Employee Embezzlement and Fraud. Defending Against Insider Threats

Transcription

1 Employee Embezzlement and Fraud Defending Against Insider Threats

2 Today s Approach An open dialogue and sharing of information regarding a common threat of internal losses. There is no guarantee that any or all of the measures discussed will eliminate fraud. The goal is to provide information that will assist in increasing the level of awareness that is necessary to reduce exposure to employee embezzlement and fraud.

3 Agenda Who and what is at risk? Who are the suspects? What methods are used? What is the average loss experience? How is fraud/embezzlement detected? What can be done to prevent it? Establishing and/or enhancing a Secure Business Culture within your organization.

4 Who is at risk? According to the latest study published by the Association of Certified Fraud Examiners (ACFE) in 2010, the most common victims of fraud were the banking/financial services, manufacturing and government/public administration sectors. Small businesses were more vulnerable due to a lack of anti-fraud controls.

5 What is at risk? Assets Cash, equipment, supplies, services, resources, personal property, etc. Information Networks & Data Intellectual property Company reputation & profitability.

6 Who are the suspects? Occupational Fraud is defined by the Association of Certified Fraud Examiners (ACFE) as: The use of one s occupation for personal enrichment through the deliberate misuse or misapplication of the employing organization s resources or assets.

7 Who are the suspects? According to the ACFE study, more than 80% of the frauds in their study were committed by individuals in one of six departments: accounting, operations, sales, executive/upper management, customer service or purchasing. In reality, fraud is committed by someone who has motive, means and opportunity.

8 What methods are used? Asset Misappropriation is the most common. Skimming cash. Falsifying expense reports. Forging company checks. Financial Statement Fraud is less common. Recording fictitious revenues. Concealing liabilities or expenses. Artificially inflating reported assets.

9 What methods are used? Corruption falls somewhere in the middle. Bribery Extortion Conflict of interest

10 Occupational Fraud and Abuse Classification System 2010 Association of Certified Fraud Examiners, Inc. 10

11 Average Loss Experience The ACFE fraud study included dollar loss and frequency numbers. The following two charts are based on 1,843 fraud reports that were received in connection with the study and of those, 1,822 included dollar amounts.

12 Occupational Frauds by Category (U.S. only) Frequency 4 4 The sum of percentages in this chart exceeds 100% because several cases involved schemes from more than one category Association of Certified Fraud Examiners, Inc. 12

13 Occupational Frauds by Category (U.S. only) Median Loss 2010 Association of Certified Fraud Examiners, Inc.

14 How is fraud detected? Tips were the most common method of detection. Information came from employees, customers, vendors and competitors. Hotlines that offer anonymous reporting are considered one of the best options for tips. Internal and/or external audits, management review and account reconciliation. Accidentally

15 What can be done? Policies & Procedures Create and/or maintain clear standards regarding confidentiality and accountability. Obtain written acknowledgements of receipt and understanding. Clear up any questions or confusion before rather than after an incident. I didn t know that was against the rules. I didn t know we couldn t do that.

16 What can be done? Fraud Awareness Training for Everyone New hires and existing employees must be educated and made aware of the importance of working together to combat potential fraud. They must be told what to be on the look out for and how to report any suspicions, observations or concerns. They should be made aware of the consequences for those who commit fraud or steal from the company.

17 What can be done? Fraud Training for Managers Establish baselines and exceptions and ensure they are maintained. Be observant and question anomalies. Investigate, document and report any violations or incidents promptly to the appropriate individuals. Create /Maintain an Anti-Fraud Environment Encourage and promote honesty and integrity among employees, customers, vendors, etc. Set positive examples of the right way to do things at all levels of the organization.

18 What can be done? Create /Maintain an Anti-Fraud Environment Encourage and promote honesty and integrity among employees, customers, vendors, etc. Set positive examples of the right way to do things at all levels of the organization. Don t allow or take short cuts to avoid the right way. Don t accept everybody else does it as an excuse.

19 What can be done? Regularly conduct meetings with employees and encourage open communication with management about concerns or issues. Consider a hotline for anonymous reporting. If available, promote Employee Assistance Programs (EAP). Use bulletin boards, and/or corporate intranet to send out important reminders.

20 What can be done? Background Checks First line of defense Physical Security Controlled access to facilities and sensitive areas. Consider CCTV monitoring. Intrusion detection with quick response to violations. Ensure there is adequate lighting around the facility.

21 What can be done? Information Security Establish and maintain specific polices with regard to access and use of corporate network and company issued equipment. Require sign-offs from all employees with regard to these policies. Conduct the same level of background checks on independent contractors or agency employees having similar access to your network. They should also adhere to and acknowledge policies as described above. Investigate and resolve immediately any reported or discovered violations or intrusions.

22 What can be done? Review & Audit The effectiveness of policies and procedures should be measured before an incident occurs. Some form of ongoing monitoring should be in place to ensure that employees are adhering to these policies. Periodic and/or random internal and/or external audits should be conducted. Any violations found should be documented and corrected immediately and must include appropriate disciplinary action if warranted.

23 What can be done? In order to establish and/or maintain an antifraud program which includes employee participation at all levels, it must considered an integral component of the workplace environment. Some suggestions to help establish a secure business culture in support of this goal : Promote adherence to existing policies that work and fix the ones that don t.

24 Secure Business Culture If your office door and filing cabinets have locks, use them. Don t share your passwords or access cards/keys. Be careful not to leave papers or other identifying information in automobiles in plain view. Never leave personal property unattended in a public place or in vehicles even when locked. Keep confidential information confidential.

25 Secure Business Culture When it comes to concerns about an employee who is exhibiting unusual behavior or there are signs of wrongdoing, trust your instincts and don t second guess yourself. Don t look the other way. Don t intervene unless it is your responsibility to do so. Question and/or report things that don t look right no matter how trivial you may think it is. Encourage others to do the same.

26 Summary Preventing fraud and embezzlement is a process not a product. Effective security requires: Partnership, collaboration and cooperation All parties are serving a common interest Ineffective security results from: Resistance, disagreement, disapproval, disregard and disinterest which in most cases leads to program failure.

27 Thank You Questions or Comments? Alexander C. Sparaco CPP Baker St. Associates P.O. Box Federal Road Brookfield, CT