauds with greater losses had a median period of 27 months from the initial fraud to discovery. If fraud occurs over such a long period of time, how does it go undiscovered?
Marshall Clinard and Peter Yeager, authors of “Corporate Crime,” found that white collar crimes are becoming increasingly difficult to detect because violations are more complex.
The key to cutting through that complexity is implementing solid internal controls.
Smaller companies may be at significant risk for fraud because they are less likely to have implemented anti-fraud or any other mitigating controls, such as segregation of duties. However, good controls can be implemented in any size organization to reduce the likelihood of fraud and errors.
What makes a good control? Written policies are a good start. Communication is the next step. Written policies should be communicated to all new hires. Changes in policies must be shared with all employees when implemented. Next, procedures and processes should be developed and documented to verify policies are followed. These can range from simple account reconciliations to approval and review by a higher-level manager for purchases or paid time off. Compliance with policies and procedures must be monitored on a regular basis to ensure the controls are operating as intended.
The tone at the top, such as a formal code of conduct, is also critical and is a cost effective way to prevent and detect fraud. Management makes a powerful statement in its communication of important expectations. Employees of companies where written policies exist, and who have received training and education focusing on errors and fraud, can help prevent and detect fraud.
Another important component of any corporate environment is a whistleblower policy that includes confidentiality. The ACFE reports, “frauds are much more likely to be detected by tips than by any other method.” Employees are often the most effective means of detecting fraud, so a hotline or other type of communication vehicle should be considered.
How does fraud happen? Criminologist Donald Cressey developed a theory called the “fraud triangle,” which describes the three components of fraud: pressure, opportunity and rationalization. Any one component can increase the possibility of fraud, but the three together create the greatest likelihood of its occurrence. For example, a trusted employee may be more of a risk if he or she is dealing with outside pressures, such as a sick relative or financial problems.
What are some behavioral indicators that a fraud may be occurring? Consider the lifestyle of the manager/employee. Is he or she living beyond what would seem reasonable? Are there any known financial pressures the employee may be experiencing? Is the employee’s spouse between jobs? Is there a close relationship between the employee and a customer or vendor? Is the employee defensive or unwilling to share or rotate duties? If the answer to any of these questions is yes, this may be a red flag and should be considered and investigated by management.
Good controls can be developed and implemented to reduce and prevent fraud. Duties should be segregated to the extent possible. Authorizations and approvals should be set, and compliance with the guidelines should be reviewed on a regular basis. Logical controls should be implemented for operational and accounting applications. Passwords should be unique to the user and changed periodically during the year. Physical safeguards, such as a locked file for check stock and significant corporate documents, should be implemented. Rotation of employee responsibilities is also a great practice. Make certain employees take vacations and have another employee perform their tasks while away. Not only does this help cross train team members, but using a different set of eyes and actions to perform a task may help identify signs of fraud.
Finally, educate all employees on ethical behavior and what constitutes fraud, and communicate expectations. Set a zero-tolerance level for unacceptable behavior.
Choosing not to implement internal controls is handing over control of your business.
Lauren E. Johns, CPA, CFE, is a manager at Yount, Hyde & Barbour PC in Leesburg, where she specializes in information technology audits. She is a Certified Public Accountant (CPA), Certified Fraud Examiner (CFE) and a member of the Virginia Society of CPAs (VSCPA).