Leading anti-fraud consultancy UKFraud.co.uk (www.ukfraud.co.uk) has published a list of ten common early warning signs which could alert management that fraud may be occurring in their organisation.
The list draws upon UKFRAUD.co.uk’s substantial experience across an international client base, ranging from major financial institutions, public sector bodies and corporations to SMEs and non-profit making organisations.
The list works on the assumption that whatever tools they use, be it IT based cons and false accounting or other traditional scams, the warning signs are often the same. As UKFraud.co.uk believes that awareness of the signs and a sound approach to countering them can often deter many opportunistic incidents of fraud, they have published the list here to help executives benchmark their own operations.
In the list suggested actions that can be taken to counter the risk of fraud are given following each sign. The early warning signs can include:
1. ERRATIC REPORTING: This sign is just as applicable to suppliers and contractors as it is to internal departments and functions within the organisation. Erratic, incomplete, late or excuse laden management reporting is often a classic sign that something is wrong. One of the possibilities is the existence of fraud. Further investigation will reveal that lip service and increasingly tenuous explanations are given assertively to thwart follow up activity. Common excuses used are often the frequent occurrence of IT failures, technology compatibility issues between different company systems or international systems. It is also often the case that once reports are complete; there are typically delays in them reaching those who need to review the data.
ACTION: Insist on up-to-date reporting, within a set timetable and then build this into the internal GRC (Governance Risk and Compliance) systems. Wherever appropriate adopt an enterprise-wide approach to technology to help with systems issues.
2. APPARENT PROCESS LAZINESS: A weakening of anti-fraud and data security systems can happen naturally, over time; and is normal – especially when things get busy. This occurs where the sage precautions and risk-avoidance measures get by-passed or ignored in practice as time goes by. This could just be the natural adjustment of systems to the practicalities of working life and busy peaks or it could be deliberate and sinister. However, with the seemingly right processes in place, top level management are often lulled into a false sense of security that they are actually being used, whilst the fraudster is busy at work getting around them.
ACTION: Make sure you implement the suggestions of your internal compliance managers and organise appropriate training to reinforce attitudes and practise. Ensure that the control processes, especially in tendering, purchasing, invoicing and customer controls and identifications are ALWAYS kept strong, managed and regularly reviewed. Where systems/processes are under pressure when used in practise, introduce a review process – and then adapt them promptly.
3. ORGANISATIONAL CHANGE AND THE DESIRE TO DUMP DATA: A major indicator can be the act of deletion or pressure on staff to delete, remove or otherwise dump past records following a restructure, a new division launch, a JV or acquisition. An excuse of, “oh I’m sorry those files were destroyed.” should be cause for alarm. It will be an even bigger problem where international operations are involved as it’s far harder to find or recreate evidence in a foreign territory.
ACTION: Take care to establish and log where paper documents are and when they should and should not be stored. Identify who is in control of the system processes and who is responsible for and has ownership of the records. They are not always the same person of course. Ensure that scanning, and indexing works properly and that no-one can intercept/edit documents. Also ensure that storage capacity is enough and controlled properly. Where acquisitions and mergers are concerned, ensure that all documents are available and stored appropriately and securely, especially those that relate to IP protection, IP development records, audit trails and staff contracts. In particular, if you are acquiring a business make sure that you have indemnities/penalty clauses built into the acquisition agreements that relate to the availability of data, logs, audit trails and so forth.
4. DATA INCONSISTENCIES OR ABSENSE IN THE ARCHIVES: Whether it is archive data or cross reference checks that are missing or wrong; factual inconsistencies will also occur naturally. The cheats who seek to defraud an organization will use the possibility to explain such inconsistencies and hide their fraud.
ACTION: Make sure that all files are electronically stored, with appropriate back-ups as part of your compliance systems and that no-one has the access to any files that include a DELETE capability. It is also worth having internal or external auditors sample check key files from time to time as a part of the audit programme. In addition arrange for the HR department to make it a gross misconduct issue to destroy data without recorded approval from above. This may not deter the fraudster but if nobody else is doing it the fraudster is more likely to be spotted at an early stage.
5. AUDIT-TIME DELAYS: Excuses, confusion or wild goose chases when disclosing to auditors, be they internal or external, can be a telltale sign too. We need to remember though that the audit team is not there to find fraud, rather to ensure that the correct processes are in place that will deliver appropriate protection.
ACTION: Ensure that everyone treats audits as important and make sure that they are completed on time and properly, and with appropriate audit skills. Where there have been delays or difficulties investigate why this was the case by drilling down into the detail. Make sure that the business critical and financial exposure areas take a priority and act upon all failings both quickly and completely; with follow-up audits if necessary.
6. BEHAVIOURAL ANOMALIES: These can range from acute defensiveness and resistance to attending review meetings, through to blaming strategies or even aggression when specific questions are asked about processes or figures. These behavioural anomalies have probably already been noticed through the assessment process or by HR staff. Research shows that internal fraudsters are most likely to be either ‘youngsters who cut across the processes and systems’ or ‘middle aged executives with the authority and a gripe’. ACTION: Get HR more closely involved. Then if you still have concerns about such people upon closer inspection, all the relevant files need to be pulled and checked, or you might even consider a private investigator to look deeper into the processes used by such high risk people.
7. GOSSIP MONGERS IN OVERDRIVE: Staff whispers and rumours “that all is not right” should always be taken seriously. These are, however, so often overlooked by senior management.
ACTION: Listen, take all such rumours seriously and investigate the reality.
8. TWITCHY NON-EXECS: Good non-execs provide a considered, independent and external perspective. Often they bring in specific expertise from outside the board’s immediate experience and their skills can vary from financial knowledge through to IT. When their comfort factor ‘goes south’ or when they have a ‘bee in the bonnet’ about something that does not add up or make sense, they often have good reason to worry. So must you.
ACTION: It is always good for the business to maintain a fresh supply of new thinking, new approaches and new concerns. Thus if non-execs have concerns about particular issues, one should fund their thinking by allowing them to bring in the appropriate specialist experts that can investigate matters more deeply.
9. UNOFFICIAL IT WORK: Technical staff working around the enterprise conducting unsupervised IT activity, often outside normal hours can also be a worrying sign, both from a risk and a cost perspective. Not every company is large enough to have a full IT department that might spot such issues through system audit trails. This is more common in smaller organisations where some are working more to help themselves than to help the organisation that is paying for their IT equipment and the software they use.
ACTION: Do the IT security staff look and think further than just password expiry issues? Make sure that someone is on the look out for data-theft, IPR theft, time theft (people spending all day on facebook etc.), or simple theft of IT assets. Make sure you have a proper asset register and IT audit system in place.
10. SCAPEGOATING: Where people are given a title but without actual responsibility, it can effectively cover up what is going on with those who do have responsibility or power in a situation. The fraudster’s hope is that should the balloon go up the scapegoat takes the blame, at least long enough for records to be destroyed and evidence removed.
ACTION: Make sure that you have strong and cascaded accountabilities. Ensure that people know what they should be doing, and that they are doing what is required of them. Make sure that everyone is contributing to the business objectives. Make sure HR is involved in creating or reviewing job specifications.
UKFraud.co.uk believes that by introducing a series of straightforward and cohesive processes and systems, organizations can greatly reduce the risk of fraud and in doing so, alert management to the early warning signs, should they be prevalent.
Says Bill Trueman CEO of UKFraud.co.uk “My first question is always to ask executives ‘do you really know how safe your own organisation is? Some do reply confidently. Most do not. Fraud can happen anywhere, anytime, but it is relatively straightforward to deter or discover at an early stage with the right systems and procedures in place.
"However, putting those systems in place and more importantly maintaining and updating them over time is the hard bit. There are always conflicting priorities and constraints in any organization. By averting or saving fraud losses though, organisations can protect their bottom line from taking an unexpected hit.
But only by having a cohesive anti-fraud strategy as part of the core management culture of the organisation is this be possible. There are generic anti-fraud processes and systems systems that can help support any strategy introduced and consultants such as UKFraud.co.uk are on hand to help introduce the required checks and procedures if required.
"It is our hope having published this list, that those who read it might at least ask themselves if they recognise any of the signs in their own organisations. We hope too that it might help make things that much harder for the fraudster.”
Those companies who have read the list and are worried that fraud may exist in their organisation can contact UKFraud.co.uk’s help-centre by sending an email to fraudhelp@ukfraud.co.uk.
FACTFILE:
UKFRAUD.co.uk is a leading UK based consultancy, with an impressive international track record of eliminating the risk of fraud. Its founder Bill Trueman is widely accepted as one of Europe’s leading fraud experts and a frequent commentator and writer on the issues involved. Trueman has extensive experience of the banking, insurance and the financial services sectors and is a thought leader at the forefront of many industry wide and international debates.(www.ukfraud.co.uk)
(EDITOR: Some of the above ten points can also be attributed to incompetence or laziness. Best to nip them in the bud, too, as they will cost your company money, also)
No comments:
Post a Comment