HOW TO SPOT AND MITIGATE FRAUDULENT ACTIVITIES For Government Entities and Nonprofit Organizations November 15, 2017
Presenters Bruce V. Bush Bruce is a Senior Director in RSM s Financial Investigations and Dispute Services practice and is based in Dallas. He has more than 20 years of experience assisting clients with allegations of financial reporting improprieties, investigating employee fraud and misconduct, resolving post-acquisition and contract disputes, and minimizing the risk of fraud through the development and implementation of prevention, detection and response controls. His clients have included audit committees, special committees of boards of directors and senior management where he helped them assess the financial impact and reputational risks associated with allegations of fraud and noncompliance with government regulations. Sean Kennedy Sean is a Supervisor in RSM s Financial Investigations and Dispute Services practice and is based in Kansas City. He has more than 8 years of experience in audit and financial advisory work. His projects include: fraud and forensic accounting investigations in private industries, governmental entities and international organizations; determination of damages in commercial litigation involving contract disputes and asset repossessions; insolvency issues and money laundering. 1
Agenda Program discussion will include: Introduction to fraud Statistics on fraud Fraud in government entities and nonprofits Overview and examples of the main types of fraud Preventative measures to spot and mitigate fraud 2 2
Introduction to Fraud The Association of Certified Fraud Examiners (ACFE) defines occupational fraud as, The use of one s occupation for personal enrichment through the deliberate misuse or misapplication of the employing organization s resources or assets. The Institute of Internal Auditors defines fraud as, any illegal act characterized by deceit, concealment, or violation of trust. Frauds are perpetrated by parties and organizations to obtain money, property, or services; to avoid payment or loss of services; or to secure personal or business advantage. 3 3
The Fraud Triangle Pressures and Incentives Motivation to commit fraud Rationalization Attitude or ethical values which allow individuals to knowingly commit fraudulent acts Opportunity Lack of internal controls Leadership or organizational culture 4 4
Audience Question What would you estimate is the median number of months that pass before fraud is detected? A. 3 B. 6 C. 12 D. 18 5 5
Statistics on Fraud A 2016 ACFE survey estimated, on average, organizations lose 5% of revenues to fraud annually. The median amount lost was $150,000 Reported frauds lasted a median of 18 months before being detected. Most occupational fraudsters are first time offenders with clean employment histories. A tip, usually from an employee, is the most common detection of fraud. The primary reasons fraud took place were lack of internal controls, the ability to override existing internal controls or lack of management involvement and review. 6 Source: ACFE 2016 Report to the Nations on Occupational Fraud and Abuse. All data tables, references, and statistics throughout this presentation are from the aforementioned source unless stated otherwise. 6
Statistics on Fraud, continued Government entities - The median loss at government entities in 2016 was $109,000 - Government entities represented approximately 19% of reported cases Nonprofits - The median loss at nonprofits in 2016 was $100,000 - Nonprofits represented approximately 10% of reported cases 7 7
FRAUD IN GOVERNMENT ENTITIES AND NONPROFITS
Fraud in Government Entities Government fraud can be considered more far-reaching than private sector fraud because tax payers provide funding for government operations and government funds are intended to serve a public good. Trillions of dollars flow in and out of federal, state, and local governments each year. Siphoning even the smallest percentage could add up to large amounts of money for fraudsters. The size and complexity of many government organizations provides the opportunity to commit fraud. 9 9
Fraud in Nonprofit Organizations Characteristics that can contribute to the existence of fraud: The finance, bookkeeping, and accounting functions are often concentrated in a few individuals, often due to lack of funding or financial resources. Nonprofit organizations sometimes place higher trust in its leaders, founders, and fund raisers. Nonprofits often have volunteer boards of directors which may not provide adequate financial oversight. Many nonprofits lack an audit committee or a robust internal audit function. Nonprofits often have a number of short-term volunteers. 10 10
OVERVIEW OF FRAUD TYPES
Types of Fraud Fraud is typically committed in one of these ways: - Internally: Committed by persons inside, such as employees, officers and directors. - Externally: Committed by persons outside, such as vendors, grant applicants and program participants. - By the organization: Typically involves multiple individuals; fraudulent fund-raising by nonprofits is one example. Internal, external and fraud by the organization can be subdivided into three categories: Asset Misappropriation Corruption Financial Statement Fraud 12 12
Audience Question From the three categories of occupational fraud, which do you think is the most common type? A. Asset Misappropriation B. Corruption C. Financial Statement Fraud 13 13
Types of Fraud 14 14
Types of Fraud in Government and Public Administration Entities 45.00% 40.00% 35.00% 30.00% 25.00% 20.00% 15.00% 10.00% 5.00% 0.00% 38.40% 25.30% Percentage Type of Fraud 15.70% 14.80% 14.00% 13.50% 10.50% 9.20% 7.90% 7.90% 1.70% Percentage Type of Fraud 15 Note: Some cases have multiple elements of fraud 15
Types of Fraud in Religious, Charitable or Social Services Organizations 35.00% 30.00% 25.00% 20.00% 28.80% 25.00% 25.00% 25.00% Percentage Type of Fraud 19.20% 15.00% 10.00% 13.50% 13.50% 13.50% 9.60% 5.00% 3.80% 1.90% 0.00% Percentage Type of Fraud 16 Note: Some cases have multiple elements of fraud 16
Asset Misappropriation Asset Misappropriation Cash Inventory and Other Assets Skimming Larceny Fraudulent Disbursements Theft Misuse - Billing Schemes - Payroll Schemes - Expense Reimbursement Schemes - Check Tampering - Register Disbursements 17 17
Asset Misappropriation in Government Entities Unauthorized purchases: Personal purchases made on government issued procurement cards. Expense reimbursement schemes: Recording personal expenditures (travel, meals, etc) as government related expenses. Misuse of government-issued assets: Using automobiles or computers for non-work related activities. Fake vendors: Submitting fraudulent invoices for payment on services or items that were not received. 18 18
Case Study #1 Asset Misappropriation Case Overview: Part of the assets in a state employee pension plan was land owned by plan and leased for a retail gas and convenience store A non-routine environmental assessment was conducted to assess environmental impacts (possibly for the sale of the land) The cost of the assessment was recorded appropriately as an expense associated with the land investment An accountant for the plan, subsequently established a fictitious environmental assessment company in her husband s name For the next decade, she fraudulently reported an annual environmental assessment had been conducted and while the cost fluctuated is was generally around the original assessment of $75,000 Payments were disbursed each year to the fictitious company and then subsequently cashed by the couple. 19
Case Study #1 (continued) Case Overview (continued): The fraud went undetected due to insufficient controls surrounding the budget of expenses within the department. The expense was viewed as a routine expense. This scheme eventually came to light once employees for the Plan notice lavish expenditures by the fraudster which included purchase of a new luxury vehicle, enrollment of kids into private school, extended vacations This red flag caused management to dig deeper into the expenses and ultimately discovered the same documentation was provided for the annual assessments, however, dates and amounts were changed from the original legitimate assessment 20
Asset Misappropriation in Nonprofit Organizations Theft of donation items: internal controls are often poorly designed at nonprofits regarding protection of donated merchandise. Fake/ghost employees: either terminated employees or fake employees exist on the payroll. Purchasing and cash disbursements - Credit card abuse: improper use of organization issued credit card. - Fake vendor accounts: submitting fraudulent invoices for payment on services or items that were not received. Theft or misuse of donor information Skimming: theft of cash before the funds have been recorded in the books. Often by someone who handles mail, logs cash receipts, makes deposits, or the initial receivers of donations. 21 21
Corruption Corruption Conflicts of Interest Bribery Illegal Gratuities Economic Extortion Purchases Schemes Invoice Kickbacks Sales Schemes Bid Rigging 22 22
Corruption in Government Entities and Nonprofits The FBI defines corruption as a breach of trust by federal, state, or local officials often with the help of private sector accomplices, and considers it their top criminal investigative priority. Bribes: giving or receiving something of value to influence an act or decision. Extortion: demanding assets or a certain action with the threat of physical or business harm if the demand is not met. Embezzlement: an employee misappropriates funds or property entrusted to him or her. Kickbacks: a vendor gives an employee a portion of a payment in return for their influence or facilitation of the transaction. Conflict of Interest: an employee or board member putting his or her own personal or professional interests above that of the organization. 23 23
Case Study #2 Corruption Situation: 2010 The BOD of a school district voted to build a new high school. An Architectural Engineering used in the past proposed estimated costs to the board to be approximately $60 Million to construct the school. Key Players in the Project: School hired an Architectural Engineering Firm to design the school. The firm was also involved in the bid process for the Construction Management Company to oversee the construction of the high school. A Project Manager was initially hired for a year, and was replaced by an actual company for the remainder of the construction of the high school. A bidding process took place and the bid to construct the high school was awarded to a reputable company with experience in the public sector. Concerns that Led to the Investigation: Turnover with several Superintendents of the school district during construction of the school. Allegations of fraud throughout the construction process CFO left abruptly upon completion of the school. Potential nepotism and conflicts of interest during the construction of the school 24
Case study #2 (continued) Procedures performed with Investigation: Requested the check register (did not have a specific accounting system) for all expenditures regarding the construction of the new high school. Traced register to the issuance of bond funds. Expenditures matched proceeds. Requested supporting documentation for expenditures Requested a payment authorization for each expenditure Interviews were conducted with key personnel to gain background information and insight into the construction of the school. Board minutes were reviewed during the construction process. Bid information for the construction manager including review of the proposals submitted by vendors, the methodology behind the scoring process for the bids, the actual scores for each vendor, and the parties involved with the selection of the construction manager. Obtained historical costs of similar public schools built in the region around same time period to get an estimate of what the school district spent versus other school districts. 25
Case Study #2 (continued) Findings: Expenditures for construction related costs with funds not obtained via bond proceeds. Concerns over fees assessed by the Architectural Engineering Firm Evidence of subcontractor bid rigging Construction Manager artificially inflating constructions costs to increase the fees paid to the company. Lack of meaningful internal controls in actively monitor the construction of the high school (controls were left to the construction manager). The costs incurred to construct the high school were significantly higher compared to other schools constructed in the area over the same time period for similar size and type of school. 26
Financial Statement Fraud Financial Reporting Asset/ Revenue Understatement Asset/ Revenue Overstatement Timing Differences Timing Differences Understated Revenues Fictitious Revenues Overstated Liabilities & Expenses Concealed Liabilities & Expenses Improper Asset Valuations Improper Disclosures 27 Improper Asset Valuations 27
Financial Statement Fraud in Government Entities and Nonprofits Government Entities: Misstatement of revenues or expenses, or recognizing in the wrong period Holding records open beyond the period end to inflate revenues Incorrect valuations Nonprofits: Misstatement or misclassifying of revenues or expenses Incorrect valuations Misclassifying expenses to mislead donors regarding funds used for certain purposes Failure to disclose significant information such as related party transactions or donation amounts 28 28
Audience Question What do you think is the most common way or method by which fraud is detected? A. Internal auditors B. Tip from an employee C. Confession by the person committing fraud 29 29
How Fraud is Detected 30 30
Red Flags 31 31
FRAUD PREVENTION MEASURES
Identifying, Mitigating and Preventing Fraud 33 Steps that can help to identify, mitigate or prevent fraud include: Control Environment: tone at the top, clear ethical boundaries, consequences Risk Assessment: discussion and assessment of current anti-fraud programs/ controls, evaluation of potential fraud risks Control Activities: policies and procedures that help ensure management directives are carried out, such as limited access to valuable assets/ information, segregation of duties, regular reconciliations, reviews and approvals Information and Communication: reinforce a strong tone at the top, provide avenues to report and address fraud Monitoring: depending on the situation, an organization might need frequent checks for newly implemented policies, or less frequent, but still regular checks for companies making little change to their current anti-fraud policies 33
Identifying, Mitigating and Preventing Fraud As shown in the 2016 ACFE Fraud study, the median duration of fraud cases is 18 months, making it hard to monitor. Financial Controls: Reconcile bank accounts Reconcile fundraising assets, such as raffle tickets and cash receipts Review any general ledger or other accounting entry adjustments Routinely complete a ratio analysis as it relates to donors vs. donations and employees vs. payroll. A trend will emerge, and it will be easier to spot potential fraud Surprise, non-routine audits It is important that a person not directly involved with the above complete these tasks! 34 34
Identifying, Mitigating and Preventing Fraud Non-Financial Controls: Implement an accounting policy and procedures manual, with specific attention to fundraising, treatment of cash and the chain of custody regarding cash and check deposits Employees, as well as volunteers, should sign and acknowledge understanding of the policies in place Implement a job rotation policy Require employees to take time off Conduct anti-fraud training for employees and managers Set up a fraud hotline, or another anonymous reporting mechanism Pre-screen employees Establish an audit committee 35 35
Fraud and Misconduct Assessment of the Risk A fraud and misconduct risk assessment includes the following key steps: Step 1: Risk Inventory Step 2: Risk Rating Step 3: Risk Remediation 36
Establish a Fraud and Misconduct Risk Inventory Prepare an inventory of possible fraud and misconduct risks. This inventory may be populated based on risks specific to the organization : Legal and compliance risks Standards provided in the code of conduct to which the organization may be subject Previous fraud and misconduct allegations, violations, enforcement actions or settlements Fraud and misconduct risk or control weakness previously identified by internal or external auditors Management or employee views of known issues or near misses that have arisen in the organization 37
Inventory and Categorize Fraud and Misconduct Risks Risk Inventory: Level 2 1.0 Misappropriation of Assets 1.1. Theft of Assets Risk Inventory: Level 1 1.0 Misappropriation of Assets 1.1 Theft of Assets 1.2 Vendor Fraud 1.3 Travel and Procurement Card Expense 1.1.1 Theft of Cash 1.1.2 Personal use of Equipment 1.1.3 Theft of Supplies 1.2. Vendor Fraud 1.2.1 Employee fraud using Dummy Vendors 1.2.2 Collusion Between Employee and Vendors 1.3.3 Vendor Fraud through product substitution or inflated billing 1.3. Travel and Procurement Card Expense 1.3.1 Personal purchases 1.3.2 Unauthorized purchases 1.3.3 Duplicate expense submission 38 38
Risk Rating Assessing the Likelihood of Risk Key Considerations Rating High / Probable (Score = 7 9) Known instances / allegations Complexity of the risk Historical trends Other considerations Medium / Reasonably Possible (Score = 4 6) Low / Remote (Score = 1 3) 39
Risk Rating Assessing the Likelihood of Risk Risk Inventory Likelihood Rating 1.0 Asset Misappropriation 1.1 Theft of Assets High 1.2 Vendor Fraud Medium 1.3 Time and Procurement Card Expense High 40
Fraud Risk Rating - Assessing the Significance of Risk Key Considerations Rating High / Material (Score = 7-9) Reputation Risk / Media Attention Criminal investigation Resignation or dismissal of functional officials Other considerations Medium / More than Inconsequential (Score = 4-6) Low / Inconsequential (Score = 1-3) 41
Risk Rating - Assessing the Significance of Risk Risk Inventory Significance Rating 1.0 Asset Misappropriation 1.1 Theft of Assets Medium 1.2 Vendor Fraud Low 1.3 Travel and Procurement Card Expense Medium 42
Risk Rating Develop the Overall Risk Risk Inventory Likelihood Rating Significance Rating Risk Rating 1.0 Asset Misappropriation 1.1 Theft of Assets High Medium High 1.2 Vendor Fraud Medium Low Low 1.3 Travel and Procurement Card Expense High Medium High 43
Preparation of a Traditional Risk Matrix Significance High 5 8 9 Medium 3 6 7 Low 1 2 4 Low Medium High Likelihood 44
Risk Profile Quadrant 3 low likelihood high impact 1 high likelihood high impact Financial statement fraud Conflicts of interest/ hidden relationships Travel and Procurement Card Expense Frauds in Treasury Theft of Assets False sales Vendor Fraud Bribery, corruption & kickbacks Bid fixing Bank Card abuse Customer fraud 4 low likelihood low impact 2 high likelihood low impact 45
Risk remediation can focus on strengthening controls for high and/or medium risk categories. Risk Category Business Process Owner Current State Improvement Opportunities Travel and Procurement Card Expense Accounts Payable J. Doe Policies Training Auditing Investigation Policies do not specifically prohibit personal use of procurement cards. There is no system for tracking the completion and follow-up on periodic audits. 46
This document contains general information, may be based on authorities that are subject to change, and is not a substitute for professional advice or services. This document does not constitute audit, tax, consulting, business, financial, investment, legal or other professional advice, and you should consult a qualified professional advisor before taking any action based on the information herein. RSM US LLP, its affiliates and related entities are not responsible for any loss resulting from or relating to reliance on this document by any person. Internal Revenue Service rules require us to inform you that this communication may be deemed a solicitation to provide tax services. This communication is being sent to individuals who have subscribed to receive it or who we believe would have an interest in the topics discussed. RSM US LLP is a limited liability partnership and the U.S. member firm of RSM International, a global network of independent audit, tax and consulting firms. The member firms of RSM International collaborate to provide services to global clients, but are separate and distinct legal entities that cannot obligate each other. Each member firm is responsible only for its own acts and omissions, and not those of any other party. Visit rsmus.com/aboutus for more information regarding RSM US LLP and RSM International. RSM and the RSM logo are registered trademarks of RSM International Association. The power of being understood is a registered trademark of RSM US LLP. 2017 RSM US LLP. All Rights Reserved.