1. A
Ethical Boardroom | Spring 2015
Lessonsin
OversightLearning from what went wrong and why can
improve your organisation’s governance
lthough this exchange is
imagined, unfortunately its
underlying construct is not
fictional. This is the story of the
‘Tahitian Prince’ who worked for
the health department in the
Australian state of Queensland
and who committed the largest
fraud ever identified in Queensland public
service history.
How no one stopped to think that an invitation
to a Queensland Health employee to the wedding
of Prince William and Kate Middleton didn’t
seem strange probably sums up many aspects
of this story.
This is the play book of fraudulent
intent, ineffective systems and
processes and people willing
not to see what was right
before their eyes.
The lessons that the
imaginedconversation
represent go to the
very core of what
constitutes good
Tom McLeod
Managing Consultant,
McLeod Governance
Board Governance | Oversight
STAYING VIGILANT
To spot fraud,
organisations need
more insight into
identifying risks
Employee: “Excuse me boss, but
could I take a week’s leave?”
Employer: “Sure, but do you mind if
I ask if you are taking a break?”
Employee: “I am attending a
wedding in London.”
Employer: “Friends?”
Employee: “Yes. William
Arthur Philip Louis
Windsor and Catherine
Elizabeth Middleton.”

2. Spring 2015 | Ethical BoardroomCopyright © 2016 by Ethical Boardroom strictly reserved. No parts of this material
may be reproduced in any form without the written permission of Ethical Boardroom.
Oversight | Board Governance
organisations that have allowed their trauma to
be publicly aired. World- class organisations
use every opportunity to improve their processes
and control frameworks. A control framework
that is static is a control framework that is
deteriorating in quality.
Whilst it wasn’t a major focus of the CCC
report, it did briefly note the weaknesses that
allowed the fraud to be committed. In the words
of the CCC “the frauds could not have succeeded
or continued for so long if it were not for a range
of factors” within Queensland Health itself –
these included:
■ Low levels of compliance with existing
policy and procedures by other staff
■ Failures of financial management
and accountability
■ Failures in supervision and management
■ Inadequate change management
processes that failed to identify risk and
failed to provide an effective follow-up
review process
■ Low awareness of the risk of fraud among
staff at all levels
■ Failure to properly investigate information
provided in audits and complaints and
evaluate it in a wider context
By using examples such as the Tahitian Prince
case, it allows a process improvement orientated
organisation to self-assess whether if the event
had of occurred within its boundaries would the
same control weaknesses been identified.
Do you already know that your organisation
has a low level of compliance with existing
policies and procedures? What are you doing
about that situation? Do the powers to be believe
that such a deficiency will never likely result in
any great harm?
governance within an organisation and how such
frameworks can be exploited to identify and
mitigate a corporation’s silent killer – fraud.
Of equal importance is that you are taking the
time to consider the scenario. Why this is of
such benefit, though, will have to wait until you
meet Joseph Barlow, born on 13 February 1975
in New Zealand.
Barlow’s journey of deceit and duplicity
commenced before he even started with
Queensland Health. Barlow landed on the
antipodean shores of Australia in 2003 and
was successful in getting a contractor role with
Queensland Health in 2004.
The Queensland Crime and Corruption
Commission (CCC) noted in its summary (and
salacious) report into the matter that “the
curriculum vitae Barlow provided to Queensland
Health stated that he received a number of
tertiary qualifications and academic awards in
New Zealand between 1995 and 1999”.
What will now not be surprising, yet was never
checked at the time, is that it turns out that
Barlow never had any such qualifications.
A path of destruction
A former colleague told the CCC that when
Barlow started working for Queensland Health
his lifestyle was beyond the means of his wage.
He said Barlow told Queensland Health
employees that he was Tahitian royalty and made
it known that he had a trust fund but needed to
have a job to access it.
Over the course of the next couple of years,
Barlow progressed through the ranks of
the Queensland Health bureaucracy, securing
a role of Principal Finance Officer (PFO) in
September 2007.
The CCC report noted the start of what was a
very slippery journey: “On 3 October 2007, 12 days
after commencing as the PFO, Barlow established
Muse Business Inspiration (The Muse) as a
Queensland Health vendor. The Muse was a
business registered to Barlow’s neighbours ...
Barlow signed the vendor set-up form for The
Muse as authorising officer … the following day,
Barlow authorised the first fraudulent payment
of $2,200 to The Muse using a General Purpose
Voucher. He authorised subsequent fraudulent
payments to The Muse on 29 October ($2,200)
and 10 December ($6,601), bringing the total of
money defrauded from Queensland Health at the
end of 2007 to $11,003.”
Barlow’smisguidedadventureswouldcontinue
for four years and would result in the loss of $16.6
million. In a final act of perverted corporate
philanthropy, Barlow wanted to leave not only a
legacy of financial destruction; he was keen to
develop well-trained staff.
He told the CCC: “I was tired of living a double
[life] you know [being] His Royal Highness … so
I prepared an $11m payment, I’ve sent it to my …
own staff … who I’ve trained … to check through
[documents] … [Finance Officer 3] would have
checked the [details] seen it was registered to
me and then … you know the game’s up … I’m
glad my staff picked it up.”
Educating your workforce
In March 2013, the fake Tahitian prince was
sentenced to 14 years in jail with a non-parole
period of five years.
Too often stories such as this one kindly
provided by Barlow are dismissed by boards and
senior management as one-off instances;
corporate aberrations from which it is
neither possible nor wise to draw any extended
conclusions.
Indeed, in our consultancy we often have to
deal with the retort that to share such stories
not only does nothing to diminish corporate
misadventure but provides would-be fraudsters
with an instruction manual for moral ambiguity.
Our challenge to such a sceptical audience is,
what is it that you are afraid of in educating
your workforce?
There are three key benefits available to
an organisational governance culture that
is prepared to examine in depth the misdeeds
of their own employees or those in other
Toooftenstoriessuchasthisonearedismissedbyboards
asone-offinstances;corporateaberrationsfromwhich
itisneitherpossiblenorwisetodrawanyconclusions
audit assessments
Companies need to
investigate information and
evaluate it in a wider context

3. Ethical Boardroom | Spring 2015
That is where the dispassionate and regular
discussion of fraud, by its very taking place,
can ignite an improved control environment.
We have even seen an organisation that uses its
discussion of such topics as evidence that they
are an employer of choice where communication
is open, irrespective of how challenging the
subject matter may be.
The second major use of such case studies is
to improve an organisation’s fraud control
framework and training environment. If the first
benefit was “What can we learn?”, this benefit is
focused on “Could it happen here?”.
In the same way that organisations seek out
– or invent – terrible natural or man-made
disasters that are of a scale that immediately
activate the organisation’s disaster recovery plan
to assess whether the plan would withstand what
the (invented) world has thrown at it, then so can
a Tahitian Prince fraud example be used.
Assessing fraud frameworks
A strong fraud control framework is made up of a
number of interdependent factors – leadership;
organisational culture; (external) legislation or
(internal)policies;preventiontechniques;detection
mechanisms; responses and reporting mediums.
Throw the facts of the case study against the
proverbial wall and see how they fall. Would your
organisation have identified the misadventure
in a timely manner? If so, how would you have
done it without detection? If not, what are the
deficiencies that you have identified?
What would have been the response of
the senior leadership of the organisation? We
have had the experience where we had to
educate senior leadership as to what they
were and were not allowed to do as
the leadership wanted to be seen as
tough on fraud but were ignorant
oftheconceptofdueprocessand
the presumption of innocence.
Do your organisation’s
p o l i c i e s a d d r e s s t h e
hypothetical issue at hand?
To borrow the phrase about
the standards you accept are
the standards you walk past;
an organisation’s policies are
onlyasgoodastheexceptions
that they allow.
Once proven – or perhaps
even on suspicion or receipt of
the allegation – what and to
whom would the organisation
be reporting the matter? Do you
have a legal obligation to report the matter to
the relevant policing authorities and what can
you expect from that authority in terms of action
and feedback?
Equally, consideration should be given to what
governance body within your organisation the
matter should be raised to and by when. A well-
constructed audit committee charter will usually
explicitly stipulate when allegations of fraud need
to be reported to it – whether immediately or at
the convening of the next meeting.
By now you have assessed whether the matter
could have happened within your organisation
and have considered whether the process
deficiencies identified by others are applicable
to your circumstances.
So now it is time to use the case study in the
training of your employees. Many years ago after
presentingtoanauditcommitteeonarun-of-the-
mill employee expense fraud, we were challenged
by the chair as to what was the split of our
resources between prevention and investigation.
The chair insisted that if we were to only have
$100, we were to spend $90 on fraud prevention.
Additionally, he asked that we up-skill the entire
organisation in fraud awareness.
His thesis – proven correct many times
over – was that a well-funded education
programme informing a receptive workforce will
save far more money than the threat of a strong
investigative environment.
As an interesting aside to the chair’s challenge,
we dramatised using professional actors the
run-of-the-mill expense reimbursement fraud
andputtheresultingshortfilmonline.Employees
were required to identify the seven examples
of misadventure and fraud – some blatant,
such as the use of a corporate credit card in an
establishment of ill repute, and others subtle,
such as making a false invoice.
Learn from previous mistakes
The average number of instances identified was
two; showing to us that we had a workforce that
was not particularly good at seeing what was
right before their eyes.
The final benefit of such case studies is,
strangely enough, career development. Not for
the fraudster, even if the maxim that all publicity
is good publicity holds true. Rather it is
career developing if you are the person that
is seen to be committed to improving the
controlenvironmentandgovernanceframeworks
of the organisation in a constructive and
meaningful way.
This lesson-learned approach, however, should
not only be limited to fraud case studies. Every
week in nearly every country a well-researched,
well-crafted report will be released, detailing
the triumphs or, more likely, the failings of an
organisation’s internal control systems.
The sources of such reports can be many and
varied – where a company has committed to
release a report publicly; through the output of
the audit, evaluation and investigation agencies
of government; via commissions of inquiry
or in the pages of transcripts released via
court action.
Seek out those reports. Learn from
them and embrace the uncertainty that
they may deliver. For, as was once attributed
to Eleanor Roosevelt, “learn from the mistakes
of others. You can’t live long enough to make
them all yourself”!
And remember to be suspicious of anyone
that says that they have received a personal
invitation to the wedding of the second in line to
the British throne.
Board Governance | Oversight
false representation
Simple fact checking can
reveal if someone is who
they say they are
A well-funded education
programme informing a
receptive workforce will
save far more money than
the threat of a strong
investigative environment