Major Embezzlements

1) A material impact: In general, the smaller the company, the easier it is for an embezzlement to be material to the entity's financial statements. As a result, material embezzlements tend to arise mostly in smaller entities; these tend to be privately held, nonprofit, or local government entities. But media reports periodically remind us that material embezzlements are possible even in public companies, where embezzlements have at times exceeded $50 million. The entity's financial statements may be misstated to varying degrees, depending on how much of the embezzlement was treated as an expense rather than “parked” as a fictitious or inflated asset on the balance sheet. A large embezzlement can damage an entity's reputation with customers, potentially resulting in reduced revenue for an extended period. Skilled employees may be laid off due to temporary financial difficulties, but may not be available if the entity recovers and wants to rehire them. Lenders may withdraw or choose not to renew their loan facilities, potentially causing liquidity problems or even bankruptcy.

2) Executives or financial reporting managers involved: Having a member of senior management or someone in the financial reporting chain involved can draw into question management integrity, the ability to rely on certain management representations, and potentially the reliability of current or previously issued financial statements and regulatory or other key reports.

Small and medium-sized enterprises may rely on a high level of trust among a small group of owners or executives who share management responsibilities. But a high level of trust can also deter these people from making even basic periodic checks on each other's areas of responsibility, creating the opportunity for some owners or executives to embezzle large amounts.

3) Key worker involved: Embezzlements that involve a key worker, such as a top rainmaker, an invaluable creative person, or the owner of major customer relationships, can pose a great challenge to senior management. If they terminate the person, the entity's ability to survive and succeed may be questionable; if they do not, how can they trust that person in future, avoid further illegal acts, and credibly encourage other employees to act with integrity?

4) Lost confidence in entity's risk management: If the method or size of the embezzlement suggests a lack of effective risk management, several key stakeholders may reduce or withdraw support for the entity. For example, lenders may withdraw, reduce or decline to renew loan facilities; regulators may curtail or limit the entity's ability to operate; suppliers may withhold deliveries; customers may switch to other providers; and shareholders may seek to replace senior executives such as the CEO. Any of these might threaten the entity's ability to survive or succeed.

Ten Strategic Actions

In our experience there are at least ten actions many entities could take to help mitigate the risk of embezzlement or to help detect it earlier if it occurs.

1) Updating risk assessments: The economic downturn of 2007-2010 led many entities to reorganize their operations and put many households into financial difficulties that continue even now. Updating your entity's assessment of fraud risks may reveal areas where embezzlement and other fraud risks have increased, potentially exposing the entity to a level of risk that exceeds the board's risk tolerance. Additional risk mitigation may be needed.

2) Enhancing whistleblower systems: Forty percent of over 1,800 frauds analyzed in the Association of Certified Fraud Examiners' 2010 Report to the Nations on Occupational Fraud and Abuse were discovered through tips, making this the number one way in which frauds are detected. Assessing whistleblower systems through benchmarking and other techniques may identify aspects that are performing at a level below industry norms.
Enhancing employee awareness education and making the system available to suppliers, customers and the general public may help to produce additional useful reports.

3) Transaction monitoring and data mining: Today's technology tools make it easier than ever to monitor even a large volume of transactions. Used continuously or for mining batches of data, these tools can help identify anomalies that may be due to embezzlement, facilitating early detection. In-house counsel may wish to explore the opportunities to enhance fraud detection through transaction monitoring tools targeted at key risk areas. Publicizing the use of such tools can raise the perceived likelihood of detection, helping to deter embezzlements.

4) Validating segregation of duties: Downsizing and consolidating employees' responsibilities can inadvertently or even knowingly compromise segregation of duties, which is typically an important internal control to help mitigate the risk of embezzlement and other frauds. An assessment can reveal if incompatible functions have been combined, or if previously-effective internal controls have been compromised, creating greater opportunity for embezzlement. In-house counsel may advise executive management to consider cross-training and scheduling job rotations periodically, which can help deter and detect long-term embezzlement schemes, as well as provide greater staffing flexibility.

5) Redesigning business processes: Consolidating locations for cash receiving, cash disbursements, payroll or other financial functions reduces the number of locations where the opportunity to embezzle arises. It can also make stronger controls more affordable. Using a reputable outsourced service provider for one or more of these functions may also reduce an entity's embezzlement risks if the terms of the contract transfer this risk to the outsourcer and the outsourcer has the financial ability or sufficient insurance to back up that protection.

6) Revisiting background checks: The basic criminal background checks that many employers perform as part of the hiring process may only check records in one jurisdiction, typically that of the applicant's current residence. If an applicant has moved, past crimes may be missed. In-house counsel can work with the human resources function to re-evaluate the background check process. Enhancements may be needed to accomplish the desired risk mitigation.

7) Zero-based budgeting: Embezzlements that continue for several years can get “baked into” budgeted expenses, making them harder to spot. In-house counsel may wish to encourage the use of zero-based budgeting, which can strengthen financial control and help to prevent and detect embezzlements.

8) Employee assistance: Employee assistance services can help employees find ways to handle personal issues such as financial distress or addictions to drugs, gambling or shopping. This may help employees avoid turning to embezzlement as a solution. Reminding employees of these services more frequently may be beneficial.

9) Sustaining values: It's easier for people to rationalize embezzling if they fear losing their job, feel that they have been mistreated by their employer, or believe that executives and managers do not “walk the talk” of the entity's asserted values. Holding people accountable for living the entity's values even in difficult times can make it harder for employees to rationalize embezzling. It can also help deter other employees from aiding and abetting in embezzlement and potentially increase the likelihood of them reporting suspected wrongdoing.

10) Code of ethics/conduct and training: A values-based, well communicated, and consistently enforced code of ethics or code of conduct can be more effective when it is explicit about what actions are prohibited and how violators will be disciplined, such as through termination and prosecution. Evaluating employees' participation in compliance and ethics training may identify parts of the entity where managers may not have allowed employees the time to take such training.

Conclusion

Embezzlements may not often pose a serious threat, but if opportunities to embezzle a large amount are presented, the loss can pose a threat to the survival of the entity and cause reputational damage. In-house counsel may consider actions including the ones above to help mitigate the risk of major embezzlements.

Toby J.F. Bishop ([email protected]), a member of this newsletter's board of editors, is director of the Deloitte Forensic Center, and Donna Epps ([email protected]) is a partner and national leader of Anti-fraud Consulting, both for Deloitte Financial Advisory Services LLP. The views expressed in this article are those of the authors and may not be those of Deloitte Financial Advisory Services LLP.

Embezzlements are rarely large enough to cause major concern to in-house counsel, directors, officers and other members of management. But under at least four scenarios, embezzlements can threaten an entity's ability to execute its overall strategy. For example, in April 2011, regulators in one Asian country prohibited a financial services company from accepting new clients in a segment of its business where a large embezzlement had occurred. The regulator determined that the company had not implemented certain required internal controls to reduce the risk of embezzlement. In another country in Asia, foreign banks face revised regulations governing the ability to expand, following regulators' investigation of another major embezzlement. We discuss below ten actions entities can take to help mitigate the risk of major embezzlements.

Four Scenarios

Studying a number of entities that have experienced relatively large embezzlements suggests to us that those organizations experienced at least one of four scenarios. Understanding these scenarios may help your entity to identify and mitigate its particular risks of major embezzlements.

1) A material impact: In general, the smaller the company, the easier it is for an embezzlement to be material to the entity's financial statements. As a result, material embezzlements tend to arise mostly in smaller entities; these tend to be privately held, nonprofit, or local government entities. But media reports periodically remind us that material embezzlements are possible even in public companies, where embezzlements have at times exceeded $50 million. The entity's financial statements may be misstated to varying degrees, depending on how much of the embezzlement was treated as an expense rather than “parked” as a fictitious or inflated asset on the balance sheet. A large embezzlement can damage an entity's reputation with customers, potentially resulting in reduced revenue for an extended period. Skilled employees may be laid off due to temporary financial difficulties, but may not be available if the entity recovers and wants to rehire them. Lenders may withdraw or choose not to renew their loan facilities, potentially causing liquidity problems or even bankruptcy.

2) Executives or financial reporting managers involved: Having a member of senior management or someone in the financial reporting chain involved can draw into question management integrity, the ability to rely on certain management representations, and potentially the reliability of current or previously issued financial statements and regulatory or other key reports.

Small and medium-sized enterprises may rely on a high level of trust among a small group of owners or executives who share management responsibilities. But a high level of trust can also deter these people from making even basic periodic checks on each other's areas of responsibility, creating the opportunity for some owners or executives to embezzle large amounts.

3) Key worker involved: Embezzlements that involve a key worker, such as a top rainmaker, an invaluable creative person, or the owner of major customer relationships, can pose a great challenge to senior management. If they terminate the person, the entity's ability to survive and succeed may be questionable; if they do not, how can they trust that person in future, avoid further illegal acts, and credibly encourage other employees to act with integrity?

4) Lost confidence in entity's risk management: If the method or size of the embezzlement suggests a lack of effective risk management, several key stakeholders may reduce or withdraw support for the entity. For example, lenders may withdraw, reduce or decline to renew loan facilities; regulators may curtail or limit the entity's ability to operate; suppliers may withhold deliveries; customers may switch to other providers; and shareholders may seek to replace senior executives such as the CEO. Any of these might threaten the entity's ability to survive or succeed.

Ten Strategic Actions

In our experience there are at least ten actions many entities could take to help mitigate the risk of embezzlement or to help detect it earlier if it occurs.

1) Updating risk assessments: The economic downturn of 2007-2010 led many entities to reorganize their operations and put many households into financial difficulties that continue even now. Updating your entity's assessment of fraud risks may reveal areas where embezzlement and other fraud risks have increased, potentially exposing the entity to a level of risk that exceeds the board's risk tolerance. Additional risk mitigation may be needed.

2) Enhancing whistleblower systems: Forty percent of over 1,800 frauds analyzed in the Association of Certified Fraud Examiners' 2010 Report to the Nations on Occupational Fraud and Abuse were discovered through tips, making this the number one way in which frauds are detected. Assessing whistleblower systems through benchmarking and other techniques may identify aspects that are performing at a level below industry norms.
Enhancing employee awareness education and making the system available to suppliers, customers and the general public may help to produce additional useful reports.

3) Transaction monitoring and data mining: Today's technology tools make it easier than ever to monitor even a large volume of transactions. Used continuously or for mining batches of data, these tools can help identify anomalies that may be due to embezzlement, facilitating early detection. In-house counsel may wish to explore the opportunities to enhance fraud detection through transaction monitoring tools targeted at key risk areas. Publicizing the use of such tools can raise the perceived likelihood of detection, helping to deter embezzlements.

4) Validating segregation of duties: Downsizing and consolidating employees' responsibilities can inadvertently or even knowingly compromise segregation of duties, which is typically an important internal control to help mitigate the risk of embezzlement and other frauds. An assessment can reveal if incompatible functions have been combined, or if previously-effective internal controls have been compromised, creating greater opportunity for embezzlement. In-house counsel may advise executive management to consider cross-training and scheduling job rotations periodically, which can help deter and detect long-term embezzlement schemes, as well as provide greater staffing flexibility.

5) Redesigning business processes: Consolidating locations for cash receiving, cash disbursements, payroll or other financial functions reduces the number of locations where the opportunity to embezzle arises. It can also make stronger controls more affordable. Using a reputable outsourced service provider for one or more of these functions may also reduce an entity's embezzlement risks if the terms of the contract transfer this risk to the outsourcer and the outsourcer has the financial ability or sufficient insurance to back up that protection.

6) Revisiting background checks: The basic criminal background checks that many employers perform as part of the hiring process may only check records in one jurisdiction, typically that of the applicant's current residence. If an applicant has moved, past crimes may be missed. In-house counsel can work with the human resources function to re-evaluate the background check process. Enhancements may be needed to accomplish the desired risk mitigation.

7) Zero-based budgeting: Embezzlements that continue for several years can get “baked into” budgeted expenses, making them harder to spot. In-house counsel may wish to encourage the use of zero-based budgeting, which can strengthen financial control and help to prevent and detect embezzlements.

8) Employee assistance: Employee assistance services can help employees find ways to handle personal issues such as financial distress or addictions to drugs, gambling or shopping. This may help employees avoid turning to embezzlement as a solution. Reminding employees of these services more frequently may be beneficial.

9) Sustaining values: It's easier for people to rationalize embezzling if they fear losing their job, feel that they have been mistreated by their employer, or believe that executives and managers do not “walk the talk” of the entity's asserted values. Holding people accountable for living the entity's values even in difficult times can make it harder for employees to rationalize embezzling. It can also help deter other employees from aiding and abetting in embezzlement and potentially increase the likelihood of them reporting suspected wrongdoing.

10) Code of ethics/conduct and training: A values-based, well communicated, and consistently enforced code of ethics or code of conduct can be more effective when it is explicit about what actions are prohibited and how violators will be disciplined, such as through termination and prosecution. Evaluating employees' participation in compliance and ethics training may identify parts of the entity where managers may not have allowed employees the time to take such training.

Conclusion

Embezzlements may not often pose a serious threat, but if opportunities to embezzle a large amount are presented, the loss can pose a threat to the survival of the entity and cause reputational damage. In-house counsel may consider actions including the ones above to help mitigate the risk of major embezzlements.

Toby J.F. Bishop ([email protected]), a member of this newsletter's board of editors, is director of the Deloitte Forensic Center, and Donna Epps ([email protected]) is a partner and national leader of Anti-fraud Consulting, both for Deloitte Financial Advisory Services LLP. The views expressed in this article are those of the authors and may not be those of Deloitte Financial Advisory Services LLP.