1. a Fraud Prevention & Detection GFOA St. Louis
July 11, 2018
© 2018 All Rights Reserved 1
Brown Smith Wallace LLP

2. 1 2 3 Agenda The Need for Fraud Prevention & Detection
How to Establish a Fraud Risk Management Program
Key Roles and Responsibilities 1 2 3
© 2018 All Rights Reserved 2
Brown Smith Wallace LLP

3. The Need for Fraud Prevention & Detection
© 2018 All Rights Reserved 3
Brown Smith Wallace LLP

4. Recent Cases
Director of Finance embezzled over $4 million through wire transfers to personal bank accounts.
Director of Procurement reaped nearly $1.3 million from services that were never provided by her company by falsifying records.
Technology Director defrauded company of more than $1 million by accepting kickbacks from vendors.
Principal stole $5,000 from student activity account.
Payroll Clerk kept former employees on payroll. Changes direct deposit to her bank account and processes false time records.
© 2018 All Rights Reserved 4
Brown Smith Wallace LLP

5. What is Occupational Fraud?
Use of one’s occupation for personal enrichment through the deliberate misuse or application of the employing organization’s resources/assets.
Three general categories:
Asset misappropriation - Employee steals or misuses an organization’s resources.
Corruption - Employee’s use of influence in business transactions in a way that violates duty to the employer for the purpose of obtaining benefit for self or someone else.
Financial statement fraud - Intentional misstatement or omission of material information in the organization’s financial reports.
© 2018 All Rights Reserved 5
Brown Smith Wallace LLP

6. 2018 ACFE Fraud Study – Key Findings
Estimated organizations lose 5% of annual revenue to fraud.
Asset misappropriation was most common, occurring in 89% of cases with median loss of $114,000.
Financial statement fraud was least common, but most costly with median loss of $800,000.
Fraud lasted a median of 16 months.
Occupational frauds are most likely to be detected by tips (40%).
Fraud perpetrators often display warning signs.
Organizations that implanted anti-fraud controls realized lower fraud losses.
Data monitoring/analysis and surprise audits were correlated with the largest reduction in fraud loss.
SOURCE: ACFE Report to the Nations: 2018 Global Study on Occupational Fraud and Abuse
© 2018 All Rights Reserved 6
Brown Smith Wallace LLP

7. How is Fraud Detected? © 2018 All Rights Reserved 7
SOURCE: ACFE Report to the Nations: 2018 Global Study on Occupational Fraud and Abuse
© 2018 All Rights Reserved 7
Brown Smith Wallace LLP

8. Who Reports Occupational Fraud
Employees – 53%
Customer – 21%
Anonymous – 14%
Vendor – 8%
SOURCE: ACFE Report to the Nations: 2018 Global Study on Occupational Fraud and Abuse
© 2018 All Rights Reserved 8
Brown Smith Wallace LLP

9. ACFE Fraud Tree © 2018 All Rights Reserved 9 Brown Smith Wallace LLP
SOURCE: ACFE Report to the Nations: 2018 Global Study on Occupational Fraud and Abuse
© 2018 All Rights Reserved 9
Brown Smith Wallace LLP

10. Most Common Schemes in Government
Corruption
Theft of Cash
Noncash
Billing
Expense Reimbursements
Check Tampering
Payroll
Financial Statement Fraud
SOURCE: ACFE Report to the Nations: 2018 Global Study on Occupational Fraud and Abuse
© 2018 All Rights Reserved 10
Brown Smith Wallace LLP

11. Fraud Triangle
© 2018 All Rights Reserved 11
Brown Smith Wallace LLP

12. Red Flags – Top 10 Living beyond their means – 41%
Financial difficulties – 29%
Unusually close association with vendor/customer – 20%
Control issues/unwillingness to share duties – 15%
No behavioral red flags – 15%
Divorce/Family problems – 14%
Wheeler-Dealer attitude – 13%
Irritability, suspiciousness, or defensiveness – 12%
Addiction problems – 10%
Complained about inadequate pay – 9%
SOURCE: ACFE Report to the Nations: 2018 Global Study on Occupational Fraud and Abuse
© 2018 All Rights Reserved 12
Brown Smith Wallace LLP

13. 10 Controls to Reduce Fraud Losses
Code of Conduct
Proactive Data Monitoring/Analysis
Surprise Audits
Audit of internal controls
Management review
Hotline
Anti-fraud Policy
Internal Audit Department
Management Certification of Financial Statements
Fraud Training
SOURCE: ACFE Report to the Nations: 2018 Global Study on Occupational Fraud and Abuse
© 2018 All Rights Reserved 13
Brown Smith Wallace LLP

14. How to Establish a Fraud Risk Management Program
© 2018 All Rights Reserved 14
Brown Smith Wallace LLP

15. COSO Fraud Risk Management Guide
Issued in September 2016.
Supportive of and consistent with the 2013 Internal Control – Integrated Framework.
Best practice guidance for organizations to follow in addressing Principle 8 related to fraud risk assessment.
Contains guidance on establishing a Fraud Risk Management Program:
Establishing fraud risk governance policies.
Performing a fraud risk assessment.
Designing and deploying fraud preventative and detective control activities.
Conducting investigations.
Monitoring and evaluating the fraud risk management program.
© 2018 All Rights Reserved 15
Brown Smith Wallace LLP

16. COSO Framework & Fraud Risk Management
© 2018 All Rights Reserved 16
Brown Smith Wallace LLP

17. Fraud Risk Management Program
Fraud Risk Governance
Fraud Risk Assessment
Fraud Control Activity
Fraud Investigation and Corrective Action
Fraud Risk Management Monitoring Activities
© 2018 All Rights Reserved 17
Brown Smith Wallace LLP

18. Principle #1 – Fraud Risk Governance
COSO COMPONENT
FRAUD RISK MANAGEMENT PRINCIPLE
Control Environment
Establish and communicate a Fraud Risk Management Program that demonstrates the expectations of the board of directors and senior management and their commitment to high integrity and ethical values regarding managing fraud risk.
© 2018 All Rights Reserved 18
Brown Smith Wallace LLP

19. Principle #1 – Fraud Risk Governance
Make an organizational commitment to fraud risk management.
Support fraud risk governance.
Establish a comprehensive fraud risk management policy.
Establish fraud risk governance roles and responsibilities throughout the organization.
Document the fraud risk management program.
Communicate fraud risk management at all organizational levels.
© 2018 All Rights Reserved 19
Brown Smith Wallace LLP

20. Principle #2 – Fraud Risk Assessment
COSO COMPONENT
FRAUD RISK MANAGEMENT PRINCIPLE
Risk Assessment
Perform a comprehensive fraud risk assessment to identify specific fraud schemes and risks, assess their likelihood and significance, evaluate existing fraud control activities, and implement actions to mitigate residual fraud risk.
© 2018 All Rights Reserved 20
Brown Smith Wallace LLP

21. Principle #2 – Fraud Risk Assessment
Involve appropriate levels of management.
Include entity, subsidiary, division, operating unit, and functional levels.
Analyze internal and external factors.
Consider various types of fraud.
Specifically consider the risk of management override of controls.
Estimate the likelihood and significance of risks identified.
© 2018 All Rights Reserved 21
Brown Smith Wallace LLP

22. Principle #2 – Fraud Risk Assessment
Assess personnel/departments involved and the fraud triangle.
Identify existing fraud control activities and assess their effectiveness.
Determine how to respond to risks.
Use data analytic techniques for fraud risk assessment and responses.
Perform periodic reassessments and assess changes to fraud risk.
Document the risk assessment.
© 2018 All Rights Reserved 22
Brown Smith Wallace LLP

23. Principle #3 – Fraud Prevention & Detection
COSO COMPONENT
FRAUD RISK MANAGEMENT PRINCIPLE
Control Activities
Select, develop, and deploy preventative and detective fraud control activities to mitigate the risk of fraud events occurring or not being detected in a timely manner.
© 2018 All Rights Reserved 23
Brown Smith Wallace LLP

24. Principle #3 – Fraud Prevention & Detection
Promote fraud deterrence through preventative and detective control activities.
Integrate with the fraud risk assessment.
Consider organization-specific factors and relevant business processes.
Consider the application of control activities to different levels of the organization.
© 2018 All Rights Reserved 24
Brown Smith Wallace LLP

25. Principle #3 – Fraud Prevention & Detection
Utilize a combination of fraud control activities.
Preventative controls
Detective controls
Human Resource Procedures (e.g. Background investigations, segregation of duties, Whistleblower System, etc.)
Consider management override of controls.
Use proactive data analytic procedures.
Deploy control activities through policies and procedures.
© 2018 All Rights Reserved 25
Brown Smith Wallace LLP

26. Principle #4 – Fraud Investigation & Corrective Action
COSO COMPONENT
FRAUD RISK MANAGEMENT PRINCIPLE
Information & Communication
Establish a communication process to obtain information about potential fraud and deploy a coordinated approach to investigation and corrective action to address fraud appropriately and in a timely manner.
© 2018 All Rights Reserved 26
Brown Smith Wallace LLP

27. Principle #4 – Fraud Investigation & Corrective Action
Establish fraud investigation and response protocols.
Conduct investigations.
Communicate investigation results.
Take corrective action.
Evaluate investigation performance.
© 2018 All Rights Reserved 27
Brown Smith Wallace LLP

28. Principle #5 – Fraud Risk Management Monitoring
COSO COMPONENT
FRAUD RISK MANAGEMENT PRINCIPLE
Monitoring Activities
Select, develop, and perform ongoing evaluations to ascertain whether each of the five principles of fraud risk management is present and functioning and communicate Fraud Risk Management Program deficiencies in a timely manner to parties responsible for taking corrective action, including senior management and the board of directors.
© 2018 All Rights Reserved 28
Brown Smith Wallace LLP

29. Principle #5 – Fraud Risk Management Monitoring
Consider a mix of ongoing and separate evaluations.
Consider factors for setting scope and frequency of evaluations.
Establish appropriate measurement criteria.
Consider known fraud schemes and new fraud cases.
Evaluate, communicate, and remediate deficiencies.
© 2018 All Rights Reserved 29
Brown Smith Wallace LLP

30. Key Roles and Responsibilities
© 2018 All Rights Reserved 30
Brown Smith Wallace LLP

31. Board and Audit Committee
Oversees the Fraud Risk Management Program.
Defines expectations about integrity, ethical values, transparency, and accountability.
Utilizes internal audit and external audit to monitor fraud risks.
Questions senior management.
Utilizes resources as necessary to investigate any issues.
© 2018 All Rights Reserved 31
Brown Smith Wallace LLP

32. Board and Audit Committee
Identifies and promptly acts in situations where senior management overrides controls or deviates from expected standards of conduct.
Verifies corrective actions taken by senior management.
Maintains an open and unrestricted communication channel with all organization personnel.
© 2018 All Rights Reserved 32
Brown Smith Wallace LLP

33. Senior Management
Overall responsibility for designing, implementing and conducting the Fraud Risk Management Program.
Creates the organization culture by setting the tone at the top.
Maintains oversight and control over fraud risks.
Guides the development and performance of fraud control activities at the entity level.
Delegates the design, implementation, conduct and assessment of fraud control activities at different levels of the organization.
© 2018 All Rights Reserved 33
Brown Smith Wallace LLP

34. Senior Management
Communicates expectations regarding the organization’s risk tolerance and fraud information reporting expectations.
Evaluates fraud risk assessments and impact on the effectiveness of the Fraud Risk Management Program.
Regularly reports to the Board on the effectiveness of the Fraud Risk Management Program.
© 2018 All Rights Reserved 34
Brown Smith Wallace LLP

35. Operational/Functional Management
Designs, implements and conducts the Fraud Risk Management Program.
Contributes to the organization culture by setting the tone at the top.
Assesses fraud risk and impact on the effectiveness of the operation/function.
Maintains oversight and control over fraud risks facing the operation/function.
Develops and performs fraud control activities at the operational/functional level.
© 2018 All Rights Reserved 35
Brown Smith Wallace LLP

36. Operational/Functional Management
Communicates expectations regarding the organization’s risk tolerance and fraud information reporting expectations to employees.
Trains employees on fraud risks, fraud identification and reporting.
Regularly reports to Senior Management on the effectiveness of the Fraud Risk Management Program.
© 2018 All Rights Reserved 36
Brown Smith Wallace LLP

37. Employees
Understanding effects of fraud and importance of preventing fraud.
Understanding organization’s ethical culture.
Understanding role within the fraud risk management framework.
Understanding importance of the fraud risk management program.
Reading and upholding the fraud risk management policy.
© 2018 All Rights Reserved 37
Brown Smith Wallace LLP

38. Employees
As required, designing and implementing control activities to prevent and detect fraud as well as participating in monitoring activities.
Understanding fraud indicators and risk factors.
Understanding how and to whom to report possible instances of fraud.
© 2018 All Rights Reserved 38
Brown Smith Wallace LLP

39. Internal Audit Ensures the Audit Committee is made aware of:
Instances of fraud
Results of investigations into suspected fraud
Corrective action plans
Monitoring plans
Considers the use of data analytics as a means of performing proactive monitoring of high risk areas.
Assesses the ongoing governance framework by verifying that all employees have attended required ethics training.
Examines trends related to violations and fraud investigations.
© 2018 All Rights Reserved 39
Brown Smith Wallace LLP

40. Internal Audit
Provides reasonable assurance that fraud prevention and detection controls are sufficient and functioning as designed.
Focus on potential fraud in all audits.
Identify potential fraud schemes.
© 2018 All Rights Reserved 40
Brown Smith Wallace LLP

41. External Audit
Plan and perform the financial statement audit to obtain reasonable assurance about whether the financial statements are free of material misstatement due to fraud.
If determined that there is evidence that fraud may exist or has occurred, the auditor’s professional standards require that the matter be brought to the attention of senior management and/or the audit committee.
© 2018 All Rights Reserved 41
Brown Smith Wallace LLP

42. Recap and Open Discussion
Ron Steinkamp, CPA, CIA, CFE, CRMA, CGMA, CCA, CCP
Partner, Advisory Services
Brown Smith Wallace LLP
(Direct)
© 2018 All Rights Reserved 42
Brown Smith Wallace LLP