Companies implement fraud control policies in order to proactively defend themselves from criminality that can diminish their financial assets and intellectual property or other intellectual assets, e.g. trade secrets. Fraud control policies allow organizations to have the power to investigate and react as needed to those suspected of fraud, including possibly filing a lawsuit against them. In some cases, alerting the police might be the appropriate response.
No employee can be exempt from the fraud control policy, so no employee’s status at the company can give them cover. Rather, every employee must be held accountable for any action for which the employee is responsible. Along with employees, any shareholders, consultants, vendors, contractors or outside agencies/companies working with an organization should be held responsible for any financial irregularity discovered.
Experts recommend creating an anti-fraud culture and communicating to employees that management takes fraud and corruption and the threat of it seriously and is committed to policies to fight it. Of course, management wants to communicate that the company intends to respond vigorously to fraud that is discovered and act strongly against employees and third parties who are found to have engaged in fraud.
Finally, experts recommend distributing a clear, understandable, and focused policy that is accessible to all employees. Especially acts of fraud should be clearly defined so everyone can understand what constitutes fraud.
Example of a Fraud Control Policy
Management is responsible for detecting possible fraud and also for taking the appropriate responses to instances of fraud when they occur. A fraud control policy would also inform employees that they are expected to report any acts of fraud that they witness or believe to be happening.
Fraud is the intentional, false representation or concealment of a material fact for the purpose of inducing another to act upon the fraud to their detriment. Some examples of fraud that might take place in a business environment would be the misappropriation of money, securities, or supplies; disclosing confidential information; destroying, removing or inappropriately using records, company equipment or resources; or insider trading.
A complete fraud control policy would entail first identifying the fraud risks that exist within a company. This means thoroughly reviewing a company’s operations and identifying the places where fraud might be committed. For example, one common example would be having employees submit expense reports to be reimbursed for travel expenses. This would be an occasion for an employee to claim expenses they did not really incur in order to pad their expense report and claim a larger payment than they are entitled to.
After identifying the fraud risks, a company would want to devise ways to prevent and detect fraud when it occurs. The goal, of course, is to reduce the incidence of fraud by implementing systems first to deter or prevent fraud and then to find it when it does occur.
Part of a complete policy might be training staff on these measures, having a code of conduct that includes reference to fraud. Protection for staff members who report fraud would include whistleblower protection, that is, assuring staff who report fraud that there will not be any retaliation against them for their reporting. The assistance of auditors or other such professionals might be helpful in devising systems to detect fraud.
An additional element of a fraud control policy would be delineating the response to incidents of fraud when it is detected. This could include identifying who conducts investigations, what remedies are available and how reporting of the incident and the response takes place. Each of these elements of fraud response must be assigned to the appropriate department and personnel. A company might involve a special fraud response team, an internal audit team, company counsel and human resources. Fraud response should include efforts that aim to minimize damage caused by any fraud that is perpetrated.
Finally, assessing fraud risks and the company’s response to fraud must be ongoing. It will not be a one-time event. Risks have to be assessed on a regular basis, possibly annually. If a company has an external auditor, of course it would be involved in ongoing assessment of fraud risks also. Hopefully, a business of any size incorporates fraud risk assessment, reporting or risks and reporting of incidents to all personnel in the company with an interest in the subject on a regular basis.
Setting up the infrastructure within the company to stay on top of fraud on a regular basis. Deterring, detecting and responding to fraud has to be incorporated into a company’s regular operations. And staff must be trained regularly on a company fraud control policy.
Examples of the kinds of fraud that a company might work to detect would include fraud from within the company itself and from external sources as well. Possible instances of fraud could include the following:
- Financial theft or misappropriation of funds or other cash-equivalent assets;
- Improper or unauthorized expenditures;
- Unauthorized or inappropriate access to information;
- Unauthorized release of information;
- Forgery and alteration of documents;
- Inappropriate use of insider knowledge, e.g. for trading in the company’s stock;
- Misappropriation or misallocation of company resources, such as mobile phones or computer equipment;
- Conflicts of interest such as favorable treatment of partners or clients for personal benefit;
- Falsification of records and data, such as expense report or payroll records;
- Fraudulent financial reporting.
Common Fraud Cases
Fraud cases usually involve the misappropriation of a company’s assets, corruption, and/or financial statement fraud. Asset misappropriation can include an employee stealing or revealing private information or a company’s intellectual property.
Persons involved in corruption might influence business deals or transactions with their power or status, sending them in directions that do not truly benefit the company. Financial statement fraud occurs when information is left out or data is falsely represented.
Confidentiality
Any person who reports suspected fraud, or is suspected of fraud, should remain anonymous. All information pertaining to the fraud case should be kept confidential, and exposed only to management and others who need to know as well as any attorney working on the case.
Confidentiality agreements protect the employee from libel and slander, and the company from potential civil liability.
Should I Consult an Attorney?
If you own a business, you probably want to consider developing fraud control policies. An experienced employment lawyer or commercial lawyer can help you develop the best policy for your business. They may be able to assist you in enlisting experts from other fields, e.g. auditors, who can help as well.
If you have been accused of violating a company’s fraud control policy, you should contact an experienced employment attorney to ensure that your rights are upheld.
