Costs attributed to occupational fraud represent 5% of annual revenues according to a recent report published by the Association of Certified Fraud Examiners. Some relatively easy and cost effective methods that decision makers can implement to recoup some of these costs involves asking the following: 1) are the organizational controls in place sufficient to detect and/or deter fraud; 2) what type of investment should be made to augment or strengthen these controls; 3) are employees able to identify or recognize common behavioral red flags exhibited by fraudsters; and 4) are there any fraud reporting mechanisms in place at the organizations? Answering these questions and implementing some proven, cost-effective controls can add to the bottom line of an organization.
The modern economic climate has caused both large and small scale fraud schemes to rise to the surface. Aggressive cost cutting measures meant to preserve shrinking profits is one area where company decision makers have been able to soften the blow from economic challenges.
The Association of Certified Fraud Examiners (ACFE) publishes a study on occupational fraud every two years titled Report to the Nations on Occupational Fraud and Abuse (RTTN). The 2010 global fraud study provides some rather staggering statistics with respect to the magnitude of fraud, waste, and abuse within the corporate world from January 2008 to December 2009.
According to estimates provided by the Certified Fraud Examiners who investigated the 1,843 cases of occupational fraud reported in the study, a typical organization loses approximately 5% of its annual revenues to fraud with a median loss of $160,000 per fraud.1 Occupational fraud is defined as “the use of one’s occupation for personal enrichment through the deliberate misuse or misapplication of the employing organization’s resources or assets.”2 In addition, close to one-quarter of those frauds involved losses of at least $1 million.3 The study also notes that smaller organizations were disproportionately exploited by occupational fraud because they typically lack the anti-fraud controls that larger, more sophisticated organizations routinely enact.4 See Chart 1 for a breakdown of the distribution of dollar losses attributed to fraud.
Methods for Implementation
The Controls
One question that business owners, audit committees, corporate boards and executive level management should be asking is whether the controls in place at their organizations are sufficient to deter and/or detect fraud. The RTTN states that “anti-fraud controls appear to help reduce the cost and duration of occupational fraud schemes.”5 The research shows that those organizations with controls in place had significantly lower losses and time-to-detection than organizations without those same controls.6 The average reduction on the median loss was 40.8% while the average reduction of the duration until detection was 33.2%. Charts 2 and 3 provide the median loss and duration until detection based on the presence of anti-fraud controls, respectively. The implementation of these controls, even a single one, can help to reduce the frequency, duration, and monetary loss associated with occupational fraud and abuse.
Investment in Controls
While these controls can help, a logical next step is to consider what type of investment should an organization make in controls such as those referenced in Charts 2 and 3. Unfortunately, the perceived cost of establishing and/or implementing such controls to protect against, deter, or detect fraud schemes often discourages organizations from effectively protecting their assets. While it is true that certain anti-fraud controls such as proper separation of duties, job rotations, internal audit groups, and the use of continuous auditing software can be cost-prohibitive, particularly for small and mid-sized organizations, there are many low cost, yet highly effective options organizations can deploy.
For instance, providing fraud training to employees at all levels is a low cost, high yield alternative that can be effectively implemented by organizations of all sizes. Even in instances where resources are severely limited, significant benefits can be gained by simply setting the right tone at the top of an organization. When management, executives, and owners set an ethical tone for their organization by implementing a code of conduct and demonstrating integrity in their actions, organizations experience lower fraud related losses.
Behavioral Red Flags
Another question that needs to be asked is whether stakeholders are prepared to identify or recognize specific warning signs that fraud perpetrators often display. According to the RTTN, the most common behavioral red flags exhibited by the transgressor were living beyond their means and having personal financial difficulties.7 Chart 4 provides a list of behavioral red flags often exhibited by perpetrators of fraud as reported in the RTTN.
Becoming aware of and being sensitive to these red flags can increase the likelihood of earlier detection and reduced exposure to fraud and its related costs. By making employees aware, perhaps during the low cost fraud training provided to all employees, that fraudsters lived beyond their means in 43% of the occupational fraud and abuse cases, those same employees can be the first line of defense in helping to reduce fraud at an organization.
Fraud Reporting Mechanism
The final question that business owners, audit committees, corporate boards and executive level management should be asking is whether a fraud reporting mechanism is in place at their organization. Hotlines, phone or web-based, that receive tips from both internal and external sources are a critical component of any fraud prevention and detection system.8 Such mechanisms should guarantee confidentiality and anonymity.9 In addition, a well-documented whistleblower protection policy must be implemented and strictly followed to encourage cooperation by potential reporters. Finally, making certain that employees, customers, contractors, or other third parties are aware of the hotline will ensure the effectiveness. According to the RTTN, tips were the most common method for detecting fraud, nearly three times more than the next closest method of detection.10 Chart 5 on the following page provides a list of the type of method used in detecting occupational frauds and the corresponding percentage of cases.
Case Example
Joe, a 15-year employee of a company with numerous offices located throughout the U.S., was the supervisor of maintenance for a five-state territory in which his job duties included the oversight of construction management and the maintenance of existing facilities. Joe’s superiors trusted him and, in doing so, granted him the authority to hire contractors for maintenance-related work. Keeping in mind that controls are necessary for any trusted employee, they limited the dollar amounts he could authorize to these contractors to a relatively low total. However, Joe’s superiors did not foresee his ability to create signature stamps mirroring his superior’s initials that gave him the ability to authorize payments at the corporate level without being detected. Joe’s scheme of issuing phony invoices on vendor letterhead (with the consent of co-conspirators from those vendors) was carried out for nearly three years without detection.
Interviews conducted by the Fraud Examiners in this case revealed that a number of co-workers complained about numerous red flags that, if known by management, may have led to an identification of this scheme earlier, thus minimizing the monetary damage. For example, fellow employees noticed that Joe and his wife both drove luxury automobiles; he bragged about winning big at local casinos; he was secretive about where he went during the day; and exhibited inconsistent mood swings that intimidated his co-workers. These are prime examples of when a fraud reporting mechanism that was known to the employees could have led to an earlier detection of the perpetrator, assuming that management and/or the employees were properly trained in identifying the behavioral red flags.
Certainly Joe’s company had controls in place, but the question remains whether those controls were adequate and/or properly monitored in order to avoid the circumvention of such controls. A surprise audit or an external audit of internal controls over financial reporting may have detected the scheme earlier which would have limited the damage.
For example, items identified during the Fraud Examiner’s analysis that related to vendor invoices and payments included:
-
Duplicate invoice numbers from the same vendors
-
Sequential invoices from the same vendor (an indication of no other customers)
-
Inconsistent date and invoice number sequence
-
High volume of invoices from newly “approved” vendors
-
High volume of invoices at the same amount and just under the approval limit (e.g., $995)
These items would likely have been identified by either a surprise audit or an external audit of internal controls over financial reporting.
Conclusion
Even with the increased perception of detection and prevention (e.g., accounting rules such as Statement on Auditing Standards 99 and national legislation such as the Sarbanes-Oxley Act), fraud continues to increase. It is important to ask the tough questions of your stakeholders such as whether the right controls are in place, what type of investments should be made in those controls, whether the stakeholders can identify or recognize specific warning signs, and whether a proper fraud reporting mechanism is in place.
Recapturing some, or all, of the 5% in revenue a business may be losing each year due to fraud can go a long way toward strengthening an organization’s bottom line. There are a number of ordinary Joes out there; the question is whether he works for you.
