VICTIMS. Tend to be smaller companies (<100 employees) *

Transcription

1 ANTI-FRAUD CONTROLS

2 SCOPE According to experts, fraud averages about 6% of revenues for the average entity * Average loss of a fraud is about $160K and goes about months before being detected 25% of all frauds cost at least $1M We do not know how much goes on and is NOT detected It can happen here * The Association of Certified Fraud Examiners, Report to the Nation fraud studies of 1996, 2002, 2004, 2006, 2008, 2010

3 VICTIMS Tend to be smaller companies (<100 employees) * The smaller the entity, the more likely there is to be a fraud The smaller the entity, the greater the loss per fraud * The Association of Certified Fraud Examiners, Report to the Nation fraud studies of 1996, 2002, 2004, 2006, 2008, 2010

4 FRAUDSTERS Tend to be tenured employees ALWAYS in a trusted position; that is, the fraudster is a trusted employee Tends to be more educated Almost always, peoples say, It is the LAST person I would have suspected. Bottom line: Fraudsters do not look like crooks!

5 CONTROLS Improving anti-fraud controls are the most effective thing an entity can do to increase its ability to defend itself against fraud Many experts believe improving controls is the ONLY thing that can be done to mitigate fraud The most common correlation of circumstances and a fraud occurrence is the lack of segregation of duties and no compensating control

6 DIFFERENCES Good accounting controls focus on proper procedures, as defined by management, for business processes. That is, are transactions initiated, authorized, recorded, and reported according to management s polices and procedures, driven by good corporate governance. That is NOT the focus of anti-fraud controls 6

7 DIFFERENCES Focus is in preventing and/or detecting fraud. That is Complete a risk assessment to identify the business processes with high fraud risk (IR-CR=RR) Use fraud theory to brainstorm the MOST likely fraud in this industry, this entity, at this time, especially given the effectiveness of accounting and anti-fraud controls in place (or absence thereof) Consider the nature of those potential fraud schemes and their red flags Design controls to prevent and/or detect this fraud (i.e., anti-fraud controls) Use fraud research to complement your risk assessment 7

8 P-D-C Model of Controls P Preventive Controls Designed to reduce the frequency of occurrence of the undesirable event(s) Force compliance with prescribed actions and procedures by screening OUT aberrant events or transactions Obviously, controls that PREVENT undesirable events are more cost effective than those designed to DETECT or CORRECT them Fraud prevention controls: How do we PREVENT a fraud from happening in the first place? 8

9 P-D-C Model of Controls D Detective Controls Designed to detect the occurrence of an undesirable event, as early as possible Reveal specific (or types of) errors or anomalies by comparing actual occurrences to pre-established standards When a departure from standard is recognized, some type of notification is sent to an appropriate party Error reports notice Actual alarm of some kind Type of notification and timeliness depends on level of risk associated with this type of undesirable event or specific undesirable event 9

10 P-D-C Model of Controls D Detective Controls Inquiry, observation, inspection are effective types of detective controls Fraud detection controls: What controls would be effective in detecting a fraud? Need to assess missing detective controls 10

11 P-D-C Model of Controls C Corrective Controls Designed to reverse the effects of the adverse event, undesirable event That is, to restore the system to where it was That is, to fix the problem) May take more than a single course of action to correct the event. In the case of fraud Need a course of action (or actions) to recover lost funds Need a course of action to respond to the fraudster adequately and appropriately Need a course of action to develop preventive controls to keep this fraud from happening again May need a PR/Media action plan to mitigate image loss 11

12 P-D-C Model of Controls C Corrective Controls Could be: An automated control Human intervention control, especially downstream A hybrid/combination of the two Fraud correction controls: What controls should we have in place, or design and implement, that should a fraud occur, we would be able to correct the fraud and its effects? 12

13 Most Effective Anti-Fraud Controls

14 ACFE tested for 5 anti-fraud measures: 1) Did the victim have a fraud hotline or anonymous reporting mechanism? 2) Did the victim provide fraud awareness or ethics training for employees and managers? 3) Did the victim have an internal audit or fraud examination department? 4) Did the victim perform surprise audits on a regular basis? 5) Was the victim audited by external auditors? 14

15

16

17 Anti- Fraud Control Frequency (%) Of Anti-Fraud Controls Order Of Frequency Of Anti-Fraud Controls Percentage Of Loss Reduction from Implementation Order Of Percentage Loss Reduction External Audit of Financial Stmts Code of Conduct Internal Audit/ FE Department External Audit of ICOFR Employee Support Programs Management Certification of F/S Independent Audit Committee Hotline Management Review of IC Fraud Training for Mgrs/Executives Fraud Training for Employees Anti-Fraud Policy Surprise Audits Job Rotation/Mandatory Vacation Rewards for Whistleblowers

18

19 PDC & Synergism Some controls are purely preventive, detective or corrective Some interact (e.g., Surprise Audits is both detective and preventive. Why?) Challenge is to develop those that interact effectively for the types of fraud that are likely to emerge in your organization 19

20 PERCEPTION OF DETECTION Number 1 most effective PREVENTION control is PoD (per criminology experts and research) Definition: Includes the fear of getting caught Includes the fear of harsh punishment, especially prison for the WCC Best deterrent to crime is swift apprehension, fair/impartial trial, timely trial, equitable punishment for the crime 20

21 Anonymous Tips General detective method #1 in EVERY survey since 1996 Is anonymous tips strictly a detective control? What happens if entity takes the anonymous tips system serious, follows up diligent and judiciously, and employees KNOW this fact? Does this approach RAISE the P.O.D. to potential fraudster, and is therefore possibly a PREVENTIVE control as well? 21

22 Surprise Audits Can be applied to a variety of specific frauds Used effectively in banking industry and other cash intense businesses for surprise cash audits of cashiers, tellers, etc. More effective than regular internal audits in preventing fraud One reason is the fraudster has no warning or time to shut down a fraud to conceal it from the auditors 22

23 Job Rotation Can be applied to a variety of specific frauds (ghost employee, lapping) Is one of the more effective DETECTIVE methods Is it also PREVENTATIVE? What happens if a potential fraudster knows job rotation will be occurring in his/her position? Would that RAISE the P.O.D.? Forced vacation (e.g., a week or more) have same effect? 23

24 Regular Audits By their nature, IA regular audits are detective If the fraudster knows when the auditors are coming, he/she can shut the fraud down and try to hide prior evidence, thus frustrating the ability of the audit to detect the fraud Regular IA audits can be a preventive measure, if it creates a perception of detection for auditees Example: Review and analyze 100% of the data using a CAAT, looking for anomalies Introduction to Fraud Detection & Prevention 24

25 Periodic Fraud Audits Can be applied to a variety of specific frauds Would probably increase the perception of detection, especially if they were surprise (i.e., unannounced) Could improve anti-fraud program or procedures even if no fraud is detected 25

26 Conclusion Choose effective PREVENTIVE, DETECTIVE & CORRECTIVE controls AND when choosing, pick those that are multifaceted in application EXAMPLES Surprise Audit, #1 Effective Is it a PREVENTIVE control? Job Rotation, #2 Is it a DETECTIVE control? Anonymous Tips/Hotline, #3 Is it a PREVENTIVE control? Fraud policy Is it a CORRECTIVE control? 26

27 QUESTIONS? Our forensic services Consulting to improve anti-fraud controls, prevention and detection controls Fraud investigation (where some suspicion or evidence related to a fraud has arisen) Fraud audits (if no particular issue exists but want to know if a fraud is going on undetected) Litigation support (if you get involved in a court case involving fraud or business valuation) Expert witness (if a fraud has occurred and case goes to court, and need someone to testify about the fraud and who the suspect is) Contact your nearest CRI office: