1. FORENSIC ACCOUNTING & VALIDATION FORUM 2015
7 July 2015
Intercontinental Hotel, Nairobi, Kenya
Fraud Risk Management “in the first 48 hours”
By
Mr. Felix T. Maromo, CFE, CPFA, Msc.
Financial Crime Compliance Manager
Standard Charted Bank Zimbabwe
2. CONTENTS
1. Why Commit Fraud
2. Proactive Vs. Reactive Action
3. Fraud happened & we detected it, What next!!!
4. Conclusion - What to do if I suspect fraud
5. Question & Answer Session
Disclaimer:
Information and views in this presentation represents solely the presenter's personal views and comments.
3. Why Commit Fraud
Fraud – Common definitions
There are many definitions, common few are:
a) Is categorized as an offense that can be charged by
law, depending on the specific circumstances of
the case.
b) Abuse of position, or false representation, or
prejudicing someone's rights for personal gain.
c) A false representation of a matter of fact—whether
by words or by conduct, by false or misleading
allegations, or by concealment of what should
have been disclosed—that deceives and is intended
to deceive another so that the individual will act
upon it to her or his legal injury.
My definition
Refers to a situation where a person makes a
material false statement; the victim relies on that
statement; and subsequently there are criminal
benefits to perpetrator.
Why Commit Fraud
5. Proactive Vs. Reactive Action
Proactive Reactive
Predictive Modeling Data Mining & Analysis
Fraud Prevention Fraud Detection
Predictive Modeling
Commonly used statistical technique to predict future behavior.
A form of data-mining technology that works by analyzing historical and current data and
generating a model to help predict future outcomes.
Involves data collection, formulating statistical model, making predictions and validating (revising)
the model as additional data becomes available.
6. Proactive Vs. Reactive Action Cont’d…
Data Mining and Analysis
Historical data is gathered and analyzed in an effort to further
understand it. Proven methodologies:
Data analysis, especially in the field of forensic accounting;
Use of filters, expressions or equations;
Sorting/indexing/summarization;
Gap & duplicate detection;
Statistical or digital analysis;
Sampling, stratification, cross tabulation or pivot tables;
aging, joining/relating, trend analysis, regression analysis or
parallel simulation; or,
Or the combination of one or more of these techniques.
Fraud Prevention Assessment
Fraud Detection
Bank reconciliations
Positive pay
Filtering & Screening Process
Alerts Management
Audits and reviews
Watch for warning signs/ Red flags
Alert Employees &Whistle blowing
Fraud Red Flags
Opportunity Red Flags
Personal Characteristics Red Flags
Situational Pressure Red Flags
Characteristics Of Top-Management Fraud
Indicators of Possible Fraudulent Activities
Understanding Symptoms/Red Flags of Fraud
7. Fraud happened & we detected it, What's next!!!
Model 1Model 1
The current model used to fight against fraud in many organizations.
There are four stages in the model shown on the diagram.
Fraud Incident
Raising consciousness, while training and other prevention criteria are out of
question.
In such an environment, fraudulent event occurs.
Company moves to crisis mode because it wants to identify the fraudster.
Company will be too eager to prevent the event from becoming known
publicly, save losses, and reduce the impact of fraud on the organization.
Investigation Stage
All security procedures and internal control are included in this stage.
Much of the investigation will be conducted by interviewing and document
examination.
The investigation might not end up with a decision.
The investigation could take long time and be costly at the end of the day.
Before the third stage begins, investigation should be completed.
Albrecht and Albrecht , 2003, p 98
8. Fraud happened & we detected it, What's next!!! Cont’d…
Action
The company decides how to take action against the fraudster.
There are four possible decision actions:
do nothing,
fire the fraudster,
transfer the fraudster to another section, or
fire the fraudster and start legal proceeding.
Resolution
The investigation file is closed;
the employee is changed;
new controls are applied or not applied; and,
the problem is resolved.
QUIZ QUESTION: Has case been handled effectively, thereby addressing Fraud Risk to the fullest
Pair Discussions!!!
9. Fraud happened & we detected it, What's next!!! Cont’d…
Conclusion- In Model 1, nothing is done after this fourth stage until a new fraudulent event takes place.
- Fraudulent events do not decrease and they might in fact become a chronic problem.
Model 2 - Fraud Savvy Model
Moral Rules
Reporting & Control
10. Fraud happened & we detected it, What's next!!! Cont’d…
There are six elements in fraud savvy model.
a) Moral Rules:
The developed rules must be embraceable by everyone working in the company
Creating a proper behaviour model
b) Training
Training of employees on a series of consequences of fraud.
Training employees on how to act when fraud is suspected.
This assist in preventing the incidence of fraud
c) Risk & Controls
This entails risk assessment and a good internal control system.
Identifying where each fraud is stemming from, thus preventing possible frauds in the future from its
very source.
d) Reporting and Control
Reporting of fraud should be facilitated.
Fraud could continue for several years if hotlines and other reporting systems are not used frequently.
Reporting includes conveying, the fraud-related information to the people concerned. i.e.
communicating the fraudulent activity to auditors security personnel, managers, employees, and
those concerned.
11. Monitoring includes:
watching the performance of internal auditors, external auditors and managers and investigations.
In companies with tight monitoring and reporting systems, fraudulent events are likely to decrease.
No matter how good the prevention efforts are, fraud could still be committed.
d) Proactive Detection
Initial detection of fraud is important.
Today computer software is used for initial detection of fraud.
d) Investigation & Prosecution
In an organisation investigation procedure, the following must be determined:
Who will conduct the investigation?
How will the event be communicated to management?
Whether or not the law enforcing authorities should be brought in?
Who will determine the scope of investigation?
Who will determine the methods of investigation?
Who will trace secret information in suspected fraud?
Who will interview, examine documents, and undertake other stages of investigation?
Who will determine the company’s reaction against fraud?
Finally,Taking lawsuit against the perpetrator should be preferred, instead of passive reaction.
Fraud happened & we detected it, What's next!!! Cont’d…
13. Fraud happened & we detected it, What's next!!! Cont’d…
Communication Risk
Members of the investigatory team are potential witnesses in any subsequent civil or criminal proceedings.
A lawyer could be consulted on whether the investigation should be recorded in writing and should advise
on how this should be done in order to maximize privilege.
A lawyer can also advise on how all communications between team members, and between team
members and third parties, should be structured in order to protect confidentiality and privilege.
Investigator should formally and automatically communicate identified deficiencies and exceptions to
appropriate leadership/management.
Law Enforcement Agencies
Before contacting any external agency to report fraud, you could consider seeking advice from your
professional advisors and lawyers.
Running an investigation solely within the company structure has certain benefits.
The benefits can disappear upon law enforcement involvement.
Should consider impact of decision DisclosureControl – regulatory and public disclosures, i.e reputational
risk with customers, suppliers, and the capital markets
As there is no legal requirement for disclosure of these events, many companies choose not to report the
event or the full extent of the fraud to law enforcement or to the general public.
Once government in involved the disclosure control is weakened.
15. Fraud happened & we detected it, What's next!!! Cont’d…
Scope of Investigation
When determining scope of investigation following
should be considered:
a) Number of input data/material flows on the
investigation context
b) Number of output data/material flows on the
investigation context
c) Number of business events within your
investigation
d) Number of human systems adjacent to the
investigation
e) Number of automated systems adjacent to the
investigation
f) Number of stakeholders involved in the
investigation
g) Number of uncertain connections around your
investigation
16. Fraud happened & we detected it, What's next!!! Cont’d…
Taking lawsuit against the Perpetrator
Role of Forensic Accounting
Emerged since the 1980s in someWestern countries, particularly in the USA and has spread world over.
Uses accounting, auditing, and investigative skills to conduct investigations into theft and fraud.
Provide an account analysis to determine the facts necessary to resolve a dispute before it is brought
before the court or the lawsuit process takes its course.
Mostly used for engagements that result in actual or anticipated disputes or litigation.
Can include fraud, valuation, bankruptcy, and a host of other professional services.
Forensic accounting can be done by specificAccounting Professionals.Whereas, Fraud examinations can
be conducted by either accountants or non-accountants and refer only to antifraud matters.
Litigation Process
The publicity around the litigation process is usually extreme due to:
the sums and range of parties involved;
the range of tactics being deployed to achieve each side’s ends;
the quantity of hearings and appeals; and,
the zeal and determination of the Claimant to succeed, the perceived capacity of the Claimant to
achieve its purpose
Usually it’s best for organisations to concentrate efforts towards recovery of lost funds/resources
rather than to see perpetrator behind bars (POINT TO DISCUSS)
17. 1. Fraud detection and investigation
What has happened that makes you believe that fraud or corruption has taken place?
What is the impact/financial loss to your company?
How has this happened?
Who is responsible for this?
When did this take place?
What evidence, if any, do you already have to support your belief?
2. If fraud has taken place internally
For fraud committed by someone within your organisation:
Seek advice from your professional advisors on how to proceed
Conduct a full internal investigation
Depending on the size of the fraud, you may want to consider taking remedial action against those concerned
If your organisation conducts own investigation with a view to reporting the matter to regulatory or law enforcement
agency, evidence should be preserved and handled with care.
Complex matters, may be appropriate to refer to independent investigators.
3. If fraud was conducted by another company or external individuals
Before contacting any external agency to report fraud, you could consider seeking advice from your professional
advisors and lawyers.
4. Next steps
Dealing with fraud does not stop at reporting it to a law enforcement agency.
Investigations can take a long time; hence communications between all stakeholders is key.
Fraud Mitigations Measures/Internal control reviews should be conducted to mitigate damage caused by fraud.
Conclusion - What to do if I suspect fraud
