fraud risks in a challenging economy dbb 072811

Increased Fraud Risks from a Challenging Economy

Wh t Y C D t P t t YWhat You Can Do to Protect Your Organization

Brian R. DuMond, CPAPartner

Dermody, Burke & Brown, CPAs, LLC

Catherine L. Casler, CIAAudit & Accounting Manager

Dermody, Burke & Brown, CPAs, LLC

OverviewA Sign of the Times

Internal Controls

Impact of Challenging Economy on Internal Controls Fraud

Impact of Challenging Economy on Internal Controls and Fraud Risk

What to Look For

Protecting Your Business/Entityg y

What to do if you see it

Final Thoughts & Questions

A Sign of the Times

Budget Cuts – Companies/Organizations trying to do moreith l

Recession

with less.

People/companies who never had financial concerns areexperiencing fiscal stress.e pe e c g sca st ess

• Credit card rate increases, cut off of credit lines.• Inability to sell homes / “toys”.• Higher living expenses – property taxes, medical, fuel,

utilities foodutilities, food.• Shrinking residual income.• Cut-backs on OT reduce take home pay.• Spouse may be unemployed.p y p y

As economic recovery gets underway, the risk of fraud maynot be reduced. It could be magnified!

A Sign of the Times

As some sectors of the economy start to improve, businesses

Recovery

are reaching for new revenue opportunities.

Companies that have cut staff are reluctant to staff up again.

Now they will have even more work to do with fewer peoplethan before the recession.

I t l t l th t k d d t tb k d iInternal controls that were weakened due to cutbacks duringthe recession will be under even more stress when newbusiness is added.

As sales increase, some employees may rationalize helpingthemselves to make up for their past sacrifices.

A Sign of the Times

In May 2008, the NYS Unemployment Rate was 4.8%. In Jan 2010it hit a high of 9 6% As of May 2011 it’s still 7 8%

Statistics

it hit a high of 9.6%. As of May 2011 it s still 7.8%.

That’s 278,300 more unemployed NYS residents in the Spring of2011 than there were in the Spring of 2008.g

2010 ACFE survey of 1,843 U.S. and International fraudprofessionals estimated that the average organization loses 5% ofits annual revenue to fraud ($50 000 lost to fraud per $1 million inits annual revenue to fraud. ($50,000 lost to fraud per $1 million inincome.)

The median loss caused by the 1,843 occupational fraud casesreported by participants in the 2010 ACFE survey was $160,000.

Small businesses (less than 100 employees) were the most frequently reported victim of fraud (31%) of reports.most frequently reported victim of fraud (31%) of reports.

Small business had almost as great a median loss per fraud as larger companies.aud as a ge co pa es

In small businesses, the primary contributing factors in 65% of the reported fraud incidents were Lack of Internal Controls and Lack of Management ReviewControls and Lack of Management Review.

47 0%

Primary Internal Control Weakness by Size of Victim Organization

22.0%

17.8%

22.7%

12.0%

17.5%

47.0%

Override of Existing Internal Controls

Lack of Management Review

Lack of Internal Controls

ng F

acto

r

<100 Employees

100+ Employees

5.8%

8.5%

5.6%

7.0%

7.8%

Lack of Competent Personnel in Overnight Roles

Lack of Independent Checks/Audits

Poor Tone at the Top

ant C

ontr

ibut

in

2.0%

2.0%

7.0%

1.2%

1.6%

5.6%

Lack of Employee Fraud Education

Lack of Clear Lines of Authority

Lack of Competent Personnel in Overnight Roles

Mos

t Im

port

a

0.9%0.2%

0.0% 10.0% 20.0% 30.0% 40.0% 50.0%

Lack of Reporting Mechanism

Percent of Cases

Employees in Accounting, Finance and Operations perpetrated 44% of the reported cases and were responsible for 44% of the median losses. espo s b e o % o t e ed a osses

More Statistics

Nearly 25% of the frauds reported to the ACFE involved losses of at least $1 million.

New Citigroup case - $19.2 million

Internal ControlsInternal control is what management doesgto see that things they want to happen willhappen, and the things they don’t want tohappen won’t happenhappen won t happen.

Controls are a way to minimize risks orfexposures that an entity may face.

Internal Controlste a Co t o s

Five Key Control ActivitiesTop level reviews – management oversight, surprisecash counts, review, audit.

Authorization and approval – review of transactionsprior to completing a cycle.

Information processing controls – IT security andInformation processing controls IT security andapplication controls.

Physical Controls – Safeguarding of Assets

Separation of Duties – no single person handles theentire process.

FraudFraudFraud is the intentional manipulation of financial datat h diff t ltto reach a different result, or

The intentional taking of assets that belong to anotherpartyparty.

Occupational fraud is conducted in the course of one’semployment.employment.

Asset misappropriation was the most common fraudreported in the ACFE 2010 survey - 90% of cases.y

Review So far we’ve spoken about:

The economic conditions that increase the likelihood of fraud happening, The businesses that are the most frequently victims of fraud, The insider sources of fraud, We touched briefly on the key control activities to deter fraud anddeter fraud, and We discussed Asset Misappropriation, the most commonly reported category of fraud.

Next, we’ll move on to discussing in more detail, thecircumstances within organizations that lead insiders tocommit fraudcommit fraud.

FraudIn the 1950’s, Criminologist Donald Cressey interviewed 200 people who were incarcerated for embezzling.

His study was geared to find out what circumstances ledHis study was geared to find out what circumstances ledthem to commit the fraud.

He noted the following:1 There as a significant personal need1. There was a significant personal need.2. An idea formulated to fix the need.3. The individual may have thought stealing was

dishonest previously, however, due to the significanceof the need and the idea, it no longer seemed as dishonest.

A d th f f d t i l bAnd the famous fraud triangle was born.

Pressure x Perceived Opportunity x Rationalization many timesResults in Fraud.

Internal Controls and FraudH i th Ch ll i E I tiHow is the Challenging Economy Impacting

Internal Controls and Fraud Risk?

Authorization and Approval –

With less staff, management has less time to perform authorizationand approval as they try and perform additional responsibilitiesand approval as they try and perform additional responsibilities.

• Approvals delayed, done after the fact, or not done at all;

• Less time/scrutiny during the review and approval process dueto time restrictions. As a result, the process is less effective inidentifying errors or irregularities;

• This could be seen as perceived opportunity by the potentialfraud perpetrator.



Information Technology controls – IT security and application controls.

• As organizations downsize their employees need to do more• As organizations downsize, their employees need to do more.In order to accomplish that, they need to have more access tomore areas in the accounting systems. This can create a fraudrisk with additional opportunity to access areas within the systemthat can start and complete a transaction.

• One place organizations may look to cut costs is in theInformation Technology department If an organization goes downInformation Technology department. If an organization goes downto one IT person, who is reviewing the work that this IT person isdoing?

Internal Controls and FraudH i th Ch ll i E I ti

S ti f D ti i l h ld h dl th ti

How is the Challenging Economy Impacting Internal Controls and Fraud Risk?

Separation of Duties – no single person should handle the entire process.

• Remaining employees do more work. As workers try to balance agreater load, there is a greater risk for errors. This can also serve as away to rationalize fraud. An I deserve mentality.

• Work of one person is not under review of another, creatingp , gopportunity for errors to go undetected. Also, if the work of a person isnot under the review of another, they may sense an opportunity tocommit fraud.

• As previously discussed, with management having less time to reviewand approve, and workers taking on more and more responsibilities,concern as to accuracy and quality of work increases as well as fraudi k i t d ith t it d ti li tirisk associated with opportunity and rationalization.

Internal Controls and FraudH i th Ch ll i E I ti

Recovery

How is the Challenging Economy Impacting Internal Controls and Fraud Risk?

Recovery

As some sectors of the economy start to improve, businesses mayreach for new revenue opportunities in unfamiliar territories or new

d t liproduct lines.

Has management taken the time to perform a thorough riskassessment of new opportunities? Have appropriate controlpp pp pprocesses been designed to deter loss of revenue from fraud?

As we’ve said before, companies that have cut staff are reluctant tohire Now they will have even more work to do with fewer peoplehire. Now they will have even more work to do with fewer peoplethan before the recession.

As sales increase, some employees may rationalize helpingth l t k f th i t ifithemselves to make up for their past sacrifices.



Top–Level Reviews and Safeguarding of assets are theremaining two key control activities.

We will focus on these areas later when discussingopportunities to mitigate the risks that arose as a result ofdownsizing.

Fraud

What to Look for

Business owner/board members/key management givingBusiness owner/board members/key management givingimpression too busy or uninterested in financial reports.

Financial reports are not prepared in sufficient detail and/or notprepared and presented timely.

Aggressive financial goals and/or incentive programs.

Financial targets continue to be achieved, but payables continueto build and cash flow continues to be a concern.

Questions asked of management are not addressed appropriatelyor satisfactorily.

Poorly monitored events/locationsPoorly monitored events/locations.

Fraud

What to Look for

High/Unexpected Turnover

Accounting Anomalies – numbers just don’t make sense.

Systems or procedures that are not well designed / documented / understandable / well known.

Employees that appear to be living beyond their means.

Employees lifestyle changes or behavior changes.Employees lifestyle changes or behavior changes.

Fraud

What to Look for

Employees experiencing financial difficulties.

Employees who take on more authority than needed for their jobibilitiresponsibilities.

Employees who are uncooperative with management oversight,audits or independent reviews.p

Employees with inflated ego/craving for success.

Employees who voluntarily take on unusual work schedulesEmployees who voluntarily take on unusual work schedules,refuse to take vacations, or who are hesitant to delegate tasks.

Protecting Your Business/Entity

Fraud Prevention

It is easier to prevent fraud than detect it.

• Increasing the perception of detection might be the most effectivefraud prevention methodfraud prevention method.

• Going back to the fraud triangle, it is difficult to take away thepressure the individual is under or the rationalization (althoughthese can be mitigated), so organizations should focus primarilyon limiting opportunity.

• This is especially challenging in light of all of the issues we have• This is especially challenging in light of all of the issues we havealready brought up in regard to decreased staff, managementand resources.


Fraud Prevention

Some ideas to mitigate risks associated with financial pressures:

• Make sure management incentives are not overly aggressive.

• Pay attention to what is going on in employees personal lives.Has spouse lost their job? New kid in college? Unanticipatedmedical expenses?p

• Is there any way your company can help the employeethrough the tough time? Build gratitude instead of resentment.


Fraud Prevention

Some ideas to mitigate risks associated with rationalization:

• In staff meetings, promote that the organization stands forhigh ethicshigh ethics.

• Introduce/reinforce code of ethics, conflict of interest policy,etc.

• Hold accountable those that violate these standards.

• Present a sense of teamwork, that everyone is in thisPresent a sense of teamwork, that everyone is in thistogether.

• When hiring, do a thorough background check!


Fraud Prevention

Some ideas to mitigate risks associated with opportunity:

• Implement whistleblower policy that truly allows anonymous reportingreporting.

• Foster an open door policy environment.

• Discipline violators/wrong doers.

• Change it up! Management should ask for different reports from time to time.time to time.

• Ask questions and follow up on unanswered questions.


Fraud Prevention

Some ideas to mitigate risks associated with opportunity - Continued

• Monitor and Review – with decreased management and staff, theb i /b d d CFO d t l ti l ibusiness owner/board and CFO need to play a more active role inmonitoring operations.

• Business owners/Boards and CFOs should meet with the externaland internal auditors and ask what areas they feel are the highrisk , and what can be done.

Be sure that the policies and procedures are documented• Be sure that the policies and procedures are documented,understood, and enforced, especially in the high risk areas.


Fraud Prevention

Some ideas to mitigate risks associated with opportunity – Continued

• Enforce holidays, vacations and handover of work.

• Ensure that both physical access to the premises and computeraccess are appropriately limited or removed.

• Management/Owner/CFO review journal entry reports, payrollchange reports, bank reconciliations, receive bank statementsand investment statements unopened and review.

• If staffing is limited, segregation of duties can be a challenge, soadditional monitoring is needed in these areas.


Fraud Prevention

Separation of duties can be difficult in a small accounting/business office.

Suggestions for splitting up duties in 2, 3 and 4 person offices.

Quick Books - Set it up to take advantage of system controls and reports that can help prevent and detect fraud.


Fraud Prevention

Some ideas to mitigate risks associated with opportunity – Continued

• Perform a risk assessment to identify fixed assets that are mostlik l bj t t f d d d l it llikely subject to fraud and develop a security plan.

• Consider an outside IT risk review.

• Secure monies properly in a locked safe. Deposits should be madedaily.

• Get on line banking under control• Get on-line banking under control.


Protect bank accounts

Fraud PreventionProtect bank accounts

• Many businesses use at least some on-line banking tools. Be sure tofollow recommended computer/internet security practices.

• Definitely do not use “shared” user ids and passwords. If fraudhappens, how would you know who did it?

M thl t ili ti i t h f b k t th t• Monthly account reconciliation is not enough for bank accounts thathold high dollars or have frequent transactions. Better to reconciledaily.

• Consider setting up Positive Pay restrictions. Your bank will onlyaccept only the checks and ACH’s you tell them you have issued.Again, be careful of separating the duties of persons who create thechecks & ACH instructions and those who issue the Positive Paychecks & ACH instructions and those who issue the Positive Paylists.


Fraud Prevention

Protect bank accounts - Continued

• Wires – Set up meaningful verification processes. Set up specificwire instructions with your bank as to the telephone # and personwire instructions with your bank as to the telephone # and personthey can speak to verify wire instructions.

• Bank account changes - Set up similar verification procedures foryour bank to confirm that administrative changes to your accountsare authorized.

• Consider setting up restricted funds transfer lists with your bank.Consider setting up restricted funds transfer lists with your bank.(For A/C # XXXX, funds may be transferred only to A/C # YYYYYand A/C # ZZZZ)

Although fraud controls do not prevent all fraud, they do greatly reduce the loss. Additionally, on average, the fraud was detected 7 months sooner than in organizations that did not have the control in place.

Control Percent of Cases Implemented Control In Place Control Not In Place Percent ReductionHotline 48.6% $100,000 $245,000 59.2%E l S P 44 5% $100 000 $244 000 59 0%

Median Loss Based on Presence of Anti‐Fraud Controls

Employee Support Programs 44.5% $100,000 $244,000 59.0%Surprise Audits 26.2% $27,000 $200,000 51.5%Fraud Training for Employees 30.6% $100,000 $200,000 50.0%Fraud Training for Management/Execs 41.5% $100,000 $200,000 50.0%g g / $ , $ ,Job Rotation/Mandatory Vacation 14.0% $100,000 $165,000 46.8%Code of Conduct 0.2% $140,000 $262,000 46.6%Anti‐Fraud Policy 30.0% $120,000 $200,000 40.0%Management Review 53 3% $120 000 $200 000 40 0%Management Review 53.3% $120,000 $200,000 40.0%External Audit of ICOFR 50.3% $140,000 $215,000 34.2%Internal Audit/FE Department 0.4% $145,000 $200,000 30.6%Independent Audit Committee 53.2% $140,000 $200,000 30.0%Management Certification of F/S 58.2% $150,000 $200,000 25.0%External Audit of F/S 76.1% $150,000 $200,000 25.0%Rewards for Whistleblowers 7.4% $112,000 $155,000 23.2%

Tips are by far the most frequent way that fraud is found.

Hotlines are an effective way to facilitate the collection of tips.

Fraud

What to do if you See or Suspect Fraud

1 Call the attorney1. Call the attorney

2. Call the Owner, President of the Board/Finance Committee

3. Call the CPA firm.

4. Call your insurance company

5. Then make the decision with your trusted advisors what the nextstep is.

6 I t ill d ti th t l6. In most cases, company will end up reporting the case to lawenforcement. In order to prosecute, the case will need to bethoroughly documented and evidence preserved.

Final ThoughtsFinal ThoughtsSevere economic pressures can cause previously honest people tobecome dishonestbecome dishonest.

Fewer people normally result in poorer segregation of duties.

This is overcome by more owner/board and management oversight,either real or perceived.

As the economy recovers and businesses get busier the controls thatAs the economy recovers and businesses get busier, the controls thatwere weakened during the recession will be under even more stress.

Fix weak controls before a fraud event happens!

Good controls keep honest people honest!

Questions?

B i D M d b d@dbbllBrian DuMond – [email protected]

Cathy Casler – [email protected]

fraud risks in a challenging economy dbb 072811

Business

internal controls th

t p t t y organizationbrian

occupational fraud

reported victim of fraud

yourwh t

reported fraud incidents

increased fraud risks

risk of fraud maynot