When were you last affected by a fraud? If you’re lucky, never. But you’d be surprised how many nasty little surprises catch people off guard. And I’m not talking about the tired old west African junk email clichés which frankly are so obvious that anyone careless enough to be taken in by them really is asking for trouble… No, this is your everyday little nasty surprise where someone, quite possibly the last person you’d suspect, has dipped their mind into your business’s money, seen that nobody has noticed them there, and gone back for proper rummage. Often simply because it’s lying there unguarded and they’ve discovered they can root around in it. As if a downstairs window was left open and they’d snatched a quick look inside whilst passing. Just curious, nothing difficult. But before you know it they have become the unreliable narrator, they have become the fraud.
Why am I writing about this? Because I know someone who was badly affected by a fraud, and in discovering what happened to them I’ve understood more about the risks always present in any business which involves ordinary people (i.e. every business). Although this example was a sad indictment of one rotten apple and the mess they created, the point is to learn to be alert to the risk all the time and always avoid complacency. And if increased awareness helps another business avoid fraud and its consequences, great.
What are the warning signs? Holidays are a classic indicator. Or rather, someone’s lack of proper holidays. A day here, a day there. Never as much as a week at a time when someone else must provide cover and possibly discover what the vacationer has been up to. So look out for lack of proper holidays for a start.
Next you can add regular evening and weekend working. Ask why: why is this necessary, exactly? Then check the answer with care – it may be plausible yet still a fiction.
Commitments made but never delivered: ‘Yes I’ll give you that report’ you are promised. It never materialises. You’re going to have to get it for yourself and check the detail ever so carefully. Avoid any hint of complacency in your thinking; avoid assuming that everything is fine unless and until you have checked all the evidence for yourself and confirmed it to be so. It may not be.
Actions reported but never completed: ‘Yes, I sorted out such and such’ you are assured. Or is that total nonsense because it never happened? If you don’t check it out for yourself, you’ll stay in the dark. It may be too late by then – so seek the evidence and review it yourself. Get corroboration from outside the business at every opportunity. You can decide how discreetly you do that (letting everyone in the business know you verify everything may be quite useful).
Be alert. Where would you look for something you knew wasn’t meant to be found? In plain sight. Just as a secret meeting might be concealed in a series of meetings, transactions can be listed amongst other transactions with their true purpose otherwise concealed. Identifying something that has been obfuscated is always difficult, but you can get an analyst to apply forensic techniques to unearth what’s really going on in a business where you know or suspect that a fraud has been hidden away. And help you find any transactions which are not what they seem.
Don’t rely for discovery on the work of your auditors. (Assuming you have auditors for your business). Less than 5% of frauds are discovered as a result of an external audit*. Frauds which are discovered have frequently been going on for 18 months and can involve upwards of £100,000 (typically payroll and asset misappropriation frauds). Discovery is most likely to be as a result of staff tip offs and whistleblowing (more than 1 in 3 frauds are unearthed this way). So make sure your whistleblowing processes are fit for purpose.
The psychology of fraud is complex but there are some common features. The main one is exploitation of an opportunity. The opportunity is normally the window left open, unguarded. That isn't complex at all.
Take the man who broke Barings Bank (Nick Leeson) – he settled his own trades and was also responsible for his department’s accounting records and returns. Lack of supervision and internal controls permitted him to hide the losses which led ultimately to Barings’ insolvency. Although Leeson was the rogue trader, his bank’s failure was blamed on the lack of supervision and internal controls. To paraphrase a later parliamentary comment: if you’re that badly organised, you’ve only got yourself to blame.
Being under-supervised, getting away with increasingly risky positions which aren’t being checked by superiors, operating out of control are not risks exclusive to banks and financial services – they provide opportunities for the everyday fraud in all other businesses as well.
And if you find fraud in your business? Seek advice and get help straight away.
It can be OK to encourage the perpetrator to help you unravel the mess they created if that involves their owning up to everything they have done (you hope they will reveal all). It’s quite possible that having hidden their fraud from the management of the business for some time they now find that they want to share. But it’s possible they’ve left other nasty surprises and you can’t rely on their remorse to help you find them all. Remember the unreliable narrator? No second chances – best remove the perpetrator from the business immediately, use their evidence, but get help too.
So if you’ve been defrauded, you’ll need help to sort out the mess plus help to overhaul your systems, improve controls and minimise the risk of recurrence. Risks can never completely be eliminated, but if you know what to look out for and where to look, you’ll be well ahead of where you were before.
In moving on after discovery, it’s important to be seen to check, to validate, to rely only on proper evidence, to avoid assumption and conjecture. There’s nothing wrong with trusting your instincts and being sceptical. Above all test that your controls work and ensure you avoid complacency, whether you’ve had the misfortune to be defrauded or not. And keep your eyes open, keep questioning. My friend learned a lot from their experience. But would much rather not have had to do so.
*[Source: US Association of Fraud Examiners’ 2016 report to the nations]