Owner Management
A typical internal fraudster is likely to be a highly trusted member of your company. So how can you ensure fraud never happens to you? Anthony Harrington investigates read on....
WOLVES IN SHEEP'S CLOTHING
A typical internal fraudster is likely to be a highly trusted member of your company. So how can you ensure fraud never happens to you? Anthony Harrington investigates
For businesses of all sizes, the statistics on fraud are, or should be, deeply disconcerting. As Paul Worth, a partner in the litigations department at the law firm Eversheds observes, figures from the Association of British Insurers put the estimated cost of fraud to the UK economy at £316bn a year, or £3650 for every household in the country. To make matters worse, these figures relate to 1999, the latest year for which the statistics are available. There are clear indications that fraud is going up year on year, so when the figures for 2004 eventually become available, that cost per household could be well over the £31,000 mark.
Worth is keen to emphasise that businesses should not regard themselves as helpless in the face of this growing threat. "Interestingly, the Metropolitan Police have done some analysis of the investigations they have carried out over the last decade. They concluded that 42 per cent of all the company frauds that they have been involved in could have been prevented if only the business had implemented its existing controls carefully enough," he says.
The staggering fact about this finding is the way it highlights how easy it is for businesses to undo all the good work they have done in analysing and articulating their controls policies and procedures by neglecting to monitor conformity to those procedures. One of the key steps in fraud prevention is persistent monitoring and checking. Having policies is not enough, you have to check to see that they are being adhered to in practice, says Worth.
Important as fraud prevention is, companies also need to have clear procedures set out for staff to follow when significant fraud is suspected or actually uncovered.
One of the key concerns for companies when a major fraud is suspected or uncovered is to ensure that they recover as much of the company assets as they can. Roger Bowden, an associate at law firm Berryman Shacklock in Nottingham, points out that there are basically two options open to a company in this position, namely a freezing order or a search order.
A freezing order freezes funds in the suspect fraudster's bank account and stops the money going out the window when the fraudster discovers that he or she has been rumbled. This is an injunction, and, as Bowden points out, injunctions do not come cheap.
"Basically, to implement a freezing order the law firm has to delegate a team to get on the case instantly, setting aside work that whoever is involved might have been busy with at the time," says Bowden. "In one instance, for example, we were instructed at 9am in the morning by a client and we obtained a freezing order from the court by 2.30 that afternoon. The suspect's bank was notified minutes later. Speed is essential in these matters," he says.
Because a freezing order is granted by a judge in the absence of the suspect, the business has to be able to make a very good case for its suspicions. If the directors only have vague suspicions that there is something going on, then this is not an appropriate vehicle.
A search order, as the name suggests, allows the company to open up files, search the suspect's desk, briefcase and so on. "You need an independent lawyer, not connected to the company's own law firm, to supervise the search action, but again, you need a very strong case to take to the judge to grant this order. You can't tell the judge that you think there might be something interesting on the suspect's PC," adds Bowden.
Then there is the role of the police to be considered. A civil action against a suspect is not a police matter, as for example, an action to recover missing assets that the subject is found to have obtained fraudulently. As far as criminal actions are concerned, whether or not a prosecution is ultimately brought is up to the police and the prosecutor.
"If you take those signs in shops that say something to the effect that 'we always prosecute shoplifters', what that means is that the shop may well always call the police, but the police then together with the Crown Prosecution Service take a view as to whether a prosecution is worth pursuing," explains Bowden.
What is crucial for the business, from an employment law perspective, is that it conducts a proper and impartial internal investigation and provides the employee concerned with a chance to tell their story. "Even in those rare instances where you catch the guilty party with their hand still in the till, as it were, you still need to exercise considerable care. Do not leap to conclusions. Build your case and make sure you have something that will stand up in court or before a tribunal," Bowden comments.
Bowden points out that the handbook that his firm hands out to clients suggests making a right to search part of the contract. "You have to allow for the fact that the subject has the right to refuse the search, no matter what they have signed, but you cover yourself by stating in the contract that you may draw adverse inferences if they refuse to submit to a search by two people of the same gender as themselves."
If someone leaves the warehouse with an odd shaped lump under their jersey, refuses a search and runs for home, the judge or the tribunal chairman at a later date will probably go with the company's interpretation. "The important thing to remember is that the burden of proof in a civil case is balance of probabilities," says Bowden.
Some small to medium-sized businesses might be under the impression that the new Asset Recovery Agency (ARA), created by the government under the Proceeds of Crime Act 2002 (POCA 2002), will assist them in recovering assets from fraudsters. Worth points out that the ARA may well take an interest in recovering the proceeds of a significant fraud but that this would not be good news for the company concerned. The funds ARA recovers go to the state, not to the victim.
"ARA has an interest wherever a criminal, be it a fraudster or a drug baron, has enriched themselves through criminal activity, so it is quite possible that it will look to recover the proceeds of fraud," says Worth. "ARA is under no obligation to inform a company that has been defrauded that it intends to act to recover funds, so it is up to the defrauded company to stay alert and to keep itself informed as to what the police and ARA are up to with respect to its case.
"Fortunately, the act allows companies to go to court to get an order to stop ARA from proceeding to recover funds where the company can show that those funds are its property, but it needs to act in a timely fashion here," Worth says.
Adam Smith, director in charge of forensic and dispute services at accountancy firm Deloitte, points out that statistics show that some 84 per cent of fraud is committed by the organisation's own employees, acting on their own or in collusion with third parties. There is also a statistic which shows that over a 10-year period, to the end of 2000, there were 665 cases of frauds over £3100,000, amounting to a total of £34.2bn over the period. This gives an average fraud value for larger cases of £36.3m, a figure that should make businesses pause for some serious thought.
There is simply no substitute, Smith points out, for running a tight ship and ensuring that all proper controls and preventative measures have been put in place and are being monitored. "We have seen over the years that the fraud market has been focused on after-the-event services. Industry can no longer afford to wait until after the event to rectify matters. Companies have to be very proactive and they need to take steps to protect against it ever happening in the first place," he says.
Worth points out that the vast majority of fraudsters start small (a point that is in keeping with the often heard truism that there is no such thing as a small fraud - it's simply a large fraud that has not yet had time to grow). "In our experience, most fraudsters won't start with a £3100,000 fraudulent invoice. They'll put through a bogus invoice for a relatively innocuous amount of money. When the internal controls fail to pick this up, they'll try it again and again, with increasing amounts. Often they go on to invent bogus suppliers and they create completely fictional descriptions for the transaction," he says.
One fraud that Eversheds was involved in untangling involved collusion between an internal accounts staff member in the client company and a heating oil supplier. The supplier regularly invoiced for 10,000 litres of heating oil when the company's tank was a 5,000-litre tank. It had become so routine that it was only queried when the company finally changed heating oil suppliers.
As an addendum to this point, Smith emphasises the well known fact that fraudsters hate taking holidays, because they fear a fresh pair of eyes coming in to see what they have been doing. One way of preventing fraud, in other words, is to identify people who never take holidays and to rotate them to different jobs from time to time. They may be the most loyal servants of the company, or they may have their fingers in the till. There seems to be no way of knowing.
Worth points out that one of the accountancy firms that specialises in collecting statistics on fraud decided to draw up a profile of a typical fraudster based on the cases available to them. "To their surprise, they found that the profile indicated that the typical internal fraudster would be a highly trusted member of the company, with at least seven years service, and typically earning around £343,500 a year as a senior member of the accounts team," he says.
Graham Muth, head of corporate finance at law firm Cobbetts in Birmingham, tends to come across fraud when companies have either completed or are in the throes of an acquisition. "One case I saw recently was when the client had completed the deal and it turned out that the balance sheet of the target company was so overstated that it could only be the result of fraud. In that instance the company had a tough struggle getting anything of its purchase price repaid," he comments.
For Muth, cutting out internal fraud is both about seeing the right controls are in place and about ensuring that you hire people with the right attitude in the first place. "Don't cut corners on reference checking," he says.
Gary Ashford, senior tax manager at accountant Grant Thornton, warns that companies need to be aware that the Inland Revenue is not minded to be relaxed about fraud. Companies that want to set their losses against tax need to be aware that, far from sympathising with them in their loss, the Inland Revenue is probably going to take the view that if the fraud is significant and has been ongoing for some years, the company will have been mis-stating its annual profits. Penalties could lie ahead, so the company ought to take the initiative as soon as a fraud is discovered and start talking to the Revenue about the likely impact on the accounts. "Remember that the Inland Revenue inspectors read the papers too," he warns.
A second point worth noting is that if it is possible to assert that the fraudster was in a position where they could exercise control, the Revenue will not allow the resulting losses to be offset against taxable profit. This is obviously the case where the fraud is perpetrated by directors or senior management, but the Inland Revenue may well want to argue that an accountant in the finance department is also a person able to exert control. Detailed advice at an early stage is essential here.
For Michael Isaacs, financial litigation and corporate fraud partner at law firm Hammonds, the key to fighting fraud is for companies to take positive steps to make themselves less attractive to fraudsters. "Companies need to create an anti-fraud culture," he emphasies. Where you have a business run by senior managers with strong personalities, who are continually overriding systems and controls, the opportunities for fraud are much greater. If you create an anti-fraud culture, it is much easier for lower ranked staff to say no, this is not the way it is supposed to be done.
"Management and senior officers need to walk the talk," says Isaacs. "They have to encourage compliance, ethical practice and business procedures by example. Compliance flows from the top."
For the fuller picture,
subscribe to Insider
every month.
