This article is authored by Cameron Johnstone, Dominic Molluso and Sean Wengel.
Employee fraud is all too common, with 80% of business leaders encountering fraudulent activity by an employee during their career, according to the Association of Certified Fraud Examiners (ACFE). What’s more staggering is that over half of the businesses that experience it will never recover their losses.
In the current pandemic-stricken environment, there’s an even higher risk of fraud – with many employees working remotely, households under financial pressure and organisations implementing hiring freezes, leading to employees doing more for less and adopting a sense of entitlement.
For this reason, it’s important to understand the most common types of employee fraud, the red flags that can lead to its detection, and ways to prevent it from occurring.
Types of fraud
Employee fraud is a deliberate act that involves some form of deception to secure an unfair or unlawful advantage. While any employee with the means and motivation can commit fraud, it usually occurs from a position of trust and authority. It can affect any organisation and can create financial and reputational risk.
- Asset misappropriation
This type of fraud occurs when employees steal assets of the business including, but not limited to cash, inventory or fixed assets from a business.
- Employee corruption
Another common type of fraud, employee corruption takes place when employees misrepresent their work performed and omit acts such as failing to enforce policies or regulations in exchange for something of value.
- Financial statement fraud
Financial statement fraud involves the deliberate alteration of company financials to mislead users. It’s usually perpetrated by management to reach certain targets or achieve specific objectives. Often, the employee benefits from this misstatement through bonuses or commissions.
Red flags
So how can a business identify employee fraud? The good news is, there are some red flags that might indicate fraudulent behaviour.
In isolation, the below behaviours don’t necessarily point to a problem. Combined however and the employee in question might be a higher internal fraud risk:
- Living beyond their means
- Addiction problems
- Financial difficulties
- Unusually close with one or two key customers or suppliers
- Secretive behaviour and unwillingness to share duties
- Unwilling to take annual leave
It’s also important to note that while anyone can be guilty of employee fraud, in most cases, it’s found to be those with extensive knowledge of processes, systems or internalcontrols – in other words, the means to do it and knowing where the weaknesses exist. Hence, it’s often those in positions of power and influence, with a level of trust and authority.
Motivators can include financial problems, pressure to meet one or more targets at work, and a rationalisation of entitlement overlaid with opportunity.
Detection
Being mindful of the above red flags, particularly in those with knowledge of processes and access to financial data can assist in the early detection of inappropriate activity.
Other means to detect fraudulent activity include regular accounting reconciliations to help highlight unusual transactions and undertaking an internal or external audit.
Fraud-related procedures are part of a standard financial statement audit which provides comfort that the data is materially accurate and includes a report to management and those charged with governance, outlining the outcome of the fraud procedures performed and providing suggestions for improvement.
Tip offs from employees are also a great way to detect fraud and demonstrate the importance of training employees in what to be aware of. It’s important employees have a process to follow if they do identify or suspect anything inappropriate occurring within the business.
Prevention
Detection can often occur when it’s too late and significant damage has been done to both the bottom-line of a business and its reputation. Therefore, preventing fraud should be priority.
There are some seemingly obvious and rather simple processes that can help prevent fraud. These include conducting thorough background and police checks on all potential staff during the hiring phase, enforcing mandatory leave, and reviewing policies and procedures to ensure they’re always up to date.
Beyond this, we believe an organisation’s best line of defence is to prevent employee fraud is to implement tailored internal controls that reflect the way in which your business operates. This is especially relevant for businesses with remote working environments which are operating with increased risk of fraud.
Importantly, while one control might work well for your business, it won’t necessarily be effective for another. Look at your processes and consider where they might break down. For example, if your employees are working remotely and signing off on contracts and statements with digital signatures, review your controls around signing off on payments and other documents to ensure they are still fit for purpose.
Training your employees in fraud awareness is also critical, with the AECF’s 2020 Report to the Nations, Global Study on Occupational Fraud and Abuse noting that 49% of cases are identified through employee tip offs. Training could include informing your employees about fraud hotlines and rewards for whistle-blowers.
Another strong preventative measure is to enforce a segregation of incompatible duties. This will ensure that each process within your business is overseen by several employees, with no one employee having responsibility from start to finish. When one person has complete control, their ability to commit and conceal fraud is increased and the business’s ability to detect that fraud is decreased. In smaller businesses, adequate segregation can be obtained even by assigning two people to a task. Where this is not possible, those handling finances should be under close supervision.
Failure to regularly review your internal controls and make them fit for purpose provides the means for fraud to arise and could result in any insurance claim lodged for recovery of the fraud being denied.
When worst case scenario has transpired…
If employee fraud has occurred and been detected, there are some incident response measures a business can take when trying to recover its losses.
Conduct a forensic review
Evidence is essential to help prosecute the perpetrator/s. A thorough analysis is often necessary to determine the extent and quantum of the fraud. IT forensics can recover content that may have been deleted and emails are often used in evidence. Ensure all information is collected and saved internally for access and use in legal proceedings or insurance claims.
Consider an ‘Agreed upon Procedures’ Engagement
A cost-effective ‘Agreed Upon Procedures’ engagement by a specialist can help focus on areas of business considered most at risk as determined by management or those charged with governance. It’s a tailored approach which provides flexibility for your business.
Communicate
In most instances, many employees will become aware of the fraud. Consider how you communicate this fraud to staff, how it would impact on any legal claims and insurance claims. If it is publicised, ensure your public relations team or media liaison communicates a succinct message to reduce damage to the business’ brand.
Set up a ‘Safe Harbour’ from insolvent trading
To ensure the directors’ personal exposures are minimised during the disruption, the Board should consider whether it is necessary to invoke Safe Harbour from insolvent trading .
When responding to suspected instances of fraud or when a business is subjected to a cyber-attack, the directors’ personal exposure may not be front of mind. This is the time when a businesses going concern is most vulnerable and directors need to consider all possible scenarios when managing their recovery plan. Putting protections in place to mitigate the impact of the worst possible outcome are simple and Safe Harbour is one of the most important.
Safe Harbour laws provide protection for company directors from liability from insolvent trading in the event the company goes into liquidation.
A qualified Restructuring Advisor is key to deploying Safe Harbour protections and is also proven to be a critical contributor to response and recovery efforts.
There are also steps a business can take to safeguard itself from future fraudulent activity. These include investigating what drove the employee to act fraudulently, conducting a root cause analysis to identify gaps or failure points in the business’s processes, ‘fixing’ the control deficiencies and formalising a response team or internal threat mitigation working group comprised of employees from different departments.
For more information on employee fraud and how to prevent, and detect its occurrence, contact your local William Buck advisor.
