Embedding Fraud Fighting Techniques into Internal Audit Mary Breslin MBA, CIA, CFE What is Fraud? The Association of Certified Fraud Examiners defines occupational fraud as: The use of one s occupation for personal enrichment through the deliberate misuse or misapplication of the employing organization s resources or assets. 1
What does that mean? The intentional and wrongful obtainment of a benefit through: Theft or embezzlement False statements (documents, grants, applications) Corruption, kickback, conspiracies, collusion, bribes Misappropriation of assets (travel expenses, payroll, equipment) 2016, Empower Audit, LLC. 3 And what does it cost us? 2016, Empower Audit, LLC. 4 2
5% of REVENUE FRAUD $3.7 TRILLION in global losses Internal audit is uniquely positioned to fight fraud in corporations. 3
Why internal audit? 2016, Empower Audit, LLC. 7 Because. Frequently, fraud examiners are called in after a fraud is identified or suspected. But we auditors are already there. We know the systems We know the processes We know many of the gaps (= opportunity) We know the players We know the incentive programs (= pressure) We know the culture, environment and tone. And we ARE ALREADY THERE.and LOOKING!!! 2016, Empower Audit, LLC. 8 4
Why don t most audits catch existing fraud? Because audits are not designed to detect fraud. 2016, Empower Audit, LLC. 9 Most audits are focused on testing controls. Most controls are designed to prevent or detect errors. Less than 4% of frauds are detected through traditional audits. But audit functions actively looking for fraud find 16.5% of reported frauds. But still almost 40% are still discovered through tips. In many fraud cases, controls were found to be working during the most recent audit. Why doesn t audit catch existing fraud? 2016, Empower Audit, LLC. 10 5
Audit Challenges Management Override Work Arounds Manual Processes Collusion 2016, Empower Audit, LLC. 11 Collusion Almost 50% of fraud cases involve collusion. What happens when collusion occurs? 2016, Empower Audit, LLC. 12 6
Controls Testing What happens when a control fails? An Action Plan? Then what? How frequently are we discussing the same issues over and over again? 2016, Empower Audit, LLC. 13 If we could move the needle just ½ of one % (0.5%) FRAUD We could save $18.5 BILLION globally 7
So how do we detect and prevent fraud while conducting an audit? 2016, Empower Audit, LLC. 15 The top 10 things audit should ensure happen in their organizations to prevent and detect fraud. 2016, Empower Audit, LLC. 16 8
2016, Empower Audit, LLC. 17 Learn the Fraud Basics Fraud Triangle Pressure 2016, Empower Audit, LLC. 18 9
I need to hit my monthly targets! Incentive / Pressure Fraud Risk Opportunity Nobody really checks Attitude / Rationalization Everyone is doing it 2016, Empower Audit, LLC. 19 Cost of Fraud & Abuse Estimated $3.7 trillion globally 5% of revenues annually Organizations without anti fraud controls lose twice as much Avg. of $150k per instance Collusion losses grow exponentially with each fraudster Losses disproportionately higher in smaller business 2014 Report to the Nation Acfe.com 2016, Empower Audit, LLC. 20 10
Fraud Tree 2016, Empower Audit, LLC. 21 How do I learn? Continuing education fraud courses ACFE website, newsletter, magazine information IIA information Books READ! Blogs LinkedIn groups ACFE, IIA, ISACA, etc. chapter meetings 2016, Empower Audit, LLC. 22 11
Conduct Fraud Risk Assessments Identifies the potential fraud risks most likely to impact your organization. Identifies the red flags and transactional attributes likely to be associated with potential fraud. 2016, Empower Audit, LLC. 23 Fraud Risk Assessments Culture Industry Systems People Processes Fraud risks are specific to each organization 2016, Empower Audit, LLC. 24 12
Know Red Flags Payroll example Ghost Employee No Vacation No sick days No payroll corrections No garnishments No 401K contributions No overtime No bonuses No dependents No benefits health No raises Badge swipes Active Directory 2016, Empower Audit, LLC. 25 Red Flags Different frauds have different red flags and different approaches for detection. Should you be looking for Attributes of the actual fraud? The concealment? The conversion? Or, like a ghost employee.what s missing? 2016, Empower Audit, LLC. 26 13
Reconcile the Cash Simple, right? Bank Accounts Petty Cash Accounts Payable Accounts Receivable Cash vs Check deposits 2016, Empower Audit, LLC. 27 Reconcile the Cash Internal Frauds involving cash Cash misappropriation globally Average duration of fraud Because of existing opportunity 60% $2 Trillion 18 Months Opportunity 14
Use Data Analytics 2016, Empower Audit, LLC. 29 Use Data Analytics Internal controls often have weaknesses that can be exploited Finding fraud manually is about as easy as winning the lottery Automation and continuous fraud auditing Detection = Prevention Expanded coverage 100% verification Quantify impact 2016, Empower Audit, LLC. 30 15
Common Fraud Analytics Match payroll with master HR file Validate payroll Validate temp/consultants Vacation / Overtime Ghost Employees Human Resources /Payroll Accounts Receivables Vendors Sales Customers who are employees Duplicate accounts Lapping Cash vs. Checks Duplicate invoices / payments Purchase fluctuations Sequential Invoices Vendors with same address Purchases under review limit Excessive Returns Low/negative margins Promotions Coupons Credit memos Discounts Shipping Addresses 2016, Empower Audit, LLC. 31 Control Vendor Lists Vendor frauds are some of the most common. Fake vendors Changing real vendor information to process fake invoices Control vendor master files. Review and delete old and inactive vendors. Monitor changes to vendor information Addresses Banking info Contact Info 2016, Empower Audit, LLC. 32 16
Fraud Response Plan Predetermined responsibilities. Who does what? Who is notified? Who is involved? When are others are notified? 2016, Empower Audit, LLC. 33 Understand Fraudsters Characteristics Personality changes Financial pressures Bully Isolated Hates audits Changes in lifestyle Living beyond means Protective over their work Unusually close with Vendor/Customer Work extraordinary number of hours Ridicules the organization, rule breakers, complainers 2016, Empower Audit, LLC. 34 17
Profile of a Fraudster Always at work does not take days off, impeccable attendance, no vacation or sick days, most loyal employee Well trusted or in position of power or trust 2016, Empower Audit, LLC. 35 Vacation Policies Employees need to take vacations. For mental health reasons AND fraud reasons. Fraudsters commonly do not take vacations. (neither do ghost employees ) 2016, Empower Audit, LLC. 36 18
Do your Homework Be certain of the information, and its implications, before sharing information. Understand the difference between fraud and errors. Get over the fear of teaching someone how to commit fraud. 2016, Empower Audit, LLC. 37 Know Your Role. Never over step your ability or authority. 2016, Empower Audit, LLC. 38 19
Questions? 2016, Empower Audit, LLC. 39 Contact Info Mary Breslin Email: mbreslin@empoweraudit.com Twitter: @auditchic LinkedIn: https://www.linkedin.com/in/marybreslin Empower Audit Training & Consulting http://www.empoweraudit.com/ 2016, Empower Audit, LLC. 40 20