2. Fraud Risk – some context first Year ending September 2015 there were 604,601 fraud offences reported (ONS) The National Fraud Indicator report in 2013 stated that for charities who had been victims of fraud, 23% of them said they had suffered at least 1 insider enabled fraud. For the private sector this increased to 49%.

3. Fraud Risk – some context first Source: BDO Fraud Track Report 2016

4. A story!

5. Our main characters Mr SmithMr Brown

6. The dark skies

7. Our heros! Miss WhiteMr Keen

8. First impact!

9. The evidence

10. Final Impact

11. So what went wrong! Recruitment – Mr Brown was the only person ever considered for the position – others were interviewed but too easily dismissed. Training – At the disciplinary interview Mr Brown said that he had flagged that he had no finance training and would need help with this. The training had never been provided. Responsibilities – At the disciplinary interview Mr Brown said that he regularly sent a copy of the customer database home and Mr Smith knew about this. It was the only way he could get his work done.

12. So what went wrong Responsibilities & Training – when Mr Brown decided to take over the production of the management accounts, no-one identified this change in responsibilities. As a result no training was given! Disciplinary Policy – The employment law advisors stated that the disciplinary policy was not specific enough on what constituted ‘gross misconduct’ and therefore Mr Brown could not be dismissed on this basis.

13. So what went wrong Appraisal – with the subsidiary being on another site 50 miles away and with only 30 staff it was not a high priority for Mr Smith and so his knowledge of what Mr Brown was doing was limited to what was in the management information produced by him. Vetting – Mr Brown was not subject to regular credit check vetting, which would have picked up on the late bills. Culture – The culture of the subsidiary never really changed after the purchase by the Group and therefore staff felt ‘un- loved’ by Head Office who only came to see them when there was a problem!

14. So what went wrong There were other things too: Staff e-mail usage policy of not e-mailing home, e-mailing of very large documents, or e-mailing strange e-mail addresses was not being monitored and reported. No segregation of duties for the compilation of the management accounts for the subsidiary.

15. So the moral of the story… Audit HR! -Recruitment -Vetting -Appraisal -Training -Culture -Disciplinary These would have helped PREVENT Mr Brown from falsifying management information. This would have helped secure the dismissal!

16. So the moral of the story… Audit Acquisitions! -Be sure everyone understands their responsibilities as part of the Group and that the group policies have been addressed in the way they work and training provided, not forgetting the Whistleblowing Policy. -Make sure you consider the culture – use the IIA’s guidance!

17. So the moral of the story… Audit Whistleblowing - In this case the subsidiary staff member knew how to do this and was comfortable, but you need to make sure this is in good standing in all parts of your organisation. Otherwise you may never know!

18. Recruitment key controls -Adverts are clear and articulate well what is being looked for. -Advertise in appropriate ways. -Using set criteria to mark all applications – ideally HR should do this or be involved. -Create interview questions up front and have them checked by HR -Make sure those conducting the interviews are trained / from HR. Ideally there should be 2 people! -Use set criteria to mark the interviews. The two people should agree on the marking! -HR should check through the decision to recruit and challenge any conflicts with the original request to recruit.

19. Vetting key controls -All appointments, including internal, should be subject to vetting. -Use a reputable agency / method. -Make sure vetting is appropriate to the role: financial, criminal, CIFAS -Look at the results and ask questions. Where possible get independent evidence to support the statement – e.g. outstanding CCJs. -Don’t allow a staff member to start until the vetting has been completed.

20. Appraisal key controls -Training is provided to all staff on the appraisal process. -Templates are well designed covering -a look back -a look forward -a development plan -A place for the appraisee to write their own comments -A place for both to sign their agreement to the appraisal. -All staff are required to have an appraisal at least once a year, ideally with at least one interim review. -All appraisals to be reviewed by the Appraiser’s line manager. -HR to review a sample selected using a suitable method.

21. Training key controls -Training needs are identified through appraisals, project implementation plans, system and process changes, acquisitions and mergers. -Training is designed to meet the needs identified -Training is designed to professional standards -Training is delivered by a qualified trainer. -Delegates are asked for feedback on the training event -Feedback is evaluated and fed into the next delivery of the specific course but also others as appropriate. -Training costs are recouped from department budgets for no-shows!

22. Disciplinary key controls -The Disciplinary Policy is reviewed and approved annually by an appropriate governance committee. -The Disciplinary Policy is communicated to all staff on a regular basis (usually annually). -Disciplinary procedures are run by trained and qualified HR staff. -Training for department managers is provided on their role in the disciplinary process. -Legal advice is sought on the disciplinary policy and procedures to ensure they meet employment law. -Cases of disciplinary action are reported through the governance structure along with their outcome. -Where staff are dismissed for gross misconduct this is communicated clearly to staff along with the reasons why.

23. Further Reading Office of National Statistics: http://www.ons.gov.uk/peoplepopulationandcommu nity/crimeandjustice/bulletins/crimeinenglandandwa les/yearendingseptember2015#fraud CIPD Guide on preventing staff fraud: http://www.cipd.co.uk/NR/rdonlyres/710B0AB0- ED44-4BD7-A527-B9AC29B28343/0/empfraud.pdf

24. Further Reading BDO Fraud track Report 2016: http://www.bdo.co.uk/__data/assets/pdf_file/0008/ 1366289/BDO_FRAUDTRACK_FEB16_FINAL.pdf