{"id":379,"date":"2018-10-15T22:21:17","date_gmt":"2018-10-15T22:21:17","guid":{"rendered":"https:\/\/centropycoaching.com\/?p=379"},"modified":"2021-02-06T13:59:15","modified_gmt":"2021-02-06T21:59:15","slug":"fraud-detection-prevention","status":"publish","type":"post","link":"https:\/\/centropycoaching.com\/fraud-detection-prevention\/","title":{"rendered":"Certified Fraud Examiner: External and Internal Fraud, Detection and Prevention and Work Place Culture [part 1 of 3]"},"content":{"rendered":"\n

Pete Miller:<\/strong> Fraud was always something that interested me. It\u2019s a fascinating part of accounting and finance-how people gain the opportunity to commit fraud, what motivates them, and how they get caught.  As a CPA, I\u2019m required to take 40 hours of continuing education credits every year to maintain my license.  I thought if I was going to be sitting in a classroom for eight hours, it had better be interesting. Earlier I had the chance to listen to a few convicted felons who served jail time for fraud. I knew courses on fraud would be interesting so I just fed that interest of mine for a few years.<\/p>\n\n\n\n

About 11 years ago, I decided to become a Certified Fraud Examiner (CFE). It was one of the most fascinating academic experiences I\u2019ve ever had. The program is numbers and finance-oriented but the human experience is built into it, too. You learn why people do what they do, the psychology behind it, the facial expressions people make if they\u2019re lying, all that kind of stuff. The history and legal side of fraud are part of the curriculum.  I passed that exam, and then built a business plan for how to develop a practice and pitched that to my partners at Clark Nuber. They said \u201cIt\u2019s a great idea. Let\u2019s go for it.\u201d And we just set on a course to build the practice and did it slowly and methodically. We\u2019ve since built up a nice resume of projects. In the last five or six years, we\u2019ve done more to announce ourselves to the marketplace and we\u2019ve had quite a pick-up in our practice. Unfortunately, fraud is a growth history.<\/p>\n\n\n\n

Lauren: External versus internal fraud, what\u2019s the difference? And what trends are you seeing?<\/p>\n\n\n\n

My specialty, really, is occupational fraud. And my focus is internal fraud: somebody using their job to commit fraud. That\u2019s primarily what I\u2019ve studied primarily for the last 10 or 12 years. But tangentially, external fraud has picked up quite a bit. It\u2019s something I keep my eye on as well. External fraud is somebody from the outside, whether<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

it\u2019s an organization or individual, who is penetrating the company somehow to get access to the company\u2019s money. We\u2019ve seen a lot of pick up around something called \u201cspear-phishing\u201d and just \u201cphishing\u201d in general. Ten years ago, phishing was more of a broad attempt, where perpetrators, bad guys, would send a mass e-mail with a link that you would click and that would give them access to some of your information or download something onto your computer.<\/p>\n\n\n\n

Phishing is broad in nature. It isn\u2019t targeted. Spear-phishing is narrow \u2013 it\u2019s focusing on something, somebody specific.<\/p>\n\n\n\n

So, these bad guys have done their research.<\/strong><\/p>\n\n\n\n

They\u2019ve done their research and they are sophisticated. What we find is they somehow get into a company\u2019s system. They\u2019ll study, for example, the CEO\u2019s emails. They look at his or her emails and figure out what their tone sounds like and what their emails typically contain. They figure out a pattern and style so that, at some point, they can draft an email that reads like it\u2019s from the CEO. And this email, in the CEO\u2019s name, will say something like, \u201cPlease send a wire transfer to XYZ. You need to send it right away\u201d sent to someone in the company with the authority to initiate a wire transfer. The thieves\u2019 first email typically starts out with a modest dollar transfer amount, and if they get a bite, the next email will be for something larger.<\/p>\n\n\n\n

They probe a little bit.<\/strong><\/p>\n\n\n\n

They probe a little bit and dip a toe in the water, and then they really go for it. We have seen, in the last year or two, about half a dozen of clients bitten by this type of scheme and some of them have fallen for it. Many more that number will get something like that type of probing email in their inbox.<\/p>\n\n\n\n

Are these spear-phishing companies U.S. companies or are they foreign?<\/strong><\/p>\n\n\n\n

It\u2019s a mix. From what I\u2019ve read, a lot of it is from outside of the United States. But there\u2019s certainly enough of it going on around here. They have a target, they look for vulnerabilities, and they find their way in.<\/p>\n\n\n\n

Speaking of targets, are larger, publicly-held companies like Microsoft and Amazon more vulnerable to this type of fraud? Or are the smaller privately-owned companies more at risk?<\/strong><\/p>\n\n\n\n

What I\u2019ve seen is that the incidences of fraud have slowed or perhaps even leveled off in publicly-held companies since Sarbanes-Oxley requirements ramped up their rigor of internal control.<\/p>\n\n\n\n

But for the smaller, privately-held companies, chances are they have a smaller accounting and finance staff. They don\u2019t have the ability to hire people for internal control\u2019s sake. There are fewer internal controls and more opportunity for something like this to happen. For the folks that fell for the spear-phishing example I talked about earlier, that was the problem. There was an absence in internal controls that allowed that to happen. In one instance, the same person could both initiate and authorize a wire transfer.<\/p>\n\n\n\n

But despite their smaller size and a lack of internal control, these companies could still have significant balances to go after.<\/strong><\/p>\n\n\n\n

That\u2019s right. They could have balances that would make it worth the perpetrators effort.<\/p>\n\n\n\n

With external fraud on the rise, smaller companies may be a bit more vulnerable for several reasons.<\/strong><\/p>\n\n\n\n

External fraud and internal fraud continue to be on the rise. But people commit internal fraud in a limited amount of methods. Schemes like fake vender schemes or ghost employee schemes or things of that nature tend to be still active and prevalent. Expense reimbursement fraud, despite technologies and software products in place that manage that process for a company internally and insert a layer of internal control, is on the rise.<\/p>\n\n\n\n

These are employees who are filing fake expenses on their expense reports?<\/strong><\/p>\n\n\n\n

Yes, or filing the same expense multiple times. The perpetrator, an employee in this instance, might have a business meal and have an itemized receipt, a signed credit card receipt, and a credit card statement. They might file all three of those at different periods of time.<\/p>\n\n\n\n

And nobody\u2019s noticing the same date? That\u2019s interesting! Tell me about the fake vendor approach.<\/strong><\/p>\n\n\n\n

The vendor management process and the kind of vendor master file that\u2019s built into accounting programs don\u2019t necessarily have a whole lot of rigor around them.  Somebody can set up a fake vendor inside of the accounting process that\u2019s very similar to a legitimate vendor. It could be ABC-LLC instead of ABC Inc. One of those is a legitimate company, the other isn\u2019t. When the check comes through the system, it looks like a familiar vendor to the person that\u2019s authorized it, and it makes its way through to payment to a bank account controlled by the perpetrator.<\/p>\n\n\n\n

I once ran a CEO roundtable that invited a convicted thief in to speak to the group.  That\u2019s how he did it. He set up fake vendors. An accomplice on the outside cashed the checks. This went on for years. The business had no actively-involved owners. The thief was the general manager. One day the owner showed up and noticed a stack of invoices. The fake invoice was on the top of the pile. The owner glanced at it and said, \u201cGosh, who\u2019s this company?\u201d And then the whole scam just started to unravel.<\/strong><\/p>\n\n\n\n

They peeled back the onion!<\/p>\n\n\n\n

Yup, they peeled back the onion.  He shared how he got into the position to commit the fraud. As he made his way up through the ranks of the company, he found other people stealing company product. He caught them doing it and then he made a big deal about catching them. It established his \u201cgood guy\u201d credentials in everybody\u2019s mind. This man also spoke of his feeling of resentment at the time. He felt like while he created the company\u2019s growth, he did not get his deserved recognition or pay. At the time, he was bitter and angry. He said, \u201cHere I was growing this company, not an owner, and I felt like it was my due. The owner wasn\u2019t paying attention and so I thought, why not?\u201d He went under the radar for far too long.<\/strong><\/p>\n\n\n\n

Not a surprise, necessarily, given that \u201ctone at the top\u201d is such a huge deal in these cases. It\u2019s not necessarily a surprise that somebody might not know what this thief was doing.<\/p>\n\n\n\n

Talk about \u201ctone at the top.\u201d What does that mean to you?<\/strong><\/p>\n\n\n\n

It\u2019s just paramount. I like to compare good tone and bad tone and think about the consequences in that context. Good tone at the top is a leader who leads by example, who is transparent and forthright with regulators, key vendors and employees. He or she goes out of his or her way to make sure they do the right thing. \u201cDo the right thing\u201d is part of their business philosophy and culture. They will go out and hire lieutenants that are like-minded and share that philosophy and then likewise, those lieutenants will hire people for their teams who are going to be like-minded. It just creates a good culture from the top down.<\/p>\n\n\n\n

Contrast that with a company with a bad tone at the top. In that case, you have a leader who likes to cut corners any way he can, who is less than forthright with key vendors or regulators and talks about people behind their back. He is not transparent about things, and is very secretive. It creates a different tone. This leader is going to hire lieutenants that are a little dodgy or sneaky and then likewise down on the line. That bad tone of the top is riper for fraud than the good tone of the top.<\/p>\n\n\n\n

It\u2019s not just a matter of training and skills in terms of anti-fraud and policy? There\u2019s that part of prevention and detection and then there are also the cultural norms, values, rules, attitude, how the leader acts, how the managers act, and the type of person they\u2019re hiring.<\/strong><\/p>\n\n\n\n

Every internal control system has its weaknesses and vulnerabilities. Both the good tone and the bad tone examples have vulnerabilities in their internal control structure. But the people who are playing the parts in the good tone example would be less likely to rationalize their way into committing a fraud. The folks on the bad side, more likely. They would say, \u2018I\u2019m not valued enough,\u201d or \u201cJoe down the hall makes way more than I do and I work so much more here.\u201d All sorts of things that could enter people\u2019s minds that they could rationalize their way through it. The right tone at the top can help put a stop into the rationalization piece which is a key part of any fraud that\u2019s going to be there.<\/p>\n\n\n\n

Every organization has issues that need discussing. Companies with healthy cultures tackle these things head-on so that there aren\u2019t a lot of \u201celephants in the room.\u201d  But if you don\u2019t end up having what are often hard conversations that lead to resolution of these issues, people get resentful. It just creates this bad energy that\u2019s going to go somewhere. It will attract wrong people and, sadly, repel the good people that might want to come to your organization, or, worse, get rid of the good people in your company. Or the goods ones stay but become what I call them \u2018zombie employees.\u2019 They were once good, but now they\u2019re empty, angry shells.<\/strong><\/p>\n\n\n\n

They\u2019re empty, angry people. Absolutely. And the rumors milling around go out of control in an environment like that. Even if the truth isn\u2019t that bad, it can spin into something that is because of all the back-channel talk.<\/p>\n\n\n\n

The leader who\u2019s willing to take feedback on their own behavior by their team members sets an incredible tone of accountability and honesty. Then it\u2019s all about holding each other accountable and doing the best job with the best people for the job. It\u2019s not about going after people and exacting revenge.<\/strong><\/p>\n\n\n\n

It\u2019s a whole different thing. The good tone folks can still have a \u201ctrust but verify\u201d approach to management. And with a good tone to the top, it just becomes something that — it\u2019s not that they\u2019re checking up on me or they don\u2019t think that I\u2019m doing my job or they don\u2019t trust me — it\u2019s just a part of the process.<\/p>\n\n\n\n

This is just how we do things.<\/strong><\/p>\n\n\n\n

The employee that\u2019s having their work reviewed is thankful that that happens for a few reasons. One, the process finds any mistakes so that I can do things correctly next time. But secondly, I like the idea that my boss reviews my work so that if anything bad does happen, it\u2019s not necessarily resting all on me. Other participants who are part of the problem are identified and that supports me as well.<\/p>\n\n\n\n

Next up: How one business owner stopped a thief before losing thousands of dollars.<\/p>\n","protected":false},"excerpt":{"rendered":"

A must read series [Part 1 of 3 ]: a Certified Fraud Examiner shares with Lauren Owen all about external and internal fraud prevention and detection for your business.<\/p>\n","protected":false},"author":2,"featured_media":384,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""}},"footnotes":""},"categories":[8],"tags":[],"_links":{"self":[{"href":"https:\/\/centropycoaching.com\/wp-json\/wp\/v2\/posts\/379"}],"collection":[{"href":"https:\/\/centropycoaching.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/centropycoaching.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/centropycoaching.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/centropycoaching.com\/wp-json\/wp\/v2\/comments?post=379"}],"version-history":[{"count":0,"href":"https:\/\/centropycoaching.com\/wp-json\/wp\/v2\/posts\/379\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/centropycoaching.com\/wp-json\/wp\/v2\/media\/384"}],"wp:attachment":[{"href":"https:\/\/centropycoaching.com\/wp-json\/wp\/v2\/media?parent=379"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/centropycoaching.com\/wp-json\/wp\/v2\/categories?post=379"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/centropycoaching.com\/wp-json\/wp\/v2\/tags?post=379"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}