Study Launched to Evaluate Fraud Prevention and Fraud Detection Strategies - Invitation to Participate

Vonya Global will soon launch their bi-annual study on corporate strategies to address Fraud Prevention, Fraud Detection, and Fraud Deterrence. The Executive Study on the Strategic Plan for Fraud Prevention, Fraud Detection, and Fraud Deterrence compiles the opinions of Executives and Internal Auditors from private, public, and not-for-profit organizations, spanning many industries.

Historically, there have been several studies conducted about fraud and fraud statistics, but few that deal directly with the strategic plans to manage fraud risks. The timing of this study is appropriate due to the heightened sensitivity to fraud risk based on the economic conditions. It seems more groups, including regulatory bodies, investors, clients, and suppliers are increasingly concerned about the ability to demonstrate effective fraud prevention and fraud detection strategies.

"Companies should do more to deter and detect fraud. Costs go far beyond the simple dollars someone steals or gains through materially misstated financial statements. Loss to employees and stockholders can be substantial.” – a response from the 2009 Study

PARTICIPANTS WANTED
Vonya Global is currently seeking volunteers to participate in the study. Participation in the study will take roughly 15 minutes and all responses will be anonymous. To enroll in the study please visit Fraud Study. As a reward for participating, volunteers will be provided special access to the results and will be invited to a member’s only webinar.

MEDIA SPONSORS
Vonya Global is currently evaluating Media Sponsorship. The Media Sponsor will be provided rights to the distribution of the results and acknowledgment in the final report. It is expected that the final report will be ready by well over 5,000 executives in over 75 countries. To inquire about sponsorship please visit Fraud Study. Click on the link to send an email and list "Study Sponsorship" in the subject line.

A Project for 2011... maybe for Internal Auditors: Reviewing Corporate Policies and Procedures

Are Policies and Procedures important? We certainly think so, unfortunately many companies have old, outdated Policy and Procedure manuals while some have none at all. As companies and internal audit departments are planning projects for 2011, consideration should be given to reviewing and updating the Corporate Policies and Procedures.

Policies and Procedures are a company’s way of documenting and communicating management’s vision into instructions for employees on how to handle issues as they arise and how employees should be executing their job responsibilities in a consistent manner.

Written Policies communicate:

• Company Rules in simple language
• Delegation of Authority
• Enforcement and consequences if not followed
• Impartial administration of company-wide Policy
• Evidence for Governance, if legally approved and followed

Procedures communicate:

• Clear guideline on how to implement a policy
• Establish boundaries for employees

While Policies are general in nature, Procedures provide the details as to what to do, often with examples and forms. Sometimes procedures include emergency steps.

By creating a Policy and Procedure Manual, the company provides a source for all employees to turn for guidance on standard matters and have management focus on exception handling and not need to waste time on day-to-day operations.

Successful Policy and Procedure Manuals require reviews and updates as laws and company environments change. Their dynamic nature requires work but overall it eliminates the redundant need for repeated instructions through time consuming meetings, memos or other correspondence.

Policies and Procedures should be assigned to a position within the company, for example the Finance Manual should be “owned” by the highest Finance position within the company, such as the CFO, and the Employee Handbook by the highest HR position such as the HR Director, etc. Policies should cover the key activities which need to be customized for each organization.

The objective is to create easy to understand policies and procedures that provide clear guidelines for everyone to follow.

Need a hand? We would be glad to help, just give us a call.

Strategic Planning for 2011? Changes in Business Can Compromise the Effectiveness of Internal Controls

If we have learned anything from the Sarbanes-Oxley era and the scandals that brought down the economy, it is that internal controls have to be effective. The first step is control design. When done properly, the design will include preventive controls to preclude undesirable activities and detective controls to alert management when exceptions occur. An appropriate design of preventive and detective controls is critical, but not sufficient. Control environments are dynamic. Changes in the business often result in workload shifts. When this happens, roles and assignments are informally swapped to make the work load more equitable. As informal process changes evolve, the control design is often unintentionally compromised, sometimes with significant consequences.

For example, an Accounts Payable Manager has the responsibility to review all vendor master file changes before payments to vendors are made. However, if the Accounts Payable Manager is suddenly swamped with a new system implementation she may not have the time to review the master file changes and she may not be available when the payable checks are ready.

In situations like this, the Accounts Payable Manager might assign the vendor master file review to an employee who is responsible for processing checks but does not have system access to enter invoices. On the surface, this appears to be a viable alternative since the responsibilities for invoice processing and vendor change review are segregated. However, this informal role change has just compromised the control system.

What happens if this employee creates an invoice from a fictitious vendor? Since the employee has been given the responsibility to review new vendor additions, the fictitious vendor is not questioned. After the invoices are processed, she simply prints the check and pockets the payment.

This is only one example to illustrate how a “quick fix” may not be in the best interests of the company. Informal reassignments are common as new pressures develop. When workloads shift, it is worth the time to review the internal control design in total. If there is no time for a total control design reevaluation, enlist the help of the Internal Audit department. In any case, when responsibilities are reassigned make sure that there are adequate mitigating controls throughout the entire process. Having “trusted” employees does not always protect against errors or fraud.

‘Tis the Season to be Internal Audit Planning

As the holiday season is rapidly approaching, good tidings are regularly shared as should be the case.  It is time to be joyous and celebratory for the year that was and hopeful for the year that shall come.

It is also a time for Internal Auditors to take stock in their year that was and plan for the year that shall come.  I presume most Internal Audit Departments have completed their annual risk assessment, are trying to wrap up any remaining items from the 2010 Internal Audit schedule, and are putting together their 2011 Internal Audit Plan.

Here are some questions I recommend Internal Auditors ask themselves:

• How has the economy impacted the audits I complete?
• How responsive is my audit plan to changes in risks?
• How was the 2010 plan better than the 2009 plan and how is 2011 going to improve upon 2010?
• What were my significant accomplishments in 2010?
• Were these accomplishments significant to only me or did they have a profound impact on the company?
• What significant accomplishments are going to be made from the 2011 audit plan?
• How is the 2011 audit plan going to enhance the strategic relevance of Internal Audit?

The easiest thing to do is keep everything the “same as last year” - and there could be logic in it like... the economic conditions, staffing shortages, resource constraints, regulatory requirements, and so on.  But, the CEO can’t go to the Board and say "the company's 2011 strategic plan is the same as our 2010 plan" and neither should the Internal Auditor.  Take whatever flexibility you have and think strategic, think relevance, and think profound impact.  Successfully do that now and in 12 months the 2012 planning will become much more fun!

For more information on Internal Audit’s strategic role please review The 2010 Report on the Strategic Role of Internal Audit.

Maximizing the Asset: Inventory Management in a Sluggish Economy

If you are experiencing shrinking margins, cash flow may become your primary concern. Increased sales will produce increased cash input, but purchases and investments lead to cash outlays, and what about inventory? Inventory sits in the warehouse. Inventory not only freezes cash flow but generates expense by requiring handling and storage space. Unless it is on the way out the door to a customer, inventory contributes nothing of value to an organization.

Inventory management is a tradeoff between the ability to meet customer expectations and the necessity of keeping assets fluid to meet unexpected demands and higher costs. Before investing in more storage space or warehouse management tools, consider using resources in ways to decrease inventory.

1. Time is money
The inventory level needed to achieve a given customer fill rate is roughly related to the square root of the lead time. That means that if all other impacts are the same, inventory levels can decrease by 50% when the lead time shortens from four weeks to one week.

One of the strategies to reduce lead time is to develop the ability to customize products at the final stages of production. This allows for the flexibility needed to respond to changes in customer demand. This not only reduces the lead time, but decreases the risk of producing the wrong products.

2. Forecasts are always wrong
Forecasts, by definition, will always be wrong. If forecasting must be used, avoid using financial projections to plan production. Although finance is a vital function in any organization, financial projections do not capture demand. Understanding demand is the key to having the right products in the right places. If a demand forecasting and deployment system is not in the budget, a simpler spreadsheet model can be used quite effectively. Even better, develop relationships with customers to directly access their needs.

3. Negotiate with vendors
Many vendors will manage inventories. Some will replenish daily, leaving only a small safety stock on the premises.

4. Standardize components
Fewer components needed across product lines mean a lower overall inventory. Examine the bills of material for similar types of components and work with engineering to consolidate wherever possible.

5. Get rid of obsolete products and components
Obsolete parts take up valuable space and require handling. If a component is custom made and may be used in the future to service product, move it to after-market stocks. Otherwise, find a buyer on the internet or simply throw the parts away.

The value of an investment in inventory is measured only by how quickly it disappears. The optimal amount of inventory is no inventory at all. This is not a realistic expectation, so the next best strategy is to minimize it wherever possible.

To conduct an audit of your inventory management process, give us a call.

Internal Audit - Adding Value in the Not-for-Profit World

While not-for-profit organizations perform many of the same accounting functions as public corporations, not-for-profits are inherently different in many ways and require a unique Internal Audit focus. In 2006, the American Society of Association Executives (ASAE) published the results of a research project undertaken by The Center for Association Leadership to identify characteristics of the most successful not-for-profit organizations. The study found the following factors to be common in the most successful associations: Commitment to Purpose, Commitment to Analysis and Feedback, and Commitment to Action.

By focusing on the conclusions of this study, auditors can go beyond assurance and provide insight that will help to identify and mitigate risk. An entity level assessment should ask questions to identify the risks associated with each factor listed above.

Commitment to Purpose
A successful organization aligns its products and services with a customer focused mission. Its reason for being is measured by its relevance to the customers and/or members. Questions for auditors to ask include:

• Are strategies aligned with the interests of the customer and/or member before the generation of revenue or the promotion of an image?
• How can upcoming changes in the external environment affect the commitment to the mission? Are underlying values constant?
• Does the association periodically and clearly define the customer? Does it best serve the customers and/or membership directly or through chapter organizations? Are the needs of special interest groups being prioritized effectively?

Commitment to Analysis and Feedback
Communication and data-driven strategies are vital to the success of a not-for-profit organization. The organization should be the ultimate authority concerning the needs and issues of its customers and/or members as well as the state of the business environment. To evaluate the risk associated with poor analysis and feedback, the following questions will be helpful:

• Are initiatives and strategic goals supported by data and research?
• How is information shared throughout the organization? Are all levels of employees actively involved?
• Are computer systems and models appropriate and sufficient?

Commitment to Action
A successful organization is flexible and adapts quickly to crisis situations. For not-for-profits, these situations typically involve a financial setback or a leadership void. Leading not-for-profit organizations also actively pursue alliance opportunities that will leverage services for the membership. The following questions assess the organization’s commitment to continuous improvement and adaptability:

• Does the organization have an action plan that will support quick decision-making in the event of a crisis?
• Are there “sacred cow” programs or services that cannot be changed?
• How does the organization identify and evaluate potential alliances?

Internal Audit has a responsibility to monitor risks particular to the not-for-profit environment. By using the 2006 study as a guideline, a partnership between audit and organization leadership can help foster success and better results for the membership community.

Data Analytics: Providing Greater Internal Audit Depth During A Turbulent Economy

Data Analysis through Computer Assisted Audit Techniques (CAATs) is an efficient way to test transactions, providing 100% assurance on the effectiveness of Internal Controls. Using basic tools such as Microsoft Excel and Access, advanced tools such as ACL or IDEA, or the tools embedded in ERP applications has been a best practice for years but has often been viewed as a luxury, not a necessity. This year, during this economy, using CAATs has become absolutely critical.

Obviously budget pressures have gone through the roof, resulting in massive global layoffs. Reductions in work force, especially to the accounting department, create enormous pressure on the employees who remain. Requiring employees to take on more responsibility often increases the likelihood of errors and misstatements. Added pressures like salary freezes combined with less oversight can tempt an otherwise honest employee to cut corners or commit fraud. The risk of financial misstatement doesn’t get any higher.

A critical way to respond to these challenges is to increase (or initiate) the use of data analytics. This approach evaluates and monitors data from every transaction processed by a company to identify anomalies. Applying data analytics to review transactions in accounts payable, advertising, freight, health benefits, construction, and other areas can yield hundreds of thousands or more in savings and recoveries. When this process is done by management instead of internal audit, errors are identified sooner and with more precision.

CAATs have been around for more than 20 years and those experienced in using CAATs have had experience ranging from good to fabulous. Unfortunately CAATs have typically been used only by Internal Audit Departments and only on selected audit projects. The inconsistent usages of CAATs make it difficult to maintain the knowledge and experience to make CAATs a regular and sustainable part of the audit process.

With the status of the economy, CAATs have become an essential part of effective Corporate Governance. The first step is gaining the basic knowledge to make CAATs part of the oversight process. The second step is sharing the knowledge throughout the Internal Audit department and management ranks. The third step is imbedding the process into the fabric of the organization to make it sustainable and continuous. Getting more oversight with less effort is possible today by simply leveraging CAATs, a technology most companies already employ.

To learn more about how to make CAATs a routine part of the audit process, please contact Vonya Global for a free consultation. Leveraging readily available software tools in combination with proprietary methodologies, our team of data analysis experts focus data analytics at common problem areas to help our clients recover overpayments and develop a sustainable approach to continuous auditing.

ACL is a registered trademark of ACL Corporation and IDEA is a registered trademark of Caseware IDEA.

---

This article was contributed by Joe Oringel and Kim Jones of Visual Risk IQ, a thought leader in Continuous Auditing and Monitoring. For more information on Visual Risk IQ, please visit their web site at www.visualriskiq.com.