14-094 CAQ Detering&Detecting 1110

of all kinds, including financial reporting fraud. Astrong ethical culture hedges against all three sidesof the fraud triangle—pressure, opportunity, andrationalization. In an ethical culture, pressure tocommit fraud is counteracted through sound riskmanagement strategies and appropriate incentives.It will support well-designed controls that reduceopportunities for fraud and increase the likelihoodof early detection. A culture of honesty limits anindividual’s ability to rationalize fraudulent actions.The primary responsibility for an organization’sculture falls to management. Corporateleadership, including senior executives and theboard of directors, sets the “tone at the top” bycommunicating and visibly adhering to clear ethicalprinciples and codes of conduct, and by providingnecessary support and resources for robust fraud riskmanagement programs and internal controls.Another vital ingredient in an ethical cultureis skepticism. Management should encourageemployees to feel not only comfortable but alsoobliged to question and challenge the results forwhich they are responsible.Boards of Directors and AuditCommitteesWith an essential role in strategy development,allocation of resources, risk oversight and thehiring, evaluation, and compensation of seniormanagement, boards are uniquely positioned toassist in deterring and detecting financial reportingfraud. In addition, although management arguablyhas the most critical role in fraud deterrence anddetection, most material financial reporting fraudcases involve senior management,1 which makes iteven more critical to have knowledgeable, engagedboards of directors overseeing them.Board members need to have an informed approachto all matters that come before them. This meansthat they must know how to exercise skepticism ina constructive manner, being aware of their ownpossible biases in judgment. The board, collectively,6must have a reasonably thorough knowledge of thecompany it serves, including an understandingof the key drivers of revenue and profitability.Like management, board members should becognizant of the role that pressure, opportunity,and rationalization can play in financial reportingfraud. They also should be alert to signs of possibleweaknesses in management’s tone at the top.The audit committee of the board overseesmanagement’s financial reporting process andinternal controls, the internal audit function, andthe external auditor. Skepticism is vital in all theseaspects of the audit committee’s role, including theselection of the external auditor and evaluation ofauditor performance. Audit committee membersshould be familiar with risks that can increase thelikelihood of fraud, and how to monitor the risk ofmanagement override of internal controls.In public companies, the audit committee isresponsible for establishing a confidential,anonymous reporting mechanism, which isrequired under the Sarbanes-Oxley Act, to managecomplaints about an organization’s accounting,internal controls, or auditing matters. This usuallytakes the form of a whistleblower or ethicshelpline. This is a critical function, because tipsfrom employees are the most common method foruncovering fraud.2 Audit committee members shouldalso be familiar with Public Company AccountingOversight Board (PCAOB) auditing standardsgoverning what the external auditor is required tocommunicate to the audit committee, particularlyspecific requirements related to fraud and illegal acts.Internal AuditThe internal audit function acts as the eyesand ears of an organization with respect to riskmanagement, control, and governance processes.Taking a risk-based approach, internal auditorsevaluate the effectiveness of these processes on acontinual basis. In addition, they may monitor andevaluate results of whistleblower programs andcollaborate across departments to help ensure thatANTI–FRAUD COLLABORATION

Internal audit should communicate, evaluate, andreinforce the ethical tone of an organization, as wellas test compliance with anti-fraud programs andother controls. Skepticism must be employed in theexamination of management’s fraud risk assessment,review of evidence supporting management’sassertions in the financial statements, and in theevaluation of controls intended to deter or detectfraud.Internal audit must operate with organizationalindependence, which usually means direct functionalreporting to the audit committee and unrestrictedaccess to both the board and audit committee in theevent concerns arise.External AuditThe external auditor provides an opinion on acompany’s annual financial statements and, in manycases, an opinion on the effectiveness of the entity’sinternal control over financial reporting. Externalauditors are engaged by and report directly tothe audit committee, but have regular contactwith management across a company’s operations.While not a component of a company’s systemof internal control over financial reporting, theaccumulated general knowledge external auditorsbring from working across multiple organizationscan be a resource for boards, management, andaudit committees.Professional standards require the external auditorat a minimum to understand the company’s systemof internal control over financial reporting as part ofits risk assessment process during the planning of afinancial statement audit. This includes considerationof the company’s tone at the top and corporateculture, and incentives or pressures that may driveTHE FRAUD–RESISTANT ORGANIZATIONan employee to commit financial reporting fraud.When developing the audit plan, the auditor shouldconsider such factors as management’s philosophyand operating style (including the integrity andethical values practiced by management), the natureof the board and audit committee’s oversight,and the company’s human resource policies andpractices, with a particular focus on its compensationarrangements.Auditing standards require external auditors toexercise “professional skepticism,” which meansthey need to be alert for information suggestingmaterial misstatements of financial statements,and to be critical when evaluating audit evidence.Auditing standards define professional skepticism as“an attitude that includes a questioning mind and acritical assessment of audit evidence.”3 Externalauditors must apply professional skepticismwhen considering the risk that management mayoverride internal controls, and take that risk intoaccount when formulating judgments about thenature, timing, and extent of audit testing. Externalauditors should also be aware of judgment biasesthat can affect the exercise of an effective level ofprofessional skepticism in the conduct of the audit.4EXECUTIVE SUMMARYresults are addressed and that applicable weaknessesin the governance, risk management, and internalcontrol environment are remediated. In many cases,they also assess compliance with the code of ethics,conduct ethics surveys of employees, and analyzeyear-over-year changes in key metrics.CommunicationsAn environment of open and ongoingcommunication with a goal of sharing knowledge,insights, and concerns to enhance the collectiveefforts is also vital in a fraud-resistant organization.Management should encourage communicationbetween managers and employees at all levels andhelp ensure boards, audit committees, and internaland external auditors are well informed on a timelybasis about the company’s operations, strategies,and risks.Communication is also a key element in identifyingand assessing potential risks of financial reportingfraud, and in developing controls that help mitigatethose risks. The updated 2013 internal controlintegrated framework published by the Committee7

of Sponsoring Organizations of the TreadwayCommission (COSO) calls for management toconduct a fraud risk assessment and emphasizes thatorganizations need to include the appropriate levelsof management as part of that assessment.Boards and audit committees are integral to thisprocess and should ask questions of management,internal auditors, and external auditors to elicitindications of potential concerns related to incentivesor opportunities for financial reporting fraud. Theyshould have executive sessions with their internalaudit staff, as well as the external auditor, even in theabsence of special concerns or significant issues. Inaddition, they should take advantage of opportunitiesto interact with managers, employees, vendors andcustomers to enhance knowledge of the companyand possible risks of financial reporting fraud. Internalauditors should conduct regular meetings with seniormanagement, the audit committee, and the externalauditor to exchange insights and perspectives.Ongoing, open lines of communication betweenthe organization’s chief audit executive and bothmanagement and the audit committee are crucial.External auditors should promote opportunities forrobust conversations with the audit committee onrelevant matters, including management’s approachto developing significant accounting estimates andfactors considered in the auditor’s assessment offraud risk. While executive sessions with the auditcommittee are not required under the auditingstandards, they do provide a forum for candiddiscussion.Global ConsiderationsLarger organizations, particularly those operating inmore than one country, can face unique challengesin determining a consistent application of their8anti-fraud principles and initiatives throughoutall locations and within various cultures. Varyingcustoms and languages can challenge themaintenance of a consistent level of ethical behaviorin a global organization. Not only must organizationstranslate ethical principles, codes of conduct, andfraud training materials into different local languages,they also must understand the various cultures inwhich a company operates, and tailor policies to localcustoms and monitor controls and compliance acrossall locations.The three sides of the fraud triangle—pressure,opportunity, and rationalization—can take onadditional significance in global organizations.Employees might feel pressure to achieve aggressivetargets. Distance from headquarters cannot onlyincrease opportunity to commit fraud, but might alsolead to diluted communications from headquartersabout ethical standards, enabling rationalization. Riskmanagement programs must be fully implemented in,and adapted to, all locations to reduce opportunity,especially in parts of the world where perpetratorsof fraud may be less likely to fear, or even face,consequences.Global organizations can mitigate the challengeof translating an ethical culture to overseaslocations by having awareness of laws, customs,and unique risks in the various regions in which acompany is operating, and by adapting policies,communications and training accordingly. Companiesalso should be aware of the consequences offailure to comply with laws such as the U.S. ForeignCorrupt Practices Act (FCPA) of 1977, the UKBribery Act of 2010, and the Organisation forEconomic Co-operation and Development (OECD)Convention on Combating Bribery of Foreign PublicOfficials in International Business Transactions, whichcame into force in 1999.ANTI–FRAUD COLLABORATION

1THEFRAUD-SUSCEPTIBLECULTUREOxalite Inc.: A Cautionary Tale*The headlines stunned investors, regulators, and the business community. Over a period of five years,several members of the management team at Oxalite Incorporated had engaged in fraudulent financialreporting. The offenses discovered included revenue-timing schemes and the creation of fictitious revenuein both U.S. and Asian offices.Prior to the discovery, a cursory look at Oxalite would have given little hint of vulnerabilities to financialreporting fraud. Its board of directors was populated with respected individuals. Oxalite had a writtencode of conduct. It had expanded at a healthy rate, even opening facilities in Asia. The company hadexperienced steady profits.But a look behind the curtain revealed a culture that encouraged and enabled fraud. Promotions werebased on loyalty rather than competence. “Fast” and “new” were the watchwords, trumping “deliberate”and “documented.” Employees did not feel safe bringing bad news forward. Furthermore, skepticism wasdiscouraged; questions frowned upon.Executives shared the company code of conduct with investors, media, and others outside the company;however employees were simply provided with a weblink to the code upon hire and few had everaccessed or read it. A significant portion of executive compensation hinged on “making the numbers.”The Asian offices came under particular pressure, as hopes for ever-higher earnings were pinned onrapid-growth markets. Executives struggled to hit targets but learned to manipulate the books to make itappear they had.The board of directors and audit committee met regularly but rarely availed themselves of theopportunity to engage internal or external auditors, or the company’s ethics and compliance personnel.Board meetings discouraged two-way discussion, and the board frequently ran out of time before ethicsand compliance issues could be discussed. The audit committee rarely met with executives or middlemanagement, and when they did, failed to ask questions whose answers might have raised red flags. Inshort, the participants in the financial reporting supply chain were insufficiently inquisitive or skeptical.They assumed all was well. It was not.*Oxalite Inc. is a fictional company created for illustrative purposes.THE FRAUD–RESISTANT ORGANIZATION9

Each case of financial reporting fraud is its owndrama, with a unique set and cast of characters andactions that unfold across different scenes. But if onewatches enough of these dramas, themes emerge.While Oxalite, Inc. is fictional, the vulnerabilitiesdescribed are present in many cases of financialreporting fraud. While the company had a codeof ethics, in reality, the practices followed by topmanagement did not conform with the code.Financial reporting fraud does not require a perfectstorm—an organization need not have multiplevulnerabilities to fall victim to financial reportingfraud. Any one of an array of deficiencies canincrease an organization’s susceptibility. However,the vigilance and engagement of all who have a rolein preparing or reviewing an organization’s financialstatements can act as a protective mechanism, sofrauds are more often deterred and more easilydetected.An examination of what causes one organizationto be susceptible to fraud while another is resistantshould begin with the character at center stage inevery fraud drama: the fraudster.The “Typical” FraudsterWho perpetrates financial reporting fraud? Amastermind, a born fraudster with a clever, criminalmind who recruits others to his or her cause? Oris it an otherwise honest employee who, throughcircumstances, turns to fraud?Research indicates it is more often the latter.According to data compiled by KPMG oninvestigations of 348 serious frauds in 69 countries,60 percent of individuals who are found to havecommitted fraud had been with their companiesfor more than five years. Since the average fraudis discovered within three years, it is a logicalconclusion that most fraudsters do not join anorganization with the intent to defraud. Just ascertain conditions can make an organization moresusceptible to fraud, so too can conditions lead an10otherwise honest employee to commit fraud.5 Inthis study, serious frauds are those considered to beof material value, such as material misstatement offinancial results, theft of cash or other assets, andabuse of expenses.The COSO study, Fraudulent Financial Reporting,1998 – 2007: An Analysis of U.S. Public Companies.2010, examined Securities and Exchange Commission(SEC) Accounting and Auditing Enforcement Actions(AAERs). The analysis of 347 enforcement actionsindicated that the CEO was named in 72 percentof the fraud cases, and the CFO was named in65 percent. In 89 percent of the fraud cases, theSEC named the CEO and/or the CFO for some levelof involvement.The Fraud TriangleNoted 20th century criminologist Donald Cresseydeveloped the “fraud triangle” to describethree conditions—pressure, opportunity, andrationalization—that can lead someone to commitfraud. He or she is tempted by pressures, enjoysopportunity through few or easy-to-overcomecontrols, and is encouraged by a corporate culturethat enables rationalization of actions.The three sides of the triangle merit furtherexamination, as they play a role in almost everyfactor that causes an organization to be susceptibleto fraud.Pressure: Pressure can be a positive force. Whengoals are achievable, they inspire creativity, efficiency,and healthy competitiveness. But what if goalsare unrealistic, seemingly unattainable by normalmeans? In those circumstances, pressure can inspirefear, particularly if failure to meet goals affectsadvancement, compensation, and possibly evencontinued employment.Fear, greed (the desire for personal gain), or acombination can exacerbate pressure. In KPMG’s2013 Integrity Survey, more than two-thirds of theANTI–FRAUD COLLABORATION

CHAPTER 1The Fraud rce: Center for Audit Quality, Deterring and Detecting Financial Reporting Fraud: A Platform for Action, October 2010.3,500 U.S. employees surveyed cited pressureto do “whatever it takes” to meet business goalsas the prime driver of misconduct, more thanany other cause cited. Similarly, the analysis ofSEC enforcement reports published by COSO in2010 found the most commonly cited motivationsfor financial reporting fraud were “the need tomeet internal or external earnings expectations,an attempt to conceal the company’s deterioratingfinancial condition, the need to increase the stockprice, the need to bolster financial performancefor pending equity or debt financing, or the desireto increase management compensation based onfinancial results.”6Opportunity: Even when pressure is extreme,financial reporting fraud cannot occur unless anopportunity is present. Opportunity arises mostbasically from the susceptibility of the company’saccounting systems to manipulation due to inherentrisks from management override or collusion, asTHE FRAUD–RESISTANT ORGANIZATIONwell as risks due to poorly designed or implementedinternal control structures.Rationalization: Rationalization of fraud can be abyproduct of pressure—“If I hit my quarterly target,it will trigger bonuses for me and my team.” Anindividual may intentionally make what they believeis a one-time reporting error and rationalize that itwill be corrected in subsequent periods. Instead,the error gets compounded, making it more difficultfor the individual to come forward and correct themistake for fear of repercussions from supervisors,thus sending the employee down the “slipperyslope.” Sometimes the rationalization is altruism—the misreporting is intended to help the companythrough a difficult period. If an organization hasno affirmative code of ethics, or if it exists butis not visibly promoted, or if the culture does notencourage the reporting of “bad news,” then it willbe even easier for employees to keep silent andrationalize their fraudulent behavior.11

WHO COMMITS FRAUD?The snapshots below are gleaned from 348 actual fraud investigations in 69 countries, representing abroad sample of frauds that include theft of cash and/or other assets, abuse of expenses, and a rangeof other fraudulent acts that are considered to be of material value, including material misstatement offinancial results.Age of fraudster:Time at the organization:36–45: . 41%3–5 years: .29%46–55: . 35%6–10 years: . 27%Other:. 24%Over 10 years: . 33%Other:. 11%Gender:Fraud committed:Men: . 87%In collusion with another party:. 61%Women: . 13%Acting alone: .39%Rank within the organization:Senior management: . 35%Management: .29%Other:.36%Methods used to override controls:Weak internal controlsexploited: . 74%Reckless dishonesty,regardless of controls: . 15%Collusion to circumventgood controls:. 11%Where the fraudster works:Discovery of fraud:Finance: . 32%Frauds discovered by chance: . 13%CEO: . 26%Frauds preceded by a “red flag”: .56%Operations/Sales: . 25%Initial red flags acted on:.6%Other:.17%Other:. 25%Employed by the organizationthat was defrauded:.90%Source: KPMG International. Who is the Typical Fraudster? 2011.12ANTI–FRAUD COLLABORATION

THE FRAUD–RESISTANT ORGANIZATIONThe Fraud-ResistantOrganiza

Financial reporting fraud comes at a high cost. The 2014 Report to the Nations on Occupational Fraud and Abuse by the Association of Certified Fraud Examiners (ACFE) found that while such reporting fraud made up just nine percent of the occupational fraud cases studied, it continues to be the