Understand why people commit fraud

To be able to be in a position to understand how fraud is committed, reduce the likelihood of it happening and if it does, investigate it thoroughly, we must first understand why people commit fraud.

There are four components to why a person commits fraud, as follows:

Pressure

Pressure on the person is the reason people make the decision to commit fraud. Pressure includes:

• Living beyond ones means;
• Greed;
• Poor credit;
• Personal financial loss;
• Unexpected financial needs.
  

Rationalisation

Rationalisation is how a person who commits the fraud believes what they are doing is reasonable. It must be remembered that rationalisation is in the mind of the person committing the fraud, not what a reasonable person would consider to be rational. Some of the ways a person committing fraud rationalises what they are doing are as follows:

• “It’s only a loan. I’ll pay it back as soon as I can."
• “They didn’t give me the pay rise I deserve.”
• “Nobody will get hurt. It’s only a company not a person.”
  
  

Opportunity

Opportunity is what within the organisation allows the person to commit fraud including a lack of controls, poor culture within the organisation or failure of management to handle fraud appropriately. Consider opportunity as follows:

A perceived opportunity
+
Ability to conceal the fraud
+
Avoidance of it being discovered
+
Avoidance of it being punished
=
Opportunity

Capability

Capability means that a person is able to commit the fraud, for example:

• The person’s position in the organisation provides them with the ability to exploit an opportunity to commit fraud that may not be available to others;
• The person is smart enough to understand and exploit weaknesses in internal controls and be able to use their position and access to exploit the weakness;
• The person has a strong ego and confidence that he/she will not be detected or he/she believes he/she could talk himself/herself out of trouble if caught – a person’s arrogance;
• He/she can coerce others to commit or conceal fraud – he/she has a persuasive personality;
• He/she lies effectively and consistently – he/she must be able to look management, auditors, investors, bankers and others in the eye and lie convincingly;
• He/she deals very well with stress – committing and managing the fraud over time can be very stressful.

Maintain appropriate password security

One of the most frustrating aspects of using a computer at work is the regular reminders to change your password. However, it is also a very important way of reducing the risk of fraud.

Cracking passwords can be an easy process if good protocols are not put in place.

There are three main ways people will attempt to crack a password – guessing, dictionary attack and brute force attack.

Some passwords can easily be guessed by someone who knows the password holder well. Examples of passwords that may easily be guessed include:

• A password being written on a piece of paper and attached to the person’s monitor;
• A password not being used at all;
• Leaving the password as what was set by the system administration – regularly “password” or “admin”;
• A password being the name of a spouse, child or pet;
• A password being a person’s favourite type of car, favourite celebrity or band;
• A password being a combination of the month and year; or
• A password being the person’s name or using their actual login as their password as well.
  

Many people also use standards words. In this case a dictionary attack will not take long to determine what the password is.

The last option is a brute force attack which will try every combination of letters, numbers and symbols. The time taken to determine the password will depend on the number of characters and the combination of letters, numbers and symbols. By using a combination of letters, numbers and symbols, there are over 100 possible combinations for each character.

It has been estimated that the time taken to crack a password is as follows:

• 4 characters = 10 seconds
• 6 characters = 1,000 seconds
• 7 characters = 1 day
• 8 characters = 115 days
• 9 characters = 31 years
• 10 characters = 3,000 years
  
  

So what does this mean? For the best password security:

• the greater the number of characters in the password, the better (at least 8);
• use a combination of upper and lower case letters, numbers and symbols;
• do not use common words;
• do not give your password to anyone else;
• regularly force users to change their password;
• force users to use a minimum number of characters;
• force users to use a combination of letters, numbers and characters; and
• do not allow the password field to be left blank.

Develop a robust employment screening process

One method of reducing the risk of fraud in your organisation is to ensure you do not employ a person who has previously been convicted of fraudulent activity. To do this, an organisation should undertake an appropriate employment screening process.

The process should be undertaken prior to the final acceptance of an offer of employment and also when an employee is promoted to a management position.

Examples of the type of screening that should be undertaken are as follows:

• Conduct a criminal history check to determine if the person has a previous conviction for a fraud related offence. Consent will be needed by the potential employee to enable such a search to be undertaken;
• Verify the potential employees previous work history. Before contacting referees, verify the contact telephone numbers of the referees to ensure you are making contact with the appropriate person;
• Verify qualifications. Consent may need to be obtained from the potential employee to enable confirmation to be obtained from educational facilities and professional bodies;
• Give the applicant an opportunity to provide reasons for gaps in employment;
• Conduct an internet search such as a Google search. It’s amazing what can be found on the internet;
• Check social networking sites such as Facebook and Twitter for postings by the potential employee.

Understand what Beyond Reasonable Doubt means

I have conducted many fraud investigations as well as defending people who have been charged with fraud. Something I see on a regular basis is that a person conducting the investigation does not understand the level of proof they need to obtain. It must be proven “beyond reasonable doubt” that a person has committed fraud. Beyond reasonable doubt is the standard of proof that is used by a magistrate, judge or jury to decide if an accused is guilty or not guilty of a criminal charge.

There are different terms for beyond reasonable doubt depending on the country you are conducting the investigation in. However, the ultimate meaning is the same.

The meaning is the proposition that is being presented by the prosecution must be proven to the extent that there is no reasonable doubt that a reasonable person would, in their own mind, consider the defendant is guilty. To be able to provide this level of proof you should also consider if you need to disprove any possible reasons why a transaction, that is subject to the criminal charge, occurred.

Control the Use of Petty Cash

What is the Risk?

The risk is that someone claims personal expenses through petty cash or makes fraudulent petty cash claims.

How to Mitigate the Risk

While petty cash may only be a small amount when compared to other assets, it is an easy target for a person contemplating committing fraud for the first time. If the person is able to easily defraud the organisation of petty cash, it may encourage the person to continue to commit fraud.

Steps to reduce the likelihood of petty cash fraud occurring includes:

• Develop a policy that clearly sets out what can be claimed through petty cash with a limit on the monetary value able to be claimed;
• All claims that are made should have source documents clearly stamped with “Paid” to ensure that they can not be used in a future claim;
• All claims made should contain supporting documents (eg. receipts and invoices) of items that have been purchased;
• Petty cash should have adequate physical security (eg. locked in a safe);
• Put procedures in place to regularly reconcile cash, claims and source documents.

Understand the role of the external auditor

The role of the external auditor has often been misunderstood. This “expectation gap” has long been explained as being the gap between what the actual requirements and standards required of the auditor and audit process as compared to the expectations of the public as to what an auditor does in the audit process.

It has often been thought that the audit provides certainty as to the accuracy of the financial statements by the auditor undertaking a 100% check of the organisation’s accounts. It has also been thought that auditors should be able to provide early warning if there are solvency problems with the organisation and lastly, it is thought that a primary role of the auditor is to detect fraud.

An example of this can be seen in the BDO Not-for-Profit Fraud Survey 2008. 61% of respondents to the survey gave a reason they did not perceive fraud to be a problem for their organisation was that fraud had not been discovered by the external audit process.

It is important that not-for-profit organisations understand the role of the audit and not to relying solely on the external audit process as a way of detecting fraud. It is also important to consider that auditors, while conducing an audit as per the auditing standards, they are also conducting the audit on a fee paying basis. To undertake an appropriate audit, an appropriate fee is required to be paid.

Auditing standards provide us with guidance as to the auditors’ responsibilities regarding fraud. For example:

• “The primary responsibility for the prevention and detection of fraud rests with both those charged with governance of the entity and management. It is important that management, with the oversight of those charged with governance, place a strong emphasis on fraud prevention, which may reduce opportunities for fraud to take place, and fraud deterrence, which could persuade individuals not to commit fraud because of the likelihood of detection and punishment. This involves a commitment to creating a culture of honesty and ethical behaviour which can be reinforced by an active oversight by those charged with governance.” Paragraph 4 of ASA240 (Australian Auditing Standard – The Auditor’s Responsibilities Relating to Fraud in an Audit of a Financial Report)

• “The auditor has a responsibility to plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether caused by error or fraud. Because of the nature of audit evidence and the characteristics of fraud, the auditor is able to obtain reasonable, but not absolute, assurance that material misstatements are detected. The auditor has no responsibility to plan and perform the audit to obtain reasonable assurance that misstatements, whether caused by errors or fraud, that are not material to the financial statements are detected.“ – SAS99 (US Auditing Standard – Consideration of Fraud in a Financial Statement Audit).

Understand what can and cannot be done to the audit trail of the accounting software

The audit trail of accounting software can be a very useful tool when conducting a fraud investigation, especially when combined with an appropriate and effective IT Policy. An audit trail provides a history of who has accessed the accounting software and what transactions those people have conducted in the accounting software.

An audit trail allows for the examination of access history by users of the software. It shows what users have accessed or attempted to access as well as what those users have changed. An audit trail can also show when someone attempts to by-pass the security that has been put in place. It can act as a method of detecting fraud if people are aware it is reviewed regularly.

Audit trails can also be used as a method of detecting fraud. By reviewing the audit trail it can show patterns of when a person conducts transactions or even potentially turn the audit trail on and off. When fraud investigations have been undertaken, it has been discovered that the audit trail would be turned off and within a short period of time turned back on. During this time the fraudulent transactions were processed.

An organisation needs to understand the security measures attached to the audit trail, if the audit trail can easily be turned on and off and how to protect the data collected by the audit trail.

If the accounting package being used allows, the organisation should have the IT administrator turn the audit trail on and password protect it so that no user of the software can turn the audit trail off or delete transactions within the audit trail.

Develop appropriate controls over events

Risk

Funds are lost due to theft during the hectic operations of a special event.

Methods to Mitigate the Risk

Many not-for-profit organisations run large fund raising events which can involve the receipt of large quantities of cash.

Such an event can provide a hectic time with potential for large quantities of cash to be stolen. To ensure all cash received is properly accounted for during such an event, the following safeguards may be of assistance:

• Encourage all donations and purchases to be made by credit card.
• If donations and purchases are made by cash, ensure controls are in place to control the money that is received (eg. having two people receipting the cash).
• Have a separate person register donations and purchases to the receipt of funds so that the two can be reconciled at a later time.

Determine if the organisation wants insurance for fraud

Fraud can cause significant financial stress to an organisation, including significant cash flow problems. Obtaining fidelity insurance may help with that problem. Fidelity insurance covers an organisation for losses caused as a result of fraud.

An organisation needs to make an informed decision as to whether it wants to maintain fidelity insurance or not. When considering this issue, questions to consider include:

• What will the insurer require to enable a payment to be made (ie. Will it require a full investigation to be completed, will the insurer require a conviction?)
• How long will it take for the insurer to make a payment? The longer the time it would take, the longer the organisation could suffer financial stress as a result of the fraud.
• What is the excess of the claim and what is the maximum payout?
• What is excluded from the policy? For example, one policy I saw excluded forgery – this could potentially exclude fraud where an employee forges a signature on an organisations cheque.
  

Again, an organisation needs to make an informed decision considering the cost of the policy and the benefits that may flow from the policy if a claim is needed to be made.

Develop and maintain a fraud risk register

Many organisations maintain a Risk Register, but few of these incorporate specific fraud risks and the associated review undertaken for a risk to be placed on the register.

A Fraud Risk Register can usually be developed from the completion of a Fraud Risk Assessment and should incorporate the following:

· A description of the risk;
· Explain the impact of the risk on the organisation if the risk is not mitigated;
· Assessment of the likelihood of the fraud occurring;
· Assessment of the seriousness / consequence of the fraud;
· What actions need to be taken to mitigate the loss;
· Who will be responsible for implementing the actions to mitigate the loss;
· What is the timeline to implement these actions; and
· The checklist for implementing the actions.

A Fraud Risk Register should be updated on a regular basis (preferably on a yearly basis) or at such times as when there is a change in such things as technology (eg. a new computer system) or a change in services provided or grants received.