Implementing robust fraud risk management strategies is not only essential for protecting an organisation’s bottom line but also for upholding its ethical integrity and sustaining long-term success.

Building a culture of fraud reporting is crucial.  By fostering an environment where employees feel safe and empowered to report suspicious activities, organisations can identify and address fraud early, protecting their interests and stakeholders.

In this publication, the InConsult team explore the essential steps in creating a culture of fraud reporting within an organisation to help combat such unethical behaviour.

Establish a Clear Code of Ethics and Conduct

A robust and transparent code of ethics and conduct serves as the foundation for fostering integrity within an organisation. This code should clearly outline the expectations for ethical behaviour, including zero tolerance for fraud, bribery, corruption, and other dishonest practices. It should also emphasize the importance of reporting any violations or suspicions without fear of retaliation.

The Code of Ethics and Conduct should be provided to all employees during onboarding.  It should be reviewed and signed as acknowledgement.  Elements of the organisations Code of Ethics and Conduct should be included in induction training and reinforced periodically at least annually by leaders and executives. Regular communication sets the tone for the entire organisation.

Lead by Example

Culture is usually top-down and not bottom-up, so creating a culture of fraud reporting starts at the top.  Leaders must “walk the talk” and demonstrate a real commitment to fraud prevention.  They must explain to employees that fraud is morally wrong and it will not be tolerated.  Leaders and executives must:

• actively encourage employees to report incidents and do so themselves,
• lead by example and consistently adhere to the organisation’s ethical standards, and
• demonstrate integrity in decision-making and day-to-day behaviours.

Establish Clear Boundaries, Policies and Procedures

Guided by the governing body or board, leaders and executives need to provide clear and transparent fraud and corruption prevention policies as well as clear reporting guidelines and procedures that include the expectations, responsibilities and appropriate channels for reporting fraud incidents.

Ensure such policies are communicated to all employees and stakeholders and easily accessible to employees and external service providers/public.

Consider using the AS 8001:2021 Fraud & Corruption Control standard as a guide to establish the foundations of your fraud and corruption prevention framework, including reporting. AS 8001:2021 is very comprehensive and covers all elements of fraud and corruption, including reporting.

Key aspects of the framework should be modified for local laws that are specific to each country the organisation operates in.  Also, whilst many fraud risks are homogenous, some fraud risks that can be specific to an industry.

Communicate the Importance of Fraud Reporting

Regular communication about the significance of fraud reporting is essential.

Organisations should conduct workshops, training sessions, and awareness campaigns to educate employees about the potential consequences of fraud, the reporting process, and the protection provided to whistleblowers. Employees need to understand that their actions play a crucial role in safeguarding the organisation’s financial and reputational well-being.

Anonymous Fraud Reporting Channels

Many employees are reluctant to report fraud due to fear of retaliation or reprisals from colleagues or superiors. Providing anonymous reporting channels for whistleblowers, such as hotlines or dedicated email accounts, can address these concerns. Anonymity empowers employees to come forward without the fear of their identity being revealed.

Whistleblowers play an important role in identifying and calling out misconduct and harm to consumers and the community.  Research by the Association of Certified Fraud Examiners (ACFE) found that 46% of all frauds were uncovered by whistleblowers i.e. anonymous reporting channels, while only 3% were detected by law enforcement.

Protect Whistleblowers

Ensuring the protection of whistleblowers is paramount in creating a culture of fraud reporting. Implementing strict policies against retaliation and taking measures to safeguard the identity of the reporter will encourage more individuals to step forward with crucial information. Whistleblower protection laws may vary by jurisdiction, so organisations should be compliant with the relevant legislation.

In Australia, the Corporations Act 2001 (Corporations Act) gives certain people legal rights and protections as whistleblowers to encourage them to come forward with their concerns and protect them when they do.

Company officers, company auditors, and other senior people within companies have obligations under the Corporations Act if they receive a report from a whistleblower.

Both the ACFE and the Organisation for Economic Co-operation and Development (OECD) recognise the important role of whistleblowers and whistleblower protection in the detection of fraud, bribery and corruption.

Foster Trust and Open Communication

Organisations must build trust with their employees to encourage honest and open communication. Creating an environment where employees feel comfortable discussing their concerns or suspicions with supervisors or designated compliance officers is essential. Trust can be built through transparency, responsiveness, and consistent support for ethical behaviour.

Implement a Comprehensive Fraud Reporting Process

A well-defined and comprehensive fraud reporting process simplifies the reporting procedure for employees, suppliers and the public. This process should specify the types of fraudulent activities that should be reported, the channels for reporting, and the steps that will be taken to investigate and address reported incidents. Regularly updating employees on the status of reported cases ensures confidence in the system.

Conduct Regular Audits and Fraud Monitoring

Frequent internal audits and monitoring mechanisms can help identify potential fraudulent activities proactively. Audits provide an opportunity to assess the effectiveness of the fraud reporting culture and ensure that the organisation is adhering to its code of ethics.

AS 8001:2021 Fraud & Corruption Control standard requires an organisation implement procedures aimed at assessing the effectiveness of internal controls that are specifically designed or intended to mitigate fraud and corruption risks.  Examples of pressure tests include desktop review of case studies, process walk-throughs and data analysis.

Takeaways

Creating a culture of fraud reporting is an ongoing effort that requires commitment and dedication from an organisation’s leadership and employees. By fostering transparency, trust, and open communication, organisations can build a robust framework that encourages employees to report fraud without hesitation. Emphasizing the importance of ethics and providing effective reporting channels and protection for whistleblowers can significantly contribute to detecting and preventing fraudulent activities, safeguarding the organisation’s reputation and financial health in the long run.

How we can help

InConsult is committed to helping organisations better understand the benefits and value of fraud and corruption control.  We have extensive experience in fraud and corruption prevention, cyber security, investigations, crisis management, internal auditing, risk management, probity, business continuity, climate risk management and pandemic planning.

Can we help? Find out more about our fraud and corruption prevention services.  If you would like to know more, contact us to discuss your needs.

#fraud #corruption #control #FCCS #fraudcorruption #as8001 #whistleblowing

The first release of AS 8001 was in 2003 after a spate of corporate collapses that included Enron, WorldCom, One.Tel and HIH in the early 2000’s.  AS 8001 was updated again in 2008, right in the middle of the Global Financial Crisis.  But a lot has happened since then, especially around information technology, and the 2021 refresh of AS 8001 reflects some of these major changes.

Why is AS 8001 so important?

Whilst many standards are not legally binding unless they are specifically included in legislation, they are considered better practice guides.

AS 8001 is a very good standard.  It’s very popular and has a strong following.  This means it is widely used as a reference point by many organisations in the public and private sector to help set the foundations of their fraud and corruption policy and framework.  It is also currently the backbone of other better practice fraud and corruption prevention guidelines.  There are many instances where regulators and government agencies use standards like AS 8001 as a reference point to guide and encourage organisations to adopt them.  For example:

• the Audit Office of New South Wales’ Fraud Control Improvement Kit closely aligns to AS 8001:2008; and
• the Australian Prudential Regulation Authority (APRA) makes reference to AS 8001:2008 in prudential practice guide SPG 223 – Fraud Risk Management.

As many organisations have adopted AS 8001:2008 for fraud & corruption control, they are likely to migrate and adopt the new 2021 edition.  Therefore it is important every organisation reviews the new Standard and makes changes to their policies, plans, systems and processes to realign with the new AS 8001:2021.

A word of warning, the changes are far from ‘cosmetic’ and will require a well planned and executed approach.  You will need to involve more stakeholders to realign to the 2021 edition.  Lets look closely at some of these major changes.

AS8001 objectives

So what does the Standard aim to achieve?  The objective of the Standard is to “…provide minimum requirements and additional guidance for organisations wishing to develop, implement and maintain an effective fraud and corruption control system (FCCS) through initiatives aimed at —

• preventing fraud and corruption;
• detecting fraud and corruption; and
• responding to fraud and corruption events that have already occurred.”

Clearly, the Standard aims to guide organisations to establish and maintain the minimum requirements for an effective fraud and corruption control system.  Organisations can and should go over and above when the exposure to fraud and corruption risks are greater.  For example, whilst Crown Resorts had many risk, governance and fraud control measures in place, it is clear now that they could have done more to recognise and manage the money laundering risks in their business.

Implications: Don’t assume that compliance or adoption of a standard like AS 8001 will solve all your problems.  The fraud and corruption control system must be aligned to the level and nature of risks in your organisation.

1. More definitions and updated definitions for ‘fraud’ and ’corruption’

The first change to note is the introduction of Fraud and Corruption Control System (FCCS) in place of a Fraud and Corruption Control Plan.   This recognises the fact that fraud and corruption control works within a broader and often integrated system…not just in a policy or plan.

Secondly, the Standard introduces the term ‘minimum requirements’ by using the word “shall” instead of “should” about 90 times in the new Standard.  The word “shall” was not used in the 2008 edition.

The new Standard has doubled the number of definitions – close to 20 new definitions. Also, the definitions of fraud and corruption have been broadened to include conduct that may not be necessarily be illegal or a breach of the criminal law, but can still have negative consequences to the organisation.

Implications: When updating your fraud and corruption control system documentation, ensure you cover the entire fraud and corruption control ‘system’ in your framework and use ‘shall’ in more areas. Also ensure your definitions are in line with the new Standard.

2. More focus on the foundations

The 2008 version of the Standard started with 4 pages on “Planning and Resourcing” before moving onto Prevention – Detection – Response.  In comparison, the new standard strengthens the foundations of the fraud and corruption control system with 13  pages of guidance to help set the foundations.  It also introduces the Governing Body and appointment of an Information Security Management System’ (ISMS) professional.

Implications: When updating your fraud and corruption control system documentation, ensure your foundations are in line with the new Standard.  With 13 pages of new guidance, this will be important. Also, there are new roles and responsibilities that will require more consultation with stakeholders and integration into day-to-day fraud and corruption control processes and governance practices.

3. The governing body

The new Standard introduces the ‘Governing body’ and brings in the Board as a new line as distinct from ‘Top management’. This closely aligns with the Institute of Internal Auditors’ Three Lines Model and ISO’s ‘oversight body’.

• The Governing Body has ‘ultimate responsibility and authority’ for the organisations activities, governance and policies.
• Top management should manage the fraud and corruption risks and have an understanding of their role in combatting fraud and corruption risk and ensure they are in a position to understand the organisations risks so they can inform the Board.

Implications: When updating your fraud and corruption control system documentation, ensure you clearly define the roles of the Governing Body and Top Management in understanding and managing the risks of fraud and corruption. You may also need to enhance your reports to the Audit and Risk Committee to provide regular updates.

4. Compliance with other standards

The revised Standard introduces the concept of ‘normative references’, meaning that some other standards issued by the International Organization for Standardization (ISO), International Electrotechnical Commission (IEC), Standards Australia (SA), Auditing and Assurance Standards Board (AASB) and National Institute of Standards and Technology (NIST) must also be complied with in order to fully comply with AS 8001:2021.   The normative references in the new Standard include:

1. AS 4811, Employment screening
2. AS ISO 31000, Risk management — Guidelines
3. AS ISO 37001, Anti-bribery management systems — Requirements with guidance for use
4. AS ISO/IEC 27001, Information technology — Security techniques — Information security management systems — Requirements
5. ISO/IEC 27037, Information technology — Security techniques — Guidelines for identification, collection, acquisition and preservation of digital evidence
6. ISO/IEC 27041, Information technology — Security techniques – Guidance on assuring suitability and adequacy of event investigative method
7. ISO/IEC 27042, Information technology — Security techniques – Guidelines for the analysis and interpretation of digital evidence
8. ISO/IEC 27043, Information technology — Security techniques – Incident investigation principles and processes
9. ASA 240 The Auditor’s Responsibility Relating to Fraud in An Audit of a Financial Report issued by the Auditing And Assurance Standards Board
10. NIST SP 800-61 Revision 2, Computer Security Incident Handling Guide

Implications: We see this as a major challenge for small to medium organisations to fully comply with the new AS 8001:2021. Organisations should still pursue alignment with the new Standard and the normative references but recognise not all areas may be fully compliant. Recognise the standard provides an opportunity for continuous improvement and keep making small and large improvements over several years. 

5. Information security

With increasing dependency on information technology, external vendors and growing importance of cyber security, most of the normative references directly relate to information security and computer security incident handling. This is a major upgrade to the new Standard.

In addition, the new Standard now includes updated guidance in relation to preventing, detecting and responding to external “cyber-born” attacks. The definition of ‘attack’ is broad and includes any “attempt to destroy, expose, alter, disable, steal or gain unauthorised access to or make unauthorised use of an asset”.  The Standard also:

• requires appointing an Information Security Management System’ (ISMS) professional,
• requires organisations to now plan in preventing, detecting and responding to external ‘cyber-born’ attacks,
• provides guidance in relation to the capture and analysis of digital evidence, and
• introduces the concept of Digital Evidence First Response.

Implications: There are significant and complex information security processes and practices required to fully comply to the ISO/IEC 27000 series of standards that will be a challenge for many organisations.  We expect organisations to consider information security as part of their fraud and corruption control system documentation, but not always fully comply.  When updating your fraud and corruption control system documentation, ensure you include information and reference to plans and processes in your organisation designed to protect information assets, enhance information security and prevent, detect and respond to cyber attacks.  

6. Harmonise fraud and corruption with Anti-Bribery Management Systems

AS ISO 37001, Anti-bribery management systems is also a normative reference i.e. organisations must once again comply with AS ISO 37001 to comply with AS 8001:2021.  The new Standard also defines bribery as a form of corruption, introduces the term “business associate”  and requires appropriate risk-based screening and management of business associates.

Implications: Guidance in respect to anti-bribery is more comprehensive in the new Standard. When updating your fraud and corruption control system documentation, ensure there is alignment between your anti-bribery practices, the new Standard and AS ISO 37001.

7. Whistleblowing

Research by the Association of Certified Fraud Examiners (ACFE) found that 46% of all frauds were uncovered by whistleblowers, while only 3% were detected by law enforcement. Both the ACFE and the Organisation for Economic Co-operation and Development (OECD) recognise the important role of whistleblowers and whistleblower protection in the detection of fraud, bribery and corruption.

For the private sector, Australian Securities and Investments Commission (ASIC) requires public companies, large proprietary companies, and corporate trustees of APRA-regulated superannuation entities to have a whistleblower policy from 1 January 2020. In the public sector, there has been whistleblowing legislation in place for many years.  For example, in NSW, there is the Independent Commission Against Corruption Act 1988 (“the ICAC Act”) and the Public Interest Disclosures Act 1994 (“the Public Interest Diclosures Act”).

The new Standard includes better guidance in relation to whistleblower protection and misconduct reporting channels to help align to the proposed new Standard ISO 37002: 2021 Whistleblowing management systems — Guidelines.

Implications: When updating your fraud and corruption control system documentation, ensure there is alignment between your whistleblowing policies, regulatory requirements and the new Standard.

8. Pressure testing fraud and corruption internal controls

The new Standard requires an organisation implement procedures aimed at assessing the effectiveness of internal controls that are specifically designed or intended to mitigate fraud and corruption risks.  Examples of pressure tests include desktop review of case studies, process walk-throughs and data analysis.

Implications: When updating your fraud and corruption control system documentation, ensure you include information about the scope and types of pressure tests to be applied as well as the appropriate governance arrangements and responsibilities.

9. Notifying impacted third-parties about fraud and corruption

The new Standard requires an organisation to consider the impact of a fraud and corruption event on third-parties.  Third-parties include customers, clients, Government services, law enforcement, community, environment, industry and national security.

Implications: When updating your fraud and corruption control system documentation, ensure there is a notification process for impacted third-parties when responding.

10. Disruption of fraud and corruption

The Standard also recognises the fact that an investigation may not always uncover all the perpetrators or obtain enough evidence for police, regulators or prosecution. But ‘disruption’ of the activity is recognised as an adequate response because they help ensure such activities don’t continue.

Implications: When updating your fraud and corruption control system documentation, ensure disruption is included as part of the response.  Disruption activities can include increase checking and monitoring, improving exception reporting and increasing audit activity.

Takeaways

A cut and paste review and update is not enough: The revised AS 8001:2021 is a welcome change.  It will require organisations to look closely at their entire fraud and corruption control system and update many components to re-align to the 2021 edition.  A simple document edit to find “2008” and, do a cut, copy and replace with “2021” is not going to cut it….excuse the pun!

A comprehensive review is required: This presents an opportunity for each organisation to conduct a comprehensive, end-to-end review of their current fraud and corruption control system and several other supporting systems such as information security, whistleblowing, third-parties, business associates, anti-bribery, and risk management to identify shortfalls in policies, plans, responsibilities, processes and practices across the fraud and corruption control ecosystem.

The review will take time and consume resources: As the revised AS 8001:2021 spreads its tentacles into other areas through the normative reference, the refresh will take time and require input from several stakeholders – from the Governing body down.

Expect gaps between different frameworks:  The revised AS 8001:2021 edition will mean that other better practice toolkits recommended by regulators and government agencies that previously relied on the 2008 edition will need to be updated…and this may take many months or perhaps years.

How we can help

InConsult is committed to helping organisations better understand the benefits and value of fraud and corruption control.  We have extensive experience in fraud and corruption prevention, cyber security, investigations, crisis management, internal auditing, risk management, probity, business continuity, climate risk management and pandemic planning.

Can we help? Find out more about our fraud and corruption prevention services.  If you would like to know more, contact us to discuss your needs.

#fraud #corruption #control #FCCS #fraudcorruption #as8001

Fraud and corruption are alive and well

In 2007, the NSW Audit Office estimated the potential fraud risk at $2.6B or 2-5% of turnover.

In May 2010, an Independent Commission Against Corruption (ICAC) report concluded that local councils are highly vulnerable to corruption yet did not use adequate risk controls such as audits.

12 months later, ICAC found that a council’s Community Services Manager solicited a payment of $10,000 from a supplier for his own benefit.

In June 2011, ICAC found that a council employee, corruptly exercised his official functions in favour of various business owners within the council area in return for money, gifts, free meals and free visits to massage parlours.

In October 2011, ICAC held a public inquiry to examine an alleged $1.5m fraud concerning councils. Between 2006 and 2008, a NSW council paid invoices for safety mesh totalling 444.55 kilometres, enough to line the Great Western Highway between Bathurst and Sydney both ways…the problem was that none of the safety mesh was delivered and the invoices were false, part of a corrupt scheme whereby the council was ripped off to the tune of $757,000.

At present, ICAC is investigating allegations that between September 2009 and February 2010, a councillor accepted a cash payment from a developer to secure assistance to expedite approval for a development application lodged for a restaurant/karaoke bar.

Elements of an effective fraud and corruption management program

An effective fraud and corruption management program requires five elements working together in harmony to be effective.

1. Fraud Prevention Policies that set the tone of expected behaviour for councillors, staff, suppliers and the community are the foundation of a good fraud management program. Examples include Code of Conduct, Public Interest Disclosure/ Whistle-blower Policy, Complaints/ Grievance Procedures, Gifts and Benefits Policy and Statement of Business Ethics. In line with best practice, a formal Fraud and Corruption Strategy should be developed to reinforce council’s position.

2. Communication and Training is essential for ensuring all people are aware of the various policies, structures and responsibilities so council’s position is clear. Regular communication, well written job descriptions and fraud awareness training is required.

Good policies are necessary elements, but alone, they’re far from sufficient.

According to the Association of Fraud Examiners, an effective internal audit function, surprise audits, fraud awareness training and whistle-blower hotlines will reduce median fraud losses by half.

3. Fraud Risk Assessments are designed to identify specific fraud risks, their causes and assess level of risk.

In these workshops, participants are proactively thinking like fraudsters and developing scenarios to perpetrate the fraud asking how can the controls be over-ridden?

4. Fraud Control involves designing and implementing specific fraud risk controls i.e. internal controls that prevent, detect and correct fraud risks.

The best organisations monitor and record all incidents of fraud (minor and major) and formally report statistics to the Risk and Audit Committees.

Examples of fraud and corruption performance indicators include:

• Staff education is tested and X% of staff understand their rights and responsibilities in relation to fraud.
• Timeframes for implementation of strategies/controls are met.
• Ongoing testing of controls shows that they are effective in preventing fraud.
• Allegations are dealt with within agreed timeframes.
• Investigations are undertaken in line with standards, including timeframes.
• Results of investigations and remedies are disseminated to act as a deterrent.

5. Fraud Response Plan establishes clear escalation lines, investigation protocols, external reporting measures and remedies. Remedies sought may include:

• Recovery action
• Transfer to another area
• Loss of privileges
• Greater scrutiny/increased controls

The Fraud Triangle

One of the most popular hypotheses to explain why people commit fraud is the “Fraud Triangle” developed by criminologist Donald R. Cressey in the 1950s.

The Fraud Triangle consists of three conditions generally present when fraud occurs: Opportunity, Pressure, and Rationalisation.

Over the years, input from forensic experts and academics consistently shows that evaluation of information about fraud is enhanced when auditors and fraud experts evaluate fraud in the context of these three conditions.

Opportunity is the ability to commit fraud. Because fraudsters don’t wish to be caught, they must firstly believe that their activities will not be detected.

Opportunity is created by weak internal controls, poor management oversight, and/or through use of one’s position and authority. Failure to establish adequate systems and procedures to detect fraudulent activity increases the opportunities for fraud and corruption.

Opportunity is the element over which councils have the most control. Limiting opportunities for fraud is one way every council can reduce it.  Red flags that can increase opportunity include:

• Management environment – lax style and attitude.
• Unsupported transactions.
• Undue secrecy.
• Employee relationships.
• Related party arrangements.
• Too much trust placed on too few employees.
• Weak security checks for employees.

Pressure, motivation or incentive is another piece of the fraud triangle.  It is the pressure or a “need” felt by the person who commits fraud. Red flags that could motivate individuals to commit fraud include:

• Addictions to gambling and/or drugs.
• Desire for material goods but not the means to get them.
• Living beyond ones means.
• Significant losses from speculative investments.
• High personal debt.
• High medical bills or debts.

Rationalisation involves a person convincing themselves that the fraud is OK.  This is the hardest fraud condition to understand and determine.

Common rationalisations include:

• Just “borrowing” money and will pay it back one day.
• Making up for being underpaid.
• Replacing a bonus that was deserved but not received.
• Council doesn’t need the money or won’t miss the assets.

Remember, fraudsters are generally trusted, respected, normal people.

In a recent PwC Global Economic Survey, it was found that 71% of public sector fraud was committed due to pressure, 15% because more opportunities were present and 12% could rationalise the fraud.

For people who are generally dishonest, it is often easier to rationalize a fraud. For people with higher moral standards, it is probably not so easy…and it is the combination of policies, procedures, training and communication that help raise peoples’ moral standards and set expectations.

A fraud and corruption management framework should be ongoing, dynamic and reflect council’s environment and activities otherwise it will be seen as useless.  In a recent ICAC hearing it was reported that a council’s fraud check was like “using a rubber band to drive a Mercedes”…i.e. totally inadequate!

• The protections available to whistleblowers, including the protections available under the legislation;
• The person/organisations to whom protected disclosures may be made, and how they can be made;
• How the company will support whistleblowers and protect them from detriment;
• How the company will investigate protected disclosures;
• How the company will ensure fair treatment of employees of the company who are mentioned in protected disclosures, or to whom such disclosures relate;
• How the policy is to be made available to officers and employees of the company; and
• Any other matters prescribed by the regulations.

Compliance challenges

The changes will present some challenges, these include:

1. Appointing internal resources who receive and investigate protected disclosures;
2. Employers need to evaluate if current processes for handling such information are appropriate or need enhancing;
3. Additional training / awareness/ communications will be required for all staff to ensure they know how to identify a whistleblower report and what to do if they receive one;
4. Employers need to ‘have-ready’ the services of an appropriate conduct investigator should the need arises; and
5. Organisations operating in multiple jurisdictions should consider whether a ‘one size fits all’ approach is appropriate, given there are differences between the whistleblower protection laws in various jurisdictions.

Consequences of contravention

Failure to comply with the new requirements is a criminal offence and significant penalties for corporations (and individuals) rising from contraventions of the legislation.

The Bottom line

Public companies and large proprietary companies will need to comply to the new Whistleblower Bill , but all employers are encouraged to have a compliant Whistleblower Policy in place and consider some form of training to all staff.