e-bizzline: Management tone will determine company attitude towards fraud

Speak out

20 June 2012 | Category: e-bizzline, Publications

Lack of effective corporate governance seriously undermines any fraud risk management programme. The organisation’s overall tone at the top sets the standard regarding its tolerance of fraud.

That’s the view of Richard Walker, Head of Business risk services at Grant Thornton Johannesburg.

“Even with numerous checklists in place, we observe that many companies are still losing valuable assets by not setting the right tone at the top regarding fraud,” says Walker.

He emphasises that it depends on a company’s senior management and directors to determine the attitude which the business has towards fraud. “It ultimately comes down to what management is saying about fraud, for example, are they prepared to prosecute – on criminal and civil counts – or ask the person to resign with a payback clause?”

According to Walker, it is essential to remember that it is the people in a business – not a computer or accounting systems – that perpetrate fraud. “When trying to prevent fraud, businesses should start by looking carefully at the kind of people they hire, by simply thinking about its recruitment practices.”

These include doing proper background checks, such as the verification of credit status, research into criminal records and confirming education levels.

While companies might focus on big items for fraud detection, Walker warns that it is very often the smaller items that can have the biggest impact.

“The smallest of crimes start with cash. The fraudulent use of company credit cards and expense claims for personal gain are simple, but well-known examples of where some of the worst instances of fraud occur. These might seem like insignificant amounts in the greater scheme of a company’s expenses, but it all adds up eventually.”

Another area where fraud is rife is in the accounts payables division where duplicate payments are made internally and externally. “This is one of the biggest fraud activities. It can involve false invoices or payments, or alternatively cash or cheque payments.”

An aspect that people often forget when it comes to fraud is that it doesn’t only revolve around money. “Theft of data and corporate information, as well as intellectual property, seems to be the norm nowadays,” he says.

Walker believes it ultimately boils down to the management’s approach to dealing with fraud. “It should never be too much trouble for a company to report fraud. One trend we see is that some companies are prepared to understate the amount of assets believed to be taken, so that they are not obliged to report it to the police.”

He refers to the Prevention and Combating of Corrupt Activities Act which requires people in a position of authority to report any fraud amounting to more than R100 000 to the authorities.

While audit committees and legislation can give guidelines on how companies should be dealing with fraud, Walker says it is about much more than merely ticking a box. Management should consider their strategy with regards to fraud is and develop a fraud prevention plan accordingly.

“Red flags should be raised when the internal and external audits do not believe a company’s control systems are adequate especially if they are seeing instances of inconsistency,” says Walker.

He advises that all companies, no matter how small, should have strict internal controls, on handling cash, including segregation of duties and training on how to spot a stolen credit card. There should also be systems that can monitor duplicate payments and very strict rules on the distribution of bank details.

“It is of vital importance to have a data handling policy for what is considered sensitive data, along with confidentiality agreements for all employees.”

In this era of information moving increasingly freely, he believes companies should consider an information classification program or text analytics system. This would, based on the usage of keywords, prohibit the transfer of sensitive data.

Control mechanisms such as anti-virus software and complex passwords will ensure protection against hacking. The frequent review and reconciliation of company bank accounts should not be forgotten.

“Simply complying with regulations by having a fraud hotline, for example, will not solve any deeper problems that your company might have. It depends on management’s attitude and principles which will ultimately be able to save companies a lot of monetary and possible reputational damage,” concludes Walker.

Related posts:

Good governance practices proactively prevent duplicate payments depleting company revenues e-bizzline: Boards have a responsibility to govern IT risks Effective risk management can add shareholder value Proper integration of business intelligence tools improves business performance

--Ends--