Approaches to Ethical Problem Solving

Ethical Principles

Ethics, Trust, and Responsibility

Although the preceding principles provide a framework for ethical decision-making, alternative decisions may result in variations of good and bad consequences. Therefore, the task is a difficult one and the choice must be left to individuals. It is impossible to provide a blueprint for every situation with laws, rules, and exceptions. The bottom line is that civilized societies are grounded in trust with underlying values and implicit codes of conduct that guide behavior. The decision process is difficult, and the range of possible outcomes suggests that the right choice is not always obvious. Though doing the right thing can be difficult, as members of society, we have a responsibility to reach for that goal every day, without exception.

Ethics and Values as Drivers of Personal Behavior

To be successful, professionals in the specialized field of fraud examination and forensic accounting must have an ethical framework for appropriate decision-making. Although the preceding material has suggested approaches to solving ethical problems, the fraud and forensic professional needs to strive for the highest degree of ethics and moral conduct. This perspective requires that the individual think about possible difficult situations and develop his or her own framework for decision-making, to the extent possible, in advance. Next, the individual needs to make the commitment required to follow his or her ethical values in all cases except those that have extreme consequences.

In practice, antifraud and forensic professionals can start with rules, laws, and Kantian imperatives to identify ethical situations (ethical dilemmas) that require more in-depth evaluation. Once the ethical problems have been identified, the evaluation process begins and professionals can use an appropriate framework for ethical problem solving, including using personal rules and processes for decision-making. The antifraud and forensic professional is not alone, and should solicit the input and opinions of other practicing professionals. In some cases, guidance and advice from professional organizations and associations can assist the individual in making the best decision. After careful consideration of the alternative outcomes and a decision is made, the professional can then move forward to implement that decision. This process will help to ensure that the anticipated goals are realized while also attempting to mitigate any negative consequences.

Students who are considering entering the field of fraud examination and forensic accounting must consider decisions that they made in the past. For example, some may have past criminal convictions that might exclude them from entry into the profession. While most offenses may not prevent a prospective student from exploring his or her options, he or she should be aware that honesty is the best policy. Get caught in a lie, and your career could be over. Tell the truth and explain the facts and circumstances of a less than perfect past, and at least the individual (applicant) will have created a foundation of trust to repair the damage caused by prior conduct.

Professional Conduct

Professions are set apart by five characteristics⁶:

1. A specialized body of knowledge
2. Admission governed by standards and qualifications
3. Recognition and acceptance by society (a characteristic that inflicts social responsibility back on the profession)
4. Standards of conduct for dealing with the public, other professionals, and clients
5. An organizational body devoted to the advancement and responsibilities of the profession

These characteristics impose responsibility on both the profession and the individual professional. Normally, such responsibilities are captured in the profession’s code of conduct. For example, Certified Fraud Examiners (CFE), as designated by the Association of Certified Fraud Examiners (ACFE), have the following code of ethics⁷:

1. A Certified Fraud Examiner shall at all times demonstrate a commitment to professionalism and diligence in the performance of his or her duties.
2. A Certified Fraud Examiner shall not engage in any illegal or unethical conduct, or any activity which would constitute a conflict of interest. (Note that the Certified Fraud Examiner has no exception for cases where they may be unaware that a particular law exists.)
3. A Certified Fraud Examiner shall, at all times, exhibit the highest level of integrity in the performance of all professional assignments, and will accept only assignments for which there is reasonable expectation that the assignment will be completed with professional competence.
4. A Certified Fraud Examiner will comply with lawful orders of the courts, and will testify to matters truthfully and without bias or prejudice.
5. A Certified Fraud Examiner, in conducting examinations, will obtain evidence or other documentation to establish a reasonable basis for any opinion rendered. No opinion shall be expressed regarding the guilt or innocence of any person or party.
6. A Certified Fraud Examiner shall not reveal any confidential information obtained during a professional engagement without proper authorization.
7. A Certified Fraud Examiner shall reveal all material matters discovered during the course of an examination, which, if omitted, could cause a distortion of the facts.
8. A Certified Fraud Examiner shall continually strive to increase the competence and effectiveness of professional services performed under his or her direction.

Forensic accounting professionals and the valuation community have professional bodies, such as the AICPA’s Forensic and Valuation Services (FVS) Section and the National Association of Certified Valuation Analysts (NACVA) that provide a vast array of resources, tools, and information for members and credential holders—CFF, ABV, CVA, etc.

Ethics at Client Entities: The Foundation for Fraud Prevention and Deterrence

Whereas the prior sections dealt with ethics at the individual and professional level, ethics are an important part of organizational behavior. In fact, ethics is the foundation for fraud deterrence and prevention both by individuals within an organization and by the organization itself.

Five-Step Approach to Compliance, Fraud Prevention, Deterrence, and Detection

1. Know the exposures (brainstorming, risk assessment, audit planning).
2. Translate exposure into likely symptoms.
3. Always be on the lookout for symptoms.
4. Build controls, audit procedures, and data-mining programs to look for symptoms (red flags).
5. Pursue symptoms to their logical conclusion and ground examination conclusions in the evidence (evidence-based decision-making).

The Perception of Detection

As noted in the meta-model in Figure 14-1, a would-be fraudster faced with the fraud triangle elements of perceived pressure, opportunity, and rationalization examine the necessary elements of fraud—the fraud act, the required concealment, and especially the conversion (the benefit to the fraudster). It’s likely that the perceived benefit drives much of the fraudster’s decision. However, between the potential fraudster and the actual commission of the fraud are organizational antifraud efforts to deter, detect, and prevent frauds. Presumably, some frauds do not occur because the would-be fraudster perceives the antifraud efforts to be effective and his or her chances of success—in terms of committing and concealing the scheme and realizing the benefit—are at risk because of organizational antifraud efforts.

Fraud deterrence goals and objectives are in line with those of the overall fraud risk management. The deterrence program should outline and explain the organization’s perspectives on fraud and, in broad strokes, outline the organization’s fraud risk program. Communications should also identify those fraud risks of high likelihood and impact. Given high-risk frauds, deterrence efforts also communicate to potential fraudsters that fraud prevention measures are in place.

One key aspect of effective deterrence is that the organization’s antifraud efforts need to be communicated. Without personnel awareness, deterrence will not be effective. As such, the organization can use a variety of mechanisms to make staff aware of the following:

• Whistleblower hotlines
• Compliance risk management processes and procedures in place
• Fraud risk management processes and procedures in place
• Types of fraud and misconduct to look for
• Awareness of symptoms (red flags) that might indicate others are misbehaving

In addition to effective communication, leadership behavior that is consistent with an ethical environment is important. More recently, compliance and antifraud professionals have emphasized that it’s more than just “tone at the top,” it’s the conduct of those at the top that is more effective in encouraging personnel at all levels to act appropriately—“actions speak louder than words.” In essence, the tone and actions of personnel at every level of the organization are critical to produce a culture of ethical behavior; it sets the standard for tolerance, or intolerance of bad behavior, and creates an environment where making the right decision is embedded in the culture of the organization. Managers in the middle of an organization take their cues from the leaders at the top and play a critical role in communicating and reinforcing the desired behavior. Middle management’s acceptance or resistance to living the corporate culture initiatives has been called “the mood in the middle.” An organization’s culture can easily be observed in the buzz of everyday hallway chats, day-to-day meetings, and in emails, and has come to be known as “the buzz at the bottom.” As Lou Gerstner, former IBM chairman once said, “Culture isn’t just one aspect of the game, it is the game.”¹²

According to a COSO study, “Fraudulent Financial Reporting: 1998–2007,” one of the critical findings was that the SEC named the CEO and/or CFO for some level of involvement in 89% of the financial statement fraud cases, up from 83% of cases in 1987–1997. Within two years of the completion of the SEC’s investigation, about 20% of CEOs and/or CFOs had been indicted, and more than 60% of those indicted were convicted. While the authors found relatively few differences in board of director characteristics between firms engaging in fraud and similar firms not engaging in fraud, 26% of the fraud firms changed auditors between the last clean financial statements and the last fraudulent financial statements, whereas only 12% of no-fraud firms switched auditors during that same time. About 60% of the fraud firms that changed auditors did so during the fraud period, while the remaining 40% changed in the fiscal period just before the fraud began.¹³

The board of directors, the audit committee, executives, and management are responsible for the corporate governance environment in an organization. The primary role of corporate governance is to protect investors, create long-term shareholder value, ensure investor confidence, and support strong and efficient capital markets.¹⁴ Most of the board’s work regarding governance is discharged through committees. To effectively carry out its primary functions, a committee must ensure its independence. A good corporate governance environment will set the “tone at the top” by creating a culture of honesty and integrity, with the leadership of the organization practicing what they preach. As the saying goes, “a fish rots from the head down,” and if corporate leadership doesn’t act in a responsible manner, it is doubtful that their subordinates will act differently.

Corporate leadership should also strive to create a positive work environment with efforts to increase employee morale, hire and promote employees who follow the company’s ethical guidelines, provide adequate compensation and professional development, and establish and monitor antifraud programs and controls. Effective corporate governance mechanisms include the following:

• An organizational code of conduct supported by an embedded culture of honesty and ethical behavior
• An independent and empowered board of directors
• An independent and empowered audit committee
• Organizational policies and reward systems that are consistent with espoused ethical values
• Confidential disclosure methods
• Effective legal and regulatory compliance and risk assessment

Responsibility for dealing with fraud risk resides with personnel at all levels of the organization, including leadership, line employees, staff, and internal and external auditors. Key players that are integral to fraud deterrence efforts include the following people:

• Board of directors
• Board of directors—audit committee
• Senior/executive organizational leadership
• Accounting personnel
• Human resources
• Business unit and operational personnel (line employees and staff)
• Legal and compliance
• Internal audit
• External consultants (if needed to fill gaps)

Board of Directors

The board of directors plays a critical role in compliance and deterrence. The board sets the tone at the top, the standard for organizational intolerance of bad behavior. Effective boards also monitor the actions of senior management, organizational performance, and key strategic issues. Some best practices for boards are as follows:

• A code of conduct specific to the board
• A code of conduct specific to senior management
• Emphasis on board independence
• Ownership and control of their agendas
• Information flow that ensures timely access to relevant data, analysis, and reports
• Access to multiple layers of management, line employees, and staff (as appropriate for important board-level issues)
• Monitoring to ensure effective whistleblower hotlines and reporting mechanisms
• Independent board nomination processes
• Independent board compensation processes
• Effective senior management team, ensuring that evaluations, performance measurement, compensation, and succession planning are in place and effective

Audit Committee

The audit committee is a board of directors’ committee. The audit committee assists the board of directors in fulfilling its corporate governance and oversight responsibilities, relative to an entity’s financial reporting, internal control system, risk management system, and internal and external audit functions. Audit committees also monitor litigation and regulatory compliance risks through interactions with organization lawyers and compliance leadership and through reports authored by the legal and compliance offices.

A critical role of the audit committee is to monitor the effectiveness of the internal control system, internal audit (if such a separate department exists), and external audit. Internal control includes the policies and practices used to control the operations, accounting, and regulatory compliance of the entity. In general, separation of duties—for those responsible for initiating, authorizing, recording, and safeguarding the organization’s assets—is a key internal control in any area of organization operations.

The audit committee is also integral to organizational risk management. It is responsible to identify and address risks that threaten the organization and its ability to achieve its strategic and tactical objectives. The audit committee fulfills its risk management responsibility by monitoring the organization’s effort to identify, prioritize, and respond to organizational risks.

To address the risk of fraud, the audit committee acts proactively. At least one member of the audit committee should have a financial background (e.g., accounting). The members of this committee typically meet more frequently than the board of directors and need to have an understanding of the risks associated with management override and collusion. The audit committee communicates to the board the status of any fraud allegations, communicates with the external auditor, and reviews the auditor’s plan with respect to fraud risks. It also provides oversight of management’s efforts to prevent, deter, and detect fraud and seeks the advice of legal counsel, as needed.

Organizational Leadership

The organization’s culture plays an important role in preventing, detecting, and deterring fraud. Like the board of directors, the organization’s executive leadership sets the tone at the top by acting ethically and following policies and procedures. The conduct of the leaders within an organization creates an environment that sets an example for others. The organization’s leadership is also responsible for the design and implementation of the fraud risk management program. The words and actions of organizational leadership need to communicate the following:

• Compliance is expected.
• Fraud is not tolerated.
• Fraudulent/unethical behavior is dealt with swiftly and decisively.
• Whistleblowers will not suffer retribution.

In addition, organizational leadership needs to implement effective internal controls, including documenting fraud risk management policies and procedures. Once in place, organizational leaders need to evaluate the effectiveness of controls by compiling information from various areas of the organization. Armed with this information, leadership needs to regularly report its efforts to the board of directors, including the following information:

• What actions have been taken to manage compliance and fraud risks
• The effectiveness of the fraud risk management program
• Any remedial steps that are needed for an effective fraud risk program
• Any actual frauds
• Any actual violations of laws or regulations

If external auditors discover fraud involving senior leadership and/or officers, the auditor should report such incidents to the audit committee/board of directors.

To be effective, fraud risk management needs to be assigned to a leader who is a senior member of management. The fraud risk management leader should do the following:

• Regularly evaluate the effectiveness of the antifraud program and its management
• Adjust the tools, techniques, controls, and other aspects of fraud risk management as required
• Report through the appropriate channels, details of any modification necessary or any technique that becomes ineffective
• Document and communicate adjustments to fraud risk management

Internal Auditors

The Institute of Internal Auditors (IIA) states that internal auditing is an (a) independent, (b) objective assurance, and (c) consulting activity designed to (a) add value and (b) improve an organization’s operations. Internal audit fulfills this assignment through a systematic, disciplined approach to the evaluation and improvement of

• Risk management
• Controls
• Governance processes

Related to fraud risk management, internal audit provides objective assurance that fraud controls are sufficiently designed and are functioning effectively. Further, internal audit can be integral in assessing the risk of management override and collusion. Optimally, members of this department have regular interactions with the organization’s fraud risk management personnel. Similar to external auditors, internal auditors are expected to exercise professional skepticism:

• A recognition that fraud, illegal acts, and unethical behavior may be present
• An attitude that includes a questioning mind and a critical assessment of audit evidence to carefully examine red flags
• A commitment to persuasive evidence (whether or not fraud or some other bad act is present)

Internal audit may be involved early in suspected fraud concerns and may lead fraud examinations. Even if fraud examinations are completed by others, internal audit may assist the remediation process by conducting root cause analysis, identify control improvements, monitor the reporting/whistleblower hotline, and provide ethics, compliance and antifraud training. An inherent assumption is that internal auditors working on compliance and antifraud issues have subject matter expertise—sufficient antifraud knowledge, skills, and competencies, including the following:

• Knowledge of fraud schemes
• Examination skills, tools, and techniques
• A general understanding of the legal environment surrounding allegations, the rights of individuals, and familiarity with other relevant legal considerations

Accounting Personnel

Accounting personnel are in a unique position to deter and prevent fraud. Accounting educational requirements typically include basic accounting, auditing, and systems courses that devote considerable time to internal controls. As such, in terms of closing down the fraud triangle role of “opportunity,” accountants, properly trained and motivated, are integral to effective compliance and antifraud efforts. They also ensure that the financial statements properly reflect, to the best of their ability, the economic performance and financial condition of the organization. The accounting department also contributes to tax compliance efforts, such as filing payroll and income tax forms with taxing authorities. Income tax filings usually include reconciliation between taxable income and financial income—very useful in most forensic accounting engagements. In general, the role of accounting personnel includes:

• Having an understanding of opportunity, fraud schemes, concealment, and conversion (the elements of fraud)
• Familiarity with red flags suggestive of noncompliance and fraud
• Ability to generate, review, and draw conclusions from analytical work, including big data and financial analyses across time and in comparison to competitors and the industry
• Understanding their critical role within the internal control framework, especially separation of duties
• Recognizing that many accounting processes and procedures are designed to reduce fraud and noncompliance risks
• Knowledge that failure to complete reconciliations of accounting records to those of independent third parties and other operating units in a timely manner may create an opportunity for fraud to occur and/or go undetected
• Understanding whistleblower roles, responsibilities, and protections
• Understanding requirements to act ethically and report suspicions or incidences of noncompliance and fraud
• Contributing to thorough and complete examinations

Human Resources

One of the keys to fraud deterrence is to prevent, to the extent possible, applicants who have a demonstrated track record of improper conduct, unethical behavior, or prior frauds to become employees. This requires proper personnel policies, through background checks and a complete set of reference checks. Upon entrance into the organization, compliance and antifraud training should be standard requirements for all employees at all levels. Such training should be tailored to the types of duties the employee will have and the associated risks. Periodic performance evaluations and compensation systems should be designed to reinforce ethical behavior in compliance with organizational policies, procedures, and best practices. Finally, all terminated employees should be required to complete an exit interview with a human resources representative, who is independent of the department in which the employee worked.

Anonymous Communications

The organization should have opportunities for employees, vendors, customers, and other stakeholders to report compliance issues. Reporting mechanisms should include an “open-door” policy where employees are encouraged to report to direct supervisors, where appropriate. In some situations, however, employees may need to report issues further up the chain of command, if their immediate supervisor is part of the problem. Employers should also provide reporting opportunities that are anonymous (e.g., whistleblower hotline). Best practices for reporting compliance issues, including suspected fraud, demonstrate the following characteristics:

• Perceived by employees and others as safe and include option for anonymous allegation reporting
• Available to employees, vendors, customers, and other stakeholders.
• Availability must be communicated and widely known.
• Open to any type of inappropriate behavior.
• Recipients of allegations must be trained to attempt to obtain a complete story and identify relevant evidence that addresses important examination elements of who, what, when, where, how, and possibly why.
• Recipients of allegations must take the allegations seriously and vet them thoroughly.
• Examination of allegations needs to protect the privacy and rights of the accused.
• Policies and conduct must ensure that no retaliation is taken against whistleblowers.

Line Employees and Staff

All organizational personnel contribute to effective compliance and antifraud programs. In general, line employees and staff play the following roles:

• Having a basic understanding of fraud
• Being aware of the red flags suggestive of noncompliance and fraud
• Understanding their specific role and responsibility within the internal control framework
• Recognizing that some job requirements are designed to reduce fraud and noncompliance risks
• Knowledge that failure to complete their assignments in a timely manner may create an opportunity for fraud to occur and/or go undetected
• Reading and understanding policies and procedures associated with their position
• Understanding whistleblower roles, responsibilities, and protections
• Agreeing to report suspicions or incidences of fraud
• Cooperating in examinations

Properly motivated and tasked line employees and staff help create a strong control environment.

Legal and Compliance

The role of legal and compliance is to ensure that the organization is conducting business to meet external requirements such as legal and regulatory guidelines and be in line with the organization’s internal ethical expectations and culture. Legal and compliance guidelines partially depend on the context in which a company operates such as local, state, national, and global jurisdictions as well as its industry. Written company policies and procedures outline compliance standards and expectations. Properly executed, compliance and legal also act to enhance the organization’s reputation while minimizing the risk of civil and criminal lawsuits. Compliance and legal personnel may also help educate organization personnel regarding important compliance, legal, regulatory, policy and procedure requirements, best practices to avoid compliance issues, and organizational expectations.

Fraud Risk Management and Compliance Program

An effective fraud risk management and compliance program is at the heart of fraud deterrence. According to the Fraud Risk Management Guide,¹⁵ first published as Managing the Risk of Fraud: A Practical Guide,¹⁶ such a program has ten key points of focus.

First, the organization and its leadership must demonstrate a commitment to compliance and an antifraud environment. This commitment starts with visible actions and words communicated by the board of directors and organizational leadership, including a code of conduct. Relevant documents are shared with employees, vendors, and customers.

Second, the program emphasizes awareness. Organizational leadership visibly conveys compliance and fraud risk management expectations and alerts organizational stakeholders to specific fraud and misconduct schemes. Compliance and fraud risk assessment efforts are visible through assessment, training, and communication efforts.

Third, organizational leaders and stakeholders are asked to acknowledge and affirm their commitment to compliance and effective antifraud efforts by reading, understanding, complying, and signing documentation. Personnel and stakeholders who refuse to participate face consequences.

Fourth, the organization expects conflict-of-interest disclosure when such situations arise. A conflict of interest involves “a situation in which a person is in a position to derive personal benefit from actions or decisions made in their official capacity.” Disclosure does not result in automated action. Rather, several outcomes are possible:

• Terminate the activity or leave the organization
• Recognize the conflict of interest, monitor it but take no other immediate action
• Impose certain constraints on activities associated with the conflict of interest
• Document and disclose conflicts of interest with legal counsel

Fifth, the organization systematically completes its compliance and fraud risk assessment on a recurring basis. The efforts to manage risks, including the involvement of appropriate personnel throughout the organization, consider relevant fraud schemes and scenarios and maps those to mitigating controls. The communication of the existence of the compliance and fraud risk assessment process may act as a deterrent. Research has suggested that brainstorming, properly deployed, can facilitate the identification of noncompliance and fraud risks. Upon completion, the assessment should be shared with the Board of Directors and Audit Committee. Other relevant attributes of effective noncompliance and fraud risk assessments are as follows:

• Considering concealment risks, in addition to possible schemes and violations
• Identifying relevant incentives and pressures that might be conducive to noncompliance and fraud
• Considering conversion—the magnitude of the benefit to the fraudster derived from their acts—and the corresponding damage to the organization
• Identifying the population of fraud risk, scaled to manageable and actionable levels
• Ensuring that personnel involved in compliance and antifraud efforts have the requisite knowledge of compliance, fraud schemes, and risk symptoms (red flags)

Sixth, the organization has reporting procedures (e.g., hotline) and whistleblower protection, zero tolerance for compliance violations, and the expectation that suspected compliance violations and suspected fraud will be reported immediately. Those reporting channels are clearly defined and communicated to employees, vendors, and customers. The protections afforded to individuals reporting suspected issues are also communicated to those in a position to act on it.

Seventh, the organization has a documented protocol for handling reported allegations and a review process. Personnel involved with the review or investigation of allegations understand the rules of evidence, the chain of custody, reporting mechanisms to those charged with governance, and the relevant regulatory requirements and legal issues.

Eight, the compliance and fraud risk management program includes remediation. Remediation includes the following:

• Efforts to collect restitution for losses
• Support for any legal actions: arbitration, mediation, criminal court, civil court
• A postmortem to identify control weaknesses that allowed the compliance violation or fraud
• Modification of operational processes, procedures, and internal controls to minimize the chances of a similar noncompliance or fraud recurring

Ninth, compliance and fraud risk management evaluation and improvement activities are designed to ensure high-quality programs. At the same time, stakeholders need to understand that compliance and fraud risk management does not mean that the organization has 100% noncompliance and fraud prevention, but rather, that there is still some risk of noncompliance and fraud.

Tenth, an iterative feedback loop to ensure continuous monitoring and improvement.

Fraud Action/Reaction AFTER Discovery

Once an allegation of noncompliance or a compliance violation is received or identified through detection efforts, the response needs to be systematic, prompt, examined by competent personnel, and confidential. Other considerations for the examination include the need to

• Preserve evidence
• Protect access to computerized information
• Have trained specialist(s)
• Consult with human resources
• Consult with legal counsel

As discussed in prior chapters, to properly examine allegations of noncompliance may require any or all of the following:

• Exploiting technology, such as results of continuous auditing, big data analytics, email and text searching/analysis
• Identifying hidden relationships among people, organizations, and events
• Identifying suspicious transactions
• Assessing the effectiveness of internal controls in the area of the allegation

The organization should have a tracking or case management system to monitor on-going allegations.

The goals of the reporting process are to improve loss recovery and minimize litigation and reputational damage. Reporting is based on monitoring of MEASURABLE criteria that might include the following metrics:

• Number of known noncompliance and fraud schemes committed against the organization
• Number and status of noncompliance and fraud allegations received by the organization that required investigation
• Number of noncompliance and fraud investigations resolved
• Number of employees who have/have not signed the corporate ethics statement
• Number of employees who have/have not completed ethics training sponsored by the organization
• Number of whistleblower allegations received via the organization’s hotline
• Number of allegations that have been raised by other means
• Number of messages supporting ethical behavior delivered to employees by executives
• Number of vendors who have/have not signed the organization’s ethical behavior requirements
• Benchmarks with global compliance and fraud surveys, including the type of noncompliance and fraud experienced and average losses associated with such acts
• Number of customers who have signed the organization’s ethical behavior requirements
• Number of fraud audits performed by internal auditors
• Results of employee or other stakeholder surveys concerning the integrity or culture of the organization
• Resources committed by the organization to compliance and antifraud activities
• Issue resolution time (average number of days to resolve an issue)
• Repeat incidents (number of current period incidents that are similar in nature to incidents in earlier periods)
• Value of losses recovered and estimate of future losses prevented

React to Early Warning Signs

The last aspect of a good fraud deterrence program requires that the organization react appropriately to symptoms of fraud, red flags, badges of fraud, and other early warning signals. Dr. Steve Albrecht references six types of anomalies that should be investigated at the earliest point of recognition: accounting anomalies, weak internal controls, analytical anomalies, lifestyle symptoms, behavior symptoms, and tips from potential informants. The following early warning signs are not compelling fraudulent indicators but are consistent with fraudulent behavior. Further, the listings are not meant to be exhaustive.

ACCOUNTING ANOMALIES

• Missing supporting documents
• Number and amount of reconciling items increasing
• Reconciling items without documentary support
• Reconciling items remain for more than one accounting cycle (generally appear on more than one reconciling)
• Excessive register voids and “no sale” transactions
• Excessive accounts receivable write-offs
• Excessive customer discounts or credits
• Same/similar vendor and employee address
• Altered documents
• Duplicate payments
• Missing second endorsement on checks
• Check out of sequence
• Vendor invoices out of sequence
• Sales invoices out of sequence
• Handwriting concerns
• Photocopied documents where originals are anticipated
• Errors with unexplained, unusual, unreasonable sources
• Journal entries without proper documentation
• Journal entries without proper approval
• Journal entries posted at unusual days of the week
• Journal entries posted at unusual times of the day
• Vendor complaints concerning payments
• Customer complaints concerning invoices, discounts, credits, postings to accounts receivable in a timely manner
• Unusual, frequent, or unaccounted for cash shortages
• Vendor invoices that lack details: quantities, prices, descriptions of goods and service purchased; addresses: phone numbers
• Vendor or customers that lack websites
• Vendors whose address is fictitious, a residence, storage facility
• Vendors whose payment usually states “hold for pick-up”
• Vendors with sequential invoice numbers suggesting only one or a limited number of clients
• Vendor invoices with differing payment addresses or instructions
• Employees that are being paid through payroll who no longer work for the organization
• Expense reimbursements without supporting documentation

INTERNAL CONTROL CONCERNS

• Reconciliations are not reviewed and formally approved
• Reconciliations not completed within thirty days of end of the month
• Lack of timely reconciliations of general ledger accounts to subledgers
• Lack of timely reconciliations to nonaccounting sources of data
• Lack of timely reconciliations to independent sources of data
• No periodic search for employee and vendor address matches
• No periodic search for duplicate payments (same invoice number, same invoice amount)
• No periodic search of missing second endorsement on checks
• No periodic search for journal entries without proper documentation
• No periodic search for journal entries without proper approval
• No periodic search for journal entries posted at unusual days of the week
• No periodic search for journal entries posted at unusual times of the day
• No periodic search for duplicate payments
• No periodic inventory of organization procurement/credit cards
• Lack of segregation of duties: less than four persons associated with the process (required: person authorized to initiate a transaction; person authorized to approve a transaction; person authorized to record a transaction; person authorized to safeguard the asset postacquisition)
• Lack of segregation of duties: four or more persons associated with the process but allocation of duties is inconsistent with segregation of duties (person authorized to initiate a transaction; person authorized to approve a transaction; person authorized to record a transaction; person authorized to safeguard the asset postacquisition)
• No periodic inventory of organizational property, plant, and equipment items
• Lack of searches for overriding internal controls and collusion:
  • Missing reviews
  • Lack of surprise audits
  • Lack of journal entry review
  • Lack of review and approval of estimates
  • Lack of review and approval of unusual transactions
• International transactions:
  • Lack of consideration of FCPA issues
  • Lack of audit specific to FCPA concerns
  • Lack of operational and financial oversight in international locales
• Related parties transactions

ANALYTICAL ANOMALIES

• Inventory: inventory write-offs exceed industry metrics
• Inventory: inventory write-offs increasing across time
• Inventory: unexplained/unusual inventory write-offs
• Employee turnover greater than x%
• Unexplained/unusual specification issues
• Unexplained/unusual quality issues
• Unexplained/unusual production scrap
• Excess purchasing
• Unexplained/unusual debit memos
• Unexplained/unusual credit memos
• Unexplained/unusual changes in account balances
• Cash shortages
• Unexplained/unusual vendor late charges
• Unexplained/unusual travel expenses
• Unexplained/unusual procurement card usage
• Unexplained/unusual account relationships: increasing revenues; lack of A/R increases
• Unexplained/unusual account relationships: A/R increases in excess of revenue increases
• Unexplained/unusual account relationships: increasing revenues; lack of inventory increases
• Unexplained/unusual account relationships: increasing revenues; lack of operating cash flow increases
• Unexplained/unusual account relationships: increasing net income; lack of operating cash flow increases
• Unexplained/unusual account relationships: increasing inventory; lack of A/P increases
• Unexplained/unusual account relationships: increasing inventory; lack of warehouse cost increases
• Unexplained/unusual account relationships: increasing sales volume; lack of decreasing cost per unit
• Unexplained/unusual account relationships: increasing sales volume; aging receivables
• Unexplained/unusual account relationships: increasing sales volume; decreasing scrap
• Unexplained/unusual account relationships: arising from unit and sales dollar volume per store, per employee, per cubic foot of sales space, per sales transaction, per customer
• Unexplained/unusual account relationships: financial performance out of line with industry metrics
• Unexplained/unusual account relationships: financial performance out of line with key competitor metrics
• Unexplained/unusual account relationships: tax return doesn’t reconcile to financial statements
• Unexplained/unusual account relationships: patterns
• Unexplained/unusual account relationships: pattern changes
• Unexplained/unusual account relationships: round numbers
• Unexplained/unusual account relationships: unusual cash transactions
• Unexplained/unusual account relationships: unusually large transactions
• Unexplained/unusual account relationships: unusual transaction timing
• Account line items that significantly exceed budget
• Account line items that significantly exceed industry or key competitor norms, especially for services
• Account line items that significantly increase from one year to the next that are out of step with company growth in revenues
• Unusual vendor payments in terms of quantity, frequency, and types of service inconsistent with sound business decisions
• Unusual vendor payments where the organization lacks records of the service provided
• Unusual vendor payments where the organization appears to be overcharged
• Unexplained increases in the quantity of goods purchased
• Unexplained inventory shortages and shortage trends
• Vendors with payments regularly falling just below enhanced approval requirements
• Payments to select vendors much faster than normal A/P turnaround
• Excessive vendor double payments
• Excessive vendor disbursement errors
• Unusual purchasing activity by employees
• Excessive A/P debit memos by employees
• Excessive manual check disbursements
• Unusual disbursements written to employees
• Excessive vendor disbursements written to “cash”
• Identification of employees with similar and identical names
• Employees whose payroll hours exceed norms
• Employees whose payroll wages exceed norms
• Employees whose payroll salaries exceed norms
• Payroll expense in excess of budget

LIFESTYLE SYMPTOMS

• Extravagant
  • Clothing
  • Automobiles
  • Vacations
  • Number of homes
  • Size and cost of home(s)
  • Weekend trips
  • Gambling habits
• New or high-priced house
• Expensive jewelry
• High-end recreational toys, such as boats, vacation homes, motor homes

BEHAVIOR SYMPTOMS

• Recent changes in employee behavior
• Suspected infidelity
• Symptoms of high levels of stress:
  • Alcohol abuse
  • Drug abuse
  • Unusual/newly observed insomnia, irritability, inability to relax, nervousness, inability to look others in the eyes, embarrassment, defensiveness, argumentativeness, belligerence, intimidating others, excessive sweating
• Confession
• Excuses for performance issues

RECEIPT OF TIPS FROM POTENTIAL INFORMANTS

• (including Employees, Customers, Suppliers, Family and Friends)

  Red-flag mitigation questions. Assuming that employees, supervisors, managers, leaders, antifraud professionals, auditors, and others will likely observe red flags, what is the next step? In general, red flags must be examined with evidence until the professional determines that the issue has a reasonable explanation, is an error that needs to be fixed, or is consistent with noncompliance or a fraudulent act and needs to be further examined to develop evidence around who, what, where, when, and how. Key red flag questions to consider include the following:

  • Does the anomaly have supporting documentation?
  • Does the documentation appear to be authentic (i.e., not falsified, altered, or fictitious)?
  • Do the transaction and its reflection in the financial statements make sense?
  • Does the transaction make sense in light of the company’s operations, goals, and objectives?
  • Does the totality of this and similar transactions make sense, analytically, when evaluated in comparison to the economy, the industry, key competitors, and other related accounting numbers within the organization?
  • Does the transaction have proper approval at proper authority levels?
  • Does the approval appear authentic?
  • Are there other aspects about the red flag that make it appear suspicious?

1. CT-1 Death in the Auto Zone. A man is found shot to death in the front seat of his car. All the windows are closed and the doors are locked; there are no bullet holes anywhere in the car and he did not commit suicide. How was he shot?
2. CT-2 Black as Night. Black as Night. A black man dressed all in black, wearing a black mask, stands at a crossroads in a totally black-painted town. All of the streetlights in town are broken. There is no moon. A black-painted car without headlights drives straight toward him, but turns in time and doesn’t hit him. Why?

Short Answer Questions

Discussion Questions

1. Compliance and fraud deterrence

Use a chart or graphical tools and techniques to present a robust compliance and fraud deterrence environment. Include on the chart or graphic:

1. The key players on the compliance and fraud risk assessment team.
2. The key attributes of a robust compliance and fraud deterrence environment for each player.
3. For the ten steps in a fraud risk management and compliance program, identify which are most closely aligned with which key players.

Student Material for step-by-step screenshots for completing the assignment are available from your instructor.

2. Fraud prevention and deterrence in action

Assume the following facts:

1. The company invoices customers for sales with an expected thirty-day collection period.
2. The invoice is used to post sales to the accounting system.
3. Checks are received in the mailroom and logged into a deposits journal.
4. The deposit is prepared and taken to the bank.
5. The deposit slip is used as an original document to record cash in the accounting system.
6. A copy of the deposits journal from the mailroom is used to credit customers for their payments.
7. Assume three general ledger accounts: cash, accounts receivable, and revenue.

Instructions: Part 1

Draw a graphic to depict these activities and their impact on the general ledger accounts. Include the necessary personnel and at least ten fraud prevention and deterrence tools and techniques to PREVENT a skimming scheme, assuming no collusion or management override. Post the personnel and those tools and techniques on the graphic.

Instructions: Part 2

What if the organization owner only hired one mailroom/office employee, one accounting clerk, and one accounting supervisor (assume no controller, no internal audit, and an annual review and tax compliance—not an annual audit). How would you alter your approach to create a robust skimming prevention environment?