'Fraud Control Gap'

The substantial 'fraud control gap' between more effective companies and others is notable both because of its scale and the breadth of its applicability. Chart 1 (page 4) compares the two groups of companies for six different aspects of fraud control. The size of the performance gap between the more effective and less effective companies is striking. For example, 93% of executives at more effective companies considered their organizations to be 'very effective' at detecting internal fraud compared with only 17% at less effective companies ' a difference of 76%. The fraud control gap is so large that it should raise questions for corporate executives, boards of directors and counsel for the majority of companies that are considered less effective.

In-house counsel may wish to consider which group their company falls into, more effective or less effective, and if the latter, what steps they would need to take to catch up with more effective organizations.

External Fraud

Chart 1 also shows that both groups of companies rated themselves significantly less effective in dealing with external fraud than with internal fraud. Fifty-six percent of executives at more effective companies considered their organization to be 'very effective' at detecting external fraud, compared to 93% for internal fraud. At less effective companies, only 4% of executives considered their organization 'very effective' at detecting external fraud, compared with 17% for internal fraud.

Most organizations find external fraud risks more challenging to address than internal fraud risks for several reasons. Globalization and outsourcing add a new dimension of complexity. Many companies have had to do business in parts of the world where they are not so experienced. This often increases their exposure to fraud in areas where they have not already established effective fraud controls. Greater business complexity, expanded reliance on technology, and the increasing attention of organized criminal groups on the corporate world all contribute to growing opportunities for external fraud. And, quite simply, it is harder for companies to maintain current knowledge about external fraud schemes that may impact them infrequently or not at all.

In-house counsel may wish to evaluate the extent to which their company has managed its exposure to external fraud. One place to start is with management's fraud risk assessment. Does it identify external-fraud risk exposure? Is it specific, identifying particular fraud schemes, their potential perpetrators, significance and likelihood? Does it address the fraud schemes relevant to the different countries in which or with which the company does business? Don't be surprised if some catching up is needed.

Whistle-blower Hotlines

Across all the companies included in the study, only 32% of executives considered their company's whistleblower hotline to be 'very effective' at uncovering or preventing fraud. The companies whose compliance programs were generally more effective rated their hotlines higher than the others (46% versus 22%), but neither result is impressive. Tips are the most common way in which frauds are detected according to a 2006 report of the Association of Certified Fraud Examiners, so effective hotlines are key, especially for detecting fraud perpetrated by senior executives. The low level of confidence in hotline performance indicated in our study means that hotlines are not being used to their potential.

In-house counsel may wish to look into whether their company's hotline is benchmarked annually using industry-specific statistics for hotline performance such as call volume, call mix, anonymity usage, and prior notification of management. Insights can also be gained by surveying employees to measure their willingness to use the hotline and their degree of trust in management to resolve issues appropriately and not to take retribution against those who report wrongdoing. Analyzing the survey results by operating unit or by geographic area can identify where the hotline may be less effective or not effective at all, enabling you to implement appropriate remediation.

Employee Training

Our study suggests that training employees on fraud is an area with room for significant improvement in many companies, both more effective and less effective. The proportion of executives at the two groups who thought their company's fraud training was very effective was 58% and 12% respectively (Chart 1).

Other questions in the study revealed that only approximately 30% of companies' senior management had effectively communicated the importance of fraud control and ensured that their employees had a clear understanding of their responsibilities for preventing fraud. It is not surprising that frauds continue to occur if 70% of companies are not effectively communicating the importance of fraud control to their employees.In-house counsel should evaluate whether their ethics, compliance or fraud risk management program includes adequate fraud training.

Reduced Fraud Expectations

The study also suggests that improving the effectiveness of fraud controls can reduce the likelihood of future frauds. Chart 2 below shows that executives at companies more effective at fraud control expected lower rates of fraud over the next 12 months than those at less effective companies. While 60% of executives at less effective companies thought it was at least somewhat likely they would experience a misappropriation of assets fraud over the next 12 months, the proportion was only 38% at more effective companies. The results are even more striking with respect to the significant issues of fraudulent financial reporting and violations of laws in foreign activities. Executives at the more effective companies were approximately half as likely to consider these issues to be somewhat, very or extremely likely over the next 12 months. Given the financial costs and potential reputational harm of such incidents, the benefit of more effective fraud controls and programs is apparent.

Approximately half of the executives also reported that their organizations had increased the resources devoted to fraud over the past 12 months. They cited increased publicity about fraud, pressure from their board of directors, and a recent instance of fraud as the main reasons for this change.

In-house counsel may wish to consider whether their company is positioned to achieve the lower rates of fraud expected by executives at companies more effective at fraud control. Don't be surprised if you have to add new controls and improve your existing ones ' you are not alone.

[IMGCAP(1)]

[IMGCAP(2)]

Study Methodology

To conduct the study, the Deloitte Forensic Center commissioned a survey of executives drawn from internal audit, compliance, finance, risk management, legal and other areas involved with fraud control in a broad range of industries and from companies of all sizes. Sixty-four percent of respondents said their company was subject to Sarbanes-Oxley.

To analyze their different approaches, participating companies were categorized as either more effective at fraud control or less effective. Companies were considered as 'more effective' when executives gave their companies an average rating of 3.5 or greater (on a five-point scale) on their effectiveness in four areas: preventing internal fraud, detecting internal fraud, preventing external fraud, and detecting external fraud.

Only 41% of the 277 senior executives participating in the online survey rated their organization's fraud control performance highly enough to meet a threshold of 'more effective.' There were few differences across industries in the ratings with the exception of financial services, where 53% of executives rated their organization's effectiveness highly.

Toby J.F. Bishop, a member of this newsletter's Board of Editors, is a partner and Mohammed Ahmed is a senior manager in the Forensic and Dispute Services practice of Deloitte Financial Advisory Services LLP. They may be contacted at [email protected] and [email protected]. The views expressed in this article are those of the authors and may not be those of Deloitte Financial Advisory Services LLP.

A 2007 study by our firm's Deloitte Forensic Center revealed relatively weak performance in many companies' fraud controls, raising concerns about the effectiveness of key aspects of corporate compliance, ethics and risk management programs. In-house counsel should consider how the findings might apply to their companies and what remedial steps they can take.

The study, which evaluated executives' views about the effectiveness of their companies' practices for controlling fraud, had five key findings:

• There is a substantial self-reported 'fraud control gap' between the minority of companies that were considered in the study to be more effective at fraud control and the majority of companies that were considered less effective. The size of the gap is so large that it raises concern about the fraud risks that less effective companies may be running.
• Executives reported that their companies were much less effective in controlling external fraud than internal fraud. This area of vulnerability creates risks particularly for companies increasing their international business activities ' a common occurrence as globalization takes root.
• Only 32% of executives surveyed believed their whistle-blower hotlines were very effective. Since hotlines are a critical part of compliance, ethics, and fraud risk management programs, executives' lack of confidence in them suggests that improvements are widely needed.
• For the less effective companies, only 12% of executives said that their employee training on fraud was very effective.
• Executives at the more effective companies anticipated that instances of fraud were much less likely. This supports the business case for enhancing fraud controls.

In-house counsel can use the detailed results of this study to identify potential areas of opportunity for improving the performance of their compliance and ethics programs that deal with fraud and other corporate criminal issues. We explore each of these findings and their implications in greater depth below. An explanation of the study methodology appears in the sidebar below.

Fraud Control Gap

The substantial 'fraud control gap' between more effective companies and others is notable both because of its scale and the breadth of its applicability. Chart 1 (page 4) compares the two groups of companies for six different aspects of fraud control. The size of the performance gap between the more effective and less effective companies is striking. For example, 93% of executives at more effective companies considered their organizations to be 'very effective' at detecting internal fraud compared with only 17% at less effective companies ' a difference of 76%. The fraud control gap is so large that it should raise questions for corporate executives, boards of directors and counsel for the majority of companies that are considered less effective.

In-house counsel may wish to consider which group their company falls into, more effective or less effective, and if the latter, what steps they would need to take to catch up with more effective organizations.

External Fraud

Chart 1 also shows that both groups of companies rated themselves significantly less effective in dealing with external fraud than with internal fraud. Fifty-six percent of executives at more effective companies considered their organization to be 'very effective' at detecting external fraud, compared to 93% for internal fraud. At less effective companies, only 4% of executives considered their organization 'very effective' at detecting external fraud, compared with 17% for internal fraud.

Most organizations find external fraud risks more challenging to address than internal fraud risks for several reasons. Globalization and outsourcing add a new dimension of complexity. Many companies have had to do business in parts of the world where they are not so experienced. This often increases their exposure to fraud in areas where they have not already established effective fraud controls. Greater business complexity, expanded reliance on technology, and the increasing attention of organized criminal groups on the corporate world all contribute to growing opportunities for external fraud. And, quite simply, it is harder for companies to maintain current knowledge about external fraud schemes that may impact them infrequently or not at all.

In-house counsel may wish to evaluate the extent to which their company has managed its exposure to external fraud. One place to start is with management's fraud risk assessment. Does it identify external-fraud risk exposure? Is it specific, identifying particular fraud schemes, their potential perpetrators, significance and likelihood? Does it address the fraud schemes relevant to the different countries in which or with which the company does business? Don't be surprised if some catching up is needed.

Whistle-blower Hotlines

Across all the companies included in the study, only 32% of executives considered their company's whistleblower hotline to be 'very effective' at uncovering or preventing fraud. The companies whose compliance programs were generally more effective rated their hotlines higher than the others (46% versus 22%), but neither result is impressive. Tips are the most common way in which frauds are detected according to a 2006 report of the Association of Certified Fraud Examiners, so effective hotlines are key, especially for detecting fraud perpetrated by senior executives. The low level of confidence in hotline performance indicated in our study means that hotlines are not being used to their potential.

In-house counsel may wish to look into whether their company's hotline is benchmarked annually using industry-specific statistics for hotline performance such as call volume, call mix, anonymity usage, and prior notification of management. Insights can also be gained by surveying employees to measure their willingness to use the hotline and their degree of trust in management to resolve issues appropriately and not to take retribution against those who report wrongdoing. Analyzing the survey results by operating unit or by geographic area can identify where the hotline may be less effective or not effective at all, enabling you to implement appropriate remediation.

Employee Training

Our study suggests that training employees on fraud is an area with room for significant improvement in many companies, both more effective and less effective. The proportion of executives at the two groups who thought their company's fraud training was very effective was 58% and 12% respectively (Chart 1).

Other questions in the study revealed that only approximately 30% of companies' senior management had effectively communicated the importance of fraud control and ensured that their employees had a clear understanding of their responsibilities for preventing fraud. It is not surprising that frauds continue to occur if 70% of companies are not effectively communicating the importance of fraud control to their employees.In-house counsel should evaluate whether their ethics, compliance or fraud risk management program includes adequate fraud training.

Reduced Fraud Expectations

The study also suggests that improving the effectiveness of fraud controls can reduce the likelihood of future frauds. Chart 2 below shows that executives at companies more effective at fraud control expected lower rates of fraud over the next 12 months than those at less effective companies. While 60% of executives at less effective companies thought it was at least somewhat likely they would experience a misappropriation of assets fraud over the next 12 months, the proportion was only 38% at more effective companies. The results are even more striking with respect to the significant issues of fraudulent financial reporting and violations of laws in foreign activities. Executives at the more effective companies were approximately half as likely to consider these issues to be somewhat, very or extremely likely over the next 12 months. Given the financial costs and potential reputational harm of such incidents, the benefit of more effective fraud controls and programs is apparent.

Approximately half of the executives also reported that their organizations had increased the resources devoted to fraud over the past 12 months. They cited increased publicity about fraud, pressure from their board of directors, and a recent instance of fraud as the main reasons for this change.

In-house counsel may wish to consider whether their company is positioned to achieve the lower rates of fraud expected by executives at companies more effective at fraud control. Don't be surprised if you have to add new controls and improve your existing ones ' you are not alone.

[IMGCAP(1)]

[IMGCAP(2)]

Study Methodology

To conduct the study, the Deloitte Forensic Center commissioned a survey of executives drawn from internal audit, compliance, finance, risk management, legal and other areas involved with fraud control in a broad range of industries and from companies of all sizes. Sixty-four percent of respondents said their company was subject to Sarbanes-Oxley.

To analyze their different approaches, participating companies were categorized as either more effective at fraud control or less effective. Companies were considered as 'more effective' when executives gave their companies an average rating of 3.5 or greater (on a five-point scale) on their effectiveness in four areas: preventing internal fraud, detecting internal fraud, preventing external fraud, and detecting external fraud.

Only 41% of the 277 senior executives participating in the online survey rated their organization's fraud control performance highly enough to meet a threshold of 'more effective.' There were few differences across industries in the ratings with the exception of financial services, where 53% of executives rated their organization's effectiveness highly.

Toby J.F. Bishop, a member of this newsletter's Board of Editors, is a partner and Mohammed Ahmed is a senior manager in the Forensic and Dispute Services practice of Deloitte Financial Advisory Services LLP. They may be contacted at [email protected] and [email protected]. The views expressed in this article are those of the authors and may not be those of Deloitte Financial Advisory Services LLP.