Responding to Fraud Risk: the CAE’s Role

Background: The Association of Certified Fraud Examiners (ACFE) conducts a bi-annual study on fraud investigations, the results of which get summarized in the ACFE Report to the Nation. The most recent report was issued in 2008 and revealed the following:

- U.S. organizations lose 7% of their annual revenues to fraud
- There is approximately $994 billion in fraud losses each year
- Fraud schemes typically last for at least 2 years before they are caught
- Corruption was the #1 scheme at 27% of all reported fraud cases
- False Billing was the #2 scheme at 24% of all reported fraud cases
- Frauds are most likely to be uncovered by a “tip” rather than any other method, including audit
- Roughly 38% of Frauds happened at small companies (>100 employees)
- Roughly 42% of Frauds happened at large companies (1,000+ employees)
- Roughly 39% of Frauds happened at Private Companies
- Roughly 28% of Frauds happened at Public Companies

What these statistics prove is while fraud may not happen at every company; no company is immune to fraud risk. As an inherent risk to business, fraud should be included in Enterprise Risk Management (ERM). Methods for managing and controlling the risk of fraud should include strategies for fraud prevention, fraud detection, and fraud deterrence.

The Chief Audit Executive (CAE) must be involved in the organizational anti-Fraud strategy. As with other business risks the CAE should be assessing Fraud Risk and evaluating the effectiveness of the anti-Fraud strategies. Here is a sample list of strategies:

Fraud Prevention

- Anti-Fraud Tone at the Top
- Strong Corporate Governance and Internal Control Environment
- Policies and Procedures to reflect mindset and actions
- Hire ethical employees (Background checks, signed forms, etc.)
- Code of Conduct – signed by every employee
- Conflict of Interest Statement (employees and business partners)

Fraud Detection

- Establish a Hotline
- Fraud Risk Assessment
- Fraud Penetration Study based on Schemes and Concealment Strategies
- Incorporate Fraud in every phase of an audit (SAS 99)
- Create/utilize a Red Flags Database
- Implement effective SOX Fraud Controls
- Data mine instead of sample testing
- Create a Toolkit including a resource roster of experts (Fraud expert, Investigator, Data mining, etc.)
- Continuously Monitor Transactions for possible Fraud

Fraud Deterrence

- Create an Internal Audit department
- Publicize Ethics Hotline
- Publicize Internal Fraud Cases and Punishment
- Publicize Continuous Monitoring Program

Vonya Global and the ACFE are not affiliated. Information in the opening paragraph is sourced from the ACFE 2008 Report to the Nation, which can be downloaded at the ACFE website.

NACD Directorship names its Top 50 Companies

The National Association of Corporate Directors magazine, "Directorship", has recently released its list of the top 50 "Best Performing, Best Governed Companies in the Fortune 500." Vonya Global applauds the publications effort to recognize the companies which place an emphasis on Corporate Governance, Ethics, Integrity, and Citizenship. There are hundreds of lists that rank companies based on revenue, profit margin, growth potential, and many other financial and non-financial metrics, but this is the first (and only that we know of) that includes these other, arguably more important metrics to the evaluation equation.

The article stated: "A great employer posts poor earnings or a great profit maker is not a terrific corporate citizen. These facts suggested that something should be done to recognize companies that are both far sighted in terms of corporate governance and producing returns for their shareholders."

The top rated company in the "Nifty Fifty" was Goldman Sachs and their CEO, Lloyd Blankfein, was named the "Directorship" CEO of the Year. Our heartfelt congratulations goes out to Mr. Blankfien and all the other companies which made it on the list.

Vonya Global and the NACD are not related organizations

The 2009 Ponzi Collapse

The great recession of 2009 brought with it 4 times the annual average of Ponzi scheme collapses (according to an AP report). Headlined by Bernie Madoff's $50 Billion blowout, there were over 150 Ponzi's revealed in 2009 compared to around 40 in 2008.

Was the Ponzi collapse a result of better governance or stricter enforcement? No. The economic situation created conditions which made it impossible for the schemes to continue. We still need better corporate governance, enhanced enforcement, and improved detection.

2009 - The Great Recession, 2010 - The Great Litigation?

An article this morning in the New York Times reported that 4.7 million cases were filed in the New York court system - the most cases ever filed. Most of these cases were either directly (bad debts and soured deals) or indirectly (domestic violence as a result of lost jobs and foreclosures) a result of the financial crisis. The article stated:

"Judges and lawyers say the tales behind any number of cases, including low-level offenses like turnstile jumping and petty theft, are often a barometer of bad times. And they said that the data showed that courts nationally would be working through the recession’s consequences for years, much as they did with the flood of cases stemming from the crack cocaine epidemic of the 1980s, even after the epidemic had slowed."

Read the article for yourself and make up your own mind -
NY Times Article.

Corporate Crime Task Force Created

It was announced on November 17th that President Obama's administration has created a Corporate Crime Task Force. U.S. Attorney General Eric H. Holder Jr. said, "Mortgages, securities and corporate fraud schemes have eroded the public's confidence in the nation's financial markets and have led to a growing sentiment that Wall Street does not play by the same rules as Main Street."

The L.A. Times reported, "The Financial Fraud Enforcement Task Force will attack what Holder called "unscrupulous executives, Ponzi scheme operators and common criminals" in much the same way that a similar task force created in 2002 by former President George W. Bush went after corporate malfeasance following the accounting scandals at Enron Corp. and WorldCom Inc."

The article continued: "The Fraud Enforcement and Recovery Act authorized $245 million annually in 2010 and 2011 to hire hundreds of prosecutors, agents and other federal officials to pursue financial fraud. It also strengthened and expanded money laundering laws and other statutes to apply to fraud committed by private mortgage lenders."

Is this something that should worry executives and corporate boards? Or... is this much ado about nothing?

A Proactive Response to Fraud Risk and Fraud Detection - The Fraud Penetration Study

One of the few truly proactive approaches to fraud prevention and detection, a Fraud Penetration Study is the application of specific audit procedures to increase the likelihood of detecting fraud in a core business system. Unlike the traditional audit approach, the Fraud Penetration Study does not focus on controls or control effectiveness, but rather the authenticity of the transaction.

There are six steps to the Fraud Penetration Study: Risk Identification, Scenario Development, Concealment Analysis, Scoping, Data Mining, and Fraud Analysis.

• Fraud risk identification starts with understanding the types of fraud risk. The starting point is accepting the concept of inherent fraud schemes. Once this concept is accepted, the auditor must understand how the scheme would occur in the specific business system; often times referred a fraud scenario.


• The fraud scenario is built from understanding the variations of the scheme based on the opportunities for fraud, entities involved, internal controls in place, and business processes currently performed. In essence, the fraud scenario is how the inherent fraud scheme would occur in a company’s business process.


• After the fraud scenario is developed, the auditor must identify and understand the common concealment strategies used to hide the fraud in this scenario. Common fraud concealment strategies are false documents, false representations and false approvals. The auditor should identify the red flags associated with the concealment strategies.


• The structure of the fraud scenario defines the audit scope for the audit plan. The audit plan may have several fraud scenarios, but each fraud scenario needs its own data mining plan and its own fraud audit procedures. Also, the audit plan provides the auditor with the necessary information to find and reveal the fraud scenario.


• Using a data mining tool like ACL(1) or IDEA(1), a sample of vendors would be selected consistent with the fraud data profile for the identified fraud scenario. Building the fraud data profile is the most important step in the fraud audit process. The goal is to select a biased and discreet number of transactions that are more likely to be fraudulent on which fraud audit procedures can be performed.


• The purpose of the fraud audit procedure is to gather evidence that is created and stored external to the perpetrator to form the basis of the Fraud Analysis. The procedure should be designed to pierce the concealment strategy. In the false billing scheme, the weakness of the concealment strategy is that the vendor does not exist. If the auditor develops an audit procedure to show that the entity does not exist, the concealment strategy will be unveiled, and the fraud exposed.

Using this methodology, you will find out if there is fraud in your business and if done well, you will find it within the first 3 days of analysis.

---

1 ACL is a registered trademark of ACL Corporation and IDEA is a registered trademark of Caseware IDEA.

Looking for Ghost Employees in a Retail Environment

Payroll Fraud, specifically “Ghost Employees” can create a significant financial burden on companies. How much? Well, according to Occupational Fraud and Abuse, by Joseph T. Wells, Obsidian Publishing Co. Inc., Ghost Employee Fraud has the highest median loss relative to all payroll fraud schemes at $275,000 per case. If it is happening at your company, it is hurting your company. Unfortunately for those of you in retail, you are one of the most susceptible.

What can be done?

A large retail organization, one of the Fortune 500 with well over 200,000 employees, has retained Vonya Global to search for Fraud in Payroll. Specifically we will be looking for Ghost Employees which (in our methodology) includes Fictitious Ghosts, No-Show Ghosts, Pre-employment Ghosts, Terminated Ghosts, Temporary Ghosts, Family/Friend Ghosts, and Temp Agency Ghosts.

Unlike an investigation, this project is a proactive approach to fraud detection. The company has no evidence or indication that payroll fraud is occurring, however they understand that based on their size and their industry they are susceptible. Our approach takes an inventory of all payroll data and files. Once we have all the information we will segregate it into groups with similar characteristics and through detailed data analysis we will identify anomalies. We are confident that we will identify Ghost Employees and as a result return hundreds of thousands of dollars to the company.

Contact us if you would like to find out more about this project or how we would help you identify fraud in your business.