In our May webinar about internal controls for fraud prevention, we scratched the surface of the fraud triangle, describing the red flags that indicate the possibility of fraud and identifying internal controls that can help limit the opportunity for fraud. After the webinar, our audience wanted more on this critical topic. We combed through the questions sent during the webinar and selected six questions we felt were most burning around internal controls. Below are those questions and our responses. Please note that each situation is unique, and we do not take a one-size-fits-all approach to internal controls. We encourage you to reach out to a professional at FORVIS for specific assistance.
Q) How do you decide who needs to complete a conflict-of-interest disclosure?
A) JA: An employer often requires a conflict-of-interest disclosure statement to help identify and avoid any potential conflicts between the employer and an employee’s interests. The disclosure process intends to help the workforce be transparent and accountable for their actions and decisions. Ultimately, everyone who is involved in a project where it is deemed necessary should complete a conflict-of-interest disclosure. More specifically, the conflict-of-interest form should indicate whether the person has an economic interest in, or acts as an officer or a director of, any outside entity whose financial interests would reasonably appear to be affected by the addition. As a rule, it is better to have one on hand than not.
Q) Have you noticed a decrease in fraudulent activity when more automation is implemented into the process?
A) JA: Automation can help companies identify patterns in data and transactions that may be indicative of fraudulent behavior. This can include analyzing unusual activity and suspicious transactions and even detecting unauthorized access attempts. Fraud detection automation can help businesses save time and resources. Especially with the rise of artificial intelligence, automation is becoming even more sophisticated. Keep in mind that automated services are tools, but there should be some human element involved in fraud detection, as there is nothing comparable to human instinct. As found by the Association of Certified Fraud Examiners (ACFE), 42% of frauds were detected by employees, so the human element is essential in detecting nuances of fraud, too.
Q) It seems really difficult to detect when multiple people collude for fraud. Any detection insights for those cases?
A) RS: Let’s consider some controls to prevent collusion in the first place. The enforcement of current controls can help limit the opportunity for this type of fraud. In addition, frequent audits/testing of the effectiveness of controls can help as well. Lastly, this type of fraud is likely to break down if the person(s) aren’t there to control and continue the scheme. Thus, rotating jobs and ensuring leave is taken are ways to help prevent this type of fraud.
Regarding the detection of collusion, the reviewing of reconciliations, expenditures, and deposits for adequate and legitimate support will help detect this type of fraud. Remember to start with what went through the bank as that is the ultimate conclusion of the transaction. Work back from the transaction amount that cleared the bank and make sure there is support for the transaction.
Q) Where do you report possible fraud if the fraud is being committed at the executive level and quality or risk management also is involved? If you have witnessed fraud AND reported it to high-ranking management, yet nothing has been done about it, where do you go from there?
A) RS: Suspecting fraudulent activity at high levels in your organization can be unsettling. It is more unsettling when others do not act quickly. A lot of states have whistle-blower protection laws (see next question about whistleblower protections) so you could consider reporting this to local or state police. They may ask that you testify so be prepared to have specific information regarding the allegation. If the possible fraud relates to a state agency, you may consider contacting the state inspector general or state auditor. In Virginia, we have a fraud, waste, and abuse hotline for reporting fraud related to state agencies. The state inspector general operates this fraud hotline, and it is a very effective tool in combating fraud. Many companies also have a fraud tipline so that also may be an option for reporting the possible fraud. As an alternative, you also could report your concerns to the board if the organization has one.
Q) Can you become a whistleblower without losing your job?
A) JA: Yes. Being fired is one of the most common fears a whistleblower has; however, there are ways to speak up without losing your job. Occupational fraud is three times more likely to be detected by a tip than by any other method, and most tips come from employees, according to the ACFE in its 2022 Report to the Nations. Corruption and other ethics violations can cause organizational loss that could be detrimental to a business. Close to half of the corruption cases were detected by a tip.1 Strong internal controls, like a fraud and ethics hotline, can help mitigate fraud and corruption risks. Many businesses have anonymous hotlines where you can report possible fraud without revealing who you are. If you do not already have a tipline, FORVIS offers a service called IntegraReport that includes an anonymous fraud and ethics hotline. A subscription provides access to your customized IntegraReport phone hotline and web-based portal, as well as hotline monitoring by fraud professionals at FORVIS.
Q) How do you handle communicating with an organization that seems reluctant to make the recommended changes intended to prevent future fraud?
A) RS: Preventing fraud can save your organization money and reputational risk. First, bring this issue to your supervisor. If they don’t want to take any action, consider going to the executives of the company or agency. If nothing is done, see if your organization has a board with a board chair or an audit committee chair whom you could approach. Lastly, you could bring this information to the entity’s external and/or internal auditors and alert them of the control weaknesses that you have observed.
How FORVIS Can Help
We realize that one article cannot address each organization’s unique situation. We hope these questions and answers continue the conversation around internal controls for fraud prevention at your organization. If you need assistance with these conversations or setting up or measuring the strength of the internal controls at your organization, reach out to a professional at FORVIS or use the Contact Us form.
- 1“Occupational Fraud 2022: A Report to the Nations,” ACFE.