Facing Up to Fraud
Financial service authorities around the world are taking a tough stance on fraud. In recent months, numerous banks have been hit with fines for allowing internal fraudulent activities to take place through lax internal controls and monitoring. This clampdown looks to continue, with the UK’s Financial Services Authority (FSA) director of enforcement, Margaret Cole, stating, “We will not hesitate to take action against any firm found wanting.”
A recent example of the global clampdown came in June 2007 from Japan when the Bank of Tokyo Mitsubishi UFJ was ordered to improve its business practices with regard to internal controls and compliance. It was forced to suspend credit dealings with new customers for a period of seven days by the country’s Financial Services Agency – a costly penalty.
In 1999, the government estimated that fraud cost firms £1.5bn a year. A more recent 2006 estimate on identity fraud put the annual cost to the UK economy at £1.72bn. CIFAS, the UK’s fraud prevention service, estimates ‘insider’ fraud is on the rise too. A survey of its members revealed that some organisations had seen a 30% increase in the number of staff fraud referrals made to the relevant fraud department in the past year. A survey from Leicester University backed up its findings, with the astonishing statistic that 70% of the 2,000 people it questioned would commit fraud if they knew they would get away with it.
John Hinds, policy and projects manager at CIFAS, said at the time the organisation announced its survey findings that: “Staff fraud is now emerging as the single most significant fraud risk both to the financial services industry and to businesses handling financial transactions.”
It is little wonder that the FSA is cracking down on fraud. In the past two years, the FSA has fined Nationwide, Capita Group and Kyte for weaknesses in each institution’s anti-fraud systems and controls. In January this year, the FSA’s chief executive, John Tiner (he has since handed over to Sir Callum McCarthy) also announced the creation of a new Financial Crime and Intelligence Division (FCID) to improve the FSA’s practices for identifying, assessing and managing criminal threats in the UK’s financial sector.
The FSA’s recent announcements demonstrate that it is clearly not going to accept weak anti-fraud policies any more and banks must, therefore, identify the long-term financial benefits of closing fraud loopholes. The FSA’s approach has been one of education, collaboration and leadership with organisations. A review of large financial groups in 2005 found that most firms had taken steps to strengthen their fraud management capabilities. Senior management also recognised the need to manage the increasing threat of fraud in a more effective and integrated way. However, improvements were still deemed necessary in the area of insider fraud.
The FSA does not require firms to comply with detailed rules and guidance on fraud management. A section in the Senior Management Arrangements, Systems and Controls (SMASC) module, however, within the FSA’s handbook (in which it outlines the standards it expects of regulated firms) stipulates that firms must “take reasonable care to establish and maintain effective systems and controls… for countering the risk that the firm might be used to further financial crime.” The onus is, therefore, on firms’ senior management to be proactive in taking responsibility for identifying and assessing fraud risk. Considerations must be made towards the adequacy of existing controls, ensuring that, if necessary, appropriate additional controls are put in place.
How financial firms choose to do so is up to them; however, there are tried and tested examples of good practice within the industry. A first starting point in building an integrated approach to fraud risk management is developing a set of fraud policies and standards. The FSA notes that within the retail banking and insurance sector, it is common practice for firms to have some type of Fraud Policy Statement, which “details the firm’s clear commitment to preventing and detecting fraud, and sets out, in broad terms, fraud definitions, responsibilities (for example between the centre and the business units), internal reporting procedures and investigating processes.”1
On a tactical level, good management relies on senior management understanding exactly what is going on within the organisation, across every department. For example, a decision to monitor financial transactions from every department in the company on a daily or weekly basis will provide a clear view of what is going on in the organisation and ensure suspect transactions can be detected and queried in a timely fashion.
Unfortunately, in practice, only 9% of organisations implement this kind of monitoring of financial transactions, with 57% conducting quarterly cycles and 34% monitoring monthly.2
Yet to look quarterly or annually is flawed: not only does it leave a bulk of work to be carried out at the end of the cycle, any fraud that has occurred within the previous period of time will not be uncovered until the audit is completed, therefore reducing the chance of recovery. In the case of incorrect or fraudulent payments, the chance of total recovery dwindles to between 50-60% once a payment has been made.3
Organisations need to move quickly if they are to stop internal fraud in its tracks. A process of continuous controls monitoring enables organisations to continuously test the integrity of transactions by automatically monitoring the effectiveness of internal controls and embedding audit best practices within key business processes. This delivers senior management timely notification of anomalies and control breaches, so managers can rapidly identify and address control issues before there is any opportunity for fraud to take place.
When an organisation adopts continuous monitoring, it achieves complete visibility of all financial transactions across its business. The system highlights potential control point failures to give managers an accurate picture of corporate risk.
Identifying such control gaps and weaknesses minimises the potential for fraud by providing assurance of the integrity of transactions underlying financial reporting. Human intuition and guesswork is not enough with insider fraud at an all-time high in financial institutions. Technology provides continuous control and reassurance, and delivers advanced analytics to identify suspicious activity, errors, segregation of duties issues, and exceptions that may be hidden within high volumes of transactions.
While fraud is a serious issue, it is not always malicious intent that causes financial loss. Duplicate invoices sound innocuous, but the cost to the business can be significant. Invoices might be paid twice due to incorrect logging in the system, whether a result of using different spellings for a vendor, a new address or incorrectly inputting information.
A system of continuous monitoring can identify similar invoices before payments are made, thereby reducing errors without manager intervention. Business process owners receive timely notification of control breaches, can quickly review quantified exposure of business risk, and drill down to specific exceptions and transactions to resolve potential problems before they escalate. As a result, organisations can better assure compliance, contain costs and minimise losses.
Fraud – and the management of fraud – requires investment from organisations: not just in technology but also people, processes and education. But there are other benefits to fraud management, beyond the financial advantage of minimising lost revenue to crime or human error. For instance, it can reduce the cost and administrative burden of regulatory compliance, and streamline management through the creation of more tightly controlled internal processes.
With the Association of Certified Fraud Examiners reporting last year that 5% of turnover is lost every year to fraud, it is no surprise that today’s financial services firms are keen to implement both tighter strategies and new technologies that reduce revenue leakage. Now with the world’s financial regulators showing a vested interest in cracking down on poor fraud management practices, the need to demonstrate strong internal controls, processes and procedures isn’t just a financially motivated decision; it’s a corporate necessity for regulatory compliance.
1Firms’ High-Level Management of Fraud Risk, FSA.
2State of the internal audit profession study: Continuous auditing gains momentum, PricewaterhouseCoopers, 2006.
3Paystream Advisors.