The State of the Art of Fraud. Glenn L. Helms, Ph.D., CPA, CIA, CITP, CISA, CFF

Transcription

1 The State of the Art of Fraud Glenn L. Helms, Ph.D., CPA, CIA, CITP, CISA, CFF

2 Can You Identify Red Flags? City of Rutland, Vermont

3 Fraud Fraud is good in good times. Fraud is good in bad times. Fraud is good anytime!!!

4 Types of Fraud Fraudulent Financial Reporting Perpetrated by management Use of journal entries, manipulating estimates, overstating assets 90 to 95% of the dollar amount of fraud 5 to 10% of all the cases of fraud

5 Misappropriation of Assets Perpetrated by employees 5 to 10% of the dollar amount of all fraud 90 to 95% of the cases of fraud How accomplished?

6 Segregation of Duties Access to assets is restricted to authorized personnel. Bookkeeping is performed in accordance with GAAP or other established criteria and accountability for assets is maintained. Authorization of transactions can be general or specific. A general authorization example would be the clerk at a retail store who records routine sales. A specific authorization is not required for each sale. A specific authorization is typically approved by senior management or those charged with governance and generally involves a large dollar amount. Independent reconciliation is when the recorded accountability of assets (per the books) is compared with existing assets (a physical count) and action is taken with regard to any differences.

7 Control Activities Fra Luca Pacioli Preventive and Detective Controls Design Controls Based Upon Risk No One Size Fits All Forensic assumes collusion

8 Auditing is Conceptually Flawed at Finding Fraud Auditors trust systems but not people Can auditors trust systems? At ems Gasoline Receipts Internet Anamoly Joe Lopez

9 KPMG Study KPMG funded a survey (KPMG Forensic Fraud Survey 2009) with executives of U.S. organizations with annual revenue of at least $250 million. Over 200 interviews were conducted Executives expect some form of fraud or misconduct to occur in their organizations. Nearly one-third of respondents said at least one of the fraud categories - misappropriation of assets, fraudulent financial reporting, and other illegal or unethical acts) was going to increase during the next year.

10 KPMG Study Respondents stated that fraud and misconduct risks will either stay the same (85%) or increase (74%) over the next 12 months. Inadequate internal controls or compliance programs heighten the risks of fraud and misconduct. Two thirds of the respondents stated that inadequate internal controls or compliance programs at their organizations enable fraud and misconduct to occur (emphasis added).

11 KPMG Study Roughly a quarter of respondents (27 percent) did not have effective protocols on how investigations should be conducted and when the board of directors should be alerted to possible irregularities. Likewise, 33 percent of the respondents stated that they lacked protocols on how to remedy control breakdowns (emphasis added). Those areas where respondents cited the most amount of at least moderate improvement needed in their anti-fraud programs include employee communication and training (67%), technology-driven continuous auditing and monitoring techniques (65%), and fraud and misconduct risk assessment (60%).

12 KPMG Study Risk Areas Where did the KPMG respondents perceive the greatest risks? The survey found that there were anticipated increases in: asset misappropriation (25%); other illegal and unethical acts (20%); and fraudulent financial reporting (8%).

13 Factors That Enable Fraud and Misconduct KPMG Study Factor % of respondents Inadequate Internal Controls 66% or compliance programs Management override of 47% internal control Inadequate oversight by 44% directors over management Collusion between employees 43% and third parties Collusion between 32% management and third parties Collusion between employees 27% and management Other factors 4%

14 Level of Knowledge by Function of How Fraud Can Occur KPMG Study Function High Moderate Low Internal Audit 67% 22% 11% Legal/Compliance Function 63% 25% 12% Audit Committee 59% 27% 13% Employees 21% 58% 21% Management 50% 39% 10%

15 The Function Most Likely to Uncover Internal Audit/ Fraud KPMG Study Function % of Respondents Legal/Compliance Function 47 Employee Whistleblower 20 Line Mangers 13 External Auditors 9 Customers/Suppliers 4 Government Regulators/Law 3 Enforcement 3 Other 2

16 KPMG Study Anticipated Assistance External Advisors Assistance From Outside Advisors Leveraging technology to identify fraud and misconduct risks Evaluating the effectiveness of compliance programs and antifraud controls Electronic discovery and preservation of documents pursuant to regulatory inquiries or litigation Providing fraud and misconduct awareness training Conducting fraud and misconduct risk assessments Conducting complex investigations in response to allegations of fraud or misconduct % of Respondents 39% 38% 37% 30% 25% 22%

17 KPMG Study Funding to Combat Fraud 75% of the respondents expected the amount of funding at their organization to combat fraud to stay the same, 16% said increase, and 9% said decrease.

18 COSO Study COSO sponsored a study, Fraudulent Financial Reporting: , (issued May, 2010) to provide a comprehensive analysis of fraudulent financial reporting occurrences investigated by the U.S. Securities and Exchange Commission (SEC) between January 1998 and December 2007.

19 COSO Study There were 347 alleged cases of public company fraudulent financial reporting from 1998 to 2007, versus 294 cases from 1987 to Consistent with the high-profile frauds at Enron, WorldCom, etc., the dollar magnitude of fraudulent financial reporting soared in the last decade, with total cumulative misstatement or misappropriation of nearly $120 billion across 300 fraud cases with available information (mean of nearly $400 million per case). This compares to a mean of $25 million per sample fraud in COSO s 1999 study. While the largest frauds of the early 2000s skewed the total and mean cumulative misstatement or misappropriation upward, the median fraud of $12.05 million in the present study also was nearly three times larger than the median fraud of $4.1 million in the 1999 COSO study.

20 COSO Study The SEC named the CEO and/or CFO for some level of involvement in 89 percent of the fraud cases, up from 83 percent of cases in Within two years of the completion of the SEC s investigation, about 20 percent of CFOs/CFOs had been indicted and over 60 percent of those indicted were convicted. Twenty-six percent of the fraud firms changed auditors between the last clean financial statements and the last fraudulent financial statements, whereas only 12 percent of no-fraud firms switched auditors during that same time. Sixty percent of the fraud firms that changed auditors did so during the fraud period, while the remaining 40 percent changed in the fiscal period just before the fraud began.

21 COSO Study Initial news in the press of an alleged fraud resulted in an average 16.7 percent abnormal stock price decline in the two days surrounding the news announcement. In addition, news of an SEC or Department of Justice investigation resulted in an average 7.3 percent abnormal stock price decline. Long-term negative consequences of fraud were apparent. Companies engaged in fraud often experienced bankruptcy, delisting from a stock exchange, or material asset sales following discovery of fraud at rates much higher than those experienced by no-fraud firms.

22 COSO Study Most frauds were not isolated to a single fiscal period. The average fraud period extended 31.4 months, with the median fraud period extending 24 months. This was slightly longer than the average and median fraud periods of 23.7 and 21 months, respectively, reported in COSO s 1999 study. This finding suggests that once fraud is initiated in one financial period (quarterly or annual), management often continues to perpetrate fraud in each quarterly and annual financial statement filing for about two years.

23 Common Financial Statement Fraud Schemes - COSO Scheme to Misstate Financial Statements Percentage of Companies Using Fraud Method Improper revenue recognition: 61% Recording fictitious revenues 48% Recording revenues prematurely 35% No description/ overstated 2% Overstatement of assets (excluding accounts receivable overstatements due to revenue fraud): 51% Overstating existing assets or capitalizing expenses 46% Recording fictitious assets or assets not owned 11%

24 Common Financial Statement Fraud Schemes COSO (Concluded) Understatement of expenses/liabilities 31% Misappropriation of assets 14% Inappropriate disclosure (with no financial statement line item effects) 1% Other miscellaneous techniques (acquisitions, joint ventures, netting of amounts, etc.) 20% Disguised through use of related party transactions 18% Insider trading also cited 24% The subcategories such as premature revenues or fictitious revenues and assets do not sum to the category totals due to multiple types of fraud employed at a single company. Also, because the financial statement frauds at the sample companies often involved more than one fraud technique, the sum of the percentages reported exceeds 100 percent.

25 Number of Fraud Cases With Asset Accounts Misstated - COSO Inventory 51 A/R 43 PP&E 24 Cash/Mkt able Securities 19 Loans/Not es Rec. 13 Investmen ts 12 Prepaid Expenses 11

26 ACFE 2012 Report to the Nations Financial statement fraud schemes made up less than 8 percent of the frauds, but had a median loss of $1 million -- the most costly category of fraud. Asset misappropriation frauds occurred in 87 percent of the reported cases with a median loss of $120,000. Small organizations were found to be disproportionately impacted by occupational fraud. These organizations lack anti-fraud controls when compared with larger organizations.

27 ACFE 2012 Report to the Nations Anti-fraud controls help reduce the cost and duration of occupational fraud. High-level perpetrators cause the greatest amount of damage to organizations. The median loss perpetrated by owner/executives was $573,000, the median loss caused by managers was $180,000 and the median loss caused by employees was $60,000 The longer a perpetrator had worked (more than ten years with an organization) was associated with a median loss of $229,000 whereas those who committed a fraud the first year on the job had a median loss of $25,000. Nearly 87 percent of fraudsters had never been previously charged or convicted for a fraud offense. A lower percentage of fraud perpetrators, 84 percent, had never been punished or terminated by an employer for fraudulent actions.

28 ACFE 2012 Report to the Nations In 81 percent of the cases, perpetrators have behavioral warning signs (red flags) such as living beyond their means or unusually close relationships with vendors. The percentage of victim organizations who had not recovered any losses was 49 percent. Employee education about what constitutes fraud and how to report suspected fraud occurrences is critical in preventing and detecting fraud. Tips were significant in detecting corruption cases (54 percent) and the percentage of asset misappropriation and financial statement fraud schemes detected by tips were both 42 percent.

29 ACFE 2012 Report to the Nations The most common fraud schemes, in rank order, are: billing, corruption, expense reimbursements, skimming, non-cash, check tampering, payroll, cash on hand, cash larceny, financial statement fraud, and register disbursements.. The median duration of all types of fraud was 18 months. However the schemes ranged from 12 months (register disbursement and non-cash schemes) to 36 months for payroll schemes. The initial detection of all types of occupational frauds was by (in rank order) tip, management review, internal audit, accident, account reconciliation, document examination, external audit, notified by police, surveillance/monitoring. confession, and IT controls. The sources of tips, in rank order, were by employee, customer, anonymous, other, vendor, shareholder/owner, and competitor.

30 Misappropriation of Assets Schemes Those schemes that had the highest median loss according to the 2012 report were: Check tampering -- $143,000. Billing -- $100,000. Cash larceny -- $54,000. Non-cash -- $58,000. Skimming -- $58,000.

31 Check Tampering -- Association of Financial Professionals Survey Seventy-one percent of organizations experienced attempted or actual payments fraud in Large organizations were significantly more likely to have experienced payments fraud than were smaller ones. Eighty-two percent of organizations with annual revenues over $1 billion were victims of payments fraud in 2010 compared with 58 percent of organizations with annual revenues under $1 billion. Twenty-nine percent of survey respondents report that incidents of fraud increased in 2010 compared to 2009.

32 Check Tampering -- Association of Financial Professionals Survey Checks were the dominant payment form targeted by fraudsters, with 93 percent of affected organizations reporting that their checks had been targeted. The percentage of organizations affected by payments fraud via other payment methods were: ACH debit percent. Consumer credit/debit cards percent. Corporate/commercial cards --15 percent. ACH credits -- 4 percent. Wire transfers -- 4 percent.

33 Check Tampering -- Association of Financial Professionals Survey Seventy-one percent of organizations that were victims of actual and/or attempted payments fraud in 2010 experienced no financial loss from payments fraud. Among organizations that did suffer a financial loss resulting from payments fraud in 2010, the typical loss was $18,400.

34 Preventive Controls -- Deposit Accounts -- Positive Pay - - Association of Financial Professionals Survey Positive pay/reverse positive pay ACH debit filters (61 percent) ACH Debit Filter Automatically returns all ACH items for a designated account, except those that are pre-authorized. Authorized ACH Originators are identified by providing the bank with specific identifier information, e.g., originating company ID, individual ID number, etc. Some banks offer the flexibility of allowing customers to further fine-tune their payment criteria based on maximum dollar amounts, exact dollar amounts, and maximum number of occurrences (84 percent).

35 Preventive Controls -- Deposit Accounts -- Positive Pay -- Association of Financial Professionals Survey Positive Pay requires the company to send (transmit) a file of issued checks to the bank each day checks are written. When those issued checks are presented for payment at the bank, they are compared electronically against the list of transmitted checks. The check-issue file sent to the bank contains the check number, account number, issue date, and dollar amount. Sometimes the payee name is included, but is not part of the matching service. When a check is presented that does not have a match in the file, it becomes an exception item. The bank sends a fax or an image of the exception item to the client. The client reviews the image and instructs the bank to pay or return the check.

36 Preventive Controls -- Deposit Accounts -- Positive Pay - - Association of Financial Professionals Survey Reverse positive pay is similar to positive pay, but the process is reversed, with the company, not the bank, maintaining the list of checks issued. When checks are presented for payment and clear through the Federal Reserve System, the Federal Reserve prepares a file of the checks account numbers, serial numbers, and dollar amounts and sends the file to the bank. In reverse positive pay, the bank sends that file to the company, where the company compares the information to its internal records. The company lets the bank know which checks match its internal information, and the bank pays those items. The bank then researches the checks that do not match, corrects any misreads or encoding errors, and determines if any items are fraudulent. The bank pays only true exceptions, that is, those that can be reconciled with the company s files.

37 Preventive Controls -- Deposit Accounts -- ACH Debit Blocks -- Association of Financial Professionals Survey ACH debit blocks (76 percent) ACH Debit Block -- This service automatically returns all ACH debits and/or credits that are directed to a particular bank account. No customer intervention is necessary once the service is set up.

38 Payee Positive Pay -- Association of Financial Professionals Survey Payee positive pay (58 percent) Payee Positive Pay -- Allows you to include the payee as an additional point of comparison between checks presented and the issue date file. It is an easy way to strengthen fraud control measures and enjoy greater security. Just match the Payee name that should appear on the check with the actual name on the item presented for payment

39 Post No Checks -- Association of Financial Professionals Survey Post no checks restriction on depository accounts (42 percent). Post No Checks -- Service rejects any check presented against an account does not have any check writing activity and returns it to the issuer.

40 Other Findings -- Association of Financial Professionals The most prevalent reason why an organization does not use a particular fraud prevention service is cost/benefit does not justify its use (36 percent). Organizations develop and/or modify internal business processes to mitigate potential payments fraud risks. The processes considered important include: Eighty-eight percent of organizations have increased their use of electronic payments for their business-to-business (B2B) transactions. Eighty-six percent of organizations have increased their use of electronic payments to employees. Eighty percent of organizations that have increased their use of electronic payments for business-to-consumer transactions did so with fraud prevention in mind.

41 Check Fraud -- Association of Financial Professionals Survey Checks remain the payment method most frequently targeted by criminals to commit payments fraud. Among the most widely used techniques to commit payments fraud were: Counterfeit checks using the organization s MICR line data (68 percent). Alteration of payee names on checks issued by the organization (56 percent). Alteration of dollar amount on checks issued (35 percent).

42 Wire Transfer and ACH Transactions This conflict came to a head when PlainsCapital, a $4.4 billion bank headquartered in Dallas, filed suit against Hillary Machinery Inc., following a series of incidents that began last November, when cyber thieves made a series of ACH and wire transactions that totaled $801,495 from Hillary s bank account. The bank was able to retrieve about $600,000 of the money, but when Hillary subsequently sent a letter requesting that the bank refund the remaining $200,000, PlainsCapital responded by filing a lawsuit in U.S. District Court for the Eastern District of Texas. The lawsuit requests that the court certify that PlainsCapital s security was, in fact reasonable, and that it processed the wire transfers in good faith. Hillary filed a countersuit in February, saying it would not be bullied by the bank, and has since then moved its business accounts to another bank in Texas, citing security as a factor. The case was settled and the terms of the settlement were not disclosed. The settlement was made days after the judge in the case struck down the bank s request to move the case into private arbitration.

43 ACH and Wire Transfer Fraud -- Association of Financial Professionals Survey Twelve percent of organizations that were victims of ACH fraud during 2010 suffered a financial loss as a result of such fraud. Organizations that suffered a financial loss as a result of ACH fraud generally did so because they did not follow best practices and/or neglected to execute their own business rules as expeditiously as they should have, including: ACH return not being timely, a criminal takeover of the organization s online system, or not using ACH positive pay.

44 Billing Frauds Fake vendor. Kickback from vendors. Reimbursement for personal purchases. Consider the use of procurement cards.

45 Expense Reimbursement Fraud Controls For travel, require the employee to use a companyapproved travel agency. For travel that is expected to be over a certain dollar amount, require an additional approval. For lodging expenses, require the hotel to direct-bill the company. The company should obtain a negotiated rate. For car rentals, require the employee to use a rental company that has been approved by the entity.

46 After You Catch the Crooks Learn their techniques install controls Prosecute and related problems 46

47 Fraud Preventive Control Anti-fraud program - Example Policies If there is a fraud, I will cooperate I will name co-conspirators I will name those who were complicit I will state how much I stole File a 1099 on these folks If no co-operation fire and lose all benefits 47