A Short Guide to Fraud Risk

Fraud Resistance and Detection

Martin Samociuk, Nigel Iyer

• Publisher: Routledge
• Year: 2017
• Topic: Business
• eBook ISBN:
  9781351961691
• Subtopic: Business General
• Index: Business

A Short Guide to Fraud Risk is for: * anyone who needs to better understand fraud risks, either company-wide, or in a specific business unit; * directors and managers who would like to add value by building fraud resistance into their organization and to demonstrate to shareholders, regulators or other stakeholders that they are managing fraud risks, rather than just reacting to incidents; * regulators, auditors and compliance professionals who need to assess the effectiveness of an organisation's fraud prevention measures. The book gives a concise but thorough introduction to the risk of fraud based on a six-element strategy. It includes practical steps to assess and treat fraud risks across an organisation, including those relating to executive directors. It also provides practical steps to develop fraud awareness across an organisation and how to implement an effective fraud detection and incident management program. The application of the principles is illustrated with example documents and numerous case studies aimed at assisting the reader to implement either individual elements or a complete fraud risk management strategy.

1 Managing Fraud Risk

Spectacular corporate collapses and numerous major frauds in recent years have sharply focused the minds of company directors, owners and regulators on the need to understand and manage fraud risk. This guide explains what fraud risk is and how, in practice, you should deal with it. We are going to assume that, in reading this book, you are someone who would like to contribute to successfully managing fraud risks in your organisation. You may have a different role, such as Finance Manager, Procurement Officer or Internal Auditor, but for the purposes of this book, we will refer to you as the ‘Fraud Risk Manager’.

We appreciate that you most likely are not the Chief Executive Officer (‘CEO’). CEOs rarely have the time to take a direct interest in fraud risk management and usually assign this role to others, such as the Head of Corporate Security, Operational Risk, Internal Audit or a dedicated Fraud Officer. Nevertheless, even though they may have assigned responsibility elsewhere, the CEO, together with the Chairman of the Board (‘Chairman’), should still act as a direct, pivotal role model for the rest of the organisation when trying to manage fraud risks. We discuss why this is so important in chapter 2. We use the term ‘Board’ as meaning the management board comprising the executive and non-executive directors.

Successful management of fraud risk does not solely depend on implementing controls and procedures. It also requires the Board to support initiatives and policies for developing an anti-fraud culture and needs Bxecutives, Business Line Managers and employees to understand their fraud risks. The Fraud Risk Manager can help to facilitate this.

Why is understanding fraud risk so important? Looking at the many corporate collapses caused by fraudulent behaviour, a hallmark of the victim organisations was that they had not understood fraud risk. With more foresight, could they have anticipated and prevented the loss or are frauds impossible to predict?

We believe that a large part of the problem probably lies in the way that fraud risks have been assessed, treated and reported (or not). Hence we have devoted a whole chapter to fraud risk assessment (chapter 3) and a chapter to treating and reporting fraud risks (chapter 4).

But before we start, let us explain what we mean by the term ‘fraud risk’. First, it is important to define ‘fraud’. There is no universal definition and we will use the definition ‘using deception to make a personal gain dishonestly for oneself and/ or create a loss for another’ (CIMA 2009). Plainly speaking, fraud involves a perpetrator committing a deceptive act to obtain a benefit.

Therefore, fraud risk is the chance of a perpetrator (or perpetrators) committing a fraud which has an impact on the organisation. Fraud can occur anywhere where there are people who are dishonest, or who become dishonest.

Key Point: a fraud risk comprises three elements:

1. the method of fraud;
2. the effectiveness of controls;
3. the degree of dishonesty and skill level of the perpetrator.

The impact or consequence of fraud can be both positive and negative to the organisation’s interests. For example, managers working in the interests of the company may fraudulently evade paying corporation tax. Similarly, financial market traders may fraudulently take profits from customers to improve their own results and therefore also the profits of the organisation they work for. The financial impact is temporarily positive, but the reputational impact (and consequential costs) if the fraud comes to light is probably going to be somewhat negative.

We have found that one of the main reasons people do not understand fraud risk is that they sometimes focus too much on the method of fraud and not enough on who might be doing it and why. This tends to happen when an organisation has a risk management framework which requires managers to assess fraud risks alongside other risks using a ‘one-size fits all’ assessment process with the main focus on controls.

It is important to remember that frauds are not accidents. They are deliberate acts and it is people who are committing them. Given the different nature of fraud risks compared with other risks, such as credit and market risks or risks resulting from accidental occurrences, fraud risks should be assessed independently of the general risk assessment process. We will come back to this message throughout this guide and we will provide more detail on how to assess fraud risks in chapter 3.

GETTING STARTED

So assuming you would like to be involved in developing and implementing strategy to manage fraud risk, where do you start?

You may not be in a position to issue policies or set a budget on your own, so getting the Board and other powerful internal allies on side is critical. Once a workable policy has been approved and issued, all line managers should be required to analyse fraud risks in their business unit and put in place anti-fraud controls and procedures.

However, successful fraud risk managers do not stop here. They understand that effective fraud prevention is as much about culture and ethics as it is about policies, starting right at the top with the Chairman and CEO. Fortunately, most organisations that we have dealt with over the last 25 years have had honest and ethical Chairmen and CEOs. In this case, it should be reasonably straightforward to get support to implement a strategy from the top down, especially when you demonstrate that reducing fraud can improve profit margins. We do not want you or your CEO to get too excited, but effective fraud risk management could mean more than a 60 per cent increase in profits, as we show later.

If you are unfortunate enough to work in an organisation where the culture is dominated by executives with a poorer-than-average sense of ethics, then your own situation is more complicated. As discussed further in chapter 2 ‘Developing an Anti-Fraud Culture’, there are sadly examples of executives who use policies and governance as a smokescreen to reassure their investors and the outside world the organisation is ethical and well controlled, while in the meantime they indulge in unethical or criminal behaviour for their own personal gain.

You can still try to make a difference within such an organisation, but it may be a difficult, if not impossible task, particularly if you cannot get buy-in at the Board level. If that does not sit well with you, in the following chapters we discuss some of the red flags which may give you an indication as to the sort of executives you are working for, so that you can think about whether or not you want to stay within that organisation or change to a more ethical employer. If you do choose to stay in an organisation with a ‘challenging’ environment, then it will help if you can find support from at least one Board member.

Example: A Chief Financial Officer (‘CFO’) uncovered a corrupt relationship whereby a Senior Purchasing Manager had received a shipment of concrete at his home address from a supplier which had won a tender for a construction project for the company. The concrete was used to build a new driveway. However, the CEO decided to take no further action because the supplier had a long-established relationship and had successfully delivered on a number of projects. There was no suggestion of a corrupt relationship involving the CEO.

The CFO was unhappy with the decision and notified the Chairman who agreed that not taking any action would set entirely the wrong tone throughout the organisation. After a showdown with the CEO, the Chairman obtained the backing of the majority shareholder to overrule the CEO. The supplier relationship was terminated and this information was made public both within the organisation and across the industry. The Chairman reasoned that setting the correct tone would act as a deterrent for any future improper relationships. However, it took a determined effort to repair the relationship between the Chairman, CEO and CFO.

The level of support which the executives provide to a Fraud Risk Manager will depend largely on their own experiences. The more fraud they have seen, the more risk averse and supportive they will often be.

We will now cover the main elements of a fraud risk management strategy and then discuss three issues which you should understand.

THE FRAUD RISK MANAGEMENT STRATEGY

Aside from an organisation’s own desire to manage fraud risk, there is increasing pressure from national and international legislative bodies for organisations to implement a fraud risk management strategy. A good place to start for a Fraud Risk Manager wishing to implement a strategy is to look at any previous cases of fraud, both internal and external to the organisation, and draw up a list of the major elements which should be in place to reduce risks of similar events reoccurring. For example, analysis of the spectacular losses in the US during the banking crises of the 1980s and early 1990s, when more than 1,600 banks were closed or received financial assistance, the Barings Bank-type trading frauds in the late 1990s and early 2000s, and the equally spectacular losses in the late 2000s reveals some common factors:

• the fraud risks were not fully understood;
• management supervision was poor;
• weaknesses in internal controls were not identified;
• red flags and fraud warnings were ignored;
...

Table of contents

• Cover Page
• Title Page
• Copyright Page
• Contents
• Acknowledgements
• A Short Guide to Fraud Risk
• Short Guides to Business Risk, The Series
• CImA
• sirca
• List of Figures
• List of Tables
• About the Authors
• Glossary of Terms and Risk Management Standards
• 1 Managing Fraud Risk
• 2 Developing an Anti-Fraud Culture
• 3 Assessing Fraud Risk
• 4 Treating Fraud Risk
• 5 Detecting Fraud
• 6 Managing Incidents
• 7 Measuring Fraud Resistance
• References
• Reviews of Nigel Iyer and Martin Samociuk’s Fraud and Corruption: Prevention and Detection