Risk Mitigation Starts with You
Is your organization at risk of fraud? The answer is yes. To what extent depends on many factors, and measuring that risk starts with assessing your organization’s culture and controls.
If you’re reading this, you have a vested interest in protecting your organization from fraud. As a board member, owner, executive, or manager, recognizing your role in risk mitigation is the best first step to building a culture of prevention at all levels.
“Tone at the top” is more than business school jargon; it is the responsibility of an entity’s leadership team to act with integrity because the example they set influences behavior all the way to the bottom. Take for example the VP of a publicly traded beverage distributor who actively engaged in overriding policies around expense reimbursement. It was not long before her middle-management team engaged in the same activity, costing the organization tens of thousands of dollars and a public disclosure regarding their weak controls with the Securities and Exchange Commission. Share price dropped after the filing, signaling a lack of confidence in leadership’s competence and resulting in a larger loss than any liberties taken with expense reimbursement (not to mention legal and investigative costs). Where management ignores or otherwise lacks honesty and integrity, employees are more likely to follow suit, increasing the risk of fraud and related financial losses.
The converse of this example can be you – a leader who prioritizes organizational ethics and holds their employees accountable to integrity of word and action, adherence to policies and procedures, and a singular goal of protecting the organization from fraud, waste, and abuse.
When you do what you say you’re going to do, and require others to do the same, even when it’s hard, you set the tone for accountability. A pattern of face-to-face conversations and daily oversight that may have worked earlier in your company, agency, or department’s development becomes harder and harder to maintain as you and your team grow. Therefore, building systems of internal controls is a necessity. But building them alone isn’t enough – continually monitoring and evaluating their effectiveness is the strongest measure of protection. Why does that matter? Stronger internal controls are associated with lower losses and increased time to detect when fraud, waste, and abuse is occurring. The sooner the bleeding stops, the stronger your bottom line.
In this white paper, Bonadio’s Fraud & Forensic team offers guidance on simple, effective actions leadership can take to prevent fraud, waste, and abuse. We cover everything from current fraud trends to critical risk areas including cybersecurity, to entity-wide recommendations for tightening controls. With a few solid improvements to your fraud prevention environment, your organization will be on the path to stronger financial results.
Fraud Facts and Misconceptions
If you’re serious about tackling fraud, establishing an understanding of the global occupational fraud landscape is a good place to start. Our favorite resource is the Association of Certified Fraud Examiners (ACFE), issuers of our Certified Fraud Examiner (CFE) credential. Every other year, the ACFE publishes Occupational Fraud: Report to the Nations, its biannual study of “the costs and effects of occupational fraud.” Occupational fraud is the misuse of an organization’s resources by an individual within the organization for some personal benefit. Often, that benefit is the siphoning of funds or other assets out of the organization’s control and into the control of the perpetrator. Sometimes, the benefit is not lining one’s own pockets, but those of their friends or family. Fraud educator Kelly Richmond Pope writes about these so-called “Robin Hood” fraudsters in her book, Fool Me Once. Other times, like at mega-retailer Macy’s last year, the personal benefit is less clear, but it may be the individual’s attempt at preserving their own job, ensuring a raise or promotion, or simply making the entity look better on paper.
We encourage you to read the full ACFE report at https://legacy.acfe.com/report-to-the-nations/2024/. Meanwhile, we’ve provided a quick recap here.
- The practitioners surveyed believe organizations lose approximately 5% of their revenue each year to fraud.
- Of the three categories of fraud – asset misappropriation, corruption, and financial statement fraud – asset misappropriation schemes were the most common, and largely the subject of this white paper. Financial statement frauds were the least common, but most costly for organizations in terms of reputational damage and regulatory fines and sanctions. Corruption was present in almost half of the fraud cases reported, typically cooccurring with either of the other types of fraud.
- Lower-level employees commit fraud more often, while higher-level employees take more when they commit fraud.
- Similarly, mid-career employees – those typically aged 31 to 50 years old – commit fraud more frequently, but older employees take more on average when they commit fraud.
- Fraudsters tend to be college educated, and hold positions in operations, accounting, and sales.
While significantly more men than women were the perpetrators in the cases reported to the ACFE, there is a growing field of interest and research in what practitioners are calling “pink collar crime” – less sophisticated forms of embezzlement more often committed by women in administrative and supporting roles within an organization. Former federal agent Kelly Paxton dedicates her book Embezzlement to that topic if you are curious about learning more.
Perhaps the biggest misconception that exists in the public about occupational fraud is that an organization’s external financial statement auditor is responsible for detecting it. Only 52 of the 1,921 cases reported for the ACFE’s Occupational Fraud 2024: Report to the Nations were discovered
through external audit – that’s less than 3%. Alarmed? You shouldn’t be. When a CFO, Controller, or other executive signs the engagement letter for their organization’s annual audit, the CPA firm generally disclaims any responsibility for finding fraud as a result of their procedures within the letter. Furthermore, when that same executive signs any management representation letter at the close of the audit, there’s usually a sentence in the letter that acknowledges management’s responsibility for designing and evaluating the effectiveness of controls. An auditor may ask certain questions related to ownership of fraud risks, and what kind of ongoing assessment happens, but only to the extent that they feel comfortable that the accuracy of the reported financials isn’t in question.
One Step at a Time: Addressing Fraud Risk by Function
Cash
Cash is king, as they say. On hand and in your sales cycle, cash is the king of fraud targets too.
Theft of cash on hand occurs when an employee with access to secured cash misappropriates or steals those funds. This form of fraud involves theft of cash stored in a vault or safe, such as petty cash. If you must keep cash on your premises, consider the following simple controls:
- Segregating duties — the person who counts the cash at the end of the day should not be the same person that counts the cash the following morning or makes the bank deposit. Cash receipts should be recorded immediately and deposited as soon as practical. Review cash deposit trends regularly for reasonableness.
- Daily logs related to petty cash counts, receipts, and distributions should be maintained within the organization’s accounting system — not outside of it. Cash logs, if kept at all, tend to be the first thing to “disappear” after fraud is discovered.
- Surveillance — cameras in your cash office are a strong deterrent of fraud.
Skimming can occur in two ways – before recording a sale on the books, or after it’s recorded. Taking customer payments before the sale hits the books leaves no audit trail but may be detected through inventory variances for sales of product. If an employee is taking a customer payment after the sale, evidence may exist on the books in the form of credit memos or adjustments. In some cases, a perpetrator may cover up the fraud instead by applying another customer’s payment to the account. This scheme is called payment lapping. Common controls to prevent skimming include:
- Separating the billing and collection function.
- Comparing revenue to inventory values.
- Including outstanding balance reconciliations on invoices to repeat customers.
Reconciling sales to cash receipts and deposits should be a standard practice when performing bank reconciliations at month end to detect fraud involving cash.
Payroll
Both real dollars and sensitive data are at risk in the payroll function. Per the ACFE’s Occupational Fraud 2024: A Report to the Nations, payroll fraud accounted for 10% of the cases submitted by Certified Fraud Examiners (CFEs). These schemes typically lasted about 18 months before being uncovered and amounted to an average loss of $383,000 per instance. Payroll fraud schemes include:
- Falsifying earnings by overstating hours worked, claiming unearned overtime, or increasing wage and salary rates within the payroll system. Detailed reviews of payroll registers and payroll system audit logs can help spot these errors quickly
- Creating ghost employees within the payroll system and directing falsified pay to an existing employee’s bank account. Periodic distributions of physical payroll checks, as well as checking employee data for duplicates can help identify ghost employee schemes.
- Falsifying commissions by overstating sales made. When fake sales are recorded in the accounting system, the fraudster will eventually have to record bad debt or some other revenue adjustment to cover up the disparity between sales generated and cash received at year end; otherwise, accounts receivable will appear outsized on the balance sheet. Ratio analysis for receivables and bad debt may help uncover problems in this area.
Beyond protecting organizational resources, your policies and procedures over payroll should include requirements to protect employee resources as well. Keep physical employee files locked, virtual employee files accessible only to human resources, and de-identified personally identifiable information (PII) transmitted outside of human resources only on a need-to-know basis. Payroll system data should not display employees’ full bank account numbers, and while organizations can’t require their employees to utilize direct deposit, it should be strongly encouraged as instances of check washing frauds increase in the community.
Disbursements
Cash disbursement fraud schemes pose a persistent threat to organizations of all sizes, as unscrupulous individuals exploit weaknesses in the accounts payable function. Obviously, the AP function is pretty broad, so where is risk highest?
- Schemes involving billing, which tends to be rather nuanced by organization, account for 30% of all asset misappropriation cases in the United States, resulting in a median loss of $100,000 per incident according to the ACFE. While a small organization may know each of its vendors well, the more you grow, the further an organization gets from knowing who’s performing what service and when. An employee could manipulate the invoicing process by setting up a shell company to submit fictitious invoices, paying legitimate invoices twice and pocketing the vendor’s refund, or overbilling through inflated prices for actual goods or services.
- Check tampering involve manipulating checks to redirect funds to an unauthorized recipient. Common methods include forging the signature of an authorized signer, altering the payee or amount on a legitimate check, intercepting checks before they reach the intended payee, or creating a concealed check amid legitimate ones.
- Wire transfer and electronics payments fraud is an external threat, usually perpetrated against an organization’s accounts payable department. Criminals may use phishing or business email compromise (BEC) tactics to impersonate executives or vendors and request urgent transfers. Hackers might also take over a legitimate vendor’s email to intercept invoices and redirect payments to fraudulent bank accounts. According to the FBI, BEC scams cost American businesses over a billion dollars each year. But don’t think that transfers only happen from outside. If any of your personnel have signing authority at the bank, there is a risk that new bank accounts could be set up and operating funds funneled there.