In PwC’s 2020 global economic crime and fraud survey, Fighting Fraud – A never-ending battle, fraud was identified among the top concerns. So the ability to identify fraud perpetrated from either within or outside the organisation and then to deal with it swiftly and fairly is critical.
In one large local company on whose board I serve, I chair the Board Audit, Risk and Compliance Committee, where the issue of identifying and handling fraud and other integrity issues features prominently. So let me share the lessons we have been learning in dealing with such matters.
A major challenge organisations face is just gathering information on fraud being perpetrated by employees or others, which is why many have invested in ways of making it as easy as possible to communicate information about integrity lapses.
These include ethics hotlines, compliance web portals, and email contacts to which to send such information – often outside of the organisation, and typically to an audit firm.
Not surprisingly perhaps, utilisation of these platforms is relatively low when compared to informal reporting, or finding out about cases through the grapevine.
Organisations, therefore, need to build cultures and systems that enable whistleblowers to feel it is the right thing to do and to feel secure about doing so. Some even provide monetary incentives, although this may encourage false whistleblowing – a not unusual occurrence anyway.
The speed with which reported issues are investigated, action is taken, and communication is fed back to the whistleblower, has a direct impact on confidence in the process. So there must be adequate investigating capacity, with staff possessing the relevant forensic experience.
Matters reported must be handled with utmost confidentiality, for whistleblowers need to remain anonymous, thus minimising the chances of retaliatory actions being taken by those involved in the integrity matter.
Then, staff in departments that are likely to access information on matters being reported – such as ICT, investigations and internal audit – should sign Non-Disclosure Agreements.
Some decide to sue staff for damages resulting from integrity issues, pursuing criminal and/or civil litigation. But the evidence threshold for successful litigation is extremely high, so one must ensure that documentation and other sources of evidence are impeccable – no mean feat.
For criminal proceedings, the investigating officers and prosecutors need to be properly appraised of the matter to ensure they fully understand the issues, prepare robust witness statements, and hence prosecute successfully.
In addition to the evidence, witnesses must come forward and corroborate that evidence, so organisations need to publish guidelines on witness protection, together with incentives to encourage witnesses to be present in what are likely to be lengthy court processes.
When obtaining evidence from private investigators, one must ensure that it is obtained through legal means, so that it can stand scrutiny in court.
Organisations also need to be alive to the fact that fraud can be perpetrated by anyone – even those responsible for ensuring internal compliance and investigating abuses.
Serious background checks and vetting therefore should be carried out before onboarding such staff, and an internal mechanism must be put in place to ensure that fraud perpetrated by staff in these offices can be detected.
In staff induction programmes the value of integrity and the importance attached to compliance should be included for all staff, and there should be continuous emphasis by all levels of management on these subjects in staff meetings.
Alongside this, those who uphold the value should be recognised, while those who do not should be penalised.
A major fraud risk results from conflicts of corporate and individual interests. It is therefore important for staff to be given an opportunity to declare such potential or actual conflicts so as to remain relaxed in their roles.
The process of making declarations should be continuous, so that staff are given an opportunity to declare interest conflicts upfront.
What happens when there is proof of culpability, and the organisation wishes to recover its losses from the employee?
With the slow pace of court litigation, it takes forever, diminishing the value of any recoveries. And that’s if the verdict is favourable, in itself of relatively low probability. But at least with the introduction of the Small Claims Courts such matters will be concluded much more quickly.
The more I have been involved in these integrity and compliance issues, the more I have realised how complex and challenging it is to deal with them, and how one must keep constant focus on them and keep applying the lessons learned.