Fraud - How to Gain Continuous Control
The pressures on business today are far-removed from those experienced only 20 years ago. The rapid adoption of information technology and governance strategy has led to the creation of a multitude of new roles. Indeed, IT and governance have also changed the priorities of many organisations too. There was a time was when compliance wasn’t even on organisations’ agendas, let alone a priority, and balancing the general ledger was as much dependent on the writing of the accountant, as the figures they were inputting.
Today, businesses are a mass of complexity, precariously balancing the needs of shareholders, employees, customers and regulatory authorities, while trying to make a profit. Added to this is the increasing pace of organisational change. Mergers and acquisitions and new technology deployments, such as ERP systems, offer further challenges. In this confused environment, the opportunity for fraud is heightened as controls are overlooked.
With 5% of turnover being lost every year to fraud, it is no surprise that today’s enterprises are keen to implement both tighter strategies and new technologies that aim to reduce revenue leakage. But viewed in a wider context, fraud prevention can be much more than a means to simply curb unnecessary loss of funds. By its very nature, tighter financial controls will improve and streamline business processes and create an environment where employees adhere to best practice guidelines. The additional benefit of regulatory compliance is a powerful driver.
Fraud and compliance are intrinsically connected. Both can be viewed as significant costs to the business – the former through obvious revenue leakage, and the latter through the increased costs of policy implementation and administration. That said, there is no reason why effective management of regulatory compliance should not create a more controlled business where fraudulent activity is easier to identify and halt. On the flip side, effective anti-fraud policies require a series of business processes and a level of financial management and understanding that is a central tenet of many of today’s compliance regulations.
But before we are engulfed by a tide of enthusiasm, success is predicated on organisations having access to and understanding of every financial transaction that touches these areas. And it won’t come as too much of a surprise to learn that many do not. In our recent survey of audit and financial executives in the UK and Germany, the results highlighted the fact that the complexity of today’s business operations is opening the door to fraud. Seventy-seven per cent of respondents agreed that auditors and CFOs need immediate access to a single view of all relevant company data, however only 24% actually have this.
Fraud and compliance are, of course, linked in other less positive ways. Organisations, and particularly audit teams, can often find themselves focusing on compliance to the detriment of other activities. And with attention focused elsewhere, fraud can become prevalent within an organisation – especially if lines of responsibility between auditors, compliance and financial executives are blurred. Alternatively, organisational change, the inevitable chaos of a company merger or new acquisition, or more operationally, the implementation of a new ERP system, provides a similarly large opportunity for internal and external fraudsters – and throws compliance programmes into a state of flux.
As is often the case, in times of change or pressure, good management, and indeed good business, relies on having a full understanding of exactly what is going on in the organisation – particularly when things are happening that shouldn’t. A period of merger or acquisition is a prime example of such change, which can lead to lax controls. To gain full visibility of the situation, managers are required to look outside of their own departments to get a true picture of the business.
As such, though compliance is a critical part of business, approaching it in a single-minded fashion is not always the most prudent way. Rather, by ensuring good business practices are in place across the organisation, boardroom executives will quickly discover that effective compliance and anti-fraud policies appear as a convenient by-product. For example, a decision to monitor financial transactions from every department in the company on a daily or weekly basis will provide a clear view of what is going on in the organisation and ensure suspect transactions can be detected and queried in a timely fashion. This one single improvement in business process will both reduce the risk of revenue leakage and create a ‘compliance-ready’ environment.
Unfortunately, in practice, only 9% of organisations implement this type of monitoring of financial transactions, with 57% conducting quarterly cycles and 34% monitoring monthly.1
While it is logical that a complete, real-time view of all financial and business transactions makes good sense, ‘visibility’ based on quarterly or annual audit cycles is a flawed process. Not only does this provide a bulk of work to be carried out at the end of the cycle, any fraud that has occurred within the previous period of time will not be uncovered until the audit is completed, therefore reducing the chance of recovery. In the case of incorrect or fraudulent payments, the chance of total recovery dwindles to 50-60% once the payment has been made.2
And the costs to the organisation do not stop with detection – remedial action also requires resources. Once a fraud is discovered, the recovery claim requires four to 20 hours of research for investigation, documentation, communications and collection.3 If that fraud is uncovered at the end of the quarter, the man-hours required could become a major burden as opposed to a steady flow of suspicious transactions that can be investigated throughout the quarter. Companies need an early warning system so that they can identify fraud as it happens and take the necessary action immediately.
While organisations implement a range of controls to detect and prevent such errors, it certainly appears that many are ineffective. For example, in the survey of auditors and finance officers, 61% of respondents said they did not know how many data anomalies were uncovered with each audit, while a third of respondents admitted that an anomaly could go over six months without being noticed. Worrying indeed, and clear evidence of why companies need an early warning system.
In 2006, Section 404 of Sarbanes-Oxley became applicable to companies operating in other jurisdictions but listed on a US stock exchange. It requires management certification and external attestation that the internal controls underlying financial reporting are working as intended. Continuous monitoring of the controls governing financial transactions can provide an increased level of assurance to management, auditors, board directors, shareholders and other key stakeholders. While regulatory compliance requirements may be the catalyst to validate these controls’ effectiveness, best practices in corporate governance make good business sense.
The current business environment continues to exert great pressure on organisations to reduce expenses and inefficiencies while improving top-line revenue growth. Simultaneously, companies must combat the increasing threat posed by fraud. Faced with a dynamic and sometimes vague regulatory landscape, fewer resources, less time and mounting demands from stakeholders to mitigate business risk, organisations must formulate strategies to contain costs, prevent fraud, safeguard corporate assets and address revenue leakage. Continuous controls monitoring provides value beyond meeting regulatory compliance requirements by enabling organisations to continuously test the integrity of transactions, to rapidly identify and solve control issues before profit erosion impacts bottom-line performance.
Identifying data irregularities and highlighting them to the appropriate individual within the organisation who can investigate the query fully is a large and complex task. Monitoring must not be limited to simply investigating large payments to unknown suppliers. There are many tests to consider, for example, that a supplier’s invoice address does not match that of an employee’s, that the person who raises the purchase order is not the person who approves the transaction, and likewise employees should not be able to approve their own expenses bills or pay rises.
While fraud is a serious issue, it is not always malicious intent that causes financial loss. Duplicate invoices sound innocuous, but the cost to the business can be detrimental. Invoices can be paid twice due to being logged into the system using different spellings for a vendor, a new address or incorrectly inputting information. During times of change, such as mergers, it is highly probable an invoice could be sent to the old company address and the new one, with both being processed accordingly. Continuous monitoring can highlight similar invoices to be checked before payments are made. One such example is a major UK logistics organisation that saved £8m in duplicate and over-payments by implanting continuous monitoring in its payables environment.
So, while massive, high profile corporate frauds will continue to grab headlines, the reality of high volume, low value fraudulent activities will continue to cause significant management problems for executives tasked with prevention. Add to this the increased compliance demands that result in a preoccupation with ticking the regulation box rather than improving financial performance and reducing financial risk, financial executives find themselves operating in an increasingly challenging environment.
The deployment of continuous monitoring technology and an improvement in business processes can actually have a much wider impact on the business than simply curbing an unnecessary loss of funds. It will reduce the cost and administrative burdens of regulatory compliance, streamline management through the creation of improved internal processes that adhere to best practice guidelines, and critically, will deliver a powerful weapon in the war against corporate fraud.
It is, therefore, somewhat of a conundrum how only 24% of organisations provide full visibility of transactional data to their auditors and financial executives, and only 28% conduct daily or weekly audits, but 81% are confident that they are meeting compliance requirements. Food for thought, indeed.
1State of the internal audit profession study: Continuous auditing gains momentum, PwC, 2006.
2Paystream Advisors.
3Paystream Advisors.