MANAGING FRAUD RISK WITH LIMITED RESOURCES

Size: px

Start display at page:

Download "MANAGING FRAUD RISK WITH LIMITED RESOURCES"

Iris Sims
6 years ago
Views:

1 MANAGING FRAUD RISK WITH LIMITED RESOURCES BDO UAE Seminar 14 November 2016

MANAGING FRAUD RISK TECHNOLOGY OPPORTUNITIES Certified Information Systems Security Professional (CISSP) Certified Ethical Hacker (CEH) Certified Hacking Forensic Investigator (CHFI) ISO 27001 Lead

2 MANAGING FRAUD RISK TECHNOLOGY OPPORTUNITIES Certified Information Systems Security Professional (CISSP) Certified Ethical Hacker (CEH) Certified Hacking Forensic Investigator (CHFI) ISO Lead Implementer Trainer Richard Uhunmwagho Manager, Technology Advisory Implemented and audited Cybersecurity programs for various organizations across different sectors based on global best practice standards such as ISO 27001, NIST, ADSIC, ISR. Recently awarded one of the top 100 Information Security Executives in the CISO Middle East awards for Page 2

3 MANAGING FRAUD RISK TECHNOLOGY OPPORTUNITIES 1. WHAT IS COMPUTER FRAUD? 2. CYBERCRIME AND COMPUTER FRAUD RELATIONSHIP 3. CIA TRIAD 4. FRAUD TRIANGLE 5. BREAKING THE FRAUD TRIANGLE 6. TECHNOLOGY OPPORTUNITIES 7. CASE STUDY 8. CONCLUSION Page 3

4 What is Computer Fraud? Defalcation Embezzlement Data files/operations Computer Systems Any defalcation or embezzlement accomplished by tampering with computer programs, data files, operations, equipment, or media and resulting in losses sustained by the organization whose computer system was manipulated - ACFE (Association of Certified Fraud Examiners) Page 4

5 What is Cybercrime? Cybercrime is any illegal activity that involves a computer or network-connected device, such as a computer or a mobile phone - US Department of Justice (DOJ) Page 5

6 CIA Triad Confidentiality Integrity Availability Page 6

7 Fraud Triangle Opportunity Pressure/Incentive Rationalization Page 7

8 Breaking the Fraud Triangle Breaking the Fraud Triangle is the key to fraud deterrence - removing one of the elements in the fraud triangle in order to reduce the likelihood of fraudulent activities. The removal of Opportunity is most directly affected by the system of internal controls and generally provides the most actionable route to deter fraud. The enhanced use of Information Technology in our business operations combined with deteriorating social values is making fraud rampant and bringing more companies in the clutches of fraudsters. Page 8

9 Page 9

10 Source: ISACA Page 10

11 Where/What are these Technology-fueled' opportunities? Page 11

12 Fraud Detection Initial Detection of Occupational Frauds- U.S Source: ACFE 2016 Report to the Nation Fraud and Technology Opportunities November 2016 Richard Uhunmwagho BDO UAE Page 12

13 Case Study 1 Donald, an IT Manager had been with XYZ Furniture Ltd since inception and earned the trust of top management. He had admin access on the accounting platform, including addition/removal of access rights and updating database records. Hillary is the accounting head. Services provided are paid by cash/cheque by the customer. When the cheque of Customer A bounces, Susie collects it from the bank and keeps it. Customer A comes back with cash but not given his check. Customer B comes to pay with cash and his records are updated with Paid-with-cheque by Susie (bounced cheque used as reference). Hillary tells Donald to update the record on the database of Customer B to paid. Page 13

14 Case Study 2 Melania was a class act, she joined the Hospitality group, HNB Ltd in 2010 and immediately her superiors knew she was a talent. By the end of 2014, she had worked in four different departments within the firm and had excelled in a senior role. Melania found herself in a position of extraordinary privileges in relation to the firm s information systems and assets. Last year she was being investigated for masterminding a mind-boggling fraud. Page 14

15 Case Study 3 BXA Ltd, a travel agency, boasts a young vibrant team with flexible work hours for staff and work-from-home options. Bernie has been with the firm for 7 years and had only gone on leave during his first year. He worked in Purchase Dept and 4 years ago, discovered a loophole in the system which allowed him to carry out unscrupulous daily tasks resulting to the approval of bogus payments to vendors (his friends). As part of the new HR policies, Mandatory annual leave is now being enforced and Ibrahim had no option but to comply. Bernie goes on his leave, comes back and continues from where he stopped, like he never left. Page 15

Case Study 4 Ted and Michelle worked in the payroll department of an investment bank, ABC Investments and Securities LLC. Ted reported to Michelle. Michelle, do you believe in ghosts?

16 Case Study 4 Ted and Michelle worked in the payroll department of an investment bank, ABC Investments and Securities LLC. Ted reported to Michelle. Michelle, do you believe in ghosts? Ted had the authority to create employees into ABC s payroll system, correct payroll information, and distribute paychecks. reviews all of his work before approval. Whilst there was segregation of duties in place, Michelle trusted Ted with her password one time and he was able to input ghost employees into the system and approve them, without Michelle knowing. Page 16

17 Case Study 5 Bob is the CEO of a fast-rising hypermarket chain. His family members are avid users of all the popular social media platforms. In November 2015, they all were travelling to Honululu for a family vacation - an 18 hour flight. Dan, the CFO, receives an supposedly from Bob mid-flight instructing him to wire a substantial amount of money to his account (provides account details) so he can settle some personal expenses while on the trip Page 17

18 Case Study 6 Timothy has been with GED LLC for 5 years, a luxury brand distributor company with offices spread across the region. Timothy is a tea boy/cleaner and comes across as amicable. He works at the head office and comes in before most of the other staff. He cleans, runs errands and serves tea all through his 7:30am to 4pm routine daily. Last 6 months, he had been social-engineered (quite radically) by a competitor. The Target? The GED s confidential data/customers. Page 18

Management support Continuous IT/Fraud Risk Assessment Continuous User Education Awareness and Training Managing User Privileges (Access control reviews, SoD reviews, Password management) Logging and

19 Management support Continuous IT/Fraud Risk Assessment Continuous User Education Awareness and Training Managing User Privileges (Access control reviews, SoD reviews, Password management) Logging and Monitoring of critical systems and user activities Removable Media controls Secure configurations (e.g. updated config, secure tools for funds transfer) Network Security (network perimeter monitoring, filtering, unusual traffic detection) Home and Mobile Policy (BYOD, remote working, wifi-access, mobile device management) Audit the effectiveness of IT Controls Page 19

20 THANK YOU CONTACT US DUBAI Suite 305, AlFuttaim Tower Al Maktoum Street, Deira P O Box 1961, Dubai, UAE Tel: Fax: info@bdo.ae JEBEL ALI FREE ZONE Office 124, LOB 16 Gate 3, JAFZ, Dubai, UAE Tel: Fax: info@bdo.ae ABU DHABI 602,6th floor, Dhafir Tower Sector 11, Najdah Street P O Box 25836,Abu Dhabi, UAE Tel: Fax: info@bdo.ae DIFC BDO Corporate Finance (ME) LLP Floor 33East AlFattan Currency Tower, DIFC P O Box , Dubai, UAE Tel: Fax: SHARJAH 14th Floor, 1402 Al Batha Tower Buhaira Corniche, Al Majaz P O Box 27064, Sharjah, UAE Tel: Fax: info@bdo.ae

MANAGING FRAUD RISK WITH LIMITED RESOURCES. BDO UAE Seminar 14 November 2016

MANAGING FRAUD RISK WITH LIMITED RESOURCES BDO UAE Seminar 14 November 2016 Managing Fraud Risk Mansi Mehta Responsible for Forensic Service Practice at BDO India based out of Mumbai Domain experience