Why fraud happens?

Corporate fraud has been around for as long as commercial enterprise has been in existence. There is no strict legal definition for fraud, although it is generally thought of as involving deception to obtain an advantage to which the perpetrator is not entitled. Fraud can be perpetrated by those outside an organisation (“third parties”), by employees, or through the collusion of employees and third parties. Numerous surveys in recent years have reported that the majority of fraudsters are employees, with more than half of these being from management grades. Estimates of losses from fraud vary widely and none are reliable but it is apparent that the extent of fraud is material in most, if not all national economies.

Fraud, however, is not inevitable; it does not have to happen. Like any other business or operational risk, the risk of fraud can be identified, managed and minimised. Fraud is more likely to occur where there is a gap in the company’s defences (its control systems), often where insufficient time has been spent considering how fraud can occur, what controls are in place to prevent it and whether those controls are operating as intended.

The main factors which contribute to today’s levels of significant corporate fraud include the growing complexity of organisations, the ever-increasing speed of modern commerce and computerisation, a history of inattention, understaffing of internal audit functions, the acceptance of some level of fraud as the ‘cost of doing business’, outdated and ineffective internal controls, aggressive accounting practices and increasingly transient employees, and corporate global expansion combined with a lack of familiarity with local business practices.

How to prevent fraud?

In our experience of investigating fraud, there is more often than not an internal control which should have prevented or detected the fraud – but it was either overridden or not properly understood by the staff responsible for the control.

Therefore, it is essential to:

• Thoroughly understand all business processes;
• Identify the fraud risks in each area from management/employees, third parties or through collusion;
• Identify the most critical risks according to severity and likely frequency;
• Implement appropriate controls;
• Implement indirect controls throughout the organisation to change the corporate culture and encourage openness and reporting;
• Identify and deal with risks posed by the IT environment; and
• Constantly review and update procedures based on findings.

Increasingly, organisations have codified guidelines on dealing with ethical and fraud-related behaviours, such as codes of conduct, governance codes, response plans and anti-fraud policies. However, we are concerned that issuing a policy by itself may be insufficient.

People need to be educated and held accountable to these guidelines, or their behaviour is unlikely to change.

The Fraud Checklist can help you to identify the matters for consideration in preventing fraud.

A recognized fraud policy

A fraud policy is a formal, written statement recording the company’s attitude to fraud. It may be included within a more general ethics statement or code of conduct that records the way in which the company deals with its customers, suppliers and staff. In particular, the policy should make it clear that fraud is unacceptable and that all instances of suspected fraud will be treated seriously and dealt with swiftly.

The fraud policy is supported by the directors, who in turn must comply, and be seen to comply, with its provisions. Paramount to the successful implementation of a fraud policy is clear and timely communications to everyone in the organization. Staff should be required to indicate their awareness of and compliance with the fraud and ethics policy on an annual basis. Compliance with it should form part of the terms of their employment.

For those in any doubt about what constitutes appropriate behaviour, the fraud policy serves as a useful deterrent. Clear communication will help ensure that employees understand what is and what is not acceptable. Fraud awareness training should also be considered, particularly for the higher-risk areas.

In some cases where an organisation’s performance is heavily dependent upon third parties (i.e. outsourcing), it may be appropriate to share the content of ethics policies with key contractors and suppliers, and to seek assurances that they will adopt these or similar standards. The corporate governance arena remains in the spotlight and the implementation of a fraud policy indicates that corporate governance is taken seriously.