Maintain appropriate controls over assets

Assets can be a significant investment for many organisations. Ensuring the security of those assets is important, especially considering the different types of assets an organisation has.

Risk

The risk is that assets are taken by employees and / or volunteers and / or external parties of the organisation for personal use and not returned (in effect, the theft of the assets).

Methods to Mitigate the Risk

When developing controls over assets, the following should be considered:

• Small assets should be secured by using locks or similar security measures where appropriate (for example, a security lock attaching a laptop to a desk);
• All assets should be tagged with an Asset Number;
• An Asset Register should be maintained. The Register should include the following information - Asset Tag number, Description of the asset, Date of purchase, Warranty information, Location of the asset.
• Stock takes of assets should be undertaken at least yearly and any discrepancies to the Asset Register should be investigated. The stock take and investigation of discrepancies should be undertaken by a person who is not responsible for the recording of assets in the Asset Register.
• If an asset is to be disposed of, it can only be removed from the Asset Register with a properly authorised Asset Disposal Form having been completed as required by the Asset Disposal Policy. Refer to my Blog post on 26 January 2009.
  

Determine if controls in place are detection or prevention controls

When developing a set of internal controls or reviewing the current internal controls in place in an organisation, it is important to determine if the organisation has a balance of prevention as well as detection controls.

Prevention controls are those controls that reduce the likelihood of fraud occurring or “prevent” the fraud from occurring. Detection controls are effectively a “back-up” control and are there to detect fraud if the prevention controls have not been effective and have allowed the fraud to occur. Detection controls that are in place should allow for the fraud to be detected as quickly as possible.

Prevention controls can be split into two types – macro and micro prevention controls.

Macro prevention controls are those controls at a strategic level that are in place to prevent fraud from occurring. Examples of macro prevention controls include:

• Having a board and management structure that lead by example – this is regularly referred to as the “tone at the top”. If the board and management of the organisation do not support fraud prevention and control in the organisation, it is difficult to have employees and volunteers support it.
• Having an appropriate fraud control plan / strategy in place which employees and volunteers are aware of and receive appropriate training on. This allows employees and volunteers to understand that fraud is not acceptable within the organisation.
• Having an ethical organisational culture within the organisation. It is important to understand the value of having an ethical organisational culture when it comes to fraud prevention. An ethical organisational culture is considered by organisations to be a primary factor in reducing the risk of fraud.[1]

Micro prevention controls are those controls that effect the day to day operations of the organisation. Examples of micro prevention controls include:

• Segregation of duties. For example, the requirement to have two people process and approve a payment makes it more difficult for one person to commit fraud unless there is collusion involved or the person committing the fraud by-passes the second person, for example by forging the person’s signature approving the payment.
• Having two cheque signatories or two passwords required for internet banking again makes it more difficult for an individual to commit fraud.

Examples of detection controls include:

• Undertaking bank reconciliations on a regular basis and investigating any discrepancies that arise. For example, a common method of hiding a fraud is to “force” a bank reconciliation to reconcile (eg. to include incorrect entries, have a deposit outstanding for more than one reconciliation, have an outstanding deposit increase from one reconciliation to another). By having the bank reconciliation reviewed on a regular basis and conducting an investigation of any discrepancies can allow fraud to be discovered quickly.
• Prepare realistic budgets and compare actuals to budgets on a regular basis and investigate discrepancies.
• Conduct exception reporting and investigate discrepancies that arise.
  
  [1] BDO Not-for-Profit Fraud Survey 2008, Chart 5.5, page 66.

Secure non cash donations received

Many organisations will receive non cash donations (for example from bequests) of expensive items such as jewelry. These items are easy targets for employees and/or volunteers to steal.

Risk

The risk is that an employee or volunteer either does not pay for or pays undervalue for an item that has been donated to the organisation for the purpose of sale so as to raise funds for the organisation.

Methods to Mitigate the Risk

To reduce the likelihood of this occurring, the following steps could be taken:

Have all donations of jewelry and other small valuable items sent directly to a valuer or auctioneer rather than to your organisation’s office. The valuer or auctioneer can catalogue items which provides independent verification that the items have been received and the value of those items;

Set a policy that states one of the following:

• Employees / volunteers and their immediate families cannot purchase these types of donations in any circumstances;
• Employees / volunteers cannot purchase these types of donations unless it is at auction; or
• Employees / volunteers can purchase these types of donations before auction but only at the valuation / reserve price set by the valuer.
  

Reduced cash receipts = reduced cash theft

According to the BDO Not-for-Profit Fraud Surveys cash theft is the most prevelant form of fraud.

Risk

Cash is an easier target to defraud than funds that have been deposited into a bank account.

Methods to Mitigate the Risk

Many organisations accept cash donations, membership fees or other income. Cash can easily be taken, is difficult to trace and is therefore a significant risk to fraud. To reduce the risk of cash theft, encourage deposits directly into the organisations bank account as first preference, or otherwise donate or pay by credit card (of course credit card fees will need to be considered).

Of course, controls must then be maintained over the relevant bank accounts to ensure cheque fraud or online payment fraud does not occur.

Do your employees and volunteers know your policies?

It is surprising the number of times when undertaking a fraud investigation and the person being investigated says “I didn’t know I couldn’t do that”. It’s hard to understand how someone could think that doing such things as fuelling their private car with the organisation’s fuel card or paying for a family dinner on the organisation’s credit card is not acceptable. However, it is regularly an excuse that is heard.

Risk

The risk is that an employee or volunteer, when being investigated for fraud, will use excuses such as:

• "I didn't know I couldn't do that"; or
• "No one told me that wasn't acceptable".

Methods to Mitigate the Risk

It is important that employees and volunteers understand the organisations policies. Firstly, it is important that the organisation has appropriate policies in place. No matter what the size of the organisation, policies should be in place – policies suitable to the size of the organisation that is.

Once appropriate policies are in place, there are a number of ways an organisation can make sure employees and volunteers understand their policies. Examples include:

• Develop a training program that employees and volunteers are required to attend. When attending, the employees and volunteers are required to sign an attendance sheet confirming their attendance at the training and a declaration of their understanding of the policies.
• Provide online training on the organisation’s intranet whereby employees and volunteers are ‘tested’ as to their understanding of policies and test results are maintained for future reference.
• Have employees and volunteers sign a declaration on a yearly basis (at the time of an annual performance appraisal or similar is an appropriate time) declaring that they have read and understood the organisation’s policies. Policies will need to be readily available to employees and volunteers so that they can have appropriate time to familiarise themselves with the policies.
• All new employees and volunteers should also receive training on the organisation’s policies and sign an appropriate declaration of their understanding of the policies.

Using Internet Banking

Online banking is a convenient and cost effective method of paying creditors and employees. However, online banking fraud is on the increase. The BDO Not-for-Profit Fraud Survey 2008 found that online banking fraud had increased to 8% of all fraud reported from 3% in 2006. This is in contrast to the decrease in cheque fraud from 10% of all fraud reported in 2006 to 5% in 2008.

Risk

Organisations do not take appropriate controls over their online banking facilities and leave themselves open to not only internal fraud but also external risks such as having the facility hacked.

Methods to Mitigate the Risk

As more and more organisations embrace the use of online banking rather than using cheques, it is understandable that online banking fraud will also be on the rise. Some of the issues to be considered in relation to online banking fraud are as follows:

• Many organisations have long had a requirement that two signatures were required on cheques. However, when transferring to online banking they only set up one password or if there are two passwords, both password holders know both passwords. An organisation should consider the use of a password for online banking in the same light as they do a signature on a cheque. A cheque signatory would not allow another person to sign a cheque using their signature (this is forgery), so why would they give their password to another person? Unfortunately it happens. At all times, a person having a password to online banking should never give that password to anyone else. An Online Banking Policy should clearly set out that the holder of a password will not provide that password to another person.
• The use of security tokens should be introduced. Security tokens are provided by financial institutions as a second security step or second level of authorisation. When a person logs onto online banking they will enter their user name and password. The number that is showing on the security token is then required. Even if someone discovered the password to the account, the security token number is constantly changing.
• Only ever log onto internet banking on a familiar computer (ie. One that you know is appropriately protected with firewalls and anti-virus software). Online banking has made it easier for organisations, as a person authorising the online banking payments can log in from any location to do so. However, the password holder needs to be confident that the computer he or she is using does not have a virus that could jeopardisea the security of their internet banking.

Never forget the Mission of the Organsation

A not-for-profit organisation’s mission is the reason for its existence. Funds are raised to ensure it can undertake its mission. When funds are lost to fraud, the organisation is unable to undertake its mission to the organisations fullest potential.

Risk

The organisation’s funds are not able to be utilised in meeting the mission of the organisation as they are taken by the person defrauding the organisation. Also, a subsidiary risk is that when an organisation discovers a person (be it a paid employee or a volunteer) commits fraud against the organisation, the organisation takes pity on the person and does not take appropriate action, to the detriment of the organisation.

Methods to Mitigate the Risk

The charitable nature of not-for-profit organisations can mean that they sometimes will take pity on a person who commits fraud (especially if that person has some form of problem such as a gambling addiction or serious illness). The concern is that when it is discovered that a person has committed a fraud, the person does not have their employment terminated, but is shifted to a different position within the organisation so that they will not be tempted to commit the same fraud again. It is interesting to note that the BDO Not-for-Profit Fraud Survey 2008 found that 20% of organisations did not terminate the employment of the person who committed the fraud.

It is not only the fraud that takes much needed funds away from the mission of an organisation. It must also be remembered that there are a number of additional costs to the organisation as a result of fraud. For example, the time it takes someone internally to investigate the fraud or the physical cost to bring external expertise into the organisation to conduct the investigation, time taken during the court process, an increase in insurance costs as a result of a claim being made and the potential loss of funding (eg. donations or grants). It is difficult to put a dollar value on these additional costs but they all take funds and time away from the mission of the organisation. However, a significant issue to consider is how the reputation of the organisation will be affected as a result of the fraud.

Whenever an organisation considers the issue of fraud and what actions should be taken as a result of fraud occurring, the mission of the organisation should be front of mind. By not terminating the employment of a person who has committed fraud (even if they show remorse and repay the money) there is an opportunity for the person to reoffend. It also sends the wrong message to other employees and volunteers, which may result in more fraud being committed. Once again this takes funds away from the mission of the organisation.

To protect its mission statement, an organisation should include the following statements in its Fraud Control Policy:

• The mission of the organisation is the reason for its existence, therefore fraud will not be tolerated as it takes much needed funds away from its mission;
• An employee who commits fraud will have their employment terminated;
• The organisation will take all actions possible (if it is economically viable to do so) to recover funds from the perpetrator of the fraud.

Disposing of Assets

Assets can be a significant investment for an organisation. Those assets can have value to the organisation at the time those assets are due to be disposed of.

Risk

The risk is that assets that may have a value to the organisation at the time of disposal are not disposed of in a method that is in the best interests of the organisation.

Methods of Mitigate the Risk

An organisation should set out a clear policy on how assets of the organisation will be disposed of when they are not longer needed by the organisation.

If the asset has some value the organisation needs to clearly define what is to happen. A transparent method of disposal needs to be in place. Examples of this include:

• Motor Vehicles – It may be decided that all motor vehicles that are no longer needed by the organisation will be sold at auction and that any employees or volunteers wishing to purchase a vehicle may do so but only through the auction process;

• Computers – It may be decided that all computers be sent to auction when they are to be disposed of and employees or volunteers wishing to purchase a computer may do so but only through the auction process; or
  It may be decided that employees or volunteers can ‘purchase’ a computer when its useful life has been reached by the organisation. Any such purchase price could be a pre-determined percentage of the original purchase price.
  

In general if the asset is something that will have no value if attempted to be sold, it can be appropriate to allow employees and / or volunteers to take the asset at no cost. However this needs to be done transparently. For example a disposal form is completed and the employee and / or volunteer signs the form acknowledging that they have received to asset in a ‘as is’ condition. The form can then be used as a reason for the asset to be written off / removed from the asset register.

Corporate Credit Cards

Many organisations use corporate credit cards which provide the card holders with a convenient way of conducting business. Rather than not issuing corporate credits cards in fear of fraud, policies and procedures can be put in place that can reduce the likelihood of fraud occurring.

Risk

The risk is that someone misuses their corporate credit card by using it to pay personal expenses and then either claiming the invoice is work related or altering the invoice to make it appear to be business related.

Methods to Mitigate the Risk

Corporate credit cards can easily be misused in the hands of the wrong person. Potential fraud can be minimised by taking some extra steps. These include:

• Have a written policy on the distribution and use of corporate credit cards. Employees who are provided with corporate credit cards should be required to sign the Corporate Credit Card Policy to acknowledge their understanding of what is required of them to hold the corporate credit card.
  

• Determine who actually needs corporate credit cards and obtain credit cards only for those people. If people only have an infrequent need to use a corporate credit card, they could utilise their own credit card or cash and have the cost reimbursed with the appropriate documentation.

• Set spending limits per person and not just have the same limit for everyone. By setting limits per individuals’ requirements, the organisation limits the maximum amount of fraud that can be perpetrated using the credit cards. As an example, it may be determined that the Chief Executive Officer only requires $2,000 per month, while a Purchasing Manager may require $10,000 per month. An organisation should not be afraid to set such limits.

• Corporate credit cards should only be used for business expenditure. What constitutes inappropriate use should be clearly set out.

• All expenses charged to corporate credit cards need to be supported with appropriate documents such as invoices.

• Be aware of peak risk periods. Consider this example. It is ‘back to school time’. An employee usually computers for the organisation. However, at the start of the school year the employee adds a laptop that never makes it to the organisation but instead ‘falls into’ their childs school bags.

• The cardholder should sign off on monthly credit card statements that all expenditure is for business purposes only. This can be done by the cardholder signing either a form attached to the statement or a stamp placed on the credit card statement that states words to the effect: - “All expenses charged on this statement are business related and are not personal in nature.”

• Do not allow cash withdrawals to be made on corporate credit cards including over the counter withdrawals at the bank or at an automatic teller machine. If a person is traveling overseas and needs cash for local currency, provide them with cash separately and require them to acquit the cash provided.

• Credit card statements should be approved for payment by an appropriate person after the cardholder has substantiated all expenses with appropriate documentation and verified that all expenditure is business related.

• When an employee resigns, an exit checklist should include the return of a corporate credit card.

Not-for-Profit Fraud Surveys

In 2005, I realised that there was very little data on the extent of fraud in the not-for-profit sector. For that reason, I wanted to conduct research into the sector to determine just how prevelant fraud was. The result of this was the BDO Not-for-Profit Fraud Survey 2006. The survey was done in conjunction with Not-for-Profit Network and Queensland University of Technology. In 2008, the second BDO Not-for-Profit Fraud Survey was released, in conjunction with Not-for-Profit Network, Queensland University of Queensland and a new partner in the University of Southern Queensland.

The surveys provide information on the amount of fraud occurring in not-for-profit organisations in Australia and New Zealand and how important not-for-profits consider fraud prevention to be. To enable the research to be ongoing, it is intended for this research to be conducted every two years with the aim of expanding the research beyond Australia and New Zealand.

To download the fraud surveys, please follow the links below:

• BDO Not-for-Profit Fraud Survey 2008

• BDO Not-for-Profit Fraud Survey 2006