We previously discussed how occupational fraud refers to fraud committed by individuals against the organizations that employ them. We continue our occupational fraud series by reviewing the control weaknesses contributing to fraud. Awareness of common control weaknesses can help you proactively manage risk in your area of influence.
Control Weaknesses Contributing to Occupational Fraud
For its most recent report, the Association of Certified Fraud Examiners (ACFE) wanted to understand the factors that can lead to occupational fraud.1 So, it asked survey participants to identify the primary control weaknesses that allowed the fraud case to occur. Here's what the ACFE learned:
“The most common factor underlying the occupational frauds in our study was a lack of internal controls; 29% of victim organizations did not have adequate controls in place to prevent the fraud from occurring.
“Another 20% of cases involved an override of existing controls, meaning the victim organization had implemented mechanisms to protect against fraud, but the perpetrator was able to circumvent those controls.
“Together, this data shows that nearly half of the frauds in our study likely could have been prevented with a stronger system of anti-fraud controls.
“Individuals with different levels of authority within an organization tend to have different amounts of access and influence, which can effect how they are able to perpetrate fraud. We analyzed how the control weaknesses varied by the position of the perpetrator."
Here's a summary of the contributing weaknesses identified in the fraud cases reported to the ACFE.
As the ACFE noted, the first two comprise 49 percent!
- 29% - Lack of internal controls (34% for staff-level fraud)
- 20% - Override of existing controls (23% for manager-level fraud)
- 16% - Lack of management review (about the same across all levels)
- 10% - Poor tone at the top (23% for executive-level fraud)
- 8% - Lack of competent personnel in oversight roles
- 7% - Various other factors
- 5% - Lack of independent checks or audits
- 3% - Lack of employee fraud education
- 2% - Lack of clear lines of authority
Perhaps the lack of internal controls was due to poor tone at the top or incompetent personnel. Or maybe the override of existing controls was made possible by a lack of management review. There's undoubtedly overlap and a "chicken or the egg" situation in the control weaknesses reported.
A university's control environment is the foundation for its internal control system.2 But an internal control system can fall apart like a giant Jenga puzzle when its foundation has fissures. One where controls are lacking, employees wink at policies, oversight is poor, and no one notices or follows up.
Many frauds in higher education are not the product of an overly complex scheme. They're often the result of someone exploiting the lack of controls (especially segregation of duties) or regular management review.
Those two activities are similar in practice because both involve keeping an eye on what's happening in one's area of influence. The opportunity for fraud arises when there is too little oversight and no follow-up.
But the occurrence of fraud when an opportunity arises is not a given. Most employees will not act on the opportunity; many will take action to correct the control deficiency.
You have good people on your team! Nevertheless, you can't know everything about your employees, their outside pressures, or how they might rationalize bad choices.
People you trust can feel and succumb to pressure and rationalize fraud. When opportunity aligns with an employee's perceived financial pressure and subsequent rationalization, the risk of fraud heightens.3
Trust is not an internal control! That's why you assess your controls rather than the people involved.
We have reviewed examples of situations like this previously on the blog:
Med Center Misappropriation - A Cautionary Tale
The Art of Noticing - Part 1, Would You Notice if $1.3 Million was Missing?
St. Louis Shenanigans - How a Trusted Employee Stole More than $5 Million
Couple Causes Chaos - This is How They Violated a University's Trust
1 Occupational Fraud 2022: A Report to the Nations
2 Your Role in Internal Control - Episode 4, Control Environment