AmTrust Europe Limited Anti Fraud Prevention & Detection Policy & Procedure

Transcription

1 AmTrust Europe Limited Anti Fraud Prevention & Detection Policy & Procedure Background Each year, Fraud costs the UK economy in the region of 30bn with Financial Services Fraud calculated at 3.8bn and Insurance Fraud at 2bn (source: National Fraud Authority 2010) and consequently the reduction of financial crime forms one of four statutory objectives of the regulator - The Financial Services Authority (FSA). Company Policy AmTrust Financial Services, Inc. ( AmTrust ) and its subsidiary Companies, including AmTrust Europe Limited (AEL), is committed to fighting fraud both internal (the potential risk of fraud being perpetrated by the Company s personnel) and external (the potential risk of fraud as a result of the dishonest intent third parties). Scope of Policy The AmTrust Fraud Prevention and Detection Policy applies to any irregularity, or suspected irregularity involving employees, shareholders, consultants, vendors, contractors, outside agencies doing business with employees, customers and/or any other parties with a business relationship with AmTrust. Any investigative activity required will be conducted without regard to the suspected wrongdoer s length of services, position/title, or relationship to the Company. See investigation procedure under. Other Irregularities Irregularities concerning an employee s moral, ethical, or behavioural conduct should be resolved by AEL departmental management and the Human Resources Department. The AmTrust Whistleblowing facility (see under), should only be used for incidents of potential fraud within the scope of this policy. Fraud Prevention & Detection To achieve this goal we have in place comprehensive Fraud Prevention and Detection Program. 1

2 The fraud program includes prevention and detection controls at the points of vulnerability. The higher the risk the tighter the internal controls, risk mitigation and more extensive the reviews and audits to detect fraud. It is not possible to build a fraud program that will prevent and detect all fraud. However, it is possible to have a strong internal control structure that includes prevention and detection controls that minimize the opportunity to commit fraud and maximize the potential for detection of fraud. A strong control system is essential to fraud prevention. If fraud is discovered Management will analyse and learn from the experience and make any necessary changes to company systems and procedures to minimise the risk that similar frauds will not recur. The investigation may highlight where there has been a failure of supervision of there has been a breakdown in, or absence of, control. Internal Audit is available to offer advice and assistance on matters relating to internal control if considered appropriate. Communication & Understanding Communication is also essential to fraud prevention. The best prevention and detection controls will not prevent fraud if employees are not aware of the risks for detection. It is always easier to prevent fraud than to detect fraud. The best fraud prevention method is to increase the perception of fraud detection. This is accomplished by employees understanding the control environment and seeing in action the diligence paid at all levels to monitoring the prevention and detection controls. It is therefore important that all personnel understand how this policy and associated procedures apply to them. Management is committed to making sure employees are aware that fraud prevention and detection is everyone s responsibility and employees are required to report any instances of possible fraud, abuse, or unethical behaviour. The determining factor in white-collar crime is organization opportunity. It is important that employees know that AmTrust is committed to detecting fraudulent activities and prosecuting offenders regardless of tenure or position. When it comes to fraud materiality is not a consideration. The activities of all employees, 2

3 regardless of position, are closely monitored including time and expense reporting. If fraud is committed by a key officer or employee it will require a disclosure in the notes to the financials and the Quarterly Management Representation Letter. Annually, employees are required to complete the AmTrust Financial Code of Conduct Compliance Questionnaire and sign the acknowledgement. In addition, employees will receive periodic training tips on fraud, security, and compliance. It is our intention that this information will help communicate our commitment to conducting business with integrity, honesty, and fairness and that the information provided will help guide employees in today s complex business environment. Protecting the Company s Position As AmTrust is a publicly-held company, The Board of Directors, Management and each employee is expected to protect shareholder value and AEL will fully support this position. Fraud directly impacts the bottom line. Adverse publicity can hurt the company s reputation as well as its share price and in the UK, reputation risk can be an event requiring specific notification to the Regulator (the Financial Services Authority). See the AEL FSA Notifications Events Policy. In addition to direct losses caused by fraud, civil and criminal sanctions may be imposed on a corporation for the fraudulent and criminal conduct of its employees. For example, the general offence under the UK Fraud Act 2006 attracts a maximum penalty of 10 years imprisonment and Organisations can receive an unlimited fine. (See definition of fraud section under). Key Systems and Control Areas In order to avoid corporate liability and meet its regulatory obligations, a corporation must establish an effective, on-going process that makes ethical conduct part of its corporate culture. 3

4 At a minimum, a corporation must establish a program which accomplishes the following goals: 1. Establish Standards and Procedures to Prevent and Detect Criminal Conduct. AEL fully supports AmTrust Corporate requirements and has adopted this Fraud Prevention and Detection Policy, and the associated policies and procedures and the AmTrust Financial Code of Conduct of Compliance Questionnaire, which, among other things, set forth standards and procedures to prevent and detect fraudulent and criminal conduct and to promote the standards of ethics and behaviour required by all personnel. 2. High Level Managerial Oversight of the Content and Operation of the Company s Fraud Detection and Prevention Program. Executive Management employees are required to sign a Quarterly Management Representation Letter and review the internal controls for their functional area to ensure that the internal controls are in place and functioning as designed. 3. Screen Individuals Prior to Employment and During Employment. AEL recruitment & induction processes need to be fully followed, including obtaining satisfactory employer references, verification of employment & qualifications, for all new hire candidates prior to an offer of employment. In addition, if the position requires disbursement of funds a credit check is also done. If any potentially adverse information comes to light from these a criminal background check should additionally be sought. On-going, the annual performance management and appraisal process and monitoring of adherence to policies and procedures must be satisfactorily completed and consideration given to completing additional credit and/or criminal background checks should adverse information be present. 4. Maintain Effective Training Programs. Employees are required to complete the AmTrust Financial Code of Conduct Compliance Questionnaire and sign the acknowledgement. In addition, employees receive periodic training tips on fraud, security, and compliance and are required to complete AEL s relevant CII Ed. Assess on-line training and assessment as part of their induction and periodically during their employment with the Company, to ensure employees understand our commitment and are trained to handle difficult situations in today s complex business environment. 5. Periodic Evaluations of Effectiveness of Compliance Program. This goal requires that a company take reasonable steps to ensure that its fraud detection and prevention program is followed, which include the provision for and 4

5 publicizing of a system and mechanisms for anonymity and confidentiality by which employees may report potential or actual fraudulent activity without fear of retaliation. AmTrust maintains a confidential and independently administered third party Whistleblowing Hotline which is available at The reporting system is tested and monitored by internal audit. See more detailed information on the reporting and Whistleblowing facilities and procedures under. 6. Promote and Enforce the Compliance Program. AmTrust promotes this Fraud Prevention and Detection Program and its Business Conduct and Ethics Program through appropriate communication, personnel support and disciplinary measures. 7. Respond Appropriately When Fraud is Detected. All reports of fraudulent activities are taken seriously and investigated. In addition, cases are analysed to determine if controls were effective and if additional preventive or detective controls are needed. The Offence of Fraud in the UK - Definition The Fraud Act 2006 (the Act) creates a general offence of fraud that can be committed in three ways: 1. By false representation; 2. By dishonestly failing to disclose information; and, 3. By abuse of position with intention to make a gain, cause loss, or to expose another to the risk of loss. The general offence attracts a maximum penalty of 10 years imprisonment. Organisations can receive an unlimited fine. The Act also created two new offences of: 1. Obtaining services dishonestly; 2. Of possessing, making and supplying articles for use in fraud. The offence of fraud relies upon the proof of dishonest intent on the part of the defendant. The Act s emphasis is on proving the intent to act dishonestly as opposed to the impact of the fraud on the victim. Lawyers will not have to show that someone was actually deceived which is an important consideration, especially in relation to hi tech fraud making it easier and more worthwhile, to prosecute individuals and criminal gangs for high volume, low value frauds. 5

6 AmTrust Fraud Prevention and Detection Responsibilities and Procedures Management is responsible for actively seeking out possible fraudulent activity and the detection and prevention of potential fraud, misappropriations, and other irregularities. Each member of the management team is required to be familiar with the types of improprieties that might occur within his or her area of responsibility, and be alert for any indication of irregularity. Any irregularity that is detected or suspected must be reported as required by Company policy and procedure. Management is required and expected to discuss and train employees on fraud and abuse. We value our Employees opinions and we will routinely ask Employees if they are aware of any suspicious or fraudulent activity. We will ask Employees if they are aware of areas where controls are weak and need improvement and seek suggestions for improvement. Monitoring AmTrust Fraud Prevention and Detection Program is designed to minimize the opportunity to commit fraud while we maximize the opportunity to detect fraud. Management will monitor those controls on an on-going basis to ensure compliance. Investigative Teams The AmTrust Investigative Team is comprised of the following individuals: Name Designation Telephone Number Stephen Ungar General Counsel , Ext Teresa Jennings VP Director of Human , Ext. Resources 7019 Harry Schlachter Sr. VP Finance , Ext Barry Moses VP, Regulatory & , Ext. Robert Carpentieri Compliance Chief Internal Control Officer , Ext

7 The AEL Investigative Team is comprised of the following individuals and may involve members of the AmTrust team as the situation requires. Name Designation Telephone Number Jeremy Cadle Legal Counsel David Lingwood Group Compliance Officer M: M: David Statham Group Auditor Investigation Responsibilities M: The Investigative Teams will have the primary responsibility for the investigation of all suspected fraudulent acts as defined in this policy. If the investigation substantiates that fraudulent activities have occurred, the Fraud Officer in conjunction with the General Counsel will issue reports to appropriate designated personnel and, if appropriate, to the Audit Committee of the Board of Directors. Decisions to prosecute or refer the examination results to the appropriate law enforcement and/or regulatory agencies for independent investigation will be made in conjunction with legal counsel and senior management, as will final decisions on disposition of the case. Confidentiality and Whistleblowing The UK Public Interest Disclosure Act 1998 (PIDA) If you are concerned about possible wrongdoing at work, the PIDA provides guidance for dealing with these in a safe and constructive way. Having a Whistleblowing facility is considered a best practice contributor towards maintaining an effective anti-fraud culture. In the UK, employers are not required by PIDA to keep the identity of a worker who raises concerns about potential malpractice confidential. What is Whistle Blowing? The UK Committee on Standards in Public Life has explained: 7

8 "The essence of a whistle blowing system is that staff should be able to by-pass the direct management line because that may well be the area about which their concerns arise, and that they should be able to go outside the organisation if they feel the overall management is engaged in an improper course." Whistleblowing Facilities If you would prefer to remain anonymous then it is important that you use the AmTrust Whistleblowing facilities which enable employees to anonymously raise concerns with appropriate AmTrust management if they have reasonable grounds for believing there is serious malpractice within the organization. The Hotline enables you to leave an anonymous message and technology is employed to disguise your voice. You will receive a 15 digit code to access the status of your message. Additionally, you can raise your legitimate concerns on-line at: Both services are provided by an independent third party Nasdaq OMX. Confidentiality All disclosures to the AmTrust Whistleblowing facility will be dealt with anonymously (subject to Public Interest Disclosure Act provisions), sensitivity and will be given sufficient priority. If you report by the other available methods, confidentiality will be maintained as far as reasonably possible, however, no member of Management can guarantee complete confidentiality and it should be noted that if the disclosure suggests criminal activity and the case is to be pursued by police, the identity of the person reporting the details may be important at a later date if criminal proceedings are to be pursued effectively. Investigation results will not be disclosed or discussed with anyone other than those who have a legitimate need to know. Your obligations as a member of AEL personnel AEL strives to provide an open an honest culture and that all persons will feel able to raise any potential concerns internally in accordance with this policy & procedure. Therefore, any employee who suspects dishonest or fraudulent activity should report immediately to the appropriate member of management (see Reporting Procedures under). 8

9 However, should any person feel unable to resolve a concern regarding potential fraud within the scope of this policy, directly with their departmental management, they are required to use one of the following options as appropriate to the situation:- Use the anonymous Whistleblowing facilities (see above), Contact an appropriate member of the UK or US Investigative Teams, Contact the UK Regulator (the Financial Services Authority see under) Financial Services Authority If you have disclosed your worry internally but remain concerned by the response/lack of response, or, if you feel unable to talk to anyone internally, you can contact the Financial Services Authority (FSA). PIDA protects you if you contact the FSA where: you satisfy the test for speaking to your employer; you reasonably believe that the information and any allegations in it are substantially true; and, you reasonably believe that the issue in question is something relevant to the functions of the FSA. FSA Contact Details The FSA s direct whistleblowing number is and the direct address is whistle@fsa.gov.uk Further information is available at Reporting a suspected fraud Any suspicion of fraud will be treated seriously and will be reviewed and analyzed in accordance with the Public Interest Disclosure Act (PIDA) PIDA provides that individuals who make disclosures of information in the public interest have the right not to suffer detriment by any act or omission of their employer because of the disclosure. Public interest qualifying disclosures include those relating to likelihood of a criminal offence (see Fraud Definition) or deliberate concealment relating to a criminal offence. 9

10 Reporting Procedures Any employee who suspects dishonest or fraudulent activity is required to report immediately to the appropriate member of management. This is important in order to avoid damaging the reputations of persons suspected but subsequently found innocent of wrongful conduct and to protect the Company from potential civil liability. If you become aware of a suspected fraud or irregularity, and you intend to report this internally via Line Management of the Investigative Teams, write down your concerns immediately. Make a note of all relevant details, such as what was said in phone or other conversations, the date, the time and the names of anyone involved. Keep these notes both confidential and secure and then report the matter immediately to either: your Line Manager; or, your Divisional Executive Director; or, the AmTrust Whistleblowing facility When you report your concerns, arrange to handover your notes and any evidence you have gathered to the appropriate investigator. Confidentiality for all parties will be maintained, as far as reasonably possible, over disclosures made in good faith which cannot be substantiated following investigation. You must not do any of the following: contact the suspected perpetrator in an effort to determine facts or demand restitution; discuss the case facts, suspicions, or allegations with anyone outside the company; discuss the case with anyone within the company - other than the Investigative Team listed above; attempt to personally conduct investigations, or interviews, or question anyone unless asked to do so by the Investigative Team above; write upon, or otherwise mark or deface any relevant documentation or amend/adjust any computer record. All inquiries concerning the activity under investigation from the suspected individual, his or her attorney or representative, or any other inquirer should be directed to the AEL or AmTrust Legal Department. No information concerning the status of an investigation will be given out. The proper response to any inquiries is: I am not at liberty to discuss this matter. Under no circumstances should any 10

11 reference be made to the allegation, the crime, the fraud, the forgery, the misappropriation, or any other specific reference. Action Required of Line Managers and or the Executive If you have reason to suspect fraud in your work area, you should do the following: listen to the concerns of your staff and treat every report you receive as confidential as possible, seriously and sensitively; make sure that all staff concerns are given a fair hearing. You should also reassure staff that they will not suffer because they have told you of their suspicions; get as much information as possible from the member of staff, including any notes and any evidence they have that may support the allegation; ensure that all associated records and documentation, including those of an IT nature, are appropriately secured; and, report the matter immediately to the appropriate Investigative Team; Malicious allegations If an allegation is made frivolously, in bad faith, maliciously or for personal gain, disciplinary action may be taken against the person making the allegation. Authorization for Investigating Suspected Fraud Great care must be taken in the investigation of suspected improprieties or irregularities so as to avoid mistaken accusations or alerting suspected individuals that an investigation is under way. Members of the Investigative Team will have: Free and unrestricted access to all Company records and premises, whether owned or rented; and The authority to examine, copy, and/or remove all or any portion of the contents of files, desks, cabinets, and other storage facilities on the premises without prior knowledge or consent of any individual who might use or have custody of any such items or facilities when it is within the scope of their investigation. 11

12 Initial Investigation It is the responsibility of the relevant Investigative Team to ensure that each reported potential fraud incident is appropriately investigated. The level and type of investigation will be dictated by the nature (internal/external), scope and financial complexity of the potential incident. For example potential: Money Laundering Incidents Please refer to the AEL Anti-Money Laundering Policy which may be found on the AEL policy and procedure management system (Conform) in particular the notification requirement to the Finance Director in his capacity of AEL Money Laundering Reporting Officer. There are specific laws and strict rules involving disclosure of suspicious cases. Internal Fraud Incidents The AEL Employee Handbook Company Procedures (Section 7 General) provides for the suspension of individuals to enable reasonable investigations to be carried out internally. The Investigative Team should ensure that all appropriate records have been isolated and made reasonably secure (including those of IT media). In cases where an individual is suspected of fraud which a subsequent investigation does not substantiate, it is important that the potential damage to the individual s reputation is minimised. Whoever originally reported the suspected fraud or irregularity will be informed that the investigation has revealed no wrongdoing. External Fraud incidents All records within the company domain which relate to the potential external fraud should similarly be made secure. Search Policy AmTrust reserves the right to conduct searches to monitor compliance with rules concerning safety of employees, security of company and individual property, drugs and alcohol, and possession of other prohibited items. A request to conduct a search does not constitute an allegation of improper conduct. The Company s management or designated investigators may search employees, their work areas, lockers, personal vehicles if parked on company property, and other personal items on company property such as bags, purses, briefcases, backpacks, lunchboxes, and other containers. Also included are any personal electronic devices, including laptops, cell phones, PDAs, thumb drives, MP3 players, etc., are (just like handbags and briefcases) subject to search if brought onto the company's premises. 12

13 There is no general or specific expectation of privacy in the workplace, either on the premises of the Company or while on duty. In general, employees should assume that what they do while on duty or on the company premises is not private. All employees and all of the areas listed above are subject to search at any time; if an employee uses a locker or other storage area at work, including a locking desk drawer or locking cabinet, the Company will either furnish the lock and keep a copy of the key or combination, or else allow the employee to furnish a personal lock, but the employee must give the company a copy of the key or combination. The areas in question may be searched at any time, with or without the employee being present. As a general rule, with the exception of items relating to personal hygiene or health, no employee should ever bring anything to work or store anything at work that he or she would not be prepared to show and possibly turn over to Company officials and/or law enforcement authorities. All employees of AmTrust are subject to this policy. However, any given search may be restricted to one or more specific individuals, depending upon the situation. Searches may be done on a random basis or based upon reasonable suspicion. Reasonable suspicion means circumstances suggesting to a reasonable person that there is a possibility that one or more individuals may be in possession of a prohibited item. Prohibited items includes illegal drugs, alcoholic beverages, prescription drugs or medications not used or possessed in compliance with a current valid prescription, weapons, any items of an obscene, harassing, demeaning, or violent nature, and any property in the possession or control of an employee who does not have authorization from the owner of such property to possess or control the property. Control means knowing were a particular item is, having placed an item where it is currently located, or having any influence over its continued placement. Any search under this policy will be done in a manner protecting employees privacy, confidentiality, and personal dignity to the greatest extent possible. Any employee responsible for the unauthorized release of information concerning individual employees will be subject to discipline. No employee may be compelled to submit to a search. However, an employee who refuses to submit to a search request from the Company may face disciplinary action, up to and possibly including termination of Employment and adverse inferences may be drawn from their failure to allow a search to be conducted. Post Initial Investigation Following investigation the relevant Investigative Team shall reach a conclusion as to whether it is appropriate to refer the matter to local regulatory and local law enforcement authorities (including the Police). If a UK investigation, the conclusion reached on the basis of evidence available, will be reported to the 13

14 AmTrust General Counsel. The AEL Investigative Team will keep a protected central record of all UK incidents reported for regulatory purposes. In deciding whether a fraud should be reported to external authorities (including the police), the following will be taken into account: The seriousness of the case; The level of evidence available; The level of money involved; and, Whether the public interest will be served. Regulatory and legal requirements Asset Recovery Where possible any loss suffered by AmTrust and/or AEL as a result of fraud shall be recovered. Legal advice will be sought, as appropriate, in order to help facilitate this. Termination of employment If an investigation results in a recommendation to terminate an individual s employment, the recommendation will be reviewed for approval by the designated representatives from Human Resources and the relevant Legal Department and, if necessary, by outside counsel before any such action is taken. The Investigative Team does not have the authority to terminate employment. The decision to terminate employment will be made by Management in conjunction with Human Resources. Should the Investigative Team believe that Management s decision is inappropriate for the facts presented; the facts will be presented to Executive Management for decision. Prosecution Where suspected fraud occurs, in any form, it will be dealt with in a controlled manner in accordance with the principles of the Anti-Fraud Prevention and Detection policy and procedure. It will be investigated fully and, dependent upon the results of the investigation, the company will consider the prosecution of all offenders, where appropriate, including employees, management, Members of the Board, contractors and external partners. 14

15 Administration AEL Compliance and Legal Counsel will liaise with the AmTrust Fraud Officer for the administration, revision, interpretation, and application of this policy. The policy will be reviewed annually and revised as needed. Other Related Policy and Procedures This policy is supported by the following AEL procedures, the details of which may be found on the Company policy and procedure management system (Conform). Anti-Money Laundering Policy; Company Employee Handbook; Business Risk Management and Control Framework; Training and Competency Framework, including recruitment, induction and performance management and appraisal procedures; People Codes of Conduct: Anti-Corruption policy and procedure; Conflicts of Interest policy and procedure: Money, Financial Benefits, Corporate Hospitality, Political and Charitable contributions policy and procedure: IT Security and Data Protection policy and procedure; FSA Notifications policy; Record Keeping policy and procedure. UK Data Protection Act policy and procedure (including US Safe Harbour arrangements) Approval For AmTrust Barry Zyskind President and Chief Executive Officer Date For AmTrust Europe Max Caviet Chief Executive Officer Date 15