Occupational fraud is not solely a financial threat, and it can also potentially change an organization’s reputation, culture, and relationships. But before dealing with any larger ramifications of fraud, defrauded organizations must first assess the damage and do what they can to “clean up the mess.” This may include terminating the perpetrator, taking civil action, or referring the perpetrator to the police. Whatever an organization chooses to do following a fraud incident, immediate action is critical and internal controls must be addressed.
How Do Victims React To Being Defrauded?
In its Occupational Fraud 2024: A Report to the Nations, the Association of Certified Fraud Examiners (ACFE) reveals that when organizations uncover fraud, 67% choose to terminate the individuals involved. In 57% of cases, organizations refer fraud perpetrators to law enforcement. Of those, 45% result in the perpetrator pleading guilty or no contest, while 27% are convicted at trial. In 14% of referred cases, law enforcement declines to prosecute.
When fraud comes to light, the role of legal counsel is critical. If your organization discovers fraud, be sure to notify your attorney before launching any investigation. Attorneys can provide guidance on how to handle potential suspects, including whether to suspend or terminate them from work, how to notify them of your decision, and what to communicate with other workers.
Also consider engaging a forensic accountant. This fraud expert can help analyze records and data, identify suspects, interview witnesses, recover financial losses, and collect evidence that will hold up in court (if applicable). Keep in mind that you may want to let your attorney hire the forensic accountant.
Whether your organization or a fraud expert conducts the investigation, it typically will involve several steps. These include gathering and reviewing relevant documents (including digital files), interviewing possible perpetrators and their coworkers, and preparing a comprehensive investigative report. Your organization also must — with legal input — decide whether it plans to pursue criminal or civil charges against those involved.
How Can You Mitigate Losses?
Note that recovering financial losses from fraud isn’t necessarily straightforward. The ACFE found that 57% of organizations recovered nothing, 30% made a partial recovery and only 13% recovered all losses related to fraud.
Such figures only highlight the need for robust internal controls to mitigate losses in the first place. For example, the ACFE reports that if surprise audits aren’t used by an organization, the median loss if fraud occurs is $200,000. But if surprise audits are used and an organization suffers a fraud incident, its median loss is only $75,000 — a 63% reduction. Obviously, following this approach to risk reduction acknowledges that internal controls aren’t always foolproof. However, when controls are deployed — particularly if your organization has several layers of protection — they can reduce median losses significantly and possibly prevent fraud altogether.
In addition to surprise audits, these controls are associated with faster detection of schemes and at least a 50% reduction in financial losses:
- Management review,
- Routine financial statement audits,
- Availability of an anonymous fraud tipline,
- Fraud training for managers,
- A written antifraud policy, and
- Proactive data monitoring.
In 32% of fraud incidents, the most common factor is a lack of internal controls. In an additional 19% of cases, managers and others override existing controls. So controls must not only exist, they also must be rigorously followed.
How Should You Address Risk?
If an employee commits fraud, what your organization decides to do will depend on the extent of the fraud, the available evidence, and many other factors. So that you’ll hopefully never have to make such difficult decisions, take steps now to help ensure your internal controls address your organization’s risks. Contact us for help.