Fraud Prevention

HomeFraud Prevention

The Prevention element of the Fraud Deterrence Lifecycle tends to be the most misunderstood and yet can provide the most value. Fraud prevention should be looked at holistically and, based on the ACFE’s fraud prevention check-up, we offer the following services (Risk Assessment, Data Analysis, Fraud Hotline Management, Background Searches, Training & Awareness and Policy Review/Development).

FRAUD PREVENTION

WHAT IS ‘FRAUD’?

Fraud is an intentional, unlawful act, that is covered up by deceit or misrepresentation that causes a loss. The important element is the ‘deception’ – that is why most frauds go undetected for an average of 3 years and in most

cases the fraudster is a long-serving ‘trusted’ employee!

HOW MUCH MONEY GETS LOST TO FRAUD?

According to the Association of Certified Fraud Examiner’s the average organisation loses 5% of its annual turnover to fraud

WHAT SHOULD ORGANISATIONS BE DOING TO FIGHT FRAUD?

All organisations should have a fraud prevention program in place as prevention is far better than cure!

WHAT IS FRAUD PREVENTION?

Prevention is defined as, “to prevent, to stop or keep from doing or happening, to hinder a person from acting”. So prevention activities are intended to secure the enterprise and its processes against fraud.

WHO IS RESPONSIBLE FOR PREVENTING FRAUD?

According to both the National Commission of Fraudulent Financial Reporting(1987) and ISA 240 (Consideration of Fraud in a Financial Statement Audit). “It is management’s responsibility to design & implement controls to prevent and detect fraud “Management… should set the proper tone… and establish controls to prevent, deter, and detect fraud” The internal and external auditors are NOT responsible for fraud prevention!

“BUT WHAT ABOUT OUR ‘INTERNAL CONTROLS?”

“If you were to ask a group of typical accountants what deters fraud, they would respond in unison: ‘Internal control!’ Using this logic, companies with adequate controls would not have fraud. But they do, time & again”

– Joe Wells, founder of the ACFE

Internal Controls ≠ Fraud Prevention!

Every organisation has internal controls but they don’t all have fraud prevention!

SO THEN, WHAT MAKES UP A ‘FRAUD PREVENTION’ PROGRAM?

There are a few fraud prevention building blocks in addition to your internal controls:

  • Do background checks on all employees
  • Do fraud risk assessments
  • Do regular fraud Awareness Training
  • Ensure that your Tone at the Top is one of honesty
  • Have an accountability matrix
  • Implement a Code of Ethics
  • Implement a reporting mechanism (hotline)
  • Implement continuous controls monitoring (CCM)
  • Implement Proactive Anti-Fraud Policies

 

(You may be asking why the hotline and CCM are listed under ‘prevention’ as they are primarily detection tools. Well, the mere fact that you have them in place, and staff are aware of them, will have a preventative effect.)

WHO CAN YOU TRUST TO HELP YOU EXECUTE A FRAUD PREVENTION PROGRAM?

Exactech Fraud Prevention Solutions (EFPS) specializes in helping private and public sector organisations to implement best practice anti-fraud initiatives. All team members are Certified Fraud Examiners (CFEs) and have over 30 years combined anti-fraud experience.

Would you go to doctor who’s not a MD? By the same token, would you hire someone who is not a CFE to advise you on how best to protect your organisation’s assets? The CFE credential denotes proven expertise in fraud prevention & deterrence!

“In general I can categorically state that Mario is highly qualified & continuously stays abreast of developments globally in his areas of expertise and he has consistently provided a professional service to us. I can without hesitation recommend his services.” – Compliance Officer – Bank

The Fraud Deterrence Lifecycle has four elements of which Fraud Prevention is obviously 1st prize, but if you do suffer a fraud you need to correct the processes that allowed the fraud to take place, otherwise you are doomed to repeat the same frauds over and over.

This means you should use Root Cause / Trend Analysis to drive Process Correction and not focus on just the symptoms of the fraud. The root causes would be established from the forensic investigations and/or internal audits and should be fed back into the fraud prevention plan in order to ensure that it is a ‘living’ document and correction would also focus on maximising recoveries of stolen monies.

This is where pure investigators tend to fall down as they don’t understand business processes and/or they think their job is done when the perpetrator is put in jail – they seem to forget that there a particular vulnerability was exploited in order for the fraudster to commit the crime and if this is not plugged the next employee will most probably try the same thing.

Deterrence modifies the person’s behavior through perception of being caught and being punished while Prevention focuses on removing the root cause of the problem, hence prevention and correction logically go together.

The Prevention element of the Fraud Deterrence Lifecycle tends to be the most misunderstood and yet can provide the most value, so let’s see what the best practice elements of a fraud prevention process are.

Fraud prevention should be looked at holistically and, based on the ACFE’s fraud prevention check-up, is presented here as sequential building blocks making up the program:

Fraud Risk Assessment – Management should assess the vulnerability of the organisation to fraudulent activity every 18 to 24 months. This is traditionally done by evaluating the type of fraud risk, the potential impact of the fraud, the likelihood of its occurrence and the pervasiveness of the risk. Fraud is like cancer. Most of us know someone who has it. We know people who will eventually have it. It has become common but we can take steps to protect ourselves through healthy choices and regular check-ups using the latest tools & technology.

Accountability – Dishonest employees may not commit a fraud if they know the organization has an oversight and confirmation process. After giving the code of ethics to all employees (in both hard and soft copy if possible), require that they sign a statement that says they have read and understood the code’s requirements and will comply with them. The fraud prevention plan should include an accountability matrix that lists the anti-fraud functions and which staff have primary, secondary or a shared responsibility. This then eliminates the excuse of ignorance.

Controls – After the fraud risk assessment results have been perused, management should determine whether there are controls in place to mitigate the identified fraud risks or if additional emphasis should be placed on existing controls. Where controls are lacking, management should design and implement additional antifraud controls to specifically address the identified fraud risks or redesign the process to be more fraud resistant.

“If you were to ask a group of typical accountants what deters fraud, they would respond in unison: ‘Internal control!’ Using this logic, companies with adequate controls would not have fraud. But they do, time & again”.

- Joe Wells, founder of the Association of Certified Fraud Examiners.

Data Analytics – Many organisations have been scared away from data analytics for the following reasons:

  • There are too many software products to choose from
  • Obtaining data is difficult
  • The exercise takes too long, Involves too many analysts and costs too much
  • The results tend to be extremely lengthy and difficult to understand

For the above reasons, many organisations perform data analytics only during the annual audit or after they have stumbled across fraud. This ‘ad-hoc’ analytics should progress to ‘repeated review’ and then ultimately to ‘CCM’ (continuous controls monitoring). CCM is a solution that uses automated, pre-defined analytic tests to critical control points within specific business process areas.

By automating sophisticated analytics and embedding audit “best practices” in organisations’ business operations, management receives timely notification of anomalies and control breaches, mitigating risks of ineffective or missing controls within application systems. Business process owners receive timely notification of control breaches, can quickly review quantified exposure of business risk, and can drill down to specific exceptions and transactions to resolve potential problems before they escalate.

Recruitment – There are primarily two types of fraudsters – career criminals and situational criminals. For the career criminal it is crucial to conduct background checks on all new employees. For the situational criminal it is crucial to do continual in-service screening (observing lifestyle changes as an example) and to ensure that exit interviews ask the right questions as some employees leave because of unethical behavior from a boss. Professional background checks can uncover criminal convictions, credit history problems, and questions about education, prior employment issues and integrity concerns. Remember that this goes for all grades – executives should not be immune from background checks!

Whistle-blowing System – Many frauds are known or suspected by both insiders and outsiders. A recent survey showed that an average of 20% of employees know about fraud within their organisations but only 40% of those reported the suspicions. The challenge for management is to encourage these ‘innocent’ people that ‘speaking out’ is their responsibility and is very much in their own interest. The service should then ensure anonymity and confidentiality otherwise employees will fear retaliation and will keep quiet.

Codes of Ethics – is the one critical cornerstone where no short-cuts should be taken. The success or failure of a fraud prevention plan depends primarily on the culture of the organization, and a sustainable Ethics Program will ensure that ethics is top-of-mind within the company.

Merely having a code of ethics is not sufficient so cutting-edge companies are designing and implementing training around the code, bringing what is often a dormant item to life. Far too often, the code lies buried in an organisation’s employee training manual and is handed out to new employees on their first day on the job and then forgotten about.

Policy – The aim of a corporate fraud policy is to demonstrate to all stakeholders that the company is taking the threat of fraud and dishonesty seriously.

By issuing a detailed policies (such as a Fraud policy, Whistle-blowing policy, Reward policy, Fraud response plan, Code of conduct, etc.) it clearly sets out what is considered to be dishonest, warns any potential wrongdoers that the consequences of being caught will be serious and explains each process. The effect therefore will be to deter any potential wrongdoers thus resulting in reduced losses from fraud and reduced costs in respect of investigating any wrongdoing. Training & Awareness – is the other critical cornerstone and by linking fraud awareness training to the code of ethics sends a strong message and reinforces what is considered appropriate behavior by the company. Training needs to happen annually, not only when new employees join the company, and it must target existing employees as well as newcomers.

The training should also bring in the whistle blowing system and how it works, the various policies, procedures and other related documents, as well as roles and responsibilities. The training should be ‘edutaining’, meaning it should inform and entertain as this is the best way for people to learn and retain what they have learnt.

If you are, however, unble to prevent a fraud from occurring in your organisation the next best is to detect it as quickly as possible and then to investigatein order to recover monies and to punish the perpetrator/s.

Keep in mind that most investigations now include cyber forensics, as suspects tend to have evidence, whether emails, documents, or web history, on their computers and this is where our specialist computer forensic services can assist you.

This service can be seen as investigative or preventative – our suggestion to organisations is to image all key staff member’s computer hard-drives when they resign. Once they have left and their computer is being used by their replacement, and you now suspect fraud, it is much more difficlut to obtain court-admisable evidence. Rather image and not need the image than the converse!

Just like the RCMP (Royal Canadian Mounted Police) motto of ‘We always get our man’, the wild dogs very seldom miss their target and have a successful kill ratio of 90%! Our computer forensic services division tends to amaze clients with what we find when analyzing suspects computers.

“An ounce of prevention is worth a pound of cure”

- Benjamin Franklin

The above quote was actually fire-fighting advice from Franklin, as those people who experienced fire damage to their homes often suffered irreversible economic loss.

The quote is most applicable to fraud, as more than thirty percent of companies that suffer frauds go bankrupt.

SO WHAT ARE YOU WAITING FOR? CALL US…!

+27 861 99 99 41