Strategically Detecting And Mitigating Employee Fraud

Transcription

1 A Custom Technology Adoption Profile Commissioned By SAP and Deloitte March 2014 Strategically Detecting And Mitigating Employee Fraud Executive Summary Employee fraud is a universal concern, with detection challenged by fragmented fraud management. Our survey notes that organizations are facing a significant number of employee fraud incidents. However, managing this category of fraud can be complicated by an overly siloed approach to data and processes. And the relative explosion of electronic data that has made manual detection techniques less effective and efficient further exacerbates this. Employee fraud management technology is a current priority for organizations. Survey respondents and Forrester research indicates that employee fraud technology is growing faster than the general fraud technology market, with a focus on enhanced usability and near real-time data analytics. A strategic road map addressing both organizational and technology challenges is key to long-term success. To address challenges in employee fraud today, organizations need to pair technology solutions directly with experienced professionals who have a deep understanding of the business operations. Fraud technology management platforms enriched by operational business acumen will play an increasingly important role in identifying and mitigating employee fraud. This SAP and Deloitte-commissioned survey of North American and European business decision-makers responsible for employee fraud management at their organization evaluates the scope and challenges of employee fraud today and key requirements for employee fraud technology solutions in the future based on Forrester s own market data, and a custom study of the same audience.

2 1 Surveying The Landscape Of Employee Fraud Management Increasing business digitization is an enabling opportunity to the fraud pressures of today s market. Employee fraud can occur in a variety of ways, some more systemic than others. Headlines continue to evidence how employee fraud can have detrimental impacts to organizations, including theft of mission-critical intellectual property, misappropriation of financial or physical resources, and corrupt use of a company s assets. Our survey results highlight that a spectrum of employee fraud schemes (such as theft of property, fraudulent disbursement, collusion, theft of intellectual property, etc.) are being perpetrated at a startling frequency, i.e., multiple times a year (see Figure 1). Furthermore, the 2012 Association of Certified Fraud Examiners (ACFE) Report to the Nations indicates that only half of affected organizations recover any losses from the identified fraud event. This trend highlights that the modern technology developments meant to facilitate operations also provide a troubling opportunity for employees to subvert it. As the global market continues to face challenges, the economic pressures on today s employees cannot be ignored. For these employees, a business landscape that commonly involves millions of transactions and terabytes of data represents an ocean of opportunity to hide fraudulent disbursements, theft of proprietary data, or collusion with third parties. While controls and logging do provide a layer of protective functionality, manual methods of sampling and reconciliation do not deliver the timeliness and coverage needed to operationalize effective identification, detection, and prevention of these fraud schemes. Fraud detection technologies are often fragmented with siloed responsibilities based on fraud area. According to our Forrsights Security Survey, Q2 2012, and custom survey data, the information technology (IT) function is the group primarily responsible for the purchase of the broader category of consumer identity theft/fraud management technology solutions. However, our survey results indicate that other parts of business operations are more often responsible for the purchase of employee fraud management solutions (see Figure 2). This represents a fundamental disconnect to fraud management and can create siloed approaches without the ability to share indicators and fraud cases even within an organization. Furthermore, adoption of business usercentric (versus IT-focused) employee fraud management solutions indicates a need for ease of use considerations. Forrester sees that the employee fraud management market is growing at an even higher rate than the broader overall, customerfacing (deposit, card payment, etc.) fraud management market. FIGURE 1 Frequency Of Types Of Employee Fraud Varies How often do the following types of employee fraud take place at your organization on average? The problem is systemic (happens frequently) Multiple times a year Once a year Less than once a year Never Don t know/not applicable Bribery and corruption 1 48% 1 16% 6% 2% Theft of intellectual property 11% 32% 12% 26% 18% 1% Collusion with third party % 2 21% Fraudulent disbursement 9% 29% 10% 21% 27% Theft of property or cash 12% 19% 8% 18% 39%

3 2 FIGURE 2 Employee Fraud Management Relies More On The Business Than Other Forms Of Identity Theft And Fraud Management FIGURE 3 Employee Fraud Management Solutions Are Being Adopted At A Higher Rate Than Identity/Fraud Management Solutions Who is the primary decision-maker for the following identity and access management technology purchases? (Consumer identity theft/fraud management) Application development 3% Business stakeholders 16% Compliance group 18% IT operations 12% Don't know/does not apply 3% Finance 8% IT security 41% Base: 1,972 information workers in the US Who is the primary decision-maker for employee fraud management technology purchases? * Other (please specify) 9% IT Operations 10% Compliance group 17% Business stakeholders Legal Source: Forrsights Workforce Employee Survey, Q2 2012, Forrester Research, Inc. Application development 1% IT security 28% Finance 27% What are your firm s plans to adopt the following identity and access management technologies? 8% 15% 13% 6% 13% 27% 18% Don t know Not interested Interested but no plans Expanding/upgrading implementation Consumer identity theft/fraud management Planning to implement in a year or more Planning to implement in the next 12 months Implemented, not expanding What are your firm s plans to adopt employee fraud management technology? 19% We are not interested We are interested, but have no plans Organizations Are Looking To Technology To Help Address Challenges In Employee Fraud 16% 1 We plan to implement in a year or more We plan to implement in the next 12 months We have implemented, but are not expanding Organizations are currently focused on employee fraud management implementations. Because employee fraud can lead to the largest financial losses and damage to reputation, it is not surprising that employee fraud management technology solutions are being adopted at a relatively high rate. Over half of survey respondents (56%) have adopted or are expanding their employee fraud management solutions (see Figure 3). Because of this, Forrester sees that the employee fraud management market is growing at an even higher rate than the broader overall fraud management market. Forrester s growth estimate for the annual growth of these markets is 20% and 15%, respectively. 42% Employee fraud management Base: 1,972 information workers in the US We are expanding/upgrading our implementation Source: Forrsights Workforce Employee Survey, Q2 2012, Forrester Research, Inc. Employee fraud technology solutions should be targeted at focusing investigator efforts in sync with operational speeds. Organizations often take a pay and chase approach to fraud management. This is due to the

4 3 lack of a fraud management technical infrastructure as well as a consolidated enterprise view of the data sources needed to operationalize this function in real time. This means that organizations may miss warning signs in time to prevent the damage. As such, fraud analysts and investigators must draw upon and piece together a variety of disparate sources long after the fraud has been committed. As one Forrester customer told us, its fraud analysts need to look at 23 total systems to analyze, identify, and investigate fraudulent employee transactions. Based on these challenges, it is not surprising that our survey uncovered that top solution requirements for business users included ease of use (46%), preventive control capabilities (37%) and the ability to monitor data in real time (33%) to support early fraud detection (see Figure 4). These features are needed to minimize financial and reputational damage, by combining preventive and detective capabilities into deterrence. Many times Forrester sees that the implementation of a fraud management system reduces fraud in two ways: It improves detection capabilities and improved detection deters potential employee fraud as well. Respondent Concerns Indicate Future Focus In Aligning Technology Muscle With Operational Know-How Operationalization of employee fraud management is being driven through automation and strong business process knowledge. Automation is critical in shifting the paradigm from detective and ad hoc to preventative and repeatable for employee fraud management solutions. If an event is not captured or flagged near the time it was perpetrated, it inherently becomes buried in volumes of data for investigators to hopefully find downstream. In that regard, our survey respondents noted a lack of automated processes was the top process/organizational challenge (47% agree, see Figure 5). Other critical business challenges include complex geographical and cultural considerations, an ever-evolving business landscape, and the need to protect the customer experience while maintaining disruption-free operations. This would indicate that organizations are looking for a holistic view of fraud risks FIGURE 4 Top Solution Requirements Include Ease Of Use, Preventative Capabilities, Ability To Monitor In Real Time What are the key future customer requirements for an employee fraud management solution? (Select three) The solution should be intuitive and easy to use 46% The solution should provide preventive control capabilities to avoid employee fraud The solution should have the capability to monitor data in real time The solution should provide strong integration with our business systems The solution should be scalable to keep up with the volume, velocity, and variety of big data The solution should allow for a highly configurable workflow and alerting system for case management The solution should have predictive analytics capabilities to identify future fraud patterns The solution should provide and protect privacy and be able to limit displaying sensitive fraud information The solution should provide end-to-end, integrated functionality for fraud identification and fraud case life-cycle management The solution should provide robust executive and compliance reporting capabilities 27% 2 23% 22% 21% 21% 33% 32% 37%

5 4 and detection that can be effectively integrated with operations, and evolve with the changing face of organizational channels, departments, and functions. As one Forrester customer told us, its fraud analysts need to look at 23 total systems to analyze, identify, and investigate fraudulent employee transactions. Leading employee fraud practices means following prominent technology trends. Survey results noted a significant emphasis on addressing challenges through predictive modeling, behavioral analytics, and big data technology (see Figure 6). This is indicative of larger technical trends where spreadsheets and structured accounting data have given way to complex, unstructured data sets across domains , social media, video, etc. The ability to tap into a cross-section of data sources provides an opportunity to evaluate a given event across multiple dimensions, thereby providing the organization with a better understanding of likelihood and impact. For example, an organization could build onto a legacy transactional system that identifies suspicious journal entries, and, in addition to this functionality, can also use enhancements for analyzing transactions in context using link and entity analytics to identify potential collusion. Systematically and automatically scanning the entire population of transactions for entities that are associated with known fraudulent transactions (customer names, phone numbers, addresses, etc.) also can highlight collusion and allows for revealing connections that are not obvious. In fact, the ACFE estimates that 81% of identified fraud cases involved one of these behavioral flags, which speaks to the potential efficacy of including this type of analytic functionality into a proactive solution. 1 In addition, legacy rules-based solutions tend to degrade in effectiveness over time if they are not continually optimized. New fraud schemes are invented, limits are tested, and system/data complexity increases. As such, businesses will need to build in mechanisms to keep FIGURE 5 A Lack Of Automated Processes Is The Top Process/Organizational Challenge In Managing Employee Fraud How much do you agree or disagree with the following statements regarding process and organizational challenges in managing employee fraud? Strongly agree Agree Neutral Disagre Strongly disagree Don t know/not applicable Fraud management processes are manual and lack automation 20% 27% 20% 26% 6% 2% Our company lacks a deep understanding of the geographical and cultural influences on how employee fraud is committed Constant change of our company s organization and business processes makes it difficult to put effective fraud management processes in place There is not a single organization and comprehensive approach for managing employee fraud at our firm, and the ownership of employee fraud management programs is fragmented It is difficult to implement fraud management operations without impeding business operations and customer experience 9% 38% 20% 2 6% 3% 17% 28% 19% 26% 10% 1% 16% 27% 22% 28% 7% 1% 17% 21% 18% 30% 11% 3% Our company lacks the expertise and skills for fraud investigation 16% 21% 17% 29% 16% 2% Our company lacks the expertise and skills for maintaining and operating fraud management technologies and tools Risk assessment processes are incomplete or nonexistent; our firm does not understand our business processes in enough detail to see where to focus for employee fraud management There is a lack of collaboration and alignment between fraud investigation and management efforts 17% 18% 27% 28% 10% 1% 12% 22% 23% 27% 13% 2% 12% 22% 22% 31% 9% 3%

6 5 solutions relevant, while managing disruptions to service. Last, big data represents data population sizes that outstrip the abilities of conventional technologies to effectively or efficiently process. Forward-looking technology solutions should consider this dimension, along with the ability to use predictive analytics. Conclusion In today s business environment, ownership of employee fraud management is fragmented and further complicated by geographically diverse operations undergoing regular change. This creates a scenario where the vexing issue of employee fraud continues to manifest and grow. Based on the significant number of employee fraud incidents, it comes as no surprise that companies are looking toward and prioritizing technology to operationalize employee fraud management. These technologies can help stop a fraud attempt in near real time. As the trend of business user involvement in employee fraud management decisions increases, the need for user-friendly fraud management products emerges. And most importantly, a long-term strategic view should be taken to effectively integrate with operations and line of business processes. Through this view, organizations can better position employee fraud management for an operations aligned view of their investigative activities. FIGURE 6 Technology Challenges Include A Lack Of Analytics Tools, Challenges Dealing With Big Data How much do you agree or disagree with the following statements regarding technology challenges in managing employee fraud? Strongly agree Agree Neutral Disagre Strongly disagree Don t know/not applicable We lack tools for using predictive analytics and behavioral analytics in employee fraud management 19% 38% 12% 22% We lack tools for analyzing unstructured and social media data in employee fraud management Our fraud management tools do not provide enough capabilities to analyze the multiple dimensions and variety of data (big data) We find fraud too late because our fraud management tools lack the capacity to process the volume and velocity of data (big data) Case management user interfaces are hard to use for fraud analysts There are data quality issues in our fraud management tools Our fraud management tools are poorly integrated with key business systems 1 38% 21% 17% 6% 13% 36% 22% 17% 9% 3% 13% 28% 26% 21% 9% 3% 1 26% 26% 21% 6% 8% 11% 28% 21% 28% 6% 7% % 32% 9% 3% Our company is using in-house developed fraud management tools that are non-standard, non-scalable, and costly to maintain Our fraud management tools and models are too rigid and are not easily adaptable to manage new, ever more sophisticated and changing fraud patterns There are too many different existing fraud management tools that are used by various departments 17% 21% 1 29% 12% 7% 7% 29% 22% 29% 9% 17% 16% 17% 3 11% 6%

7 6 Methodology This Technology Adoption Profile was commissioned by SAP and Deloitte. To create this profile, Forrester leveraged its Forrsights Security Survey, Q Forrester Consulting supplemented this data with custom survey questions asked of 90 US and European business decision-makers responsible for employee fraud management at their organization. Survey respondents included managers and above in finance/accounting, fraud management, compliance, operations, and legal departments who were either the final decision-maker around employee fraud management or provided significant input to the final decision-maker. The auxiliary custom survey was conducted in December For more information on Forrester s data panel and Tech Industry Consulting services, visit Endnotes 1 In 81% of cases, the fraudster displayed one or more behavioral red flags that are often associated with fraudulent conduct. Living beyond means (36% of cases), financial difficulties (27%), unusually close association with vendors or customers (19%) and excessive control issues (18%) were the most commonly observed behavioral warning signs. Source: 2012 Report to the Nations, Association of Certified Fraud Examiners ( ABOUT FORRESTER CONSULTING Forrester Consulting provides independent and objective research-based consulting to help leaders succeed in their organizations. Ranging in scope from a short strategy session to custom projects, Forrester s Consulting services connect you directly with research analysts who apply expert insight to your specific business challenges. For more information, visit forrester.com/consulting. 2014, Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available resources. Opinions reflect judgment at the time and are subject to change. Forrester, Technographics, Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. For additional information, go to [1-MHPIHW]