Tag Archives: fraud management

A CDC for Cyber

I remember reading somewhere a few years back that Microsoft had commissioned a report which recommended that the U.S. government set up an entity akin to its Center for Disease Control but for cyber security.  An intriguing idea.  The trade press talks about malware and computer viruses and infections to describe self -replicating malicious code in the same way doctors talk about metastasizing cancers or the flu; likewise, as with public health, rather than focusing on prevention and detection, we often blame those who have become infected and try to retrospectively arrest/prosecute (cure) those responsible (the cancer cells, hackers) long after the original harm is done. Regarding cyber, what if we extended this paradigm and instead viewed global cyber security as an exercise in public health?

As I recall, the report pointed out that organizations such as the Centers for Disease Control in Atlanta and the World Health Organization in Geneva have over decades developed robust systems and objective methodologies for identifying and responding to public health threats; structures and frameworks that are far more developed than those existent in today’s cyber-security community. Given the many parallels between communicable human diseases and those affecting today’s technologies, there is also much fraud examiners and security professionals can learn from the public health model, an adaptable system capable of responding to an ever-changing array of pathogens around the world.

With cyber as with matters of public health, individual actions can only go so far. It’s great if an individual has excellent techniques of personal hygiene, but if everyone in that person’s town has the flu, eventually that individual will probably succumb as well. The comparison is relevant to the world of cyber threats. Individual responsibility and action can make an enormous difference in cyber security, but ultimately the only hope we have as a nation in responding to rapidly propagating threats across this planetary matrix of interconnected technologies is to construct new institutions to coordinate our response. A trusted, international cyber World Health Organization could foster cooperation and collaboration across companies, countries, and government agencies, a crucial step required to improve the overall public health of the networks driving the critical infrastructures in both our online and our off-line worlds.

Such a proposed cyber CDC could go a long way toward counteracting the technological risks our country faces today and could serve a critical role in improving the overall public health of the networks driving the critical infrastructures of our world. A cyber CDC could fulfill many roles that are carried out today only on an ad hoc basis, if at all, including:

• Education — providing members of the public with proven methods of cyber hygiene to protect themselves;
• Network monitoring — detection of infection and outbreaks of malware in cyberspace;
• Epidemiology — using public health methodologies to study digital cyber disease propagation and provide guidance on response and remediation;
• Immunization — helping to ‘vaccinate’ companies and the public against known threats through software patches and system updates;
• Incident response — dispatching experts as required and coordinating national and global efforts to isolate the sources of online infection and treat those affected.

While there are many organizations, both governmental and non-governmental, that focus on the above tasks, no single entity owns them all. It is through these gaps in effort and coordination that cyber risks continue to mount. An epidemiological approach to our growing technological risks is required to get to the source of malware infections, as was the case in the fight against malaria. For decades, all medical efforts focused in vain on treating the disease in those already infected. But it wasn’t until epidemiologists realized the malady was spread by mosquitoes breeding in still pools of water that genuine progress was made in the fight against the disease. By draining the pools where mosquitoes and their larvae grow, epidemiologists deprived them of an important breeding ground, thus reducing the spread of malaria. What stagnant pools can we drain in cyberspace to achieve a comparable result? The answer represents the yet unanswered challenge.

There is another major challenge a cyber CDC would face: most of those who are sick have no idea they are walking around infected, spreading disease to others. Whereas malaria patients develop fever, sweats, nausea, and difficulty breathing, important symptoms of their illness, infected computer users may be completely asymptomatic. This significant difference is evidenced by the fact that the overwhelming majority of those with infected devices have no idea there is malware on their machines nor that they might have even joined a botnet army. Even in the corporate world, with the average time to detection of a network breach now at 210 days, most companies have no idea their most prized assets, whether intellectual property or a factory’s machinery, have been compromised. The only thing worse than being hacked is being hacked and not knowing about it. If you don’t know you’re sick, how can you possibly get treatment? Moreover, how can we prevent digital disease propagation if carriers of these maladies don’t realize they are infecting others?

Addressing these issues could be a key area of import for any proposed cyber CDC and fundamental to future communal safety and that of critical information infrastructures. Cyber-security researchers have pointed out the obvious Achilles’ heel of the modern technology infused world, the fact that today everything is either run by computers (or will be) and that everything is reliant on these computers continuing to work. The challenge is that we must have some way of continuing to work even if all the computers fail. Were our information systems to crash on a mass scale, there would be no trading on financial markets, no taking money from ATMs, no telephone network, and no pumping gas. If these core building blocks of our society were to suddenly give way, what would humanity’s backup plan be? The answer is simply, we don’t now have one.

Complicating all this from a law enforcement and fraud investigation perspective is that black hats generally benefit from technology long before defenders and investigators ever do. The successful ones have nearly unlimited budgets and don’t have to deal with internal bureaucracies, approval processes, or legal constraints. But there are other systemic issues that give criminals the upper hand, particularly around jurisdiction and international law. In a matter of minutes, the perpetrator of an online crime can virtually visit six different countries, hopping from server to server and continent to continent in an instant. But what about the police who must follow the digital evidence trail to investigate the matter?  As with all government activities, policies, and procedures, regulations must be followed. Trans-border cyber-attacks raise serious jurisdictional issues, not just for an individual police department, but for the entire institution of policing as currently formulated. A cop in Baltimore has no authority to compel an ISP in Paris to provide evidence, nor can he make an arrest on the right bank. That can only be done by request, government to government, often via mutual legal assistance treaties. The abysmally slow pace of international law means it commonly takes years for police to get evidence from overseas (years in a world in which digital evidence can be destroyed in seconds). Worse, most countries still do not even have cyber-crime laws on the books, meaning that criminals can act with impunity making response through a coordinating entity like a cyber-CDC more valuable to the U.S. specifically and to the world in general.

Experts have pointed out that we’re engaged in a technological arms race, an arms race between people who are using technology for good and those who are using it for ill. The challenge is that nefarious uses of technology are scaling exponentially in ways that our current systems of protection have simply not matched.  The point is, if we are to survive the progress offered by our technologies and enjoy their benefits, we must first develop adaptive mechanisms of security that can match or exceed the exponential pace of the threats confronting us. On this most important of imperatives, there is unambiguously no time to lose.

The Right Question, the Right Way

As every CFE knows, an integral part of the fraud examination process involves obtaining information from people. Regardless of the interview’s objective, all CFEs should embrace the role of interviewer and use the time-tested techniques recommended to us by the ACFE. But asking the right questions does not necessarily ensure key information will be uncovered; an effective interviewer also recognizes the need to separate truth from deception. Consequently, crafting effective questions, understanding the communication dynamics at play, actively participating in the interview process, and remaining alert to signs of deception will help examiners increase the effectiveness and efficiency of our interviews and of our overall engagements.

Some interviewers try to gather as much information using as few questions as possible and end up receiving convoluted or vague responses. Others seek confirmation of every detail, which can quickly turn an interview into an unproductive probing of minutia. Balancing thoroughness and efficiency is imperative to obtaining the necessary and relevant facts without overburdening the interviewee. Because the location of this line varies by interviewee, CFEs can find this balance most effectively by ensuring they ask only clear questions throughout the interview.

Some individuals might respond to a question in a way that doesn’t provide a direct answer or that veers off topic. Sometimes these responses are innocent; sometimes they are not. To make the most of an interview, examiners must remain in control of the situation, regardless of how the interviewee responds.  Being assertive does not require being impolite, however. In some instances, wording questions as a subtle command (e.g., “Tell me about…. or “Please describe….) can help establish the interview relationship. Additionally, remaining in control does not mean dissuading the interviewee from exploring pertinent topics that are outside the planned discussion points.  Interview questions can be structured in several ways, each with its own strengths, weaknesses, and ideal usage. Open questions ask the interviewee to describe or explain something. Most examination interviews should rely heavily on open questions, as these provide the best view of how things operate and the perspective of the staff member involved in a particular area. They also enable the reviewer to observe the interviewee’s demeanor and attitude, which can provide additional information about specific issues. However, if the CFE believes an individual might not stay on topic or may avoid providing certain information, open questions should be used cautiously.  In contrast, closed questions can be answered with a specific, definitive response, most often “yes” or “no.” They are not meant to provide the big picture but can be useful in gathering details such as amounts and dates. Examiners should use closed questions sparingly in an informational interview, as they do not encourage the flow of information as effectively as open questions.

Occasionally, the questioner might want to direct the interviewee toward a specific point or evoke a certain reply. Leading questions can be useful in such circumstances by exploring an assumption, a fact or piece of information, that the interviewee did not provide previously. When used appropriately, such questions can help the interviewer confirm facts that the interviewee might be hesitant to discuss. Examples of leading questions include: “So there have been no changes in the process since last year?” and “You sign off on these exception reports, correct?” If the interviewee does not deny the assumption, then the fact is confirmed. However,  before using leading questions, the interviewer should raise the topic with open questions and allow the interviewee the chance to volunteer information.

The examiner should establish and maintain an appropriate level of eye contact with the interviewee throughout the interview to personalize the interaction and build rapport. However, the appropriate level of eye contact varies by culture and even by person; consequently, the examiner should pay attention to the interviewee to determine the level of eye contact that makes him or her comfortable.

People tend to mirror each other’s body language subconsciously as a way of bonding and creating rapport. CFEs can help put interviewees at ease by subtly reflecting their body language. Further, the skilled interviewer can assess the level of rapport established by changing posture and by watching the interviewee’s response. This information can help CFEs determine whether to move into sensitive areas of questioning or to continue establishing a connection with the individual.

Confirming periodically that the examiner is listening can encourage interviewees to continue talking. For example, the interviewer can provide auditory confirmation with a simple “mmm hmmm” and nonverbal confirmation by nodding or leaning toward the interviewee during his or her response.

When the interviewee finishes a narrative response, the examiner can encourage additional information by echoing back the last point the person made. This confirms that the interviewer is actively listening and absorbing the information, and it provides a starting point for the person to continue the response.

Occasionally, the examiner might summarize the information provided to that point so that the interviewee can affirm, clarify, or correct the interviewer’s understanding.

Most often, the greatest impediment to an effective interview is the interviewer him or herself.  While it is clearly important for the interviewer to observe, to listen, and to assess the subject in a variety of ways, the role of the interviewer, and the effect he or she has on the interview process, cannot be minimized.

The interviewer typically focuses on the subject as the person who will provide the information he or she seeks. The interviewer concentrates on establishing rapport, listening effectively, analyzing the subject’s verbal and nonverbal communication, and gauging how much or how little the subject is telling her. These are valid areas of concentration for the interviewer. One significant risk is that the interviewer may pay too little attention to the negative influences s/he can bring to the interview, process. The terms interview and communication are interchangeable, and effective communication is a two-way street. What makes the interviewer an effective communicator and effective interviewer is not just the signals he or she picks up from the subject but also the signals, the information, the tone, and the body language he or she sends to the subject. It is highly presumptuous of the interviewer to think he or she has little or no effect on the subject and that the subject is not evaluating, assessing, and analyzing the interviewer.

The interviewer’s style of dress, jewelry, and grooming may tell the subject as much about the interviewer as does the interviewer’s demeanor. If the interviewer is overdressed for the occasion, does it make the subject feel inferior or intimidated? If too casual, does the interviewer send a signal of the lack of importance of the interview and, as a result, does the subject become too relaxed or not as attentive? Attire should have a desired effect. For example, when interviewing an enforcement officer or other professional who is familiar with uniforms and clothing as indicators of status, it may be appropriate to wear a coat and tie. In general, it is best to always to err on the side of conservative dress for the circumstances.

The examiner should not attempt to interview two or more persons at one time unless there is no other option. It is more difficult to control an interview with two or more subjects. One subject may be more dominant than the other. The subjects will influence each other’s memories. Some subjects will not want to embarrass themselves in front of a peer or supervisor. The environment for confidential communications will be adversely affected.

When the interviewer responds to the subject’s responses, he sends signals. At times, it might be advisable to not write notes down at the time the individual tells the interviewer something sensitive. Rather, the interviewer might consider devoting his attention to the subject and writing down the sensitive information after the conversation has moved away from the sensitive area.  The interviewer should never become argumentative, antagonistic, or belligerent. The use of the  “Good Cop, Bad Cop” routine can have unwanted results, especially long term. The CFE interviewer should use tact, speak clearly and with authority but without use of threatening language. The interviewer should consistently set a professional tone.

Finally, all individuals want to be shown respect. Maintaining the personal dignity of the subject is critical for the success of the interview and follow-up efforts. Everyone wants respect, from homeless persons to top executives. To be shown respect, especially if the subject is not accustomed to it, is disarming and contributes to that essential, professional tone.

Not Just the Hotline

Prior to our Chapter’s last scheduled live training event, I was invited as a presenter to an orientation session for a group of employees serving as staff to a local government fraud, waste and abuse hotline. Anonymous communications, often called “tips,” may take various forms, including a posted letter, telephone call, fax, or e-mail. Long gone are the days when any governmental or private organization receiving such a communication would feel comfortable disregarding it. In today’s environment, such communications are almost always taken seriously, and significant efforts are made to resolve every credible allegation. By their very nature, such investigations are triggered suddenly and generally require a prompt and decisive response, even if only to establish that the allegations are unfounded or purely mischievous. The allegations may be in the form of general statements or they may be very specific, identifying names, documents, situations, transactions, or issues. From the CFE’s or forensic investigator’s perspective, no matter what form they take or how they are received, anonymous communications addressed to the client can pose challenging investigative issues in themselves whose complexity is often under-estimated.

The initiators of such tips can be motivated by a variety of factors, which range from the possibility of monetary gain (substantial monetary recovery is available to whistleblowers under the U.S. False Claims Act), to moral outrage, to genuine concern over an issue or simply from the desire of a disgruntled employee to air an issue or undermine a colleague. Adding to the complication, legislation such as Sarbanes-Oxley and the raft of on-going private and governmental scandals, the increased scrutiny of health care providers and of defense contractors have all served to raise public awareness of whistle-blower programs specifically and of the importance of anonymous reporting mechanisms in general.

With hotlines now so ubiquitous, it’s equally important for investigators to be aware that anonymous tips come in not only to formal public hotlines but in a wide variety of forms and through many channels; such communications can come addressed to various individuals and groups within the company or to outside entities, to government agencies, and even via outside news agencies. Typical recipients within the company of non-hotline tips can be expected to be legal counsel, audit committee members, senior management, department supervisors, human resources managers and the compliance or ethics officer. A tip may take the form of a typical business letter addressed to the company, an e-mail (usually from a nontraceable account), or an official internal complaint. It may also duplicate tips submitted to news agencies, competitors, web site postings, chat rooms, or government agencies. It may also be a message to an internal ethics hotline phone number. Whatever form it takes, a tip may contain allegations that, while factually correct at its core, may also include embellishments or inaccurate information, wildly emotional allegations, or poor grammar. Further, the communication structure of the tip may be disorganized, repetitive, display unprioritized thoughts and mix key issues with irrelevant matters and unsupported subjective opinions. In other cases, while the tip’s information about specific issues may not be correct, it may contain a grain of truth or may identify elements of several unrelated but potentially troubling issues.

In some situations, the allegations aired in an anonymous tip may be known within the company and labeled as rumors or gossip. Some whistle-blowers are neither gossip hounds nor disgruntled employees but, rather, frustrated employees who have tried to engage management about a problem and have gone unheard. Only then do they file a complaint by sending a letter or an e-mail or by making a phone call.  While one should never leap to a specific conclusion upon receipt of an anonymous communication, inaction is never a recommended option. One of the dangers of ignoring an anonymous tip that wasn’t initially received via the hotline is that a situation that can be satisfactorily addressed with prompt action at lower levels or locally within the organization may become elevated to higher levels or to third parties and even to regulatory bodies outside the entity because the whistle-blower believes the communication has been side-lined or shunted aside. This can have damaging consequences for an organization’s reputation and brands if the allegations become public or attract media attention and a cover-up appears to have occurred, however well-intentioned the organization may have been. Ignoring an anonymous tip also may negatively impact staff morale and motivation, if suspicions of impropriety are widespread among staff and it appears that the employer is uninterested or doing nothing to rectify the situation. Ultimately, management may leave itself open to criticism or perhaps the danger of regulatory censure or legal action by stakeholders or authorities if it cannot demonstrate that it has given due consideration to the issues raised in an anonymous communication.

Once notified by a client of the receipt of an anonymous tip, the CFE or forensic accounting investigator should obtain an understanding of all the circumstances of that receipt. While the circumstances on the surface may appear unremarkable and trivial, that information is often a key factor in determining the best approach to dealing with a tip and, more broadly, often provides clues that are helpful in other areas. Initial facts and circumstances to be established include:

• How? This refers to how the information was conveyed—for example, whether it was in a letter, phone call, or e-mail and whether the letter was handwritten or typed. Additionally, the forensic accounting investigator seeks to determine whether the message includes copies of corporate documents or references to specific documents and whether the tip is anonymous, refers to individuals, or is signed.
• When? This includes establishing the date on which the message was received by the entity, the date of the tip, and in the case of a letter, the postmark date and postmark location.
• Where? This involves establishing where the tip was sent from, be it a post office, overseas, a private residence, within the office, a sender’s fax number, or an e-mail account.
• Who? To whom was the tip sent? Was it a general reference such as “To whom it may concern”? A specific individual? A department such as the head office or internal audit? The president’s office? The press? A competitor? Sometimes an anonymous notification will indicate that another entity has been copied on the document; this requires verification. Always consider the possibility that the tip may have been sent to the auditor and/or to the U.S. Securities and Exchange Commission.
• What? This refers to understanding the allegations and organizing them by issue. Often, a tip will contain many allegations that are variations on the same issue or that link to a common issue. For this reason, it is often helpful to formally summarize in writing the tip by issues and related sub-issues. Does the information in the tip contain information that may be known only to a certain location or department? If so, that may point to a group of individuals or former employees as the source of the tip.
• Why? What is the possible motivation for the tip? Issues with misreporting financial information? Ethical decisions? Disgruntled employee? Former employee airing grievances?

For many organizations, whistle-blower communications have become almost daily phenomena. But many of the most serious allegations don’t arrive via a hotline.  This is largely because in the wake of corporate scandals, lawmakers and ethics authorities are responding to public concern by encouraging employee monitoring of corporate ethics and affording some statutory protections for whistle-blowers. Dealing with the unexpected anonymous tip that triggers a CFE conducted investigation can be a challenging matter, even for the most seasoned investigator. Objective analysis and the strategic approach taken by professionals skilled in corporate investigations can assist clients in successfully addressing issues that may have serious legal and financial implications. Protection of employees from retaliatory action and the
company’s need to decide whether and to whom to disclose information are among the many issues created by the receipt of anonymous tips.  For the CFE, the key to resolving cases of anonymous tips usually involves a detailed examination of copious amounts of data obtained from various sources such as interviews, public records searches, data mining, hard-copy document review, and electronic discovery. A careful, experience-based investigative strategy is imperative to address the circumstances surrounding the transmittal and receipt of any anonymous tip and to tackle its allegations prudently and thoroughly.

Asked and Answered

Some months ago, I was involved as a member of an out-of-town fraud examination team during which the question of note taking during an investigative interview arose. A younger member of the team (a junior internal auditor) wanted to know about approaches to the documentation of not just one, but possibly of the several prospective interview sessions it initially appeared might be necessary regarding the examination.

As the ACFE tells us, notes, whether handwritten or recorded, always send an unambiguous signal to the subject that the interviewer is memorializing his or her comments. Interviews without notes are significantly limited in their value and may even signal to the interview subject that it may later be just a question of her word against the interviewer’s. If the interviewer takes only cryptic or shorthand notes and later reviews those notes with the subject to confirm what was said, the interviewer should recognize that the notes, while confirmed and edited to a certain extent, will still be less than complete.

On the other hand, tape recording an interview is a significant obstacle to full cooperation. People are reluctant to be recorded. For the most part, the use of tape recorders to take notes is not recommended in situations involving a potential fraud. Most subjects will resist the use of recorders and, even in circumstances where the subject may have agreed to their use, their responses will be more guarded than if a recorder was not used. If a recorder is used, be sure to begin the taping by recording the date, time, names of the individuals present, and an acknowledgment by the subject that they know the interview is being recorded and they have agreed to be recorded.

Once the interviewer has determined how s/he will document the interview, s/he should ask the subject if it is okay to take notes or record the session. It is the polite and professional thing to do and it serves two purposes:

–It is part of the process by which the subject is encouraged to be a participant;
–If the subject balks or tells the interviewer she does mind that the interviewer takes notes, it can open a line of questioning by the interviewer to determine the exact cause of the subject’s objections;

The subject should always be advised that note taking is critical to the integrity of the process and that notes ensure that what the subject says is documented properly. Failure to take notes limits the information to the memory and interpretation of the interviewer.  In a professional setting, most subjects will understand the critical nature of notes. Very few people will say it is not all right to take notes, regardless of how they feel about it. If they are absolutely opposed to the taking of notes, find out why and concentrate on what the subject says and reduce the interview to notes as quickly as possible after the interview. With a hostile subject who opposes note taking, the interviewer can ask if it is okay for her to make selected notes regarding dates or things the interviewer might not remember later. The interviewer can explain that it is important that s/he understand the subject’s position or communication correctly. If the subject is still adamant about the interviewer not taking notes, it should be documented in the interviewer’s report.

As the fraud interviewer develops his or her interviewing skill set, s/he should concentrate on taking verbatim notes which, among other things, include, at a minimum, nouns, pronouns, and verbs. Some practitioners recommend that the interviewer not attempt to write everything down. The argument is that, in doing so, the interviewer will not have an opportunity to observe the subject’s nonverbal communications.

The generally accepted recommendation is, therefore, where feasible, that the interviewer take down verbatim as much of what the subject says as is possible. This includes repeated words and parenthetical comments. This practice allows the interviewer to later review what the subject said as opposed to what the interviewer thought the subject said. Note taking also provides additional documentation of what the subject is communicating and (when reviewed after the fact in the light of additional knowledge) of what the subject has excluded.

During the act of taking notes, the interviewer should exercise caution. Taking notes intermittently can signal to the subject that the interviewer takes notes only when the information is important. Conversely, if, during the interview, a very sensitive area is broached, or if the subject indicates that s/he is uncomfortable with an area or issue, the interviewer can put her pencil down, lean forward, establish good eye contact, and listen to the subject. The simple suspension of note taking may place the subject at ease. As soon as the interview moves to a less sensitive area, the interviewer should try to reduce the previously mentioned sensitive area to notes. If the subject associates note taking with core interview information, the subject may interpret continued note taking as encouragement to continue talking.

The interviewer should not write down interpretive comments while taking notes. The interviewer should however make notes, where appropriate, in cases where verbal and
nonverbal indications of both resistance or cooperation are found.

The interviewer should always take notes with the possibility in mind that the notes may be subjected to third party scrutiny. This scrutiny may extend to opposing counsel in the event of litigation. The interviewer’s notes may or may not be privileged materials. With this in
mind, the interviewer should consider the following:

–Begin each separate set of interview notes on a clean page;
–Identify the date, time, and place of the interview and all the individuals present at the interview;
–Obtain as much background data on the subject as possible, including telephone numbers, and identify means of contacting him or her, including alternate numbers for family and friends;
–Initial and date the notes;
–Document the interviewer’s questions;
–Take verbatim notes if possible. Concentrate, but do not limit notes of the subject’s responses to:
• Nouns
• Pronouns
• Verb tense
• Qualifiers
• Indicators of responsibility, innocence, or guilt
–Do not document conclusions or interpretations;
–Report any unusual change in body language in an objective manner. Document the changes in body language and tone, if applicable, in conjunction with notes of what the subject or interviewer said at the time the body language or tone changed;
–At the conclusion of the interview, review the notes with the subject to confirm what the subject has said.

Finally, following the interview, your notes should be reproduced in printed form as quickly as possible.  Enough cannot be said for the value of a well-documented set of interview notes for every aspect of a subsequent investigation; their presence or absence can make or break your entire case.

Fraud is Crisis

Every fraud represents the challenge of a crisis of greater or lesser degree to the organization which suffers it.

Seventy-one percent of surveyed companies told the financial press in a 2016 survey that they have some sort of general crisis management plan and/or program in place, and almost a further 12 percent indicated that they have one in development. A fraud related crisis has the further potential to have a very significant impact on the reputation of the company and its officers, on the company’s ability to reach its objectives, and even on its ability to survive.  Thus, executives are learning that crises in general are to be avoided, and if avoidance is not possible, that the crisis is to be managed to minimize harm. Directors are also learning that organization-wide crisis assessment, planning, and management must be part of a modern risk management program and, further, constitute a vital component of the overall fraud management program.

Unfortunately, the urgent nature of a major fraud precipitated crisis frequently triggers a focus simply on survival, and ethical concerns can be largely forgotten in the heat of the moment. A crisis is an event that brings, or has the potential for bringing, an organization into disrepute and can imperil its future profitability, growth and long term viability. Effective management of such events involves minimization of all harmful impacts. Crisis-driven reactions rarely approach this objective unless advanced planning is extensive and based upon a good understanding of crisis management techniques, including the importance of maintaining reputation based upon the company’s past, substantiated ethical behavior. If ethical behavior is considered of great importance by a corporation in its normal activities, ethical considerations should be even more so in crisis situations, since crisis resolution decisions usually define the company’s future reputation.

Not only are crisis decisions among the most significant made in terms of potential impact on reputation, remediation opportunities may also be lost if ethical behavior is not a definite part of the crisis management process. For example, avoidance of crises may be easier if employees are ethically sensitized to stakeholder needs; phases of the crisis may be shortened if ethical behavior is expected across the board by all employees; and/or damage to reputations may be minimized if the public expects ethical performance based on the company’s past corporate actions. Moreover, the degree of trust that ethical concern instills in a corporate culture will ensure that no information or option will be suppressed and not given to the decision maker(s) who must deal with the crisis. Finally, constant concern for ethical principles should ensure that important issues are identified and the best alternatives canvased to produce the optimal decision for the company.

Fundamental to the proper management of a crisis is an understanding of four phases of a crisis: pre-crisis, uncontrolled, controlled, and reputation restoration.  As I indicated above, the main goal of any general crisis management program should be to avoid crises on the front end (including those activated by frauds). If this is not possible, then the goals should be to minimize the impact. This can be done by anticipating crises or recognizing early warning signs (red flags) as soon as possible, and responding to soften or minimize the impact and shorten the time during which an anticipated crisis will be uncontrolled. These goals can best be achieved by proper advanced planning, by continued monitoring, and by speedy, effective decision making during the crisis.

Advanced planning for any type of crisis (including fraud) should be part of a modern enterprise risk assessment and contingency management program because of the growing recognition of the potential negative reputational impact of an unanticipated crisis. Fraud examiners can pro-actively assist in this process by conducting fraud risk assessments and by participating in brainstorming for potential problem areas, assessing the vulnerabilities identified, and devising suggested contingency plans for effective action. Second, red flags or warning indicators can be picked out that will identify what is developing so that the earliest action can be taken to minimize cost.

Seventy-three percent of the surveyed companies also reported having a senior-level management and corporate-level crisis management team that focuses on the individual crisis, and 76 percent had a crisis communication plan, which includes notification of the public, employees, government, and the media. The process of CFE assisted brainstorming to identify potential frauds should address fraud related scenarios that could arise from:

  1. Natural disasters;
  2. Technological disasters;
  3. Differences of expectations between individuals, groups, and corporations leading to confrontations;
  4. Malevolent acts by terrorists, extremists, governments, and individuals;
  5. Management values (ethical challenges) that do not keep pace with societal requirements, laws and obligations;
  6. Management deception;
  7. Management misconduct.

Managing the crisis effectively once it has happened is vital to the achievement of crisis management goals. Quick identification and assessment of a developing crisis can be instrumental in influencing the outcome efficiently and effectively. One of the defining characteristics of a crisis is that it will degenerate quickly if no timely action is taken so delay in identification and action can have serious consequences.

The 2016 survey also indicated that internal corporate training programs were apart of preparing for crisis awareness for most the respondents, and that 48 percent used outside contract trainers. Major factors listed by respondents as needing improvement in crisis management generally included internal awareness (51 percent), communication (46 percent), drills/training (38 percent), vulnerability/risk assessment (36 percent), information technology (33 percent), planning/coordinating (32 percent), and business continuity (25 percent).

Undivided attention to any crisis, but especially to fraud related crises, and avoidance of other related problems that can conflict decision makers will result in better decisions, just as will the making of advanced plans on a contingency basis and the integration of ethics into the fraud containment/response process. One of the most important aspects to keep in mind during the assessment of crises, and the avoidance or minimization of their impact, is the immediate and ongoing impact on the organization’s reputation. By reflecting on how the organization’s response to the crisis will affect the perception by stakeholders of it trustworthiness, responsibility, reliability, and credibility, decision makers can make choices that benefit all stakeholders and often enhance the organization’s reputational capital or shorten the period of its diminishment; here, as in all things fraud related, CFE’s, through their expertise and advice, have a critical role to play.

Bob the Builder

bobthebuilder

by Rumbi Petrozzello
2016 Vice President – Central Virginia ACFE Chapter

The soundtrack of my summer was a cacophony of drills, sanders and related discordant noises, all guaranteed to drive me to near insanity. Since the bulk of this seemed to be happening right outside my window, the result was a shrinking view of the sky, more views into the homes of my neighbors than I ever wanted and a near-constant film of dust on everything in our home, despite all our best efforts. I thought that construction was looming large only in my life but, coming off a trip to Nashville, Tennessee, I see that I’m far from alone. I took a tour bus around the city and, it almost seemed the city skyline was made up of little else than the silhouettes of massive construction cranes. There’s a lot going on in an industry that, at least in New York City, has a history of control by organized crime.

It’s hardly surprising – construction projects span long periods of time and require many moving parts. There can be several contractors responsible for different parts of a construction project, and each of those contractors hires subcontractors. Because projects range from moderate to long term, contractors and subcontractors will bill periodically for work in progress and, there is a lot of leeway for estimating just how much of the project has been completed. Depending on the contract, there may be head room to get paid for cost overruns and, if there’s room for that, you can be sure that someone is going to try to take advantage. There is no shortage of ways in which fraud or error can occur when it comes to construction. Controlling various aspects of the construction industry was lucrative business for organized crime for many years. Nowadays, the regular fraudster on the street has also found his way into profiting from construction related fraud – if the opportunity is there, the ethically challenged always seem to find ways to exploit it.

As forensic accountants and fraud examiners, we may find ourselves being called upon to investigate such frauds. Sometimes companies decide to be proactive and bring us in to assess, suggest and institute practices that will help prevent, detect and deter fraudulent activities. In either case, there is much that we can do. An important aspect of this type of effort is our emphasizing to the client and the wider business community the importance of well-kept and comprehensive business records. As tedious as some of this may feel to those maintaining the records, such records can prove invaluable when things go wrong. Contractors and their subcontractors should both maintain up-to-date ledgers. The ledger information should be corroborated by supporting information. Examples of critical documentation are:

  • Payroll records – this includes matching the ledger information to time cards, information from payroll processing companies and filings with city, state and federal authorities.
  • Bank statements – bank statements should be reconciled to the general ledger and there should be searches for possible bank accounts that are not reported on the ledger. Is the contractor transferring funds to accounts for related companies? What information is on the credit card statements and how does it relate to the contractors’ ledgers? Does information on brokerage accounts match information in the general ledger?
  • Invoices – do the vendors declarations of what’s going on make sense? Do their submitted expenses make sense? Can you immediately understand their expenses or is the information vague and lacking enough detail to determine what the vendor is being paid for? Have costs been misclassified? Follow the money … we should always stop and take the time to look and see where the money is going and why it’s going there.

Many construction projects employ union workers. Because unions tend to be organizations with lots of bureaucracy, it follows that they tend also to be organizations with lots of records. If a union tells you that it does not have many records, that fact alone should raise a red flag. When seeking to verify information from such organizations, there are various standard records we can request:

  • Shop steward report – This is a report that will show the names of the employees working, the times they reported for work and left and out and the number of hours worked. This information can be very useful in testing if the hours claimed are reasonable.
  • Job descriptions – Do the job descriptions make sense and do they match the employees that are claiming to be doing the work? In one case in New York City, a legally blind man was listed on the books as a heavy machinery operator. Subsequent investigation revealed that he was indeed blind; and he never went anywhere near heavy machinery.
  • Member profiles – Review benefits and see to whom the union pays those benefits. Review the records and see if anything jumps out at you as being unusual, requiring further information and perhaps investigation. Do you have a member (or members) listed who’s well-paid for not doing much?
  • Look at the records the general contractor keeps and see if they match the records kept by the union.

If you’ve been brought in to perform proactive fraud prevention and detection work, encourage and suggest that, if one does not already exist, the company set up an effective and comprehensive whistleblower program. Confidential sources are often the most important element of an investigation. These sources can also be very helpful in making sure that you ask for all the documents needed for your specific investigation and they can also make valuable suggestions precisely where else you can look for vital case information.

If my city is anything like yours, there are a lot of construction projects being planned and in the works. You don’t have to look hard at all to find media reporting on cost overruns and fraud in the construction industry. From The Big Dig in Boston to personal tales told to you by friends, there are many ways in which the moving parts of any construction project can be exploited by fraudsters. There are also many ways in which we can be of service as forensic accountants and fraud examiners to deter, detect and investigate every aspect of this exploitation.

Value Added

value-addedI was reading an article in one of the business magazine to which I subscribe the other day in which a well-known business pundit was reporting that the Fortune 500 companies he interviewed for his article were becoming more and more concerned with getting increased levels of value at every level from their investments in their co-partners.  This search for higher levels of value means more pressure for performance at those same management levels and with more pressure, as every CFE knows, comes more potential for management frauds.  Fraud prevention programs cannot be immune to this phenomenon.

CFE’s have traditionally not had to consider the importance of adding value when performing their investigations since, in the case of a suspected or identified fraud, the ‘value’ of the investigation was all too apparent, i.e., to describe and, possibly, prosecute the fraudster and to lay the ground work to prevent a similar instance of the same scenario from recurring. Beyond the written report of the investigation itself, follow on (if there was any) typically consisted of verifying compliance with policies and procedures, without providing recommendations for improvement of the fraud prevention program itself or performing other consultative activities. The fraud examiner’s role was often more akin to that of a police officer than to that of a business partner.

In today’s environment, however, the evidence from practice increasingly indicates that CFE’s, like all other co-parties, are under increasing pressure to provide services that enhance the value of their client’s investment in the valuable fraud prevention services CFE’s can provide, as adding value is becoming widely considered an integral part of even the investigative process.  But what does adding value entail, and how do CFE’s provide it? While the answer may vary depending on individual circumstances, CFE’s make potentially value-adding contributions throughout the entire investigative process and in almost every aspect of our work.

When management engages the services of the CFE, it’s applying a governance control.  CFE investigations provide management, the board of directors, external auditors, and, most importantly, the audit committee with vital information about the fraud and about the key controls whose failure allowed it.  This information is the groundwork for the prosecution of the fraudster, for corrective action, for the repair of the control structure, and vital for future fraud prevention.  This type of information may or may not be possible for CFE’s to quantify monetarily in all cases, but it definitely constitutes a value-added service to management.

Most large organizations employ some sort of risk-based fraud prevention plan or program. Management, needs to address the highest fraud risks within its organization, and the fraud prevention program must reflect and address those risks. It’s here that CFE consultation can prove invaluable.  A plan developed by incorporating the organization’s highest risk departments, business units, processes, and their respective fraud prevention controls makes effective use of limited organizational resources and thereby also adds value through efficiency.

During an engagement, the CFE may observe numerous opportunities for anti-fraud related process improvement or other enhancements that might ultimately either increase the organization’s security or help fulfill its over-all duty to protection its assets. But a word of caution. While this activity constitutes adding value, investigators need to be wary of overstepping. If they come to believe every engagement should routinely include a recommendation to improve the organization’s fraud prevention effort, practitioners risk directing organizational resources ineffectively. An investigator who spends too much time looking for improvements or added controls may be harming the organization by misdirecting resources that could be applied to more critical areas.  In evaluating risk versus reward, investigators must determine if the effort and resources expended to find an improvement are worth the potential benefits.  Key to prevention of this misstep is to communicate closely with your client and use that communication to never lose sight of how your investigation fits into the bigger picture of overall management objectives for its organization. It’s within that overall context that the fraud prevention effort should always be embedded.

Management, boards of directors, audit committees, and corporate counsel will all rely eventually on the fraud examiner’s report on the facts of an investigation and on the related fraud prevention controls over the processes and risks within the organization, and they will likely view this information as value-added.  So, to add value effectively through reporting, CFE’s need to consider where they want their audience to focus. Accordingly, they should consider the needs, wants, and resources of the various stakeholders who have engaged them. The final investigative report should be easy for readers to navigate, and if appropriate, it should stratify findings into categories of importance to effectively support the dual objectives of possible prosecution and immediate remediation.  With that said, every well written fraud report will add future value through its impact on the organization’s fraud prevention effort and the investigator should write it with an eye to that important follow-on objective.

Fraud examiners are recognized by the courts and by the public as fraud specialists. Their expertise in this and related areas enables them to help management analyze fraud related risks to the organization and to assist in the design of controls to mitigate those risks. By having the expertise to perform investigations, research issues, and benchmark with peers on best practices, CFE’s can become a truly valuable resource to any client management for fraud prevention program design. These activities also constitute adding value.

Developing a complete understanding of all the aspects of how the fraud examination process fits into the client organization should be an ongoing undertaking that also adds value, though it may be difficult to quantify in terms of dollars saved, or earnings, or reduced risks. To a degree, CFE’s, as I said above, add value simply by performing their functions effectively and efficiently. But careful attention to the organization’s risk profiles and to the information requirements of various players in the organizational governance framework represent an ongoing challenge to fraud examination and forensic accounting practitioners alike, and are the key to ensuring that the value they add is maximized.

Of Estimates, Errors & Fraud

fraud-warningThere was a local case of embezzlement in the news last week in which the suspected perpetrator claimed that a number of her seemingly fraudulent transactions, as identified by her company’s external auditors, were in reality ‘mistakes’ (mostly either accounting or estimating errors) or, in other cases, just simple missteps occasioned by ignorance of her company’s accounting policies. Somewhat surprisingly, this all too common defense seemed to cast some doubt, at least from the newspaper’s point of view, on the overall propriety of the entire prosecution. For me, the case brought to mind, on one hand, the differing roles of external auditors and forensic accountants and, on the other, the often critical role played in investigations by the introduction of the foggy elements of accounting estimates, simple errors and ignorance.

Unlike the external auditors in this case, the forensic accounting investigator’s concern is not limited to reaching a general opinion on financial statements taken as a whole, derived from reasonable efforts within a reasonable materiality boundary. Instead, the forensic accounting investigator’s concern is, at a much more granular level, with the detailed development of factual information—derived from both documentary evidence and testimonial evidence—about the who, what, when, where, how, and why of a specific, suspected or known impropriety.  In my opinion, it’s the lack of such investigative granularity in the follow-up to the simple discovery of the individual fraud by the auditors in this recent case that resulted in the ‘ambiguity’ expressed by the newspaper.

The auditors discovered the suspected fraud through their routine sampling procedures, which predication of the existence of an impropriety would have furnished the starting point for the work of a forensic accountant had one been called in. Think of it like the relationship between the accountant and the financial analyst.  The financial analyst’s work typically begins when that of the accountant ends; the audited financial statements are the foundation on which the work of the financial analyst rests.  So too do discoveries of improprieties by auditors often lead to a subsequent investigative hand off to forensic investigators.  The forensic investigator starts by seeking and examining all relevant evidence concerning the particular case made available, not only by the auditors, but by all the concerned parties.  Based on the investigative findings, the forensic accounting investigator then assesses and measures losses or other forms of damage to the organization and recommends and implements corrective actions, often including changes in accounting processes and policies and/or personnel actions. In addition, the forensic accounting investigator assists management in taking preventive actions to eliminate recurrence of the problem. In contrast to the external auditors, the forensic accounting investigator’s more complete findings and recommendations may form the basis of testimony in litigation proceedings or criminal actions against the perpetrators. They may also be used in testimony to government agencies such as the Securities and Exchange Commission in the United States or the Serious Fraud Office in the United Kingdom. Accordingly, the scope of the investigation and the evidence gathered and documented must be capable of withstanding challenges that may be brought by adversely affected parties on both sides of the prosecution or by skeptical regulators.

Clearly, there are many commonalities between auditing and forensic accounting which, at best , can support the formation of a close working partnership. Both rely on:

  • Knowledge of the industry and the company, including its business practices and processes;
  • Knowledge of the generally accepted accounting principles of the jurisdiction in question;
  • Interpretation of business documents and records;
  • Independence and objectivity—perhaps the most important commonality.

The foggy nature of estimates and errors arises in financial transactions and statements due to the continuous nature of business. Unlike a footrace that ends at the finish line or an athletic contest that ends with the final buzzer, a business and its transactions are continually in varying stages of completion. There are many items in a financial statement for which the final outcome is not known with precision. Given the complexity and continuity of business, it’s difficult to capture a clear snapshot of a company’s financial position and performance at a random point in time. As a general matter, estimates are most commonly made concerning the final amounts of cash that will be received or paid once assets or liabilities are finally converted into cash. Such estimates can encompass, for example, allowances for uncollectible customer receivables, estimates of liabilities for claims or lawsuits brought against a company, the amount of profit or loss on a long-term contract, and the salability of inventory that is past its prime. Most estimates are based on three types of information: past performance of the same or similar items, what is currently occurring, and what management perceives as the probable outcome. Further complicating matters, the weight to assign each type of information varies depending on the particular circumstances. But no matter how determined, unlike the score of a sporting contest, an estimate on the books or in financial statements is a prediction of what will happen, not the objective tally of what has already taken place.  For all these and a host of other reasons, the ACFE tells us that accounting estimates are always a fertile ground for every type of financial fraud.

What the forensic investigator brings into this mix is his or her informed, holistic approach (as outline above) to the detailed analysis of any specific, predicated fraud.   Legitimate assertion of managerial confidence in the business’s ability to achieve certain estimated results is one thing. A deceptive misinterpretation that is intended to generate a favorable estimate is another thing altogether and may pose a substantial investigative challenge well beyond the scope of most routine financial audits. Practicing forensic accounting investigators are trained to address the often vexing complexities and alternative rationales that may be offered to explain the difference between an estimate and an actual result. Given that estimates often constitute the cause of material differences in financial statement presentations, the ability to distinguish between the manipulatively self-serving and the merely incorrect is a critical element of many forensic investigations.

To get back to our newspaper case, U.S. auditing standards state that the main difference between fraud and error is intent. Errors are unintentional misstatements or omissions of amounts or disclosures in financial statements. So, errors may involve:

  • Mistakes in gathering or processing data from which financial statements are prepared;
  • Unreasonable accounting estimates arising from oversight or misinterpretation of facts;
  • Mistakes in the application of accounting principles related to amount, classification, manner of presentation, or disclosure.

Fraud, on the other hand, is defined in SAS 99 as an intentional act that results in a material misstatement. The motive or intent of an individual in making accounting entries is not the primary focus of the external auditor’s procedures as it is of the forensic investigators. Auditors direct their efforts toward determining objectively measurable criteria regarding account balances and transactions by asking: Do the assets exist? How much was paid? What is the basis of the estimate? Is it reasonable? How much was collected? Were the goods shipped to the customer? By asking questions such as these and obtaining evidence to support the estimate where appropriate, auditors can be better positioned to ascertain that the amounts in the books are correct. Thus, given the focus of the auditor, intent is not uniformly relevant; evaluation of intent is a subjective as opposed to an objective evaluation, and ascertaining intent is a difficult exercise at which the trained forensic accountant is highly skilled.

For the foreseeable future, corporate fraud will continue to present substantial challenges and opportunities for fruitful partnership between auditors and forensic accounting investigators. However, it must be recognized that the complexities of the business world and the ingenuity of highly educated, white-collar criminals will always manage to produce schemes that unfortunately go undetected until they reach significant proportions. Forensic accounting investigators will investigate, prosecutors will convict, and regulators will react with new and more requirements … and, without question,  the fraudsters will always be with us.

Before It Happens

tone-at-the-top

Register Today for Investigating on the Internet May 18-19 2016 RVACFES Seminar!

An attendee at our summer seminar on fraud prevention last year, reported that she had become quite discouraged by the amount of in-house fraud her auditors were detecting among the employees of the overseas subsidiary of her non-profit organization.  She asked our speaker, Chris Rosetti, what he would recommend to head off what seemed like a growing number of defalcations that were costing her firm large amounts of time and money to investigate and, in some case to prosecute.   Chris told her it was always motivation that drives employees to commit fraud, and that motivation can take many forms, ranging from family needs or a desire to keep up with a colleague’s lifestyle. Often, employees’ motivation to commit fraud depends on how they perceive they’re being treated by their employers. Nevertheless, there are many ways any management can minimize employees’ motivation to commit fraud. Some common methods include increasing morale, implementing employee support programs, creating a culture of high ethical standards, rewarding loyalty, establishing an open-door policy,  and reducing pressures to make the numbers.

Fraud occurs less frequently when individuals feel positively about their employers than when they feel abused, threatened, or ignored. Negative workplace environments diminish morale and can affect employees’ attitudes about committing fraud. Employees who consider themselves to be unfairly treated are more prone to commit fraud. Accordingly, increasing employee morale can be a powerful tool in decreasing employees’ motivation to commit fraud.  Chris recommended that our questioner’s management might consider steps like the following, relatively low cost ways to boost employee morale in the overseas subsidiary …

–Provide organization-sponsored social events;
–Routinely recognize employees for good work and make the recognition a big deal, taking time to really celebrate accomplishments;
–Offer flexible work arrangements to the greatest extent possible;
–Exhibit a strong ethical tone at the top;
–Engage individual contributors in the decision-making process;
–Listen closely to employee grievances and settle them as soon as possible;
–Tune into employees’ emotional needs;
–Offer competitive compensation and benefits;
–Show employees the results of their work.

Chris went on to emphasize that competitive compensation and benefits are especially important for increasing employee morale. Perceived inequities between a home office and a subsidiary in compensation and benefits policies can contribute to fraud, and less-than competitive compensation is always a negative factor that can increase the risk of fraud. The ACFE reports that employees who feel adequately compensated for their work are less likely to commit fraud against their employers. Management should compare its organization’s compensation structure with those of their competitors to ensure that their employees are not underpaid.

On the flip side management should reduce the following factors, which the ACFE has identified as detracting from a positive work environment:

–Top management who do not seem to care about or reward appropriate behavior;
–Negative feedback and lack of recognition for job performance;
–Perceived inequities in the organization;
–Autocratic rather than participative management;
–Low organizational loyalty or feelings of ownership;
–Unreasonable budget expectations or other financial targets;
–Fear of delivering bad news to supervisors or management;
–Less-than-competitive compensation;
–Poor training and promotion opportunities;
–Lack of clear organizational responsibilities;
–Poor communication practices or methods within the organization.

Chris went on to say that many organizations have begun to realize the benefit of employee support programs. Support programs are designed to help employees cope with personal problems that might motivate them to commit fraud or adversely affect their work performance, health, and well-being. These programs generally include assessment, short-term counseling, and referral services for employees or their family members.

These programs can provide support for a range of issues, including:

–Substance abuse;
–Emotional distress;
–Major life events, including births, accidents, and deaths;
–Health care concerns;
–Financial or legal concerns.

If organizations can offer employees a means to address such issues, they might be able to prevent fraud by those who are suffering. Providing safe outlets for coping can reduce an employee’s motivation to commit fraud.
Creating a culture of high ethical standards is a necessary component to any fraud prevention program. That is, management must be committed to preventing fraud, and it must build an ethical environment. The tone at the top, which is created by the organization’s leadership, refers to the ethical (or unethical) atmosphere in the workplace. According to Chris, whatever tone top management sets will have a trickle-down effect on employees. If the tone set by managers upholds ethics and integrity, employees will be more inclined to follow those same values. But if management appears unconcerned with integrity and focuses solely on the bottom line, employees will be more prone to engage in corrupt activities because they feel that ethical conduct is not a focus or priority within the organization.

Organizations that cultivate ethical cultures frequently encompass strong governance practices, such as:

–Free information flow;
–Employee access to multiple layers of management and effective control of a whistleblower hotline;
–Effective senior management team (including chief executive officer, chief financial officer, and chief operating officer) evaluations, performance management, compensation, and succession planning;
–An employee code of conduct that is clear, concise, and communicated;
–A code of conduct specific for senior management.

An ethical organization culture also includes management assurance of ethical considerations in hiring, evaluating, promoting, and earning policies for employees, as well as ethical considerations in all aspects of the entity’s relationships with customers, vendors, and other stakeholders. Ethical organizations will also address issues of ethics and the impact of ethical behavior on their strategies, operations, and long term survival. The level of management’s commitment to these areas varies widely and directly affects the fraud risk profile of an organization.

Rewarding employees for their loyalty might reduce the likelihood of fraud, but this type of morale boosting activity, according to Chris, can be successful only if the organization has an ethical culture. From a fraud prevention point of view, it’s probably more important that management establish an open-door policy to minimize employee pressures. Having an open door policy gives employees an opportunity to voice their concerns and feel heard. Employees who feel empowered and valued as a member of a team might feel a sense of loyalty to their organization and will be less inclined to commit fraud against their employer. Likewise, if employees can speak freely, managers will understand the pressures facing their employees and might be able to eliminate or reduce them.

Finally, Chris recommended reducing the pressures on employees to “make the numbers at any cost”. This alone can reduce the likelihood of fraud. One way to reduce pressures is to provide performance-based compensation rather than profit based or revenue-based compensation. When compared to profit or revenue-based compensation, performance-based compensation-such as bonuses calculated as a function of clearly set performance indicators-can reduce the motivation to cut corners, cheat, or fraudulently make the numbers. In some industries, it’s possible to tie compensation only to sales or profits. When this is done, it’s important to monitor staff performance closely, and management must encourage ethical behavior on a regular basis.

When a Fraud Goes Public

reputation

Download Our Chapter’s Free App RVACFES on Google-Play!

There’s a high probability that every fraud examiner, during the course of his or her career, will work on at least one fraud that hits the newspapers.  Your client and its counsel will undoubtedly turn to you as a member of the investigative team for input, especially, as is most frequently the case, the whole experience will be new to them. Given the overwhelming importance of corporate on-line and off-line reputation as a driver of value and with sustainability as a strategic concern, the bottom-line value of communicating with all corporate publics about both tangible and intangible events affecting performance has risen. This is doubly the case with a sensitive issue like a publicized fraud. Today, the ACFE tells us, intangible assets can account for as much as 70 percent of the value of a business. They include brand, employee loyalty, credibility, trust, and (perhaps of most importance) reputation. In a world continually rocked by corporate governance and other scandals, attention to reputation risk is proving more important than ever. Because organizations derive that reputation from how their various stakeholders and publics perceive their performance, behavior, and actions in the goldfish bowl of social media, the need for more careful management of the public information interface is also vital but especially so in a crisis.

The ACFE also reports that a growing number of major global companies are investing substantial resources to manage their reputational risk, and have increased their efforts to do so over the last five years. Indeed, 82 percent of risk managers report their companies are making a “substantial” effort to manage reputational risk, and 81 percent said they’ve increased their focus on reputational risk during the last 36 months. That’s partly because risk managers recognize the difficulty most enterprises have attempting to wrap their corporate arms around the nuances of just what a reputation is and what risks it faces, and also because less than half of the executives surveyed said the management of reputational risk was “highly integrated” with their enterprise risk management (ERM) function or another risk oversight program.

During the fraud risk assessment process many CFE’s have likely suspected or even warned that the actions that some of their client enterprises were taking or planning to take – especially those related to over-the-top spending or perceived lapses in corporate ethical judgement – might not be viewed today with the stakeholder disinterest they once were.   Now, every management must deal with reputational risks that were not necessarily reputational risks in the past, and they must deal with changes – rapid in many cases given social media – in the public’s estimation of what is and isn’t acceptable corporate behavior.

Any publicized fraud, major or minor, impacts the corporate reputation and serves as proof that all of its key fraud risks are intertwined; each risk can impact others. Losses to fraud impact reputation just as surely as bad strategic decisions. To help minimize the negative effects of these intertwined threats, organizations should consider identifying risk champions within the organization, including the CEO, the president, regional presidents, and, sagely, the marketing director, whose roles would include not only monitoring and reporting on on-going reputational risks but, acting as a committee,  in actively shaping the corporate response to a publicized fraud.  These champions routinely look for reputational risks as part of their day-to-day activities, arranging for corporate auditors to test anti-fraud controls and look at policies and procedures that might carry some type of reputational risk.  Likewise, every member of management should be sensitized to be aware of reputational risks and educated to identify areas for audit that, in their opinion, are not being managed correctly and thus likely represent loci of developing fraud-related threats to the enterprise’s good name.

Organizations which haven’t experienced a publicized fraud often overlook the multifaceted nature of reputational risk and the need to consider it at the inherent level, rather than focusing, as so many organizations do, on reputational risk at the lower, residual level; damage to reputation is never just a residual effect and should never be viewed as such. This judgment error can leave managements complacent about the magnitude of damage a threat to the company’s reputation can cause. A sense of comfort with the expected perceived control level can make many boards and executives not think about the inherent, potentially devastating reputational risks that are always lurking around every corner.  Never forget, the world’s response to a damaged reputation is faster and harsher today than ever before.

Just how fast social media can change and affect the public’s opinion of any company is something of which many organizations are still insufficiently aware.  Although companies cannot prevent anti-company commentary related to a fraud on social media sites, they can monitor them and possibly influence them. It’s doubtful that many of today’s client senior management were taught the practice of determining potential reputational risks and of monitoring a corporation’s response to them on social media.  CFE’s need to recommend that client companies expand their public mood-tracking activities to these venues when actually responding to and addressing a published fraud.

The management of reputational risk during a publicized fraud requires a constantly updated, fresh approach to what could happen and the reverberations it could have throughout an enterprise’s public universe. Financial responsibility as one type of reputational risk that is not new; as consumers become more actively involved in narratives involving stock market manipulation and corporate corruption, companies are more at risk for being labeled as ‘irresponsible’ if they don’t have a perceived high level of corporate governance. Worldwide slow economic growth has made the reputational risk of all corporate related missteps a greater threat to any company because it simply might not be able to recover from a financial fraud fallout as quickly as it might have in high growth times. Slow growth may also lead more employees to engage in the kind of activity – fraud, theft, quality corner-cutting – that can damage an organization’s reputation and the general public is well of aware of the fact.

Helping client companies manage reputational risk during their response to publicized frauds, including that risk in their fraud risk assessments and then on-going reassessment of the performance of risk related  controls is an area where CFE’s can add tremendous value at very little incremental cost; doing so will certainly add value to the overall fraud prevention effort. And don’t overlook training front line employees in their role in protecting the corporate reputation.

Thoughtful, coordinated management of the fallout from a publicized fraud is the difference between a company stumbling blindly into a far worse reputation debacle than necessary, and heading off disaster by acting swiftly to contain the reputational damage and move the organization forward. CFE’s have a critical role to play in all of this.