By Irv Schwarzbaum, Director, J.H. Cohn’s Business Investigation Services Group
Business fraud is in the headlines almost every day, and though it’s commonly associated with the big corporate names, it is critical to note that without proper controls and oversight in place, it can impact any organization, of any size.
When fraud is discovered, the first question often asked is, how? It is a triangle of conditions—perceived opportunity, rationalization, and pressure
1 —that creates the perfect storm for financial foul play. Fraud can be committed in a variety of ways, including:
- Abuses of trust committed by people in organizations for personal profit;
- Business crimes committed by organizations to inflate share value, e.g., false earnings reports; and
- Confidence games designed to cheat clients, e.g., investment Ponzi schemes.
Specifically, fraud most often comes in the form of asset misappropriation, which includes check forgery; theft of money, inventory, or services; and payroll fraud. Bribery, corruption, kickbacks, shell company schemes, manipulating contracts, or substituting inferior goods, all of which can be considered illegal acts, are also fraudulent activities. Finally, while the least common, financial statement fraud—which includes manipulating the figures for the individual’s or entity’s financial advantage—is usually the most expensive type of fraud.
A company’s vulnerability to fraud often comes down to its leadership, and to the fear and greed of a company’s executives. Companies have earnings pressures brought on by stockholders, venture capitalists, financial analysts, and other stakeholders. Add to that complications arising from liquidity pressures and executives who “want the deal done yesterday,” and fraud may be seen by some as an option. And while statistically, CEOs and company presidents are not the most likely people within a company to commit a fraud, the fact that compensation and bonus are often tied to company performance may cause them to overlook or ignore fraud indicators. In fact, when individuals in upper management—those individuals who earn in excess of $200,000 per year—are guilty of fraud, they are likely to have embezzled $50 million2.
Taking these behaviors into account, there are many areas and ways for fraud to be committed, including:
- Revenue recognition;
- Expense capitalization;
- Inventory manipulation;
- Overstatement of receivables;
- Fictitious vendors;
- Unsubstantiated valuations of assets; and
- Intra- and inter-company activities.
The typical U.S. organization loses seven percent of its annual revenues to fraudulent activity2 . If this percentage was applied to the 2008 U.S. gross domestic product of $14.196 trillion, it could be projected that roughly $994 billion was lost to fraud in 20083. This staggering statistic, along with laws and regulations that include the revised U.S. Federal Sentencing Guidelines of 2009, the U.S. Foreign Corrupt Practices Act of 1977, COSO – ICFR Guidance for Smaller Companies, and the Sarbanes-Oxley Act, make a strong case for having an effective system in place to prevent and detect fraud.
Good Internal Controls: The Five Key Components
Good internal controls have proven to be critical as a means to help prevent theft and fraud. The five essential components of an effective internal control system, according to the Committee of Sponsoring Organization of Treadway Commission (COSO), are as follows:
- Control Environment, which sets the tone for the organization and influences the control consciousness of its people;
- Risk Assessment, or the identification and analysis of relevant risks to achieving objectives;
- Information and Communication, defined as systems or processes that support the identification, capture, and exchange of information in a form and time frame that enable people to carry out their responsibilities;
- Control Activities, or the policies and procedures that help ensure management directives are carried out; and
- Monitoring, the processes used to assess the quality of internal control performance over time.
In the absence of these factors, virtually any organization, regardless of size and scope, may find itself in jeopardy. Compliance must be made a priority from the top down. In today’s post-Sarbanes-Oxley environment, it’s critical that controls are in place, to not only prevent fraud, but protect a company from the actions that regulators may take against it if the business fails to make financial transparency and compliance a part of its day-to-day operations and long-range plans. Paying attention to the vulnerabilities outlined above will help companies (and their inside and/or outside counsel) deal with fraud issues and, more importantly, help to prevent it from happening in the first place.
Next Steps: The Role of the Forensic Examiner
When fraud is suspected in an organization, most business owners are unsure what to do first. Of course, general or outside counsel should immediately be contacted. Simultaneously, contact the company’s internal auditors and discuss putting additional controls in place to prevent any suspected fraud from reoccurring. Specifically, once fraud is suspected, make changes to existing processes to try to prevent the fraud from continuing. While it’s important not to accuse anyone at this time, procedural changes can help. For instance, if asset misappropriation is suspected, add another approver to the sign-off process for expenses. Companies should note that any interim actions do not replace the need for strong internal controls.
In some cases, counsel may also recommend coordinating efforts with an independent forensic/fraud examiner, who will document and investigate the suspected fraud and ultimately issue a report that answers such questions as:
- How did the fraud occur?
- Who perpetrated it?
- Was it a sole individual or was there collusion among employees or third parties?
- What was the dollar impact of the fraud?
- Is the fraud still occurring?
- Is this fraud/theft occurring in other areas of the company?
If it is found that fraud is indeed occurring, the resulting investigation report can be used in a number of ways. In cases of sizeable frauds that have a large public impact, the report is often used as a basis to pursue legal action. Other times, the reports are given to the State Attorney General. In lower-profile situations, or in situations in which the company does not wish to raise awareness of the perpetuated fraud, the report may be used as a basis for employee termination.
Fraud can happen in any company, of any size, at any time. By staying vigilant to the warning signs and establishing good, solid internal controls, companies can avoid this crippling problem and concentrate instead on increasing revenues and long-term growth.
Irv Schwarzbaum, CPA, CIRA, CFE, CFF, CICA, is a director in J.H. Cohn’s Business Investigation Services Group. He can be reached at 866-688-0700 or ischwarzbaum@jhcohn.com.
[1] Statement on Auditing Standards No. 99 “Consideration of Fraud in a Financial Statement Audit”
[2] Figure derived from research conducted by the Association of Certified Fraud Examiners as reported in the association’s “Report to the Nation on Occupational Fraud and Abuse.” 2008
[3] Based on U.S. Department of Commerce first quarter 2008 GDP estimates.