Posted on

Bribery Schemes and Their Compliance Responses

Bribery Schemes and Their Compliance Responses

This writing will highlight some of the more unusual bribery schemes described in 2019 Foreign Corrupt Practices Act (FCPA) enforcement actions and also consider their impact on compliance programs, what they mean for the compliance professional and how the government could potentially use these cases to require more effective compliance programs going forward.

Businessman working with the financial mechanism on blurred background .

Discounts to Distributors

Bribery Scheme

The Microsoft Corporation FCPA enforcement action demonstrated a failure around the company’s policy on providing discounts to distributors and other third-party sellers. The company had a policy requiring a review of discounts above certain thresholds be approved by Microsoft’s Business Desk. But this approval required a valid business justification before the discount could be granted. Unfortunately, a cut and paste job was done by the local business unit, which included a “competition with competitors”, “customer price sensitivity” and the ubiquitous “possibility” of winning other work as justifications for the discount.

These business justifications were provided with no supporting documentation and were approved by the Business Desk. There was a time limit expiration on these discounts; however, there was no follow up by the Business Desk to determine if the discount was revoked or otherwise taken off the table after the time limit expired. You might think that after multiple requests for discounts from the same business unit, which included the same justifications of competition with competitors, customer price sensitivity and the possibility of winning other work someone, the Business Desk might have at least asked them to cut and paste a different business justification to support the discount.

Compliance Response

There must be a comprehensive discount approval process for distributors, which must be followed, tested and include effective oversight. If a business submits multiple requests for a discount and each request includes the same business justification the approver should become suspicious and request proper supporting documentation before granting these requests.  As far back as the BHP Billiton FCPA enforcement action, where the business justification for government travel to the 2008 Beijing Olympics became a cut and paste job, the regulators have made clear that there must be a substantive reason for the discount and that discount must be tested.

This testing also comes in the form of reviewing, with a critical eye, the backup documentation provided to demonstrate the business case for the discount. If there is no documentation, the discount request should not be approved. If there are conditions attached to the discount approval, such as a time limit expiration on the discounts; there must be follow up to determine if the discount was revoked or otherwise taken off the table.

Signature area

Joint Ventures

Bribery Scheme-JV Formation

There were multiple bribery schemes employed by Fresenius Medical Care AG & Co. KGaA (FMC). One of these schemes included the setting up of joint ventures (JV) as a mechanism to pay corrupt doctors, employees of state-owned health care enterprises and government officials who were also medical officials. There was one JV in Angola and two in Turkey created for illicit purposes. In both bribery schemes, 35% of the JV interest was doled out to the corrupt officials. There was no capital contribution required from the employees of state-owned enterprises and government officials. The employees of state-owned enterprises and government officials all cashed out at some point for monetary values far above their individual monetary values in the JVs.

Bribery Scheme-Hidden Interests

Westport Fuels Systems, Inc. (Westport) and a Chinese state-owned enterprise were 50/50 owners in a JV. It was restructured so that a portion of the shares held by Westport and a privately held Hong Kong conglomerate would have to be transferred to the state-owned enterprise and a Chinese private equity fund in which senior Chinese government official held a significant financial interest. The Chinese government official sought and received a low valuation of the JV so he could make a quick turnaround of profitability outside the scrutiny of Chinese regulators. Westport’s Board of Directors authorized Westport’s management to complete the negotiations and execute the share transfer. The final deal agreed upon was a valuation of $70 million for the Chinese JV, with Westport agreeing to transfer its shares to the state-owned enterprise and the private equity fund in exchange for a long-term framework supply agreement.

Compliance Responses

Forming the JV

JVs provide many FCPA risks that other types of business relationships do not bring. For instance, the JV may interact with foreign government officials or employees of a state-owned enterprise; then leverage those relationships for an improper benefit relating to contracts, regulatory licenses, permits or customs approvals. It is difficult to regulate a JVs interaction with foreign government officials when your partner is a state-owned enterprise, or where your company is relying on the local company for its local contacts and expertise for business development and/or regulatory knowledge and experience.

The risks are compounded when the US Company does not exercise control over the JV. This is further compounded by the fact there is no minimum threshold for a FCPA enforcement action against a US company for the actions of a JV in which it holds an interest. If a company holds something less than majority rights, it must urge, beg and plead for the majority partner to adhere to anti-corruption compliance standards and controls. Often, these requirements are established in the JV agreement but the success in securing such contract protections depends on the importance of the global company to the JV itself.  The government not only considers the percentage of ownership in the JV but also considers the company’s ability to influence and control the JV.  Therefore, it is important to impart your compliance program requirements to the JV is the JV does not have its own compliance function and/or program, including relevant policies and procedures.

Knowing who your JV partners before entering the business relationship is critical. Therefore, a robust due diligence is something you must conduct from the start. Both the FMC and Westport enforcement actions demonstrate that if a government official has or even hides an interest in a JV; payments, distributions and buy-outs can be an avenue to make corrupt payments.

The JV Agreement

As a starting point, it is important to have compliance terms and conditions, these reasons can include some of the following: 1) to set expectations between the parties; 2) to demonstrate the seriousness of the issue to the non-US party; and 3) to provide a financial incentive to conduct business in compliant manner.

You must have an absolute prohibition of all forms of bribery and corruption. Many foreign JV partners may not understand that the FCPA applies to them if they partner in a business relationship with a US company. Further, they do not understand that they may be covered persons under the FCPA. This all must be spelled out for them. Audit rights are a key clause in any compliance terms and conditions and must be secured.

Managing the Relationship

A key tool in managing the affiliation with a JV post-contract execution is effective auditing techniques. Your compliance audit should be a systematic, independent and documented process for obtaining evidence and evaluating it objectively to determine the extent to which your compliance terms and conditions are followed. You should work to obtain, review, analyze and evaluate relevant data; and use the data as a basis to remediate any issues which have arisen in the operation of the JV.

In addition to monitoring and oversight of your JVs, you should periodically review the health of your JV management program. The robustness of your JV management program will go a long way towards preventing, detecting and remediating any compliance issue before it becomes a full-blown FCPA violation. As with all the steps laid out, you need to fully document all steps you have taken so that any regulator can review and test your metrics. The 2019 Evaluation of Corporate Compliance Programs (2019 Guidance) lays out what the Department of Justice (DOJ) will be reviewing and evaluating going forward for your compliance program. You should also use these metrics to conduct a self-assessment on the state of your compliance program for your JVs.

zoltar

Sham Third Parties and Third Party Services

Sham Third Parties

In the FCPA enforcement action involving Quad/Graphics Inc., the bribes were paid through the tried and true method of sham third party vendors. While the bribery scheme was about as basic as you could get for “sham-ness” as the third-party vendors were all owned by the same individual, their basic corporate information was all the same as they were all registered in Lima, Peru, with the same address and with no real business operations. Needless to same Quad failed to perform any due diligence on them. The services performed by the Sham Vendors of course contributed to their “sham-ness” as while the Sham Vendors submitted invoices allegedly for pre-press, modulation and/or packaging services none of them performed any such services for the company. Indeed, all these services were performed on site by Quad Peru employees.

The billing by the Sham Vendors and the form of payment to the Sham Vendors was also evidence of their “sham-ness”. Several of the invoices submitted contained red flags, including having the same date and dollar amounts and consecutive invoice numbers. Other red flags included, whole and rounded dollar amounts, large invoice amounts that were disproportionate to the services described, invoices that were consecutively numbered with the same date and invoices without purchase orders or any supporting documentation.

Sham Third Party Services

Fresenius used another bribery scheme in Angola. It was the creation of fraudulent storage payments with a shell company owned by the sons of an Angolan government official, a Military Health Officer in charge of purchasing, to provide warehousing space for a warehouse which housed no FMC products. In or around December 2011, FMC Angola paid approximately $560,000 to this shell company for purported “Temporary Storage Services,” However, no FMC company products were ever stored at the warehouse. When the company’s internal audit function unearthed this scheme, the local business unit simply put a contract in place, executing a written contract with the Shareholder Company to provide temporary storage services for approximately $77,000 per month from January 2012 to January 2013. Once again, no company products were ever stored at the warehouse.

Compliance Responses

The steps in the lifecycle management of any third-party are mandatory for every compliance program. There should be a business justification which is reviewed by an appropriate level of compliance personnel. These forms are usually sent and collected by a business sponsor who governs the relationship with the third parties. The next step involves robust due diligence for any third parties, whether they are sales side representatives or provide goods/services to your organization through the Supply Chain. The level of due diligence is based upon the risk score assigned to each of the third parties. Quad/Graphics Inc. (Quad/Graphics) is the starkest in this area as a simple check on the corrupt third-parties would have revealed that they were all owned by the same individual, their corporate information was all the same as they were all registered in the same city, with the same address.  This was topped off by the fact that they had no real business operations and any visual inspection of their stated business address would have revealed this.

Yet the most important step is managing the relationship after the contract is signed. This is the key lesson from Quad/Graphics and FMC. What does the information included in the invoice provide to you? Are the services delivered legitimate? For Quad/, the services described were performed by in-country Quad/Graphics employees. In the case of FMC, the services listed were for the non-existent storage of non-existent products. Other indicia of fraud and corruption found in invoices include multiple invoices with consecutive numbering’ with the same date and dollar amount, invoices with rounded dollar amounts, invoices with no supporting documentation and, finally, hand delivery of check so there was no bank to verify the accounts. A simple review by someone who knew what they were doing would have raised red flags and lead to further investigation.

I welcome you comments and thoughts and wish everyone a happy, healthy, and prosperous New Year!

Best!
Jonathan Pic

Jonathan T. Marks, CPA, CFE

Posted on 1 Comment

Speaking and Training on Fraud, Compliance, Ethics, and More…

Welcome to my site. I have spoken and been the keynote speaker for many conferences, including the ABA, ACC, ACFE, IIA, and IMA to name a few. I have designed customized training for the board, senior leadership, legal, compliance, internal audit, and others for some of the world’s largest organizations.

“I have had the pleasure to hear Jonathan Marks speak on a number of occasions. …most recently at a Fraud conference sponsored by the Long Island Institute of Internal Audit. Jonathan gave a dynamic and engaging half day presentation on fraud in financial reporting. He engages his audience with his expertise and knowledge of risk management, fraud and internal audit. His ability to share his experiences in fraud investigations over the past thirty years coupled with his interactive approach with his audience made for a compelling and memorable presentation.” Chief Audit Executive 

If you are interested in booking me for your next event or need customized training, please email me with the date or dates, location and address of presentation, the audience make-up, the subjects you would like covered, and the duration of the talk or training.

I have provided you with some Selected Training Programs (See below) and please peruse my blog posts for some additional topics and ideas. Keep in mind I speak and provide training on most anything related to governance, risk, and compliance, with a focus on fraud and forensics.

I will do my best to get back to you quickly.

Thank you!

 

Jonathan Pic

Jonathan T. Marks, CPA, CFF, CITP, CGMA, CFE and NACD Board Fellow

Selected Training Programs

Management Override of Internal Controls

The risk of management override of internal controls to commit fraud exists in any organization. When the opportunity to override internal controls is combined with powerful incentives to meet accounting objectives, senior management might engage in fraudulent financial reporting. This session will examine management override, focusing on the differences between the override of existing controls versus other, more prevalent breakdowns. It will also explore actions to help mitigate the threat of management override, approaches to auditing for management override and the psychology behind management’s override of controls. You Will Learn How To:

  • Identify red flags of management overriding controls
  • Ascertain an approach to auditing for management override
  • Assess the latest trends and research regarding management override of controls
  • Develop a better fraud risk assessment that highlights areas and gatekeepers that might have a greater chance of overriding controls.

Operationalizing Compliance – Master Class with Tom Fox, Esquire

The Master Class developed by Tom Fox, provides a unique opportunity for any level of FCPA compliance practitioner, from the seasoned Chief Compliance Officer (CCO) and Chief Audit Executive (CAE), Chief Legal Counsel (CLO), to the practitioner who is new to the compliance profession.

If you are looking for a training class to turbocharge your knowledge on the nuts and bolts of a best practices compliance program going forward, this is the class for you to attend. Moreover, as I limit the class to 20 attendees, you will have an intensive focus group of like-minded compliance practitioners with which you can share best practices. It allows us to tailor the discussion to your needs. Mary Shirley, an attendee at the recent Boston Master Class said, “This is a great two-day course for getting new folks up to speed on what matters in Compliance programs.

Tom Fox is one of the leading commentators in the compliance space partners with Jonathan T. Marks to bring a unique insight of what many companies have done right and many have done not so well over the years. This professional experience has enabled him to put together a unique educational opportunity for any person interested in anti-corruption compliance. Simply stated, there is no other compliance training on the market quite like it. Armed with this information, at the conclusion of the Doing Compliance Master Class, you will be able to implement or enhance your compliance program, with many ideas at little or no cost.

The Doing Compliance Master Class will move from the theory of the FCPA into the doing of compliance and how you must document this work to create a best practices compliance program. Building from the Ten Hallmarks of an Effective Compliance, using the questions posed from the Evaluation of Corporate Compliance Programs and the FCPA Corporate Enforcement Policy as a guide, you will learn the intricacies of risk assessments; what should be included in your policies and procedures; the five-step life cycle of third-party risk evaluation and management; tone throughout your organization; training and using other corporate functions to facilitate cost-effective compliance programs.

Highlights of the training include:

  • Understanding the underlying legal basis for the law, what is required for a violation and how that information should be baked into your compliance program;
  • What are the best practices of an effective compliance program;
  • Why internal controls are the compliance practitioners best friend;
  • How you can use transaction monitoring to not only make your compliance program more robust but as a self-funding mechanism;
  • Your ethical requirements as a compliance practitioner;
  • How to document what you have accomplished;
  • Risk assessments – what they are and how you can perform one each year.

You will be able to walk away from the class with a clear understanding of what anti-corruption compliance is and what it requires; an overview of international corruption initiatives and how they all relate to FCPA compliance; how to deal with third parties, from initial introduction through contracting and managing the relationship, what should be included in your gifts, travel, entertainment (GTE) and hospitality policies; the conundrum of facilitation payments; charitable donations and political contributions, and trends in compliance. You will also learn about the importance of internal controls and how to meet the strict liability burden present around this requirement of FCPA compliance.

Ethics and Governance Training

This session will cover how ethics is key to good governance and how governance fits into your anti-fraud program. Moreover, we will explore the components of a Sample Code of Ethics, the cost of ethical lapses, organizational situations that encourage bad behavior, the new ethics paradigm, and how to spot a moral meltdown.

Corporate Governance During a Crisis

We also discuss leading practices in crisis management and present several scenarios allow the participant(s) to work though mock crisis scenarios. For example, in your first week at your company, you just received information about an alleged massive fraud and you are now in a crisis. In this session, members of the audience will play different roles within the company (members of the board, legal department, managers, etc.) to have a discussion, including:

  • What type of crisis plan do you have, if any?
  • What to do and how to formulate a plan of action?
  • Who to call first, how to prioritize tasks, and where to prioritize resources?
  • Who (internal and external players) to get involved and when to get them involved
  • What data is needed when a crisis hits?
  • How to prepare for the media and when to reach out?
  • How to communicate with customers, vendors and suppliers, regulatory agencies, and other parties?

Fraud Risk Assessment Process and Guidance

Many professionals struggle with developing a fraud risk assessment that is meaningful. We discuss the objectives of a fraud risk assessment, the components of a fraud, and key considerations for developing an effective assessment. Then we explore the sources of risk, the fraud risk universe, and some of the key components of the assessment. Lastly, we walk through the key steps in the assessment process and walk through a sample fraud risk assessment that considers COSO’s Principle 8, which contains considerably more discussion on fraud and considers the potential of fraud as a principle of internal control.

FCPA (Bribery and Corruption): Building a Culture of Compliance

This session covers why compliance is important and the new guidance issues by the DOJ. We also explore current regulatory enforcement trends, whistleblowers Under Dodd-Frank, the U.S. Federal Sentencing Guidelines, risk-based third-party due diligence, way to thwart an investigation, differences and similarities between the FCPA and the U.K. Bribery Act, successor liability, and provides the participant with a proven 13-Step Action Plan.

Fraud Investigations

Knowing what to do when an allegation of fraud is presented is critical. Failing to understand the process could jeopardize the ability to prosecute wrongdoers. This session discusses why investigations are important, inherent risk and exposures, the types of investigations: internal and independent, board considerations, triaging an allegation, investigative challenges, and keys to running a successful investigation, and why root cause analysis should be considered after completing the investigation.

Third Party Risk Management and Oversight

Third party risk is the biggest nemesis when it comes to FCPA violations. This session discusses the key components of a compliance program and why it needs to be evolving to meet the business and compliance challenges, which are constantly occurring across the globe. We explore the latest DOJ guidance on the evaluation of corporate compliance programs. We build our discussion on the foundation of the key steps to be included in a third-party risk management program and cover some of the red flags of agents and consultants.

Putting the Freud in Fraud: The Mind Behind the White Collar Criminal

To properly fight corporate fraud we need to understand how a fraudster’s normal differs, so executives, managers and board members can develop more effective anti-fraud programs that take into account the behavioral and environmental factors that are common in cases of white-collar crime. By establishing an environment in which ethical behavior is expected — and by understanding how white-collar criminals look at the world differently — it is possible to begin closing the gaps in internal controls, develop a proactive fraud risk assessment and response program and significantly reduce the financial and reputational risks associated with fraud.

In this session, we take a closer look at the personality traits of individual perpetrators of massive fraud.

  • Discuss the basics of profiling and identifying elements of behavior common among white-collar criminals.
  • Discover what role company culture plays in the commission of fraud.
  • Hear cutting-edge ideas and methods to help detect and deter fraud.

Fraud Overview

This session is a “nuts and bolts” discussion about fraud and responding to fraud in an effort to reduce the incidence of fraud and white-collar crime. We go into the characteristics of fraud, who commits fraud, the fraud triangle and Pentagon™, the components of fraud, the regulatory environment & the focus on increased personal responsibility, internal controls to deter and detect fraud, and anti-fraud programs.

Triaging a Whistleblower Allegation

As corporations continue to adopt whistleblower programs, many find themselves struggling to manage burgeoning caseloads. As a result, serious internal fraud investigations can be delayed (with mounting losses) while less consequential complaints are being investigated. The lack of a timely, systematic and repeatable process for evaluating and prioritizing whistleblower tips, which can also expose an organization to increased regulatory risk. While there is no single, “right” method for following up on whistleblower complaints, this session discusses Why Investigating allegations or tips are important, why timeliness matters, investigation challenges, and provides the participant with a sample approach.

Skepticism: A Primary Weapon in the Fight Against Fraud

What happens when we don’t ask why? Professional skepticism occurs when those responsible for fighting fraud take nothing for granted, continuously question what they hear and see and critically assess all evidence and statements. This session we discuss the role of independent reviewer or inspector, particularly of your own assumptions, whether you are placing undue weight on prior risk assessments or discounting evidence inconsistent with your expectations, and pressures placed on you to truncate procedures or make unwarranted assumptions to beat time constraints.

Root Cause Analysis 

The regulators are expecting more today and want to know that your remediation efforts are not treating the symptoms), but rather the root cause(s).

Root cause analysis is a tool to help identify not only what and how an event occurred, but also why it happened. This analysis is a key element of a fraud risk management program and is now a best practice or hallmark of an organizations compliance program. When able to determine why an event or failure occurred, it is then possible to recommend workable corrective measures that deter future fraud events of the type observed. It is important that those conducting the root cause analysis are thinking critically by asking the right questions (sometimes probing), applying the proper level of skepticism, and when appropriate examining the information (evidence) from multiple perspectives.

This program is designed to introduce the common methods used for conducting root cause analysis and to develop an understanding of how to identify root causes (not just causal factors) using proven techniques. In addition, we will demonstrate how to initiate a root cause analysis incident exercise and work with senior management, legal, compliance, and internal audit on an appropriate resolution. We also introduce the “spheres” acting around the “meta model of fraud” and how to use those “spheres” in the root cause process. Finally, this program will present the “three lines of defense”, which provides the audit committee and senior management with a better understanding where the break downs occurred.

Posted on 5 Comments

Skepticism – A Key Tool in the Fight Against Fraud

What is wanted is not the will to believe, but the will to find out, which is the exact opposite.” – Bertrand Russell, “Skeptical Essays,” 1928

Questions about professional skepticism – how to define it, how much is enough, what policies support it, and what practices diminish it – are perennial topics of concern among auditors and accountants. These topics also should be of concern to all stakeholders, including a company’s management, board of directors, and audit committee.

In any discussion of fraud detection and prevention, the phrase “trust but verify” is almost certain to come up. Regardless of how apt that concept might have been in the context of Cold War diplomacy, it could be argued that “trust but verify” is actually bad advice when it comes to deterring fraud in general.

In fact, “trust but verify” could be a downright dangerous approach when applied to audit procedures in particular. A much better slogan for fraud deterrence would be, “Trust is a professional hazard.”

Skepticism: It’s Everyone’s Job

Recently, the necessity of professional skepticism has been emphasized repeatedly. For example, in August 2013, Jeanette M. Franzel, board member of the Public Company Accounting Oversight Board (PCAOB), said, “Our inspection results all    too often show that substantial progress is needed in order to more consistently achieve the appropriate application of professional skepticism throughout the audit process and across audits. Additional efforts are needed to better understand how the framework of professional skepticism applies across varying audit situations.”

Months earlier, the PCAOB issued a staff audit practice alert on the topic, which included this cautionary note: “Observations from the PCAOB’s oversight activities continue to raise concerns about whether auditors consistently and diligently apply professional skepticism. Certain circumstances can impede the appropriate application of professional skepticism and allow unconscious biases to prevail, including incentives and pressures resulting from certain conditions inherent in the audit environment, scheduling and workload demands, or an inappropriate level of confidence or trust in management. Audit firms and individual auditors should be alert for these impediments and take appropriate measures to assure that professional skepticism is applied appropriately throughout all audits performed under PCAOB standards.”

It is not just auditors who must be concerned with maintaining appropriate professional skepticism. This point was stressed during a roundtable convened in April 2013 by the Anti-Fraud Collaboration, which comprises the Center for Audit Quality (CAQ), Financial Executives International (FEI), The Institute of Internal Auditors (IIA), and the National Association of Corporate Directors (NACD). The author participated in this program, which had the objective of bringing together some key players – corporate directors, financial executives, external auditors, and internal auditors – from all along the financial reporting supply chain to discuss each group’s expectations and understanding of the various players’ roles in deterring and detecting financial reporting fraud.

Boards, particularly audit committee members, must take care to exercise a skeptical approach to financial reports and supporting information.

A portion of the discussion focused on an initial survey of the four organizations’ members, which produced a number of surprising findings about the attitudes and opinions of the various stakeholders. The roundtable’s summary concluded, “A large majority of survey respondents believe that financial management has primary responsibility in deterring financial reporting fraud, with a smaller majority believing financial management is responsible for detecting financial statement reporting fraud.”

The implication is that because financial management plays a leading role in detecting financial fraud, it is incumbent on executives – not just auditors – to exercise appropriate levels of professional skepticism. Board members and particularly audit committee members also must take care to exercise a skeptical approach to financial reports and supporting information.

1 skept.JPG
Exhibit 1 – Trust vs. Skepticism

Source: “Closing the Expectation Gap in Deterring and Detecting Financial Statement Fraud: A Roundtable Summary,” Anti-Fraud Collaboration, 2013, p. 15

Tellingly, 42 percent of the internal auditors said that their organization exhibits more trust than skepticism. This is a particularly troubling admission considering the paramount role that professional skepticism – not trust – must play in auditors’ performance of duties.The Anti-Fraud Collaboration’s survey also revealed that the various stakeholders’ expectations and opinions about their organizations’ effectiveness in deterring and detecting fraud vary widely. When asked to rate his or her organization’s overall performance, an internal auditor was much less likely to say that his or her organization exhibits the appropriate balance between trust and skepticism. As shown in Exhibit 1, only 46 percent of those affiliated with the IIA said that their organization exhibits the appropriate balance of trust versus skepticism, compared to 58 percent of the financial executives (members of FEI), 70 percent of the external auditors (CAQ members), and 79 percent of the board members (affiliates of NACD) who responded.

Defining the Issue

An obvious early step in helping executives, boards, and auditors decide the appropriate balance between trust and skepticism in their organizations is to come  to a general agreement on what professional skepticism really means. The auditing profession, as one might expect, has devoted considerable effort to defining the term.

The IIA, representing the internal audit profession with approximately 180,000 members worldwide, defines professional skepticism as “the state of mind in which internal auditors take nothing for granted; they continuously question what they hear and see and critically assess audit evidence.” PCAOB standards define professional skepticism as “an attitude that includes a questioning mind and a critical assessment of audit evidence.” It requires an emphasis on the importance of maintaining the proper state of mind throughout the audit.

Over the past 10 years, researchers have developed a theoretical model that views professional skepticism as a function of six fundamental characteristics, including a recognition that individuals might have different perceptions of the same information.

Defining skepticism and identifying its primary traits have also been the subjects of considerable academic and professional research in recent years. In November 2013, the Standards Working Group of the Global Public Policy Committee (GPPC), a consortium of large accounting firms, published a research paper on the topic. The publication, “Enhancing Auditor Professional Skepticism,” was written by professors Steven M. Glover and Douglas F. Prawitt of Brigham Young University. The paper’s stated purpose was to develop “a shared understanding of what professional skepticism is, how it should be applied, the threats to professional skepticism and the safeguards that may be cost effective.”

The authors noted at the outset that “the term ‘professional skepticism’ is widely used but may mean different things to different organizations and individuals.” The writers went on to suggest that “to move the dialogue on improving the consistent appropriate application of professional skepticism forward, it is important that a shared understanding be developed regarding what professional skepticism is, how it should be applied and documented in various situations, and how threats to professional skepticism manifest themselves at different structural levels.”

Businessmen is thinking in front of blackboard

The GPPC research, like many other efforts, draws partly from academic work by Kathy Hurtt, Martha Eining, and R. David Plumlee. In a series of papers over the past 10 years, these researchers developed a theoretical model that views professional skepticism as a function of six fundamental characteristics:

  1. A questioning mind: Not accepting information at face value but instead looking for evidence or proof to justify the information
  2. Suspension of judgment: A propensity to withhold acceptance or rejection until all information has been found and considered
  3. A search for knowledge: As evidenced by genuine curiosity and enjoyment of learning
  4. Interpersonal understanding: Recognizing that individuals might have different perceptions of the same information
  5. Self-confidence: Valuing one’s own insights and being willing to challenge the assumptions of others
  6. Self-determination: The personal initiative to take action based on the evidence

This multidimensional view and a related 30-question survey the authors developed to provide an empirical measure of individual auditors’ relative skepticism have formed  the basis of much of the academic research on professional skepticism over the past decade. This view also provides a useful explanation of characteristics and behavior that can be inherently difficult to measure objectively.

Ninety-four percent of board members were confident or highly confident that they exercise sufficient skepticism

Skept 2.JPG
Exhibit 2 – Confidence That Each Party Exercises Sufficient Skepticism

Source: “Closing the Expectation Gap in Deterring and Detecting Financial Statement Fraud: A Roundtable Summary,” Anti-Fraud Collaboration, 2013, p. 15

Complacency: The Big Challenge

An objective of all this research on professional skepticism is to help identify factors that prevent or discourage auditors – and others in the financial reporting supply chain – from developing and maintaining the appropriate level of skepticism. One of the most prevalent factors is simple complacency – as demonstrated by another response to the Anti-Fraud Collaboration’s survey.

As shown in Exhibit 2, survey respondents were asked to assess their confidence that the various groups responsible for deterring and detecting fraud in their organization were exercising a sufficient level of skepticism.

Of all the groups, board members (NACD members) were most complacent about the performance of responsible parties in their organization. They were almost unanimous (98 percent) in expressing confidence that their company’s internal and external auditors exercise sufficient skepticism. Ninety-four percent of board members were confident or highly confident that they exercise sufficient skepticism themselves.

On the other hand, external auditors (CAQ members) were much less confident in others’ performance. Only 73 percent of the CAQ’s respondents were confident or highly confident that financial executives exercise sufficient skepticism of financial results. External auditors viewed board members and audit committees almost identically to executives.

Internal auditors (IIA members) had roughly the same view of financial executives and even less confidence that board members and audit committees demonstrate appropriate skepticism in reviewing financial information. In other words, the views of internal and external auditors differ significantly from the views of executives and board members.

Other Impediments to Appropriate Skepticism

Complacency is only one attitude that could cause an executive, board member, or auditor to exercise insufficient skepticism when considering financial information. The GPPC’s research paper points out several natural tendencies that can lead to faulty judgment or weakened skepticism:

  • Overconfidence. Decision-makers must be careful not to overestimate their abilities and understanding of issues. Overconfidence can lead them to challenge statements, assumptions, and procedures insufficiently.
  • Confirmation bias. It’s natural to give more weight to information that confirms our opinions. This inclination can bias a wide variety of auditor judgments and cause executives and board members to see what they expect to see.
  • Anchoring. Anchoring is the tendency to start with initial values and data that are familiar. An auditor can be influenced inappropriately by the previous year’s account details, for example.
  • Availability. Information that is easily accessible (or available from memory) is often considered less relevant to a decision than information from alternative sources. As a result, auditors unconsciously might not apply the most relevant information to the audit.

In addition to personal biases, other challenges can inhibit skepticism. For example, an external auditor’s conflicts of interest and less-than-thorough understanding of the business are areas of legitimate concern.

One of the most significant challenges is deadline pressure. An auditor is naturally under substantial pressure to complete the work and issue the report promptly. A cunning fraudster can take advantage of the situation by initially diverting the auditor’s time and attention to areas that are unlikely to raise concerns and saving problematic areas until the engagement’s end, when time is short. Recognizing and resisting this tactic requires the application of professional skepticism – not only on the part of the external auditor but by the others involved in the process as well.

Beyond Audit: What Other Stakeholders Can Do

Although the GPPC’s research focused on auditors, the same observations – and the same potential weaknesses – apply to everyone in an organization who has the responsibility to detect or deter fraud, from executives with financial reporting responsibilities to the board of directors in general and members of the audit committee in particular. Ultimately, all these individuals have a direct interest in detecting fraud or misstatement and a responsibility to be on guard against complacency or other impediments.

The GPPC study’s authors noted, “While auditors can and must do better in their central role, we believe that a complete solution to the problem of enhancing auditor professional skepticism requires an approach that addresses threats at all structural levels and that involves all of the key stakeholders that share responsibility in enhancing the reliability of the financial reporting process.”

It is essential for all organizations to encourage clear, open communication among all parties concerned. The Anti-Fraud Collaboration’s report noted, “For the roles to operate well together, communication is critical.” The authors went on to advocate “open and candid conversation among the internal and external audit functions, financial management, and the audit committee, allowing for audit committees to perform their governance role with necessary transparency and realistic expectations.”

Beyond this general effort, all stakeholders can take a number of specific steps to encourage appropriate levels of professional skepticism, including the following –

  • Self-criticize each significant judgment. Make it a point to play the role of the independent reviewer or inspector, particularly of your own A professional skeptic continuously challenges his or her beliefs and belief-based risk assessments. Critical self-assessment is necessary to demonstrate to others why and how beliefs and assessments are justified.
  • Make an effort to resist complacency and other natural tendencies such as confirmation bias. Question whether you are placing undue weight on prior risk assessments or discounting evidence inconsistent with your with your expectations.
  • Be alert to Pressure. Pay particular attention to pressure to truncate risk assessment procedures or make unwarranted assumptions to beat time constraints. This step is especially important as deadlines approach.
  • Understand the sources of evidence.  Identify and assess audit risks from multiple perspectives, using multiple sources of evidence,
  • Be aware of the relative reliability of various types of evidence. In general, documentation from internally generated documents – particularly those that are generated manually or not linked to other reporting systems – is less reliable as evidence than documents generated by external sources such as banks or suppliers.  See graphic below.

If, as asserted at the outset, trust is indeed a professional hazard for auditors, then it follows that informed, knowledgeable skepticism is a professional asset. That principle applies not only to auditors but also to the board members and financial executives responsible for detecting and deterring fraud of  all  types,  specifically  financial reporting fraud. By challenging their own assumptions – and creating an environment in which such challenges are encouraged and supported – companies will not just   deter fraud but make its detection more likely.

I welcome your thoughts and comments.

Best!

Jonathan Pic

 

Attribution:

Jeanette M. Franzel, “Auditor Objectivity and Skepticism – What’s Next?” American Accounting Association Annual Meeting, Aug. 5, 2013, http:// pcaobus.org/News/Speech/Pages/08052013_AAA. aspx

“Staff Audit Practice Alert No. 10: Maintaining and Applying Professional Skepticism in Audits,” Public Company Accounting Oversight Board, Dec. 4, 2012, http://pcaobus.org/Standards/QandA/12-04- 2012_SAPA_10.pdf

“Closing the Expectation Gap in Deterring and Detecting Financial Statement Fraud: A Roundtable Summary,” Anti-Fraud Collaboration, 2013, p. 3, https://na.theiia.org/standards-guidance/Public%20 Documents/Anti-Fraud%20Collaboration%20Report. pdf

“IIA Chapter 10,” “Quizlet” online study guide, 2014, http://quizlet.com/15259935/iia-chapter-10-flash- cards/

“Staff Audit Practice Alert No. 10.”

Steven M. Glover and Douglas F. Prawitt, “Enhancing Auditor Professional Skepticism,” Global Public Policy Committee, November 2013, p. i, http://www. thecaq.org/docs/research/skepticismreport.pdf

Ibid.

Ibid, p. ii.

The Hurtt Skepticism Scale is summarized in Rosemary Fullerton and Cindy Durtschi, “The Effect of Professional Skepticism on the Fraud

Detection Skills of Internal Auditors,” Social Science Research Network, Nov. 11, 2004, http://ssrn.com/ abstract=617062

“Enhancing Auditor Professional Skepticism,” p. 18.

“Closing the Expectation Gap in Deterring and Detecting Financial Statement Fraud,” p. 10.

skept 8
Evidence
Posted on

Jonathan T. Marks, Baker Tilly Partner, is Speaking Today at the First Chair Event in Chicago on Triaging Whistleblower Allegations

frm

As the use of whistleblower programs continues to grow, many organizations find themselves struggling to manage burgeoning caseloads. As a result, serious fraud investigations can be delayed (with mounting losses) while less consequential complaints are being investigated. The lack of a timely, systematic and repeatable process for evaluating and prioritizing whistleblower tips that contain allegations of ethical breaches can also expose an organization to increased regulatory risk. While there is no single, “right” method for following up on whistleblower complaints, the most effective approaches often resemble the medical triage programs that hospitals and first responders use to allocate limited resources during emergencies, or a crisis situation. Here are some useful guidelines for designing and implementing a fraud triage system.

The Growing Use of Whistleblower Programs

Despite extensive fraud detection measures, closer management scrutiny, and increasingly sophisticated technology, the most common fraud detection method is still the simplest: somebody notices something suspicious and decides to speak up. According to the Association of Certified Fraud Examiners’ (ACFE) 2018 Report to the Nations on Occupational Fraud and Abuse, 40.0% of the cases reported in their study were uncovered as the result of tips (usually from an employee, supplier, or customer) —more than internal audit 15% and management review 13% combined. The ACFE study also demonstrates that dedicated reporting hotlines are particularly effective. In organizations where such hotlines were in place, 46.0 % of the cases reported were uncovered through tips, compared with only 30.0% percent of the cases in organizations without hotlines. These results are consistent with patterns that have been recorded in the ACFE’s biennial survey since its inception 20 years ago. On a broader scale, as a matter of best practice, the COSO Internal Control–Integrated Framework, along with various other enterprise risk management (ERM) frameworks and guidance from Institute of Internal Auditors (IIA), also emphasize the importance of establishing and maintaining effective whistleblower programs.

In addition to their demonstrated effectiveness, whistleblower programs have also been promoted through recent regulatory actions. For example, one section of the Dodd-Frank Wall Street Reform and Consumer Protection Act directs the Securities and Exchange Commission to make monetary awards to individuals who voluntarily provide information leading to successful enforcement actions that result in monetary sanctions over $1 million. A few years earlier, the Sarbanes-Oxley Act of 2002 required the audit committees of publicly traded companies to establish procedures to enable employees to submit confidential, anonymous information regarding fraudulent financial reporting activities. Dodd-Frank and Sarbanes-Oxley are only two examples out of a broad range of laws that encourage – and often mandate – whistleblower programs. A 2013 study by the Congressional Research Service found no fewer than 40 federal whistleblower and anti-retaliation laws, designed to protect employees who report misconduct. Eleven of those 40 laws were enacted after 1999. On February 21, 2018, the U.S. Supreme Court issued an opinion in Digital Realty Trust, Inc. v. Somers, a long-anticipated case that clarifies who is protected as a “whistleblower” under the Dodd-Frank Act’s anti-retaliation provisions. It states that to qualify as a “whistleblower” under Dodd-Frank, individuals now have a clear incentive to report all sorts of observations to the SEC before reporting those observations through their company’s internal reporting infrastructure. Now under Dodd-Frank an individual is only protected from retaliation if he or she has reported a potential violations to the SEC before he or she separates from the company. Such laws not only make whistleblower programs more common, they also make the timely resolution of tips even more critical, as we are about to explain.

There is momentum today to correct Dodd-Frank.

On July 9, 2019, the U.S. House of Representatives passed H.R. 2515, also known as the Whistleblower Protection Reform Act of 2019 (“WPRA”). The WPRA is designed to address a gap in the whistleblower protections afforded under the Dodd-Frank Consumer Protection and Wall Street Reform Act of 2010 (“Dodd-Frank”), as interpreted by the Supreme Court in Digital Realty Tr., Inc. v. Somers, 138 S. Ct. 767 (2018). Specifically, the Supreme Court in Digital Realty Trust ruled that the anti-retaliation provision of Dodd-Frank does not extend to protect employees who only make reports concerning violations of securities laws internally, as opposed to individuals who made a report to the U.S. Securities and Exchange Commission (“SEC”). The WPRA is designed to amend Dodd-Frank to ensure the statute’s protections extend to individuals who make internal reports of securities violations.

Responding to Tips – Why Timeliness Matters Dodd-Frank, Sarbanes-Oxley, and the various regulatory structures that were established to implement them are helping to mold a corporate environment where undervalued and underappreciated compliance professionals and in-house counsel are incentivized to “blow the whistle.” Such incentives can be helpful in creating a self-regulating environment, but they also make it essential that corporations establish a timely and effective process for remediating complaints. For example, to carry out its mandate under Dodd-Frank, the SEC established a separate Office of the Whistleblower, which has paid out more than $160 million to 46 whistleblowers in connection with 37 covered actions, as well as in connection with several related actions since it was founded in 2011. Three of the ten largest whistleblower awards were made by the SEC during FY 2017.

Under this program, there are exceptions if at least 120 days have passed either since the auditor (excluding external auditors who obtained the information during the audit of an issuer) or accountant properly disclosed the information internally (to their supervisor or to another person in the organization who is responsible for remedying the violation (i.e., the audit committee, chief legal officer, chief compliance officer, or their equivalents), or since they obtained the information under circumstances indicating that the entity’s officers already knew of the information. Then they can report the lapse directly to the SEC and be eligible for a sizable whistleblower award – from 10 percent to 30 percent of any fines or sanctions that are collected. The program’s website prominently features headlines such as “SEC Issues $17 Million Whistleblower Award” and “SEC Awards More Than $5 Million to Whistleblower,” to cite only two of many recent examples.Since the program’s inception, the SEC has ordered wrongdoers in enforcement matters involving whistleblower information to pay over $975 million in total monetary sanctions, including more than $671 million in disgorgement of ill-gotten gains and interest, the majority of which has been, or is scheduled to be, returned to harmed investors .With incentives like that, it should be no surprise that whistleblower complaints are on the rise. Yet in most cases, such awards would not have been available if the companies involved had resolved the initial fraud complaints within 120 days.Unfortunately, our experience indicates that, while many companies invest in tips hotlines and similar whistleblower programs, a large portion of them fail to invest adequately in an allegation review process for promptly evaluating, prioritizing, and responding to the whistleblowers’ tips in a systematic, repeatable, and defensible manner. As the number of tips grows and investigators’ caseloads expand, complaints end up sitting in a queue waiting to be investigated, while the company remains vulnerable to the risks the tipsters were warning about, and the SEC timeline is running.

A 2018 study of customers of the compliance software company NAVEX Global found that case closure times have blipped to 44 days and has dropped to 40 days according to their 2019 study. This metric is important given that, under certain agency whistleblower provisions, an organization will have limited time to complete an internal investigation.

Moreover, when the various categories of fraud are compared, cases involving suspected accounting, auditing, and financial reporting fraud took the longest to resolve by far – 55 days! In other words, the average case closure time for cases of suspected financial fraud was almost halfway to the 120-day deadline – the point at which employees are incentivized to report the case directly to the SEC and expose the company to additional, sizable sanctions.

Hidden and Direct Costs of Delayed Response Even setting aside potential SEC sanctions, delays in investigating whistleblower tips are costly in other ways. Delayed responses to tips can cause employees and other potential sources to lose confidence in the hotline or other whistleblower program, undermining the effectiveness of the the compliance and ethics program and adding further complexity to the risk management effort. Most companies expend considerable time, effort, and resources in creating compliance and ethics programs. Failing to establish a system for dealing with allegations or tips in a timely manner can mean those expenditures are probably wasted. There are also direct costs associated with delays in handling tips. The losses resulting from a fraud scheme are directly related to how long the scheme goes on. The ACFE’s 2018 Report to the Nations found that the median losses for frauds that were uncovered in six months or less was $30,000. But at the other end of the scale, schemes lasting more than five years caused a median loss of $715,000. Simply put, the longer perpetrators are able to continue, the more financial harm they are able to cause. Clearly, the absence of an effective program for handling whistleblower complaints promptly and effectively can have a significant and direct financial impact – in addition to the regulatory, employee relations, and reputational risks such a shortcoming entails.

A Triage Approach While there is no single, one-size-fits-all method for following up on whistleblower complaints, the most effective approaches are similar in many ways to medical triage programs, such as those implemented by hospitals and first responders during emergencies to help medical professionals prioritize the treatment of patients. In medical triage, those with serious, life-threatening injuries are treated ahead of those whose conditions are less severe. In the same way, a fraud triage program helps risk, audit, and fraud professionals prioritize the investigation of tips and whistleblower complaints. Those that indicate serious, material risks are addressed differently and more aggressively than those that reflect mere misunderstandings, minor errors, personal grievances, or false tips, all of which could tie up investigators unnecessarily. Under a fraud triage program, the same principles apply. Hotline tips or complaints that do not indicate fraudulent behavior can be delegated to human resources, IT, or other line or support functions that are capable of handling them more efficiently. Meanwhile, complaints that involve suspected fraud, but which are less significant in terms of financial losses, control failures or other risks, may be set aside temporarily while larger, more material cases receive immediate attention.

Proper Staging of the Allegation – the Critical First Step A swift and thorough triage process leads directly to a more appropriate and timely response. The specifics of that response will vary, of course depending on the nature and severity of the case, but the fundamental elements of the treatment include forming the right team to investigate, understanding root causes, and providing timely disclosure to all constituencies. Before such a response can be planned and executed, however, the tip or allegation must be evaluated or “staged” based on a consistent set of criteria. Navigant’s fraud governance framework identifies five such stages:

Stage 1 Stage1 allegations have a low threat level and do not suggest a breakdown of internal controls. Tips that get grouped into this stage do not have a financial or reputational impact. These may include employee-to-employee disputes, isolated cases of small-scale employee theft, and the normal policy complaints, misunderstandings, and personal disagreements that are often raised through a whistleblower program. In most cases, these complaints are best handled by human resources or management personnel.

Note: Human Resources and management should be trained on proper investigation protocols, including the escalation process. A basic level of review should be performed and documented to corroborate that no further investigation is warranted. This review and documentation could be performed by a branch or office manager. For an employee who is the target of such a complaint, management should consider placing such employee on a temporary legal hold which triggers the retention of email and other documents until the risk of retaliatory litigation has passed.

Stage 2 These allegations are more serious in nature, and often indicate some deficiency in the design of internal controls. Examples include business rule violations such as recurring employee theft or patterns of falsifying expense reports. If the allegation is substantiated, then the result of the remediation process is a change to a business process or business rule, followed by an enhancement of the company’s preventive or detective internal controls. Because they indicate a deficiency in internal controls, such allegations are escalated to the internal audit function in order to obtain a deeper understanding of the control environment. Internal audit should evaluate what controls are currently in place, and determine where the breakdown in internal controls occurred. It is also important to assess if the allegations are signs of a bigger problem or if they could have an impact on financial reporting. If financial reporting is affected, sensitivity testing must be performed to calculate the low case, medium case, and worst case financial impact. Internal audit’s review also might identify multiple violations. Again, the employees affected should be put into a legal hold which triggers the retention of email and other documents until the risk of litigation passes. In some cases, employee termination may be warranted.

Stage 3 These allegations are serious in nature, generally involve an override of internal controls, and thus are at a minimum a serious deficiency. But they have only a minimal impact on the financial statements or the company’s reputation. More serious allegations in this category include fraud, embezzlement, and bribery involving employees or mid-level management. Such cases require the same level of investigation as Stage 2 cases, along with an internal investigation that usually is conducted under the direction of the general counsel, involving compliance and internal audit as well. In some instances, the investigation might need to be performed independently by a function or person who is not directly involved in the control environment.

Stage 4 These are serious allegations that could have an impact on the completeness and accuracy of the audited financial statements, and that could indicate a material weakness in internal controls. They do not, however, appear to involve any member of the senior management team. Such cases are generally addressed through an internal investigation, usually under the direction of outside counsel operating under privilege. The investigation often involves the use of independent, outside experts as well.

Stage 5 These are serious allegations that involve one or more members of the senior management team, or are serious enough to damage the company’s reputation. The receipt of allegations in this stage usually place the company into crisis management mode, and could result in the restatement of audited financial statements or added regulatory scrutiny. In such instances, the board generally should engage outside counsel and forensic investigation experts to initiate a privileged and confidential fact-based investigation. The external auditors may also be involved and a disclosure to the SEC may be required. It’s important to note that, in both Stage 4 and Stage 5, engaging outside experts is generally necessary. Other critical elements of the Stage 4 and Stage 5 responses include having a qualified and experienced investigation team, along with a time-phased work plan that is minimizes disruptions to the organization’s day-to-day business as much as possible. The investigators will begin with fact-finding interviews to help them evaluate who else to interview and when. The investigators will also help the company identify a list of custodians who will be interviewed to understand where their data was being saved (for example, on email servers, mobile phones or other devices, flash drives, cloud servers, and network folders). Generally, a large-scale data collection effort will then ensue in order to search and preserve all potentially relevant information. The goal is to determine who knew what and when, and how high up the chain the knowledge went. The investigation will also assess if the audited financial statements be relied upon, so that counsel and board members can determine what disclosure requirements might apply. In addition, where internal control issues are noted, outside counsel can also recommend and assist in recommending new or enhanced policies, procedures, and controls.

Ownership, Responsibility and Follow-Up Obviously, the triage staging system described here is not the only plausible methodology an organization can use for evaluating allegations of wrongdoing and planning appropriate responses. Other thought leaders in the field have proposed evaluating tips according to various other criteria such as the severity of the allegation, the specificity of the information it contains, and similar factors. Ultimately, whatever triage process and framework is chosen it will need to be customized to reflect the company’s particular situation and its particular industry. In many instances, boards may choose to combine elements from several approaches.

Regardless of the specific criteria upon which the system is based, the importance of maintaining written policies and procedures cannot be overstated. Moreover, but in all cases it is important in all cases that the responsibility for developing, implementing, and maintaining the triage response system be clearly defined. The assignment of this responsibility will vary as well, depending on the size and nature of the organization, its governance structure, the volume of whistleblower complaints and other factors. It could fall to internal audit, the corporate general counsel, a board committee, a designee of the CFO, or some other person or group – but in all cases it’s essential to have a designated individual or business function that is responsible for initially capturing complaints and performing the triage o the allegation(s). Once the framework is set and data is being collected, it’s also important to step back and periodically assess what the data is saying. For example, if the complaint hotline is bombarded with a high frequency of inconsequential complaints related to minor personnel disputes uniform violations or employees complaining about having to work a holiday, then it may be time to provide additional training on how the complaint hotline is to be used. An increase in sexual harassment complaints or complaints related to substandard working conditions could be provide an early warning of a potential leading indicator for a class action lawsuit. Similarly, an increasing number reports of low dollar employee theft are usually signs of a larger cultural problem. Evaluating the data and trends captured in your complaint system can help you make decisions that could prevent the next “big event.” In that sense, an effective, well-designed, and consistently executed fraud triage effort can pay even bigger dividends that go beyond the direct benefit of helping you evaluate and prioritize tips and complaints more efficiently.

Lastly, as facts come to light, there might be a need to escalate the allegation. If an investigation starts with human resources or internal audit, they should be trained on what to do if the matter intensifies!

escalation process.jpg

Matters that generally require escalation include, but are not limited to:

  • Violation of law – antitrust and competition, anti-bribery and corruption, employment discrimination and harassment, fraud against third parties by employees
  • Accounting, books and records – public financial reporting, internal financial reporting and disclosure, insider trading, SOx, Dodd-Frank
  • Environmental, healthy, safety
  • Any employee theft, misappropriation, or fraud against the organization in excess of $$$$$$$ 
  • Code of Conduct Violations of the Executive Leadership team
  • Misconduct by Legal, Ethics and Compliance employees – failing to investigate or stopping an investigation
  • Third party frauds against, or thefts from, the organization

Care should be taken and consultation with legal counsel and compliance is wise move, unless they are or appear to be involved, then go directly to the Board of Directors

Board members, I would seek to understand the escalation process and I would review the allegation log to ensure investigations are being done timely, you are being briefed on all serious matters, proper discipline has been applied, and  internal controls are installed or enhanced to try to prevent and detect possible future bad or “carryover” behavior! 

I welcome your comments and suggestions.

Jonathan T. Marks

Attribution:

  • Buckley
  • NAVEX
  • ACFE
  • SEC

 

This material is protected by Copyright Laws and may not be reproduced in any form without my express written permission.

Posted on

Spotting an Ethical Meltdown!

When there is an allegation of fraud that turns into a reality, everyone usually asks the question, “Why wasn’t the alleged fraud caught sooner?”

Maybe because one profile of a fraudster includes a salesperson mentality that is cloaked with a “false sense of integrity“, hoping your level of skepticism is lowered in an effort to deceive you, or deflect, or direct you away from them and the evidence being concealed that could ultimately prove a fraud has occurred.

So how can you increase your odds of detecting an ethical meltdown, or worse, a fraud?

Let me try to lay it out for you.

Background

The word “ethics” is derived from the Greek word ethos (character), and from the Latin word mores (customs). In essence, it is what you do or don’t do when no one is watching.

It’s always clear what’s right or ethical in a perfect world, but we don’t live in a perfect world! In the real world, situations are often murky.

Someone’s wrong can be your right, which means your right will definitely, at some point, be someone else’s wrong. Most of the time the “right” choice can be subjective.

At some point, senior leadership and employees will have to make tricky ethical decisions and often those decision are impacted by ethical conflicts, which are influenced by pressure or some other factor(s). Recognizing these conflicts and the red flags can help deter a situationally ethical senior leader or employee from crossing over the line.

angel_devil_tug_war_1600_clr_6266

Some common ethical conflicts include the following –

Truth vs. loyalty – Honesty or integrity vs. commitment, responsibility, or promise-keeping.

Justice vs. mercy – Fairness, equity, & even handed application of a principle or rule conflict with compassion or empathy.

One vs. many – When the needs of an individual person or group conflicts with the needs of a larger group or society as a whole.

Short-term vs. long-term –  Now vs. then conflicts arise when immediate needs or desires run counter to future goals or needs.

Red Flags

  • Pressure to maintain sales, budgets, etc.
  • Behavior that uses fear and silence
  • Leaders with a big or unconstrained ego/personality or hubris (infallibility and superiority)
  • Conflicts of interest that are overlooked or unaddressed
  • An attitude that goodness in some areas atones for evil in others

Here are some linguistical red flags that I find helpful too*-

  • “Well, Maybe just once…”
  • “No one will ever know…”
  • “It sounds too good to be true…”
  • “Everyone does it…”
  • “Shred that document…”
  • “We can hide it…”
  • “No one will get hurt…”
  • “What’s in it for me…”
  • “This will destroy the competition…”
  • “We did not have this conversation…”

figures_solve_puzzle_1600_clr_2127.pngBoard of Directors Role in Helping Thwart an Ethical Meltdown

  • Bolster your corporate governance framework by having it reviewed by an outside party;
  • Ensure the communication from senior leadership is appropriate and pure (not filtered);
  • Have a strong working relationship with CEO and work together to develop strong ongoing monitoring protocols;
  • Go out into the field and talk to mid-level managers – listen for a murmur;
  • Be sure the written policies are more than the bare minimum of compliance – require more than just the minimum;
  • Listen to dissenters carefully;
  • Understand that Tone and Conduct from the Top is not just the CEO’s responsibility – it’s also the Board of Directors; and,
  • Reward people who speak up and help minimize damage or even save the organization.

Closing Thoughts

Everyone in the organization is responsible for ethics and sustaining a culture of compliance!

Be cognizant of the common ethical conflicts and deal with them timely and appropriately.

Don’t ignore any red flag.

I welcome your thoughts, opinions, and suggestions.

Best!

img_7798-2

Jonathan T. Marks, CPA, CFE

*Tip – consider these when doing an email search during an investigation.

Posted on 1 Comment

A Violation of Trust: Fraud Risk in Nonprofit Organizations

tornado money.jpg

The risk of fraud is a serious concern for all types of enterprises, but fraud can be particularly damaging to a nonprofit organization, for which a damaged reputation can have devastating consequences.

The Costs of Fraud in Nonprofit Organizations

According to the 2018 global fraud study by the Association of Certified Fraud Examiners (ACFE), the typical organization loses an estimated five (5) percent of its annual revenue to fraud. The ACFE reported that private companies suffered the greatest median loss, at $164,000; however, nonprofit organizations had the smallest median loss of $75,000. For some a $75,000 this may be insignificant, but for many nonprofits, financial resources are extremely limited and a loss of $75,000 can be particularly devastating.

Beyond the immediate financial loss, however, an even greater potential cost of fraud to nonprofit organizations is the reputational damage that can occur. Because most nonprofits depend on support from donors, grantors, or other public sources, their reputations are among their most valued assets. In addition, fraud in nonprofit settings often garners unrelenting negative media attention.

Vulnerability to Fraud

Nonprofits can be particularly attractive targets for fraudsters. Executives who are passionate about their agencies and their missions are naturally trusting of others who share their interest- or who pretend to. Moreover, board members and executives who are dedicated and talented in their particular fields may not be well versed in financial issues and internal controls.

In addition, nonprofits of all sizes may have only limited resources available to address internal controls. This makes them vulnerable to an employee who could recognize this lack of controls and use it as an opportunity to override controls, if they even exist, to commit fraud.

As the Center for Audit Quality has noted, “fraud cannot occur unless an opportunity is present. Opportunity has two aspects: the inherent susceptibility of the [organization’s] accounting to manipulation, and the conditions within the [organization] that may allow a fraud to occur.” In addition, the opportunity for fraud is also affected by an organization’s culture, a factor that is often overlooked.

The very nature of some nonprofits also makes them tempting targets. Many nonprofits distribute grants, scholarships, awards, or other types of financial aid to outside agencies or individual recipients. This opens yet another door for potential abuse or misappropriation and requires even more oversight to make sure funds are not being misappropriated. In addition, nonprofits tend to have large amounts of cash and checks coming in from various sources, making them vulnerable to skimming (when an employee accepts payment from an outside party but does not record the sale and instead pockets the money) or cash larceny (when an employee steals cash and checks from daily receipts before they are deposited in the bank).

Struggling agencies also frequently experience relatively high staff turnover, making training and adequate segregation of duties more difficult. Finally, many nonprofits depend heavily on volunteers and other community members, which can further complicate efforts to establish or maintain internal controls. It is important to remember that internal controls provide only reasonable—not absolute—assurance that the objectives of an organization will be met. As a result, no organization, even one with the strongest internal controls, is immune to fraud.

why.jpg

How Fraud Occurs and Why

While nonprofit organizations present particular temptations to fraudsters, the actual fraud schemes they might face are common to all types of organizations. Fraud schemes in nonprofits can include check fraud, embezzlement, ghost employees, expense fraud, misappropriation of funds for personal use, fictitious vendor schemes, kickbacks from unscrupulous vendors, and outright theft of cash or assets—to name a few.

One area in which nonprofit organizations seem particularly vulnerable is billing schemes, in which an employee fraudulently submits invoices to obtain payments he or she is not entitled to receive. According to the most recent ACFE survey, billing schemes were among the most common fraud methods in the cases studied for the 2012 report.

Billing schemes often involve the creation of a shell company. In such a fraud, a dishonest employee sets up a fake identity that bills for good or services the organization does not receive. In some instances, goods or services may be delivered but are marked up excessively, with the proceeds diverted to the employee.

Other scams include pay-and-return schemes that cause overpayments to legitimate vendors. When an overpayment is returned, it is embezzled by the employee. Another favorite is simply ordering personal merchandise that is inappropriately charged to the organization.

Common incidents and warning signals or red flags of potential billing fraud include but are not limited to:

  • Unfamiliar vendors
  • Invoices for unspecified or poorly defined services
  • Vendors that have only a post-office-box address
  • Vendors with company names consisting only of initials (many such companies are legitimate, of course, but fraudsters commonly use this naming convention)
  • Sudden increases in purchases from one vendor
  • Vendor billings issued more often than once a month
  • Vendor addresses that match employee addresses
  • Large billings that are broken into multiple smaller invoices that will not attract attention
  • Internal control deficiencies such as allowing a person who processes payments to approve new vendors

These warnings or red flags can be organized into four general categories (below) and can help in the design of internal controls and monitoring procedures –

Data

  • Transactions conducted at unusual times of day, on weekends or holidays, or during a season when such transactions normally do not occur
  • Transactions that occur more frequently than expected — or not frequently enough
  • Accounts with many large, round numbers or transactions that are unusually large or small
  • Transactions with questionable parties, including related parties or unrecognized vendors
  • Misclassification of transactions

Documents

  • Missing or altered documents
  • Evidence of backdated documents
  • Missing or unavailable originals
  • Documents that conflict with one another
  • Questionable or missing signatures

Lack of Controls

  • Unwillingness to remediate gaps
  • Poor “tone from the top”
  • Inconsistent or nonexistent monitoring controls
  • Inadequate segregation of duties
  • Lax rules regarding transaction authorization
  • Failure to reconcile accounts in a timely manner

Behavior

  • Financial difficulties or generally living beyond one’s means
  • Divorce, family problems, or addiction problems
  • Past employment-related or legal problems
  • Overly or suddenly charitable
  • An unusually close association with vendors or recipients of grants or services
  • Control issues and a general unwillingness to share duties
  • Refusal to take vacations
  • Irritability or defensiveness
  • Complaints about inadequate pay, lack of vacation, or comp time
  • Complaints about lack of autonomy or authority

It is also worth noting that fraud is not about obstruction; rather, it is about deception, deflection, and persuasion. When fraudsters or white-collar criminals are profiled, they often are found to be anxious, secretive, moody, hot-tempered, friendly, outgoing, and passionate. They often are good salespeople and will say what people want to hear in order to build rapport and gain trust. Moreover, often there are other warning signs or red flags hidden in plain sight…such as living beyond one’s means, having financial difficulties, maintaining an unusually close association with vendors, or exhibiting excessive control issues, which generally will not be identified by traditional internal controls. It is important to maintain a healthy level of skepticism and always remember that trust is a professional hazard; if you do not verify information, you could become a victim.

fraud tile.jpg

Some Common Frauds Schemes*

  • Skimming — Cash is stolen before the funds are recorded in the accounting records
  • Credit card abuse — Perpetrators either use organization-issued credit cards for personal use or use donor credit card numbers
  • Fictitious vendor schemes — Perpetrators set up a company and submit fake invoices for payment
  • Conflicts of interest — Board members or executives have hidden financial interests in vendors
  • Payroll schemes — Continued payment to terminated employees, overstatement of hours, or fictitious expenditure reimbursement
  • Sub-recipient fraud — Abuses by a sub-recipient entity include intentional charges of unallowable costs to the award, fraudulent reporting of levels of effort, and reporting inaccurate performance statistics and data
  • Deceptive fundraising practices
  • Misrepresentation of the extent of a charitable contribution deduction entitlement, misrepresentation of the fair market value of donated assets, and failing to comply with donor-imposed restrictions on a gift
  • Fraudulent financial reporting
  • Misclassifying restricted donations to mislead donors or charity watchdogs, misclassifying fundraising and administrative expenses to mislead donors regarding funds used for programs, and fraudulent statements of compliance requirements with funding sources

duration.JPG
Source: ACFE

Implementing Controls

As with all risk issues, the ultimate responsibility for identifying gaps and developing fraud controls rests with management. To meet this responsibility, management should avoid complacency and not assume that if fraud occurs “the auditors will catch it.” Although having an annual audit is a good anti-fraud control, by the time an audit uncovers a fraud scheme, it is usually too late to prevent the financial and reputational damage that will follow.

Most board members and executives of nonprofits do not think as fraudsters do, which is a good thing. Unfortunately, this can make it difficult for them to develop controls that help reduce their organizations’ exposure to fraud risk. A critical step in the process of developing an effective fraud risk management program is assessing the board’s own skills and capabilities and deciding where professional help is most needed. The board is ultimately responsible for oversight of the organization’s risk management efforts, which senior management is then charged with carrying out.

Anti-Fraud Principles

Here are some important principles to keep in mind as you work to refine the anti-fraud control policies at your organization:

  • Form an effective and empowered audit committee or equivalent. One of the most important attributes of the audit committee is complete independence from management. In addition, the committee should be authorized to hire outside counsel and other advisers to assist it in discharging its responsibilities. Although your circumstances may warrant a larger committee, a committee of three to five members is generally workable and optimal for most nonprofits. At least one audit committee member should be a financial expert, but individuals with nonfinancial skills and expertise are also needed to provide additional perspective.
  • Establish and enforce a system of effective controls. Combinations of internal and cultural controls form the core of an anti-fraud program. Internal controls limit opportunities to hide the fraud trail and can discourage all but the most arrogant fraudsters. Common tools include security and access controls, such as dual authority or monetary authorization limits, as well as audits, inspections, and transaction monitoring. The recent ACFE survey pointed out that the presence of anti-fraud controls is notably correlated with significant decreases in the cost and duration of occupational fraud schemes.
  • Establish the right tone from the top. Mere mechanical compliance with internal controls can still leave the organization vulnerable, which is why the attitude and actions of management are so important. Actively and visibly promoting a culture of integrity and ethics will embolden honest employees to put a stop to fraud. Most organizations find that a strong ethical environment encourages self-policing, thereby increasing the level of oversight far beyond what internal control methods alone provide.
  • Provide a clear process for reporting suspicious behavior. Over the years in which the ACFE has been conducting its global fraud studies, the most effective means of detecting fraud has always been tips. In the most recent study, tips were responsible for uncovering nearly three times as many frauds as any other form of detection such as management reviews, surprise inspections, audits, or surveillance devices. While some nonprofits use a third-party hotline service for reporting suspicions about fraud, creating a culture where employees know that the nonprofit’s reputation and mission depend on their willingness to report suspicions of fraud is less costly and may be equally effective.
  • Develop a response plan in case deterrence fails. In spite of everyone’s best efforts, fraud still can occur. In many cases, the initial reaction of executives or board members is to confront the suspected fraudster outright or, if there is doubt, to begin collecting paper or electronic evidence. All too often, these are exactly the wrong things to do and could compromise an organization’s ability to prosecute. Confronting a suspected fraudster without adequate evidence is not only awkward and legally dangerous; it can also alert the suspect to cover his or her tracks. On the other hand, surreptitiously examining computer links and email archives could compromise the evidence and imperil the integrity of a formal investigation, making conviction and recovery more difficult. To avoid these various unintended consequences, nonprofit organizations should develop appropriate strategies in advance to deal with specific types of fraud or other misconduct. The protocol for dealing with an employee suspected of cheating on an expense report is different from that for an executive involved in a conflict of interest.
  • Confront the issue openly and directly. Perhaps the most common impulse when fraud is detected is to dismiss the offender, limit the damage, and hope the story can be kept quiet. This too is likely to fail. Eventually, word of the fraud gets out and the associated rumors are likely to be exaggerated, causing even more reputational damage than would have been done if the board had simply been forthright.

Suspect Fraud, Now What?

When the organizational suspects that fraud is occurring within their organization, they have a number of options. They can choose to do nothing, either to avoid the bad publicity or in the hope that the problem will disappear on its own, they can attempt to handle the issue internally, or they can engage outside investigators and/or forensic accountants to probe the issue more deeply.

The wisest course of action is the last one – to engage a team of forensic experts. These teams consist of a range of professionals such as lawyers and experienced fraud & forensic investigators. These experienced professionals can help identify how the loss occurred, identify “leakage” or others areas not originally thought to be an issue, preserve any available evidence, quantify the loss, control the flow of information and, in many cases, help stem the loss. The forensic team will then be able to aid the board of directors or governing body in enhancing their governance framework and fraud risk management program to help protect and preserve the organization.

Other Possible Issues

Improperly using organizational funds for personal benefit could challenge your tax exempt or 501(c)(3) status. In addition, depending on the circumstances it could trigger a violation under the False Claims Act** (Lincoln Law – 31 U.S.C. §§ 3729 – 3733.).

The above should be discussed with a competent attorney.

A Combination of Deterrence and Detection

As important as it is to respond quickly to fraud, avoiding the situation in the first place is the best plan of all. Although it is unrealistic to expect to completely eliminate the risk of fraud, the governing body and executives in a nonprofit organization can take effective steps to minimize the risk.

By establishing an environment in which ethical behavior is expected, closing gaps in internal controls, and developing a proactive fraud identification and response program, nonprofits can hopefully reduce the financial and reputational risks associated with fraud.

Lastly, larger organizations should strongly consider emulating Sarbanes-Oxley or SOx best practices. For example: Require the principal executive and financial officers of the nonprofit organization to certify the annual financial statements and Form 990 are accurate and complete and the organization has maintained adequate internal controls.

Closing

I welcome your thoughts and comments and please realize many of this can be applied to a for profit organization.

Best!

img_7798-1

Jonathan T. Marks, CPA, CFE

 

*Not a complete list.

**The Justice Department reported its 2018 fraud statistics showing $2.8 billion in recoveries under the False Claims Act.  While this number is staggering, fiscal year 2018 recoveries were down from than $500 million from fiscal year 2017.  Nonetheless, companies in the healthcare, defense and financial industries continue to face significant False Claims Act risks.

Attribution
ACFE
Baker Tilly
Adapted from an article I wrote at my prior firm, Crowe
Section 302 of the Sarbanes-Oxley Act of 2002
Mike Volkov

 

Posted on

PHorensically Speaking Podcast Feed is Live!

With the help from a true friend, Tom Fox, I am entering the world of Podcasting.

I will be developing at least three Podcasts per month that will focus on pervasive governance and fraud issues impacting Boards and their organizations.  One objective is help the practitioner go from detection to prevention, if possible, so that a crisis can be thwarted.

Click here for the Podcast feed. I welcome your feedback and suggestions.

Jonathan

 

 

 

 

Jonathan T. Marks, CPA, CFE

Posted on 1 Comment

Combating Fraud Through Effective Internal Controls

“Fraud is not an accounting problem; it is a social phenomenon.” Joe Wells

Who Commits Fraud

The cultural and environmental characteristics that increase fraud risk are not always so blatant.  Research shows that anyone can commit fraud. Fraud perpetrators usually can’t be distinguished from other people on the basis of demographic or psychological characteristics. According to Jonathan T. Marks (“Marks”), a partner at Baker Tilly, practicing in the global forensic investigation and governance space, “most fraudsters have profiles that look like those of other honest people; however, fraudsters play you against humanity and build a false wall of integrity around themselves with the hope that your level of skepticism is reduced enough to be manipulated and fooled.”

Among the various kinds of fraud that organizations might be faced with, occupational fraud is likely the largest and most prevalent threat today, with bribery and corruption enforcement actions that allege violations of the Foreign Corrupt Practices Act (“FCPA”) causing organizations of all types and sizes to rethink their approach to governance, risk management, compliance, internal audit, and the design of their internal controls. The regulators have sent a clear message that simply maintaining a compliance program is not enough. Compliance programs and internal controls must be adequate and effective at preventing and detecting fraud.  Moreover, recent enforcement actions highlight the importance to organizations that internal controls must be continuously monitored to ensure they are effective.  Although there is little case law, these enforcement actions have become non-binding guidance in cases that do not involve FCPA violations.

Although most companies will not readily admit that their organizations may be vulnerable to fraud, according to the 2018 Report to the Nations published by the Association of Certified Fraud Examiners (“ACFE”), which contains an analysis of 2,690 cases of occupational fraud that were investigated between January 2016 and October 2017, organizations lose 5% of their annual revenues to fraud. While this number is only a general estimate based on the opinion, it represents the collective observations of more than 2,000 anti-fraud experts who together have investigated hundreds of thousands of fraud cases. Based on the ACFE’s study, the median loss caused by frauds was $130,000, with 22.0% of the cases resulting in losses of at least $1 million.

Because fraud inherently involves deception, deflection, distraction, and concealment, many frauds will never be detected. Therefore, organizations are encouraged to implement certain anti-fraud internal controls, in order to help minimize the opportunities to commit fraud, or at least catch any fraudulent activity sooner.

In practice, it’s been our experience that most professionals don’t really understand the definition of an internal control. Marks recently developed a definition (see below) that has become what is believed to be today’s standard that should be reviewed along with the enemies of internal controls and other factors when designing an internal control. Marks emphasizes that internal controls are a process. They do something!  When it comes to designing anti-fraud internal controls to detect and deter fraudulent activity, those individuals assigned to this task must have the necessary skills and experience.

A good system of internal controls, with the right balance of preventive, deterrent, and detective controls, can greatly reduce an organization’s vulnerability to fraud.

Preventive controls are those manual or automated processes designed to stop fraudulent activity from occurring. Deterrent controls are designed to proactively identify and remove the causal and enabling factors of fraud. Detective controls can also be manual or automated but are designed to identify an undesirable event that has already occurred. No system of internal controls can fully eliminate the risk of fraud, but well-designed and effective internal controls can deter the average fraudster by reducing the opportunity to commit the fraud and increasing the perception of detection.

enemies of control.png

While the Fraud Pentagon, which is an enhancement to the three elements of fraud, identifies the conditions under which fraud may occur, the Triangle of Fraud Action describes the activities an individual must perform to perpetrate the fraud. Thus, understanding the Enhanced Meta-Model of Fraud (Model) is imperative.  The model includes two key elements: The Perpetrator, or the “why based” Fraud Pentagon and the alleged Crime or the “what based” Triangle of Fraud Action that includes the act, concealment strategy, and conversion tactics, should be part of the process when considering what internal controls to implement and how they should be designed.

Advanced Meta Model of Fraud Marks

Based on the ACFE’s study, occupational fraud schemes are typically classified into three categories:

  • Asset misappropriation (theft of cash, data, property, etc.);
  • Corruption (bribes, kickbacks bid-rigging, economic extortion, illegal gratuities, etc.); and
  • Financial statement fraud schemes (deliberate misstatement, misrepresentation, omission of financial statement data, etc.).

When assessing an organization’s fraud risks and designing anti-fraud controls, it is important to remember that fraudsters typically seize whatever opportunity arises when committing their schemes. Thus, many frauds, including nearly one-third of the cases involve more than one form of occupational fraud. For example: Corruption represents one of the most significant fraud risks for many organizations today and would obviously involve corruption and because in most cases would need to be concealed, the books and records or financial statements could be impacted too. In fact, of the top eight concealment methods (create, alter, and destroy) noted, fraudulent journal entries made the list.

three-fraud-trees-3567769231-1546959364746.jpg

Historically, although theft of assets has produced the lowest average losses, these schemes have accounted for the vast majority of reported fraud activity. Within this category, there are various techniques which an employee may utilize to steal company assets and resources, including theft of cash receipts and fraudulent disbursements of cash such as through billing schemes, fictitious vendors, fraudulent expense reimbursements, or check tampering. Understanding and analyzing each of these categories is a critical first step in designing an effective control environment throughout the organization which may aid in preventing and detecting fraudulent activity.

Based on the ACFE’s study, victim organizations that had implemented certain common anti-fraud controls such as the following experienced considerably lower losses than organizations lacking these controls, and some reduced the fraud duration.  Here are some anti-fraud controls to strongly consider:

  • Conduct a Formal Enterprise-Wide Fraud Risk Assessment aimed at proactively identifying and addressing an organization’s vulnerabilities to both internal and external fraud. As every organization is different, the fraud risk assessment process is often more an art than a science. What gets evaluated and how it gets assessed should be tailored to the organization—there is no one-size-fits-all approach. Additionally, organizational fraud risks continually change. It is therefore important to think about a fraud risk assessment as an ongoing, continuous process rather than just an activity. A fraud risk assessment starts with an identification and prioritization of fraud risks that exist in the business. The process evolves as the results of that identification and prioritization begin to drive education, communication, organizational alignment, and action around effectively managing fraud risk and identifying new fraud risks as they emerge. The fraud risk assessment should be reviewed periodically, but no less than annually and there should be a heightened focus on the scenarios where management could override of internal controls.
  • Implementation of an independent Whistleblower or Ethics hotline and web portal whereby internal and external sources (see graphic below) may anonymously and confidentially report fraudulent, suspicious, or other behavior. Historically, the receipt of internal or external tips has represented the most common detection method for each of the three categories of fraud schemes listed herein. Proper and on-going training along with clearly articulated policies and procedures related to the hotline should be supported by management. Implementation of a whistleblower hotline, especially when accompanied with an anti-retaliation policy and/or reward program, will effectively improve an organization’s overall control environment through increasing the perception of detection. Lastly, a hotline is not enough. Organizations need to have a process that appropriately captures, triages, assesses, investigates, and reports potential misconduct.

sources-of-fraud.png

  • Segregation of duties involving the custody of assets, authorization of transactions affecting those assets and recording/reporting of related transactions. Segregation of duties is a basic building block of sustainable risk management and internal controls for an organization. The underlying theory of separation of duties is that a single employee should not be in a position to both perpetrate and then conceal errors or fraud in the normal course of their duties. For example, the Institute of Internal Auditors[ii] suggests there needs to be an adequate division of responsibilities among those who perform accounting procedures or control activities (authorization/recording) and those who handle the assets (custody). In general, the flow of internal processes should be designed in such a manner that one individual’s roles and responsibilities serve, in part, as a check and balance of another individual’s work. Such a system would serve to reduce the risk of undetected errors and limit opportunities to misappropriate assets or conceal intentional misstatements in the financial statements.
  • Timely reconciliation of bank accounts and management review of the reconciliations (bank reconciliations, petty cash, etc.) and bank statements. Bank reconciliations provide insight into the differences between an organization’s cash balance per the balance sheet and per the bank statement, while also proving the completeness and accuracy of the data recorded in the organization’s cash ledger. Depending on the size of the organization and the volume of cash transactions, bank reconciliations may be performed anywhere from a daily to monthly basis. Adequate segregation of duties should also be implemented in the bank reconciliation process, in that the cash bookkeeping, bank reconciliation, and check signer/wire authorization functions should be separated.
  • Review and authorization of expense reimbursements by supervisors and management in a timely fashion.  Some expense reimbursement schemes include: mischaracterized expenses, overstated expenses, fictitious expense, and multiple reimbursements and last for approximately twenty-four months before being detected.  The ACFE’s study states that a significant portion of asset misappropriation schemes involve situations in which an employee makes a claim for reimbursement of fictitious or inflated business expenses. Management should first ensure all policies and procedures, including those related to expense and travel reimbursements, are communicated to all employees, along with timely notifications of any relevant updates. Furthermore, expense reports submitted by employees, including any underlying support, such as credit card bills, receipts, telephone bills, etc., should be reviewed and signed-off by the employee’s immediate supervisor and the organization’s payroll department. Expense reports submitted by members of management should be reviewed by other members of management.
  • Safeguarding and reconciliation of petty cash funds on a periodic basis by authorized employees.  Although petty cash funds typically represent an insignificant amount of cash held by an organization, primarily used for small day-to-day expenses, petty cash improprieties may be a signal of broader issues regarding management’s approach to internal controls and the organization’s control environment. To help strengthen the processes surrounding petty cash, sequentially numbered vouchers should be kept as well as disbursement receipts with the disbursement date, amount, purpose, and employee name. Further, the petty cash custodian should maintain a reconciliation of the petty cash fund, reconciling total cash on hand plus outstanding receipts to the total petty cash maximum. Access to the petty cash fund should also be limited to a small number of employees, with the funds kept in a locked box.  Lastly, to test compliance with organizational policies and further increase the perception of detection, management may order an independent audit of the petty cash fund on a periodic basis.
  • Proactive Monitoring Using Data-Driven Fraud Detection and Technology, including robotic process automation, can be an effective way to identify “red flags” and other anomalies that were once difficult to detect. Today we are able to link together different legacy systems with minimal disruption and create dashboards that could provide management with the “visual guilt” necessary to investigate into the most promising indicators. According to the ACFE study, the use of proactive data monitoring and analysis and surprise audits was associated with a more than 50% reduction in fraud losses.

Closing

Today’s environment requires the board and management to maintain a proactive approach to identifying vulnerabilities unique to their organization and implement properly designed or sound internal controls to help prevent, deter, and detect fraudulent activities. Demonstrating a genuine interest and concern in the implementation of sound internal controls will aid management in minimizing future potential losses or worse reputational harm.

For more information on fraud, internal controls, risk assessments, investigations, or something other, kindly reach out to me directly.

Best!
img_7798-2

 

 

Jonathan T. Marks, CPA, CFE

 

 

Attribution:
ACFE 2018 Report to the Nations
Albrecht, W. Steve. Fraud Examination, 4th Edition. Cengage Learning.
Marks, Jonathan T., Fraud Pentagon and Enhancement to the Three Elements of Fraud https://boardandfraud.com/2018/09/21/the-fraud-pentagon-an-enhancement-to-the-fraud-triangle/
Getty Images
The Institute of Internal Auditors.  Simplifying Segregation of Duties.  2009.
A meta-model of fraud and white-collar crime (adapted from The Evolution of Fraud Theory, by Jack Dominey, A. Scott Fleming, Mary-Jo Kranacher and Richard A. Riley Jr., “Issues in Accounting Education,” Volume 27, Issue 2, May 2012.
Wells, Joseph T. Principles of Fraud Examination, 4th Edition. Wiley.
Posted on

Fraud tip Friday! The Grand Illusion

If you think Good Tone or Conduct from the Top means you have an ethical environment, guess again!

Some of your people are up to no good.

  • Train and design controls using red flags;
  • Develop robust monitoring and feedback procedures;
  • Triage allegations appropriately;
  • Investigate promptly and appropriately;
  • Ensure you remediate based on the root cause(s) and not the symptoms; and
  • Get a quality Fraud Risk Assessment for the Holidays – available here!

Happy holidays and to a great 2019!

Best,

Jonathan T. Marks, CPA, CFF, CPA

Posted on

Collusion, Conflicts of Interest, and Corruption!

Corruption can take many forms, but its root cause could and often does include a conflict of interest of some sort and possibly collusion.

OECD states, Conflict of interest occurs when an individual or a corporation (either private or governmental) is in a position to exploit his or their own professional or official capacity in some way for personal or corporate benefit.

The most commonly known fraud involving collision is bribery – something given to influence a specific act to happen – whether given after an act has been performed or made to obtain a future benefit or information. Where there is collusion there may also be a conflict of interest. While this type of fraud doesn’t necessarily involve a distinct third party, it does involve the employee in a role other than as an employee.

This is where an employee colludes with another party (whether from outside or inside the business) to use his role as an employee to obtain a personal benefit.

Frauds that involve collusion usually occur off the books. That is, usually no activity needs to be concealed or hidden in business records.Based on the above, it should be obvious that conflicts of interest can present significant fraud and other risks for corporations, government agencies, fiduciaries, customers and suppliers.

The following ICC Guidelines and a consultation with an experienced fraud examiner can help in fighting wrongdoing.

Guidelines

Recently, the ICC released its Guidelines on Conflicts of interest. As will most guidelines these should be viewed as a tool and can be applied to all organizations – public, private, and not for profits.

The International Chamber of Commerce (ICC) recommends that enterprises closely monitor and regulate actual or potential conflicts of interest, or the appearance thereof, of their directors, officers, employees, agents and representatives and make sure they don’t take advantage of conflicts of interest of others.

Section II of the Guidelines provide among other things a definition of a conflict of interest, with explanatory notes and a description of three types of conflicts with examples. I also provide you with a definition from the New York Stock Exchange’s Corporate Governance Rules below. I suggest reading both.

There is also discussion in Section III of the Guidelines on communication and training, evaluation of a policy on conflicts of interest (with a description of the key elements of a policy), and how to prevent, manage and mitigate conflicts.

The publication concludes by describing four “dilemma” scenarios that can be used as a training aide.

Fraud Risk

Inherently, conflicts of interest schemes are one of the most difficult areas of fraud to detect, investigate, and obtain adequate evidence. Improper investigations can create counterclaims and civil actions against organizations and professionals.

Common conflicts of interest schemes include:

Purchase schemes, which involve the over-billing of a company for goods or services by a vendor in which an employee has an undisclosed ownership or financial interest

Sales schemes, which involve the underselling of company goods by an employee to a company in which the employee maintains a hidden interest

When it comes to detecting conflicts of interest schemes, it’s usually a the failure to disclose because:

Employees, directors, or others don’t understand the potential seriousness of having a conflict of interest or the company’s policy relating to it.

The employee, director, or other party is deliberately trying to conceal or hide the conflict. There shouldn’t be any reasons for employees and others not declare conflicts of interest, assuming they have read the policy and are made aware of their responsibilities.

Other Risks and Activities

Leadership that is controlling or domineering can operate with a long-term view, in alignment with others’ interests.

There can be several risks from controlling or domineering leadership, including the potential for conflicts of interest and abusive related-party transactions that are often difficult to detect, assess, and investigate.  

Why? Because many people have a difficult time avoiding conflicts of interest, they are usually secretive, and the financial or other benefits more often than not are hidden, albeit sometimes in plain sight, but nonetheless can put the individuals involved and their company at risk of regulatory scrutiny and reputational harm.

The New York Stock Exchange’s Corporate Governance Rules defines conflicts of interest as the following:

“A conflict of interest occurs when an individual’s private interest interferes in any way ̶ or even appears to interfere ̶ with the interests of the corporation as a whole. A conflict situation can arise when an employee, officer or director takes actions or has interests that may make it difficult to perform his or her company work objectively and effectively. Conflicts of interest also arise when an employee, officer or director, or a member of his or her family, receives improper personal benefits as a result of his or her position in the company…. The company should have a policy prohibiting such conflicts of interest, and providing a means for employees, officers and directors to communicate potential conflicts to the company.”

I have found the types of activities that can create a possible conflict of interest include:

    Nepotism is the practice of giving favors to relatives and close friends, often by hiring them
    Cronyism is the appointment of friends and associates to positions of authority, without proper regard to their qualifications
    Self-dealing is a situation in which someone in a position of responsibility in an organization has outside conflicting interests and acts in their own interest rather than the interest of the organization

The ICC Guidelines have some examples in Section II that I suggest you review too.

Sarbanes-Oxley (SOx)

For those subject to SOx, in addition Sections 302, 906, and 404, several other sections of SOx relate to internal controls and corporate governance.

Section 406: code of conduct and ethics Section 406(c) requires all US-listed companies to maintain a code of conduct applicable to all directors, executives, and employees with the definition of “code of ethics” as stated in this section. The NYSE Corporate Governance Rules (Provision 10) also require a company to adopt and disclose its Corporate Governance Guidelines and Code of Business Conduct and Ethics.

The code of conduct must be publicly available and must define conflicts of interest, illegal and improper payments, anti-competitive guidelines, and Foreign Corrupt Practices Act (FCPA) compliance, as well as acceptable dealings with employees, suppliers, customers, investors, creditors, insurers, competitors, auditors, and so forth.

Conclusions

Conflicts of interest can be problematic if not understood and managed appropriately.

Conflicts of interest increase the risk of bias and poor judgment because of the obligation to two or more competing interests and usually never end well for those that have consciously avoided the company’s business practices and ethics.

When it comes to fraud risk management, compliance and internal audit need to understand conflicts of interest and address them accordingly.

All conflicts of interest must be documented in writing! This really helps if there is ever an issue, because you can show the regulators the company is proactively dealing with these issues.

I welcome you thoughts, comments, and suggestions.

Best,

Jonathan T. Marks, CPA, CFF, CFE

Attribution:
ACFE
ICC
NACD
OECD