Good Culture = Reduced Fraud

An organisation can never underestimate the value a good culture within the organisation plays in reducing the risk of fraud. Having a good culture includes management and the board leading by example as well as employees and volunteers enjoying working for the organisation and believing in the organisation’s mission.

A poor culture where employees and volunteers feel that they are not part of the organisation, feel ignored and have low morale have less loyalty to the organisation and do not have the same, if any, feel of guilt at committing fraud against the organisation.

But how do you know if you have a good culture within your organisation. Using employee/volunteer surveys is one way to determine if the organisation has a good culture. Another way is to review retention rates and sick leave rates. If rates are increasing it may indicate a slide in the organisation’s culture.

The following are some issues that may detract from the culture within the organisation and therefore lead to an increase in fraud:

• Management and the Board not leading by example, being autocratic, do not take action against inappropriate action and do not reward good behaviour;
• Actual or perceived inequalities in the way staff and volunteers and managed;
• Not being recognised either with appropriate promotion and/or market rates of pay;
• Unrealistic budget expectations, both reducing costs and increasing funding or a combination of both; and
• Poor training and lack of other employee benefits.

Trust

Something that I hear all the time when I talk to nonprofit organisations is that they trust their employees. It is also interesting that in many instances, the organisation trusts employees more than volunteers.
While the majority of employees and volunteers are honest, there will always be some that are not. So what do you do? Here are some tips to help:

• Don’t be concerned about implementing new controls. You are doing this for two reasons. Firstly to protect the organisation from fraud and secondly to protect employees and volunteers that do follow the rules.
• If you can’t segregate duties, put other controls in place that will act as detection controls.
• If someone has been doing the same role for a long time and it is difficult to suggest you need to change the way it is done, explain the risks – for example an employee would regularly take the cash takings to the bank in their her car every day. She was not concerned when we suggested a change to make sure the organisation was covered by insurance and she would not at risk of potentially being robbed.

While all organisations will ultimately have to place some level of trust in employees and volunteers, don’t ever be afraid to implement new controls or change controls already in place. You can’t put all of your trust in a person without the back up of some form of control. This is simply not acceptable.

What is the true cost of fraud?

The following, while not an exhaustive list, need to be considered:

• Of course the actual value of the fraud needs to be taken into account.
• How much does it cost to investigate the fraud? This could be the cost to bring in someone externally to conduct the investigation or the time cost of people within the organisation to investigate the fraud.
• Who will liaise with law enforcement and take the necessary time to work with them and potentially ultimately attend court to give evidence?
• Fraud comes straight off the bottom line – consider this: if your organisation runs with a 1% surplus, a $50,000 (off the bottom line) fraud means that you need to raise $5,000,000 (top line) to replace that $50,000. This is a very difficult task to do.
• Would the fraud mean your organisation would need to either need to arrange an overdraft or extend the overdraft to maintain the cashflow? The additional interest becomes a cost of the fraud for the length of time it takes to no longer need the overdraft or extended overdraft.
• It is very difficult if not impossible to determine the cost of the fraud on the reputation of the organisation. What effect would the fraud have if it made the front page of the newspaper?
• Could the organisation be at risk of losing funding such as grants?
• Losses can be offset by any insurance, but it needs to be remembered that an insurance payout is “after the fact” and cashflow can be significantly affected before the payout is received.

Does Your Board Hinder Your Fraud Prevention?

I am often asked the question of how does the person charged with fraud prevention in an organisation, get buy in from the board and in some instances from management.

There is no easy answer, but the following are some ideas that may help:

• Remind the board of their duties to the organisation – eg. duty of care;
• Have the board consider what they organisation could do with an amount that could easily be lost to fraud, say $50,000 (eg. run a specific program, provide a service to 250 clients);
• Step the board through the true cost of fraud (eg. the loss of funds to the fraud, extra interest on an increased overdraft facility, cost to investigate the fraud, legal costs);
• Explain that employees and volunteers should not be concerned with the introduction of a fraud control program – the program is important to protect those employees and volunteers that are honest and find those that are not.

How do you deal with the media?

There are a number of issues you need to deal with when fraud is discovered. One of those is how do you deal with the media. The following are suggestions on issues that need to be considered:

• The first thing you need to consider, and pre-plan for, is the potential risk to your organisation of media attention, should it become publich that it has suffered a fraud. For example, a charity is likely to be at a higher risk as funds it relies on are from public donations and it would therefore potentially make newsworthy reading.
• The organisation then needs to be prepared. Does the organisation have a media policy? If yes, part of that policy should be who has authority to speak to the media. This person should be the person authorised to speak to the media if enquiries are made about the fraud. It also needs to be determined who authorises what can be said to the media.
• The organisation needs to consider how they will address the issue if they are contacted by the media. It is the reputation of the organisation that is at risk if a report that is not favourable to the organisation is published.

How Do You Recover Funds Lost to Fraud

When developing a Fraud Control Policy an important part of that plan is determine if it is possible to recover funds that the organisation has lost to fraud. A number of issues need to be considered:

• Does the organisation have insurance for fraud? This has been discussed previously. If the organisation has insurance for fraud, remember that cash flow potentially could be affected until such time as a payment is received.
• Determine if it is economically viable to take civil recovery proceedings. If the fraudster has a gambling or other addiction it is unlikely that funds will be available. However, if the fruadster has purchased a property or utilisied the funds in some other similar way, funds may be available for recovery. The organisation must remember that the funds that have been taken are the organisations. The organisation should not “feel sorry” for the fraudster.
• When the fraudster is found guilty, the court may order restitution. However, in this case the organisation must wait until the matter has been through Court. This may take 18 months or more. In this time, the fraudster may have disposed of any funds and assets that they have owned. This is the least favourable of the three alternatives.

Should Fraud be Reported to the Police

When developing a Fraud Control Policy an important part of that plan is a clear statement as to whether fraud that has been discovered will be reported to the Police. A number of issues need to be considered in making this decision:

• In some jurisdictions, it is required by law that any serious offence is report to the Police. An organisation needs to understand if such a requirement is in place in their jurisdiction;
• If an organisation does not report the matter to Police, the organisation needs to consider what message this send to other employees and volunteers;
• If an organisation does not report the matter to Police, will the person committing the fraud go on to another employer and commit fraud there?;
• By reporting the matter to Police, the organisation needs to consider if it is likely that the fraud will be reported in the media as it goes through the Court process and the potential damage this could cause the organisation;
• The organisation’s insurance policy may require the fraud to be reported to the Police.

Cheque Fraud

Cheque fraud can easily occur and can cost an organisation significant amounts if appropriate controls are not in place.

Cheque fraud can occur in a number of ways:

• Using false invoices to have a cheque paid in favour of the false business;
• Changing a legitimate cheque (payee and amount) without having authority to do so;
• The theft of cheques and the use of those cheques at a later time;
• Duplication of cheques, especially if they are preprinted by the company;
• Depositing a cheque into another account without authority.
  

To prevent cheque fraud, there are a number of possible controls:

• Reconcile the bank account on a regular basis;
• Never sign blank cheques. Only sign cheques when details have been completed and there is documentation supporting the payment;
• Limit the number of signatories on the account and remove signatories when they are no longer required;
• Ensure that cheques require at least two signatories;
• Keep all cheques in a safe place to deter theft;
• Avoid the use of acronyms when completing the Payee;
• If you are expecting more cheques and they have not arrived, contact the bank and cancel them.

Using Imprest Accounts

If you operate at a number of different locations or have a number of branches, the use of imprest accounts may be a good solution.

An imprest account is used on the following basis:

• A set bank account balance (set depending on the spending requirements of the location / branch and on the regularity of the reimbursement (eg. weekly, monthly));
• Deposits are made to the organisations general account and not the imprest account;
• A reconciliation of the imprest account is conducted when a reimbursement is required;
• Signatories to the imprest account are usually people located at the location / branch for ease of use of the account.

The use of an imprest account reduces the risk of fraud as it reduces the possible spending people at the location / branch can undertake.

The imprest account system allows locations / branches to have some autonomy while still being restricted in the amount they can spend and still providing regular support for the expenditure they undertake.

Travel Expenses

How do you control expenses spent by employees while travelling on work related trips? There are a few options which can be considered, each with their own benefits and risks.

Per Diems

These allow an organisation to reduce paperwork if they have a number of employees and volunteers travelling. A per diem is an allowance which can be easily set by referring to meal allowances as set by the relevant federal government. In Australia, this is set by the Australian Tax Office. If the employee spends more, it will be at their own personal cost. However, if they spend less they keep the amount they did not spend.

The benefit to the organisation is that it knows exactly how much it will spend and has a reduced level of paperwork. The potential cost to the organisation is that the employee spends less and therefore the organisation overpays the employee.

Full reimbursement of costs

In this situation, employees need to provide receipts for all meals and other costs incurred. However, the organisation needs to clearly set out what is and is not acceptable expenditure. For example, no alcohol, no mini bar in the hotel room. If a number of employees and volunteers travel frequently, the administration of this system can out way the benefits of only reimbursing the actual costs incurred. Also employees can spend more than they would under the per diem system because it’s “on the boss” or the organisation is paying for it. The other concern is that receipts are obtained by the employee where these costs are not actually incurred and reimbursement made.

Both systems have advantages and disadvantages. Whichever system is used, there needs to be a clear policy developed for when employees and volunteers are travelling on business.