Waste, Fraud and Abuse (Gwen Moritz Editor’s Note)

Here’s a little mantra I’d like for you to commit to memory: Wherever there are human beings, there will be waste, fraud and abuse.

It’s true in government, as the infamous GIF trial in Fayetteville has underscored. It’s true in private business. It’s true in nonprofits — even churches. It’s true in families.

As I mentioned in this space a couple of weeks ago, the Association of Certified Fraud Examiners recently released its 10th biennial study on occupational fraud and abuse. The “Report to the Nations,” which is available for free download, has been exceptionally helpful to me in understanding different types of workplace fraud, who commits them, what kind of organizations are victimized, how they are detected and red flags for managers to watch for.

By analyzing 2,690 cases of occupational fraud investigated between January 2016 and October 2017, the ACFE again estimated that organizations lose 5 percent of the annual revenue to fraud. But that’s just an average and just an estimate.

The individual case studies reveal that the losses for small businesses (with fewer than 100 employees) tend to be larger than losses among larger companies. Much larger. For small companies, the median loss was $200,000, almost twice the median loss for larger companies. This seems to be because larger companies are more likely to have robust fraud prevention and detection processes. (Scams that are caught sooner cost less — that’s one of the most obvious findings in the report.)

The ACFE breaks occupational fraud into three categories: asset misappropriation, corruption and financial statement fraud. Asset misappropriation — various forms of embezzlement — is by far the most common category. But it is also the least costly per incident — median loss of $114,000 in the cases studied — in part because it is the kind of fraud most likely to be perpetrated by low-level employees.

Corruption — conflicts of interest, bribery, illegal gratuities, extortion and the like — requires the fraudster to be in a position of some influence. The median loss from this category was $250,000. Comparatively few people in any organization are in a position to cook the books, but when they do, it is the most costly kind of occupational fraud (median cost of $800,000).

The Report to the Nations slices and dices occupational fraud in a bunch of ways: by type of organization, by tenure of the perpetrator, by department, gender, education, criminal background and employment history. But since fraud can happen anywhere there are human beings, I think the most useful parts are the findings on prevention and detection.

Eighty-five percent of workplace fraudsters display at least one of 18 “behavioral red flags,” according to the ACFE, and the most common are the ones you would probably expect: living beyond their means or financial difficulties. Other common red flags include an unusually close association with a vendor or customer and unwillingness to share duties.

But I was surprised by this finding: Poor job performance is not much of a red flag. In only 14 percent of cases did the perpetrator have a poor performance evaluation before or during their frauds.

The red flags, of course, were often identified after the fraud had been detected, and the most expensive controls are not nearly the most effective at detecting fraud. Internal audits turned up only 15 percent of the cases studied, and management reviews only 13 percent. IT controls detected fraud only 1 percent of the cases — no more often than spontaneous confessions.

By far the most common means of detection was from a tip — fully 40 percent of the cases reviewed. And among organizations that had a hotline for reporting fraud and abuse, the percentage of cases uncovered that way rose to 46 percent.

One of the most effective controls is a simple code of conduct. Fully 80 percent of the victim organizations in the study had codes of conduct, so they clearly don’t prevent workplace fraud. (Wherever there are human beings, remember.) But the median loss at companies with codes of conduct was less than half that at companies with no code of conduct.

Expectations can clearly impact outcomes.

Email Gwen Moritz, editor of Arkansas Business, at GMoritz@ABPG.com and follow her on Twitter at @gwenmoritz.