INDUSTRY INSIGHTS | FALL 2010 EFFECT

Protect Your Organization From Fraud

by David Legge

Everywhere I look these days I encounter fraud.

Just the other day, I read about an individual who embezzled more than $700,000 from a nonprofit organization. This person would be receiving either two years probation or a six-month jail term and restitution, but the nonprofit fared worse. It may be forced to close.

Then while traveling, I read the instructions on how to access my hotel’s Internet. It suggested turning off your spam blocker and shutting down your firewalls to be able to use its system to its maximum advantage. While I retired to bed early instead of logging on, I knew my decision meant I’d return to the office facing a host of unopened email. Surely many travelers ignore the security risk due to the demands of business and customer service.

Then just two days ago, the computer system of one of our small business clients was hacked into. The criminals gained access to the client’s online banking records and started wiring funds out. An alert bank employee stopped the activity, but not before some of the money had already left the bank.

While these instances are anecdotal, they underscore recent data from the Association of Certified Fraud Examiners (ACFE), which issued its 2010 Report to the Nations on Occupational Fraud and Abuse. The three highest categories were corruption, asset misappropriation, and fraudulent statements. Here are just a couple of items mentioned in the report:

• The typical organization loses 5 percent of its annual revenues to occupational fraud.
• The median loss for the cases studied was $160,000, with almost one-quarter of all reported cases topping more than $1 million.
• Small organizations are disproportionately victimized by occupational fraud. These organizations are typically lacking in anti-fraud controls compared to larger counterparts.

As an owner of a small business and as an individual, it is your responsibility to protect your assets and minimize your losses. Here are a few basic suggestions.

Play “what if” with your insurance agent(s)

Most businesses and individuals buy insurance to provide protection from mistakes and accidents, or to minimize the effects of criminal activity. However, how do you know if you have the right coverage? When I was the managing partner of our firm before we joined LarsonAllen, I played a game of “what if” with the various insurance agents we dealt with. I asked questions like, “What if an employee was performing services at a client location and caused damage to the facility?” The answers did not necessarily result in a change in our coverage, but at least it let us know what our exposure was.

Additionally, if you have not verified your insurance with your agent in the past few years, you may be surprised to find you are not covered for things you thought you were. Insurance policies are not static documents. Think about how many times you received small print notices from your insurance company or bank announcing changes in coverage or terms. Try playing “what if” with your agent to see if you have holes in your exposure.

Have clear policies and procedures

If your staff were traveling and needed Internet access, would they know not to disable a computer’s protection systems like the hotel suggested? To help your employees make the right decisions, provide them with these policies and require confirmation that they understand them. Furthermore, note your organization’s demographics and consider whether additional training is necessary so all staff grasp what a “restricted site” is and what email attachments should be avoided. And remember, policies are only good when applied uniformly across all levels of the organization. LarsonAllen requires all employees to certify their understanding of this policy on an annual basis. I know this because I just had to confirm it myself.

Provide the mechanism

In the ACFE study, the number one method for the initial detection of occupational fraud was from tips. In fact, it has been the number one means of detecting fraud since 2002, when these studies first began. The overwhelming majority of your employees, customers, and outside vendors want to do the right thing. However, you need to provide a mechanism for people to report a tip anonymously (e.g., phone or web-based portal). Anonymity is key, because employees often fear retaliation from superiors or peers.

Fraud is not going away, but there are many things that can be done to make sure it does not affect your organization.