Reduced cash receipts = reduced cash theft

According to the BDO Not-for-Profit Fraud Surveys cash theft is the most prevelant form of fraud.

Risk

Cash is an easier target to defraud than funds that have been deposited into a bank account.

Methods to Mitigate the Risk

Many organisations accept cash donations, membership fees or other income. Cash can easily be taken, is difficult to trace and is therefore a significant risk to fraud. To reduce the risk of cash theft, encourage deposits directly into the organisations bank account as first preference, or otherwise donate or pay by credit card (of course credit card fees will need to be considered).

Of course, controls must then be maintained over the relevant bank accounts to ensure cheque fraud or online payment fraud does not occur.

Do your employees and volunteers know your policies?

It is surprising the number of times when undertaking a fraud investigation and the person being investigated says “I didn’t know I couldn’t do that”. It’s hard to understand how someone could think that doing such things as fuelling their private car with the organisation’s fuel card or paying for a family dinner on the organisation’s credit card is not acceptable. However, it is regularly an excuse that is heard.

Risk

The risk is that an employee or volunteer, when being investigated for fraud, will use excuses such as:

• "I didn't know I couldn't do that"; or
• "No one told me that wasn't acceptable".

Methods to Mitigate the Risk

It is important that employees and volunteers understand the organisations policies. Firstly, it is important that the organisation has appropriate policies in place. No matter what the size of the organisation, policies should be in place – policies suitable to the size of the organisation that is.

Once appropriate policies are in place, there are a number of ways an organisation can make sure employees and volunteers understand their policies. Examples include:

• Develop a training program that employees and volunteers are required to attend. When attending, the employees and volunteers are required to sign an attendance sheet confirming their attendance at the training and a declaration of their understanding of the policies.
• Provide online training on the organisation’s intranet whereby employees and volunteers are ‘tested’ as to their understanding of policies and test results are maintained for future reference.
• Have employees and volunteers sign a declaration on a yearly basis (at the time of an annual performance appraisal or similar is an appropriate time) declaring that they have read and understood the organisation’s policies. Policies will need to be readily available to employees and volunteers so that they can have appropriate time to familiarise themselves with the policies.
• All new employees and volunteers should also receive training on the organisation’s policies and sign an appropriate declaration of their understanding of the policies.

Using Internet Banking

Online banking is a convenient and cost effective method of paying creditors and employees. However, online banking fraud is on the increase. The BDO Not-for-Profit Fraud Survey 2008 found that online banking fraud had increased to 8% of all fraud reported from 3% in 2006. This is in contrast to the decrease in cheque fraud from 10% of all fraud reported in 2006 to 5% in 2008.

Risk

Organisations do not take appropriate controls over their online banking facilities and leave themselves open to not only internal fraud but also external risks such as having the facility hacked.

Methods to Mitigate the Risk

As more and more organisations embrace the use of online banking rather than using cheques, it is understandable that online banking fraud will also be on the rise. Some of the issues to be considered in relation to online banking fraud are as follows:

• Many organisations have long had a requirement that two signatures were required on cheques. However, when transferring to online banking they only set up one password or if there are two passwords, both password holders know both passwords. An organisation should consider the use of a password for online banking in the same light as they do a signature on a cheque. A cheque signatory would not allow another person to sign a cheque using their signature (this is forgery), so why would they give their password to another person? Unfortunately it happens. At all times, a person having a password to online banking should never give that password to anyone else. An Online Banking Policy should clearly set out that the holder of a password will not provide that password to another person.
• The use of security tokens should be introduced. Security tokens are provided by financial institutions as a second security step or second level of authorisation. When a person logs onto online banking they will enter their user name and password. The number that is showing on the security token is then required. Even if someone discovered the password to the account, the security token number is constantly changing.
• Only ever log onto internet banking on a familiar computer (ie. One that you know is appropriately protected with firewalls and anti-virus software). Online banking has made it easier for organisations, as a person authorising the online banking payments can log in from any location to do so. However, the password holder needs to be confident that the computer he or she is using does not have a virus that could jeopardisea the security of their internet banking.

Never forget the Mission of the Organsation

A not-for-profit organisation’s mission is the reason for its existence. Funds are raised to ensure it can undertake its mission. When funds are lost to fraud, the organisation is unable to undertake its mission to the organisations fullest potential.

Risk

The organisation’s funds are not able to be utilised in meeting the mission of the organisation as they are taken by the person defrauding the organisation. Also, a subsidiary risk is that when an organisation discovers a person (be it a paid employee or a volunteer) commits fraud against the organisation, the organisation takes pity on the person and does not take appropriate action, to the detriment of the organisation.

Methods to Mitigate the Risk

The charitable nature of not-for-profit organisations can mean that they sometimes will take pity on a person who commits fraud (especially if that person has some form of problem such as a gambling addiction or serious illness). The concern is that when it is discovered that a person has committed a fraud, the person does not have their employment terminated, but is shifted to a different position within the organisation so that they will not be tempted to commit the same fraud again. It is interesting to note that the BDO Not-for-Profit Fraud Survey 2008 found that 20% of organisations did not terminate the employment of the person who committed the fraud.

It is not only the fraud that takes much needed funds away from the mission of an organisation. It must also be remembered that there are a number of additional costs to the organisation as a result of fraud. For example, the time it takes someone internally to investigate the fraud or the physical cost to bring external expertise into the organisation to conduct the investigation, time taken during the court process, an increase in insurance costs as a result of a claim being made and the potential loss of funding (eg. donations or grants). It is difficult to put a dollar value on these additional costs but they all take funds and time away from the mission of the organisation. However, a significant issue to consider is how the reputation of the organisation will be affected as a result of the fraud.

Whenever an organisation considers the issue of fraud and what actions should be taken as a result of fraud occurring, the mission of the organisation should be front of mind. By not terminating the employment of a person who has committed fraud (even if they show remorse and repay the money) there is an opportunity for the person to reoffend. It also sends the wrong message to other employees and volunteers, which may result in more fraud being committed. Once again this takes funds away from the mission of the organisation.

To protect its mission statement, an organisation should include the following statements in its Fraud Control Policy:

• The mission of the organisation is the reason for its existence, therefore fraud will not be tolerated as it takes much needed funds away from its mission;
• An employee who commits fraud will have their employment terminated;
• The organisation will take all actions possible (if it is economically viable to do so) to recover funds from the perpetrator of the fraud.

Disposing of Assets

Assets can be a significant investment for an organisation. Those assets can have value to the organisation at the time those assets are due to be disposed of.

Risk

The risk is that assets that may have a value to the organisation at the time of disposal are not disposed of in a method that is in the best interests of the organisation.

Methods of Mitigate the Risk

An organisation should set out a clear policy on how assets of the organisation will be disposed of when they are not longer needed by the organisation.

If the asset has some value the organisation needs to clearly define what is to happen. A transparent method of disposal needs to be in place. Examples of this include:

• Motor Vehicles – It may be decided that all motor vehicles that are no longer needed by the organisation will be sold at auction and that any employees or volunteers wishing to purchase a vehicle may do so but only through the auction process;

• Computers – It may be decided that all computers be sent to auction when they are to be disposed of and employees or volunteers wishing to purchase a computer may do so but only through the auction process; or
  It may be decided that employees or volunteers can ‘purchase’ a computer when its useful life has been reached by the organisation. Any such purchase price could be a pre-determined percentage of the original purchase price.
  

In general if the asset is something that will have no value if attempted to be sold, it can be appropriate to allow employees and / or volunteers to take the asset at no cost. However this needs to be done transparently. For example a disposal form is completed and the employee and / or volunteer signs the form acknowledging that they have received to asset in a ‘as is’ condition. The form can then be used as a reason for the asset to be written off / removed from the asset register.

Corporate Credit Cards

Many organisations use corporate credit cards which provide the card holders with a convenient way of conducting business. Rather than not issuing corporate credits cards in fear of fraud, policies and procedures can be put in place that can reduce the likelihood of fraud occurring.

Risk

The risk is that someone misuses their corporate credit card by using it to pay personal expenses and then either claiming the invoice is work related or altering the invoice to make it appear to be business related.

Methods to Mitigate the Risk

Corporate credit cards can easily be misused in the hands of the wrong person. Potential fraud can be minimised by taking some extra steps. These include:

• Have a written policy on the distribution and use of corporate credit cards. Employees who are provided with corporate credit cards should be required to sign the Corporate Credit Card Policy to acknowledge their understanding of what is required of them to hold the corporate credit card.
  

• Determine who actually needs corporate credit cards and obtain credit cards only for those people. If people only have an infrequent need to use a corporate credit card, they could utilise their own credit card or cash and have the cost reimbursed with the appropriate documentation.

• Set spending limits per person and not just have the same limit for everyone. By setting limits per individuals’ requirements, the organisation limits the maximum amount of fraud that can be perpetrated using the credit cards. As an example, it may be determined that the Chief Executive Officer only requires $2,000 per month, while a Purchasing Manager may require $10,000 per month. An organisation should not be afraid to set such limits.

• Corporate credit cards should only be used for business expenditure. What constitutes inappropriate use should be clearly set out.

• All expenses charged to corporate credit cards need to be supported with appropriate documents such as invoices.

• Be aware of peak risk periods. Consider this example. It is ‘back to school time’. An employee usually computers for the organisation. However, at the start of the school year the employee adds a laptop that never makes it to the organisation but instead ‘falls into’ their childs school bags.

• The cardholder should sign off on monthly credit card statements that all expenditure is for business purposes only. This can be done by the cardholder signing either a form attached to the statement or a stamp placed on the credit card statement that states words to the effect: - “All expenses charged on this statement are business related and are not personal in nature.”

• Do not allow cash withdrawals to be made on corporate credit cards including over the counter withdrawals at the bank or at an automatic teller machine. If a person is traveling overseas and needs cash for local currency, provide them with cash separately and require them to acquit the cash provided.

• Credit card statements should be approved for payment by an appropriate person after the cardholder has substantiated all expenses with appropriate documentation and verified that all expenditure is business related.

• When an employee resigns, an exit checklist should include the return of a corporate credit card.

Not-for-Profit Fraud Surveys

In 2005, I realised that there was very little data on the extent of fraud in the not-for-profit sector. For that reason, I wanted to conduct research into the sector to determine just how prevelant fraud was. The result of this was the BDO Not-for-Profit Fraud Survey 2006. The survey was done in conjunction with Not-for-Profit Network and Queensland University of Technology. In 2008, the second BDO Not-for-Profit Fraud Survey was released, in conjunction with Not-for-Profit Network, Queensland University of Queensland and a new partner in the University of Southern Queensland.

The surveys provide information on the amount of fraud occurring in not-for-profit organisations in Australia and New Zealand and how important not-for-profits consider fraud prevention to be. To enable the research to be ongoing, it is intended for this research to be conducted every two years with the aim of expanding the research beyond Australia and New Zealand.

To download the fraud surveys, please follow the links below:

• BDO Not-for-Profit Fraud Survey 2008

• BDO Not-for-Profit Fraud Survey 2006

Welcome

Welcome to my Fraud in NFP Blog. The Blog is dedicated to the issues associated with fraud in the not-for-profit sector. From my experiences over the last 20 years, in investigating fraud in the not-for-profit sector, fraud can have a significant impact on a not-for-profit organisation – more so than if a ‘for profit’ organisation suffers a fraud. Fraud can lead to bad publicity, the loss of donations, the loss of government grants and many other issues.

My hope is that my Blog will give you useful ideas that will help you and your not-for-profit organisation prevent fraud from occurring and if it does occur, then enable you to discover it quickly to reduce the damage it causes.

Lisa Bundesen