Internal Audit Function Proactive Measures for Finding Anti-Fraud and the Internal Audit Function Proactive Measures for Finding Fraud, Waste, and Abuse Colors I Like (in this presentation) Washington, D.C. IIA Chapter January 16, 2013

Agenda Introduction Defining Fraud – ACFE Statistics Auditor Responsibilities Developing a Robust Anti-Fraud Program Overview Discussion of Specific Elements Questions/Discussion

Paul J. Soos – CIA, CFE, CICA Manager of Anti-Fraud & AP Recovery Services BA (Accounting) Baldwin-Wallace College Certified Internal Auditor Certified Fraud Examiner Certified Internal Controls Auditor CPA Candidate Past President of NE Ohio ACFE Chapter Past Audit Director - The Scott Fetzer Company

CBIZ MHM offices in major cities, nationwide. About CBIZ, Inc. CBIZ MHM offices in major cities, nationwide.

About CBIZ, Inc. (cont.) CBIZ is the 7th largest provider of professional services in the U.S. and is NYSE listed (CBZ) 4,500 people in 200 offices across the USA CBIZ provides consulting and advisory services for HR, CFOs and CIOs Global coverage in 70 countries – Partners with Kreston International

About CBIZ Risk & Advisory Services CBIZ Risk & Advisory Services (RAS) is the National Internal Audit and Sarbanes-Oxley practice within CBIZ Internal Audit: Significant experienced practitioners with prior Fortune 1000 and Big 4 experience Sarbanes-Oxley: More than 900 CPAs, CIAs, CFEs, CISAs and technical professionals Strong Anti-Fraud Practice – Prevention, Detection and Investigative Services Significant depth in a wide variety of IT audit services including general controls, application controls, security, and disaster recovery planning Local access: In major cities throughout the United States High percentage of Director and Manager time included in every engagement Our practitioners have greater than 15 years of internal audit experience Independent: No attest work to cause independence conflicts

Anti-Fraud Services – Two Service Lines Reactive Investigations A problem is suspected Quantification Prove elements of offense Recovery focused Insurance Restitution Civil remedies All-Size Companies Fraud Prevention/Detection Fraud Risk Assessments Evaluating Controls Through Eyes of a Forensic Accountant Data Mining/Analysis Seek indicators of fraudulent activity “Checkbook Analysis” All-Size Companies

Investigations – Anti-Fraud Consultants Financial Statement Auditors Private Investigators Forensic/Investigative Accountants

Understanding Fraud ACFE Report to the Nation Statistics The Fraud Triangle Most Common Schemes In Total By Industry By Size of Company Likely Perpetrators

ACFE Report to the Nation (2012) Survey of CFE’s – 1,388 cases (01/10 – 12/11) Median loss - $140,000 – 20%+ over $1 million Median length of scheme – 18 months, which means that it was not uncovered during a year-end audit Asset misappropriation – 87% of all cases with a median loss of “only” $120K Financial Statement Fraud – only 8% of all cases, but a median loss of over $1 million Corruption schemes fell in the middle, comprising just under one-third of cases and causing a median loss of $250,000.

ACFE Report to the Nation (2012) Survey participants estimated that the typical organization loses 5% of its annual revenue to fraud. Applied to the estimated 2011 Gross World Product, this figure translates to a potential total fraud loss of more than $3.5 trillion.

ACFE Report to the Nation (2012) Small organizations are disproportionately victimized by occupational fraud, and suffer the largest median losses. These organizations are typically lacking in anti-fraud controls compared to their larger counterparts, which makes them particularly vulnerable.

ACFE Report to the Nation (2012) The industries most commonly victimized in the study were: Banking/financial services Government and public administration Manufacturing sectors

ACFE Report to the Nation (2012) High-level perpetrators cause the greatest damage to their organizations. Frauds committed by owners/executives were more than three times as costly as frauds committed by managers, and more than nine times as costly as employee frauds. Executive-level frauds also took much longer to detect.

ACFE Report to the Nation (2012) Almost 80% of the frauds in the study were committed by individuals in one of six departments: Accounting Operations Sales Executive/Upper Management Customer Service Purchasing

ACFE Report to the Nation (2012) 87% of fraudsters in the study had never been previously charged or convicted for a fraud-related offense and 84% had never been punished or terminated by an employer for fraud-related conduct. This finding is consistent with prior studies.

ACFE Report to the Nation (2012) Fraud perpetrators often display warning signs that they are engaging in illicit activity. The most common behavioral red flags displayed by the perpetrators in our study were: Living beyond their means (36% of cases) Experiencing financial difficulties (27%) Close relationships with vendors/customers (19%) Excessive control issues (18%)

ACFE Report to the Nation (2012) 49% of victims have not recovered ANY of the perpetrator’s takings. This finding is consistent with prior studies, which show 40% - 50% of victim organizations do not recover any of their fraud-related losses. Anti-fraud controls appear to help reduce the cost and duration of occupational fraud schemes. They looked at the effect of 16 common controls on the median loss and duration of the frauds. Victim organizations that had these controls in place had significantly lower losses and time-to-detection than organizations without the controls.

What Can the Report Do For Us? Profile of common victims and perpetrators Identifies most common fraud schemes Quantifies rate of occurrence and relative losses In short – know what to look for Evaluate your fraud risk and procedures

The Fraud Triangle – Donald Cressey Incentive Opportunity Rationalization

Distribution of Losses

The Three Main Types of Fraud Asset Misappropriation – 86.7% - $120K Stealing stuff – $ (88%), Inventory, Other Assets Billing schemes, T&E, check tampering Corruption Schemes – 33.4% - $250K Conflicts of interest, bribery, improper gratuities Fraudulent Financial Statements – 7.6% - $1M Concealed liabilities, fictitious revenues, improper valuation

Asset Misappropriation Sub-Categories Schemes Involving Theft of Cash Receipts CATEGORY Skimming 14.6% $58K Cash Larceny 11.0% $54K DESCRIPTION Any scheme in which cash is stolen from an organization before it is recorded on the organization’s books and records Any scheme in which cash is stolen from an organization after it has been recorded on the organization’s books and records EXAMPLES Employee accepts payment from a customer but does not record sale, and instead pockets the money Employee steals cash and/or checks from daily receipts before they can be deposited in the bank

Asset Misappropriation Sub-Categories Schemes Involving Fraudulent Disbursements of Cash CATEGORY Billing 24.9% $100K T&E Reimbursement 14.5% $26K DESCRIPTION Any scheme in which a person causes his employer to issue a payment by submitting invoices for fictitious goods or services, inflated invoices, or invoices for personal purchases Any scheme in which an employee makes a claim for reimbursement of fictitious or inflated business expenses EXAMPLES Employee creates a shell company and bills employer for services not actually rendered Employee purchases personal items and submits invoice to employer for payment Employee files fraudulent expense report, claiming personal travel, nonexistent meals, etc.

Asset Misappropriation Sub-Categories Schemes Involving Fraudulent Disbursements of Cash (cont.) CATEGORY Check Tampering 11.9% $143K DESCRIPTION Any scheme in which a person steals his employer’s funds by intercepting, forging, or altering a check drawn on one of the organization’s bank accounts EXAMPLES Employee steals blank company checks, makes them out to himself or an accomplice Employee steals outgoing check to a vendor, deposits it into his own bank account

Asset Misappropriation Sub-Categories Schemes Involving Fraudulent Disbursements of Cash (cont.) CATEGORY Payroll 9.3% $48K Cash Register Disbursements 3.6% $25K DESCRIPTION Any scheme in which an employee causes his employer to issue a payment by making false claims for compensation Any scheme in which an employee makes false entries on a cash register to conceal the fraudulent removal of cash EXAMPLES Employee claims overtime for hours not worked Employee adds ghost employees to the payroll Employee fraudulently voids a sale on his cash register and steals the cash

Asset Misappropriation Sub-Categories Other Asset Misappropriation Schemes CATEGORY Cash on Hand 11.8% $20K Non-Cash 17.2% $58K DESCRIPTION Any scheme in which the perpetrator misappropriates cash kept on hand at the victim organization’s premises Any scheme in which an employee steals or misuses non-cash assets of the victim organization EXAMPLES Employee steals cash from a company vault Employee steals inventory from a warehouse or storeroom Employee steals or misuses confidential customer financial information

Fraudulent Asset Misappropriation Category Cases % of Cases Median Loss Skimming 203 14.6% $58,000 Cash Larceny 152 11.0% $54,000 Billing Schemes 346 24.9% $100,000 T&E Reimbursements 201 14.5% $26,000 Check Tampering 165 11.9% $143,000 Payroll 129 9.3% $48,000 Register Disbursements 50 3.6% $25,000 Cash on Hand 164 11.8% $20,000 Non-Cash 239 17.2%

Professional Services Frauds by Industry Industry Cases Most Common Second Most Common Financial Services 229 Corruption Cash on Hand Government 141 Billing Manufacturing 139 Health Care 92 Education 88 T&E Retail 83 Non-Cash Insurance 78 Professional Services 55

Victim Organizations of Fraud (Size)

Profile of Perpetrators Position Gender Age Tenure Education Level History

The Position of Perpetrators

The Gender of Perpetrators

The Age of Perpetrators

The Age of Perpetrators

The Age of Perpetrators (2010 Survey)

The Tenure of Perpetrators

The Education Level of Perpetrators

Perpetrator’s Criminal/Employment History Only 5.6% of the fraud perpetrators in the study had been previously convicted of a fraud-related offense, and another 5.9% were charged but not convicted, which has been virtually unchanged since 2008. 83.7% had never been punished or terminated by a previous employer. These statistics suggest that criminal background checks and employment checks may have some effect in preventing fraud, but the effect is probably limited.

Behavioral Red Flags of Perpetrators

How is Fraud Detected? Percent Occurrence Quiz Name potential methods of detection

Percent Occurrence Quiz How is Fraud Detected? Percent Occurrence Quiz Alphabetical Listing Account Reconciliation By Accident Document Examination External Audit Internal Audit Management Review Notified by Police Tip

How is Fraud Detected?

How is Fraud Detected?

How is Fraud Detected?

How is Fraud Detected?

How is Fraud Detected?

How is Fraud Detected?

How is Fraud Detected?

How is Fraud Detected?

Median Loss By Detection Method

Name potential sources of tips Source of Tips? Quiz Name potential sources of tips

Source of Tips? Alphabetical Listing Anonymous Competitor Customer Employee Other Shareholder/Owner Vendor

Source of Tips

Source of Tips

Source of Tips

Source of Tips

Source of Tips

Source of Tips

Source of Tips

Conclusions/Recommendations • Occupational fraud is a global problem. • Fraud reporting mechanisms, such as hotlines, are a critical component of an effective fraud prevention and detection system. • Organizations tend to over-rely on audits, especially external audits. • Audits should not be relied upon exclusively for fraud detection. • Employee education is the foundation of preventing and detecting occupational fraud. Most frauds are detected by tips.

Conclusions/Recommendations • Organizations that have anti-fraud training for employees and managers experience lower fraud losses. Surprise audits are an effective, yet underutilized, tool in the fight against fraud. • While surprise audits can be useful in detecting fraud, their most important benefit is in preventing fraud by creating a perception of detection. • Small businesses are particularly vulnerable to fraud. • Managers and owners of small businesses should focus their control investments on the most cost-effective mechanisms, such as hotlines and setting an ethical “tone from the top” for their employees.

Conclusions/Recommendations • Internal controls alone are insufficient to fully prevent occupational fraud. Fraudsters exhibit behavioral warning signs of their misdeeds which will not be identified by traditional controls. • Auditors and employees alike should be trained to recognize the common behavioral signs that a fraud is occurring and encouraged not to ignore them. • Given the high costs of occupational fraud, effective fraud prevention measures are critical.

Internal Audit’s Role What are our responsibilities? What do others (management, the board, stakeholders) think our responsibilities are? How much time do we spend considering fraud matters? Do we incorporate fraud risks into our risk assessment? Do we use fraud specialists to supplement/train our staff?

SAS 99 Considerations • Description and characteristics of fraud This section describes fraud and its characteristics. • The importance of exercising professional skepticism This section discusses the need for auditors to exercise professional skepticism when considering the possibility that a material misstatement due to fraud could be present. • Discussion among engagement personnel regarding the risks of material misstatement due to fraud This section requires, as part of planning the audit, that there be a discussion among the audit team members to consider how and where the entity's financial statements might be susceptible to material misstatement due to fraud and to reinforce the importance of adopting an appropriate mindset of professional skepticism.

SAS 99 Considerations • Obtaining the information needed to identify risks of material misstatement due to fraud This section requires the auditor to gather information necessary to identify risks of material misstatement due to fraud, by Inquiring of management and others within the entity about the risks of fraud. Considering the results of the analytical procedures performed in planning the audit. Considering fraud risk factors. Considering certain other information. • Identifying risks that may result in a material misstatement due to fraud This section requires the auditor to use the information gathered to identify risks that may result in a material misstatement due to fraud.

SAS 99 Considerations • Assessing the identified risks after taking into account an evaluation of the entity's programs and controls This section requires the auditor to evaluate the entity's programs and controls that address the identified risks of material misstatement due to fraud, and to assess the risks taking into account this evaluation.

SAS 99 Considerations • Responding to the results of the assessment This section emphasizes that the auditor's response to the risks of material misstatement due to fraud involves the application of professional skepticism when gathering and evaluating audit evidence. The section requires the auditor to respond to the results of the risk assessment in three ways: A response that has an overall effect on how the audit is conducted, that is, a response involving more general considerations apart from the specific procedures otherwise planned. A response to identified risks that involves the nature, timing, and extent of the auditing procedures to be performed.

SAS 99 Considerations • Responding to the results of the assessment This section emphasizes that the auditor's response to the risks of material misstatement due to fraud involves the application of professional skepticism when gathering and evaluating audit evidence. The section requires the auditor to respond to the results of the risk assessment in three ways: A response involving the performance of certain procedures to further address the risk of material misstatement due to fraud involving management override of controls. The procedures include: Examining journal entries and other adjustments for evidence of possible material misstatement due to fraud. Reviewing accounting estimates for biases that could result in material misstatement due to fraud. Evaluating the business rationale for significant unusual transactions.

SAS 99 Considerations • Evaluating audit evidence This section requires the auditor to assess the risks of material misstatement due to fraud throughout the audit and to evaluate at the completion of the audit whether the accumulated results of auditing procedures and other observations affect the assessment. It also requires the auditor to consider whether identified misstatements may be indicative of fraud and, if so, directs the auditor to evaluate their implications.

SAS 99 Considerations • Communicating about fraud to management, the audit committee, and others This section provides guidance regarding the auditor's communications about fraud to management, the audit committee, and others. • Documenting the auditor's consideration of fraud This section describes related documentation requirements.

March 2011 Article – Where There’s Smoke, There’s Fraud CFO Magazine March 2011 Article – Where There’s Smoke, There’s Fraud An Action Plan Start at the top Educate employees • Change the culture ASAP • Hold surprise audits Check (and double-check) employee backgrounds Prepare a data-breach response plan Make sure the Board of Directors plays its role

Tone From the Top Two prevailing attitudes regarding fraud: We would never hire someone like that (head in the sand) We are willing to be proactive in making sure that these situations do not occur (professional skepticism)

Primary Internal Control Weakness Observed by CFEs

Frequency of Anti-Fraud Controls

Dollar Impact of Anti-Fraud Controls % Implemented Control In Place Control Not In Place % Reduction Management Review 60.5% $100,000 $185,000 45.9% Employee Support Programs 57.5% $180,000 44.4% Hotline 54.0% Manager/Executive Fraud Training 47.4% $158,000 36.7% External Audit of ICOFR 67.5% $120,000 $187,000 35.8% Employee Fraud Training 46.8% $155,000 35.5% Anti-Fraud Policy 46.6% $150,000 33.3% Formal Fraud Risk Assessments Internal Audit Department 68.4% KEY: External Audit of F/S = Independent external audits of the organization’s financial statements Internal Audit / FE Department = Internal audit department or fraud examination department External Audit of ICOFR = Independent audits of the organization’s internal controls over financial reporting Management Certification of F/S = Management certification of the organization’s financial statements

Duration Impact of Anti-Fraud Controls % Implemented Control In Place Control Not In Place % Reduction Job Rotation/Mandatory Vacation 16.7% 9 months 24 months 62.5% Rewards for Whistleblowers 9.4% 22 months 59.1% Surprise Audits 32.3% 10 months 58.3% Code of Conduct 78.0% 14 months 30 months 50.0% Anti-Fraud Policy 46.6% 12 months External Audit of ICOFR 67.5% Formal Fraud Risk Assessments 35.5% Employee Fraud Training 46.8% Manager/Executive Fraud Training 47.4% KEY: External Audit of F/S = Independent external audits of the organization’s financial statements Internal Audit / FE Department = Internal audit department or fraud examination department External Audit of ICOFR = Independent audits of the organization’s internal controls over financial reporting Management Certification of F/S = Management certification of the organization’s financial statements

Anti-Fraud Program Components Often Managed by Internal Audit – Should Incorporate Board of Directors and Senior Management Involvement – Prevention Detection Response Organizational Ethics Policy Employee and Vendor Validations Transactional and/or Process-Specific Anti-Fraud Controls Reporting Mechanisms (i.e. Hotlines) Fraud Detection Analyses Continuous Monitoring Process/protocols for: Internal Investigations Disciplinary Actions Remediation to Prevent Repeat Occurrences Adequate Insurance – Continuous Evolution – Program components should be periodically evaluated for effectiveness, efficiency, and to ensure current organizational anti-fraud risks, or goals, are addressed.

Areas of Proactive Fraud Reviews Accounts Payable/Human Resources Testing Vendor Master File (incomplete records, shared addresses, TIN, phone) Invoice Testing (even dollar, sequential, numbering) Employee Testing (SSN, shared addresses, bank accounts) Shell company (vendors and employees sharing info – addresses, bank accounts)

Vendors/Employees Sharing Addresses

Areas of Proactive Fraud Reviews (continued) Purchase/Procurement Card (P-Card) Transactional/monthly/credit limit Potential split transactions Prohibited categories High-risk merchants (PayPal) Other policy violations

Areas of Proactive Fraud Reviews (continued) Travel & Entertainment (T&E) Policy compliance (company card, agency, etc.) Potential split transactions Prohibited categories High-risk merchants (airfare) Wire Transfers and ACH Transactions Policy compliance/approvals Tie in to vendor testing

Conflict of Interest

Fraud Prevention Checklist Is ongoing anti-fraud training provided to all employees of the organization? Is an effective fraud reporting mechanism in place? To increase employees’ perception of detection, are the following proactive measures taken and publicized to employees? Is fraudulent conduct proactively sought out? Are surprise audits performed? Is continuous auditing software utilized? Is the management climate/tone at the top one of honesty and integrity?

Fraud Prevention Checklist Are fraud risk assessments performed to proactively indentify and mitigate the company’s vulnerabilities to internal and external fraud? Are strong anti-fraud controls in place and operating effectively, including the following? Proper separation of duties Use of authorizations Physical safeguards Job rotations Mandatory vacations

Fraud Prevention Checklist Does the internal audit department, if one exists, have adequate resources and authority to operate effectively and without undue influence from senior management? Does the hiring policy include the following (where permitted by law)? Past employment verification Criminal and civil background checks Credit checks Drug screening Education verification References check

Fraud Prevention Checklist Are employee support programs in place to assist employees struggling with addictions, mental/emotional health, family or financial problems?  Is an open-door policy in place that allows employees to speak freely about pressures, providing management the opportunity to alleviate such pressures before they become acute? Are anonymous surveys conducted to assess employee morale?

Questions/Discussion ACFE Report To The Nations (includes Fraud Prevention Checklist) www.acfe.com Paul J. Soos - CFE, CIA, CICA psoos@cbiz.com 812.637.5737