Avoiding the Fraud Triangle

The Treasury Department requires virtually all businesses that provide financial services to the public to file”Suspicious Activity Reports” when they see financial transactions that might indicate malfeasance.  This monitoring requirement used to be focused primarily on banks, but as part of the USA Patriot Act it was expanded to get a broader view of the financial system.   Apparently this expansion was worthwhile as the latest “SAR Review” released by the Financial Crimes Enforcement Network shows quite an uptick in this type of suspicious behavior.

Despite -- or maybe because of -- the focus on following the money to stop terrorism, questionable activities associated with terrorist financing were the topic of 30% more filings than last year.  Money laundering filings went up in 2010, after a decline the year before.  (Apparently even criminals had a tough time with the recession).  Interestingly depository institutions actually reported a year over year decline in suspicious activity.  The growth is in the “shadow banking” world that includes credit unions and money services businesses.  Of those, Gaming Establishments increased their filings by 16% and Card Clubs increased 180%.

All of this serves as a reminder that the technology allowing more transactions to happen more easily is also fertile ground for criminals.  This isn’t just a big business problem.  Ironically, according to the Association of Certified Fraud Examiners  per employee losses from fraud are 100 times greater for small businesses than those for larger companies.  The Association cites 3 areas where small businesses make themselves especially vulnerable:  inadequate screening of new employees, not using financial controls to contain fraud, and allowing employees to conduct transactions that make it easy to commit fraud.  The fraud triangle is built on a base of incentive and rationalization.  All it takes is opportunity to commit the crime.  If employers make it easy, it’s more likely to happen. 

Change Impact Downstream

While much has been discussed about the recent (it is actually technically over) recession in terms of long run unemployment, my work week reminded me about the impact on those still working.  Everyone is trying to do different things faster -- yet often with the same infrastructure.  While it’s tough to turn even a small business on a dime, the fact is there are plenty of people who are doing that just to keep solvent.  It’s really important though to consider the downstream impacts of these big changes on the how the company operates day-to-day.  In particular the effectiveness of internal controls can dissipate significantly when rapid change is the order of the day.

A small business facing economic duress is unlikely to think managing control risk is a top priority, but it actually is.  While the bottom line is crucial, knowing that you in fact have the correct bottom line is equally important.  Recent statistics from the Association of Certified Fraud Examiners show fraud in the workplace is uncovered by accident 25% of the time.  Compare that to the 12% of fraud discovered by external audits.  Needless to say, preventive controls are more important, as they can stop fraud before it occurs.  They also help prevent mistakes, which are also more likely to occur at a time when change is rapid and ongoing.

If it’s so important, how does one prioritize management of controls?  (It’s easier than you might think.)  Particularly in a changing environment there are a couple of items worth focusing on.  If your business doesn’t have a formal set of internal controls, make a list of the informal procedures that you believe are providing the appropriate checks and balances.  Then collect a group of folks you work with to dissect if any of those programs might be working differently (as in not working) under the new ways the business is operating.  If it involves cash, assets that can easily be transported or your regulatory responsibilities, this is a big priority.  You can make a hit list of items that are not on the short list, consider the risk to the business and then act accordingly.