STRATEGIES FOR MANAGING RISKS FROM FRAUD TO CORRUPTION. April 11, 2017

Transcription

1 STRATEGIES FOR MANAGING RISKS FROM FRAUD TO CORRUPTION April 11, 2017

2 Overview Current trends EY s 14 th Global Fraud Survey Five key principles of fraud risk management Discussion of each of the five principles Summary of key points Wrap up 2

3 Number of Canada interviews: role, sector, revenue Job Function Finance 48 Internal Audit and Risk 32 Legal 8 Compliance 4 Other executives 8 Revenue More than $1 billion 38 $500 million to $1 billion 32 Less than $500 million 30 Sector Automotive 2 Consumer products, retail, wholesale 24 Financial services 18 Government and public sector 32 Life sciences 4 Manufacturing and chemicals 3 Oil, gas, and mining 2 Power and utilities - Professional firms and services 2 Real estate 6 Technology, communications, and entertainment Other transportation - Other sectors 2 2 EY s 14 th Global Fraud Survey, Canadian perspective Base: All respondents in Canada (50) 3

4 Financial statement fraud unethical behaviour persists Actions justified to meet financial targets Canada North America Developed markets Emerging markets All respondents At least one of these 24% Change valuations/reserves More flexible product return policies Extend monthly reporting period Backdate a contract Book revenues earlier than they should be Don't know 14% 12% 2% 2% 2% 2% None of these 74% Q. Given the pressure that often exists to meet financial targets, which, if any, of the following activities do you feel can be justified to meet those targets? Base: Canada (50); North America (100); Developed markets (1,100); Emerging markets (1,725); All respondents (2,825) 4

5 Corruption 1 in 10 One in ten respondents would make a cash payment to obtain or retain business in an economic downturn. In some jurisdictions, such as the Far East, a significantly higher proportion of respondents would do so with 1 in 4 executives able to justify such payments. 5

6 Poll 1 Which risks do you think are potentially increasing in your organization (select all that apply) a. Cyber breach or insider threat risks b. Bribery and corruption risks c. Expense report fraud d. Procurement fraud risks conflicts of interest, shell companies e. Capital project risks f. Merger and acquisition risks g. Financial statement fraud risks h. Theft of cash i.e. wire transfer fraud, cheque thefts 6

7 KEY PRINCIPLES 7

8 Key Principles in Managing Risks The organization: 1. Establishes and communicates a Fraud Risk Management Program 2. Performs comprehensive fraud risk assessments to identify specific fraud schemes 3. Selects, develops and deploys preventive and detective fraud controls activities 4. Establishes a communication process to obtain information about potential fraud and deploys a coordinated approach to investigations 5. Selects, develops and performs ongoing evaluations to ascertain whether each of the five principles is present and functioning 8

9 ESTABLISH AND COMMUNICATE A PROGRAM 9

10 Establish and Communicate a Fraud and Corruption Risk Management Program Demonstrated commitment to tone at the top Board oversight Comprehensive risk management policy Thoroughly document the program 10

11 Fraud Risk Management Program Fraud risk identification Risk assessment Risk tolerance Controls improvement Fraud response plan Anti-fraud program Vision Risk management Inherent fraud risks Assess Residual risks; risk tolerance Knowledge policies and training Prevent Culture tone at the top and accountability Procedures and controls Monitoring and analytics Detect Code of conduct compliance and ethics program Confidential reporting Respond Investigation, remediation, continuous improvement Operational excellence Performance management (Metrics) Integration with enterprise risk management Governance 11

12 Poll 2 My organization has a documented fraud risk management program that has been communicated to all employees. a. Yes b. No 12

13 FRAUD AND CORRUPTION RISK ASSESSMENTS 13

14 Perform Comprehensive Fraud and Corruption Risk Assessments Fraud risk assessment A fraud risk assessment helps to determine what may cause fraud and its impact on the company Probability drivers fraud triangle Impact drivers Size Asset values Liquidity Legal and regulatory implications Customer implications Reputation risk attitude/rationalization 14

15 Prioritizing Fraud and Corruption Risks Likelihood False expense claims Fake vendor Theft of cash Priority Foreign subsidiary hides losses Bribery Improper revenue Payroll fraud Not priority Tax fraud in Brazil Severity 15

16 Poll 3 What changes in your organization have taken place in the past year that could affect your fraud and corruption risk profile? (select all that apply) a. New management b. Mergers and acquisitions c. Downsizing, particularly in compliance and finance areas d. New IT systems e. Changed incentives and bonus plans f. Operations in new countries g. Changes in your industry such as increased competition h. Changes in policies and procedures 16

17 PREVENTIVE AND DETECTIVE CONTROLS 17

18 Preventive and Detective Controls Integrates with the Fraud Risk Assessment Mix of preventive and detective controls Considers fraud risk tolerance level of residual risk an organization is willing to accept Logical and physical access Segregation of duties Authority limits Transaction-level controls 18

19 Preventive and Detective Controls (cont d) Utilizing Human Resource procedures Fraud and Corruption Risk Management training Performance and compensation evaluations Annual employee surveys and exit interviews Whistle blower program Proactive data analytics Identify anomalies Rules based, trends, text analytics and risk indicators 19

20 INVESTIGATE AND CORRECT 20

21 Fraud and Corruption Investigations Whistle blower system case management Investigation and response protocols Conducts investigation Communicates the results Evaluates the investigation process Efficiency Effectiveness 21

22 Take Corrective Action Remediate controls Disciplinary actions Training Insurance claim Civil action Criminal referral 22

23 MONITORING 23

24 Fraud and Corruption Risk Management Monitoring Activities Considers a mix of ongoing and separate evaluations, targeting high risk areas Establishes appropriate measurement criteria (KRI) Considers changes in the organization Benchmarking fraud risks to others in the industry Evaluates, communicates and remediates deficiencies in the program 24

25 Poll 4 Which of the following fraud risk management strategies does your organization leverage? (select all that apply) a. Ethical guidance to employees, vendors/contractors b. Enterprise-wide and topic specific (i.e. procurement, AP etc.) fraud training c. Stand-alone fraud and corruption risk assessment, refreshed periodically d. Use of data analytics to detect fraud e. Assesses the design and operating effectiveness of transaction-level controls related to priority fraud and corruption risks f. Documented action plan for suspected fraud g. Periodically evaluates the effectiveness of the investigative process h. Periodically evaluates the effectiveness of the fraud risk management program 25

26 SUMMARY OF KEY POINTS 26

27 Summary of Key Points Well documented and communicated fraud risk management policy Enterprise-wide fraud risk assessments Preventive and detective controls concentrating on high risk areas and including data analytics Documentation of a comprehensive fraud response plan Ongoing and separate evaluations of all components of the fraud risk management program including the program itself 27

28 Contact Information Linda Lister is a Senior Manager in the Fraud Investigation & Dispute Services group of EY. With over 16 years experience in numerous industries, her expertise in theft and fraud investigations, corporate financial restatement activities, assisting clients in designing compliance programs and reporting to regulators on their corporate governance has been gained through her position as an EY professional and through various internal auditing appointments. Linda is a CPA, CGA, CMA a Certified Fraud Examiner and Certified in Financial Forensics. She earned her Diploma in Investigative and Forensic Accounting (DIFA) from the Rotman School of Management, University of Toronto, Canada. She is a past Governor for the IIA, Toronto Chapter and a current Director for the ACFE, Toronto Chapter. Linda Lister Senior Manager Contact: (416) Linda.M.Lister@ca.ey.com 28