Fraud risk management in not for profit organisations

Transcription

1 Fraud risk management in not for profit organisations TJ Koekemoer Director Ernst & Young, Australia 1 May 2012

2 Agenda Introduction The fraud landscape Understanding fraud risks using the fraud triangle Strategies to respond Questions an organisation should be asking itself Q&A 2

3 Understanding the challenge Not for profit fraud landscape Abilityto respond to fraud Online credit card scams Skimming Misuse of funding provided by NFP 3

4 The fraud triangle Use of cash Lack of controls Informal governance Opportunity Natural disasters Lack of segregation of duties High employee/volunteer turnover Unrealistic targets Maintain social status Personal financial situation Pressure Opportunity to Commit Fraud Internal and External Pressure Internal Controls Rationalization I am doing this for the good of the charity I m not getting paid to do this I ve worked hard so I deserve it No one will find out 4

5 Who owns fraud? Ernst & Young 11 th Global Fraud Survey (2010) 60% 50% 40% 30% 20% 10% 43% 57% 56% 54% 0% CFO Compliance Internal Audit Legal Does your organization have well-defined roles for different groups (internal audit, compliance, risk and legal) in response to the first reporting of a possible case of fraud, bribery or corrupt practice? Base: Percentage of respondents (1,409) agreeing 5

6 Fraud Risk Management Framework Adapted from ACFE Fraud Magazine Jan/Feb 2011 Ownership Communication Human Resources Code of Ethics Setting the proper tone Fraud Prevention Policies Communication and Training Fraud risk assessment Proactive Fraud controls monitoring Reactive Fraud Response Plan Process owners Risk Appetite 6

7 Fraud risk appetite Designing risk management without defining your risk appetite is like designing a bridge without knowing which river it needs to span. Your bridge will be too long or too short, too high or too low, and certainly not the best solution to cross the river in question. What is the organisation s appetite towards fraud risk? How is this appetite reflected in the following aspects of fraud control: Prevention Detection Response What is really meant by Zero tolerance and is your organisation s efforts reflective of this zero tolerance in all aspects of fraud risk management? 7

8 Ernst & Young 11 th Global Fraud Survey (2010) Effective fraud prevention Internal controls Internal audit Regular rotation of personnel Management reviews Internal education / comms of anti-fraud policy Encouragement and protection for whistleblowers Australia External audit Global Q: On a scale of 1 to 10, where 1 is not at all likely and 10 is extremely likely, how likely are each of the following factors to prevent fraud? Shown: percentage giving 8, 9 or 10 score. Base: all respondents in Australia (52), globally (1409) 8

9 The top initial detection methods ACFE Report to the Nation

10 The source of tips ACFE Report to the Nation

11 Questions an organisation should be asking itself What is the 'tone from the top and is this being communicated effectively? Are our polices and procedures and codes adequate to inform/guide/prescribe conduct and organisational expectations in relation to fraud control Do we have strategies in place to prevent, detect and respond to fraud? And how effective and overarching are these strategies? Is there a clear ownership/responsibility and accountability for the coordination of fraud control efforts? Do we really understand our fraud risk profile? What steps do we take to ensure that this profile is current and/or reflects changes in our operating environment and the economy generally? Where is our fraud risk management strategy currently at compared to better practice and where do they want or need to be in comparison? Are we making use of all available resources within the organisation to combat fraud, e.g internal audit, risk and compliance function, technology, broader employee base (the eyes and ears )? Do we engage effectively with all of our stakeholders to manage fraud risk? Is our position on fraud clear to those we do business with? Do we provide our people with the knowledge to identify a potential fraud and the means to report it? 11

12 Questions?

13 Ernst & Young Assurance Tax Transactions Advisory About Ernst & Young Ernst & Young is a global leader in assurance, tax, transaction and advisory services. Worldwide, our 152,000 people are united by our shared values and an unwavering commitment to quality. We make a difference by helping our people, our clients and our wider communities achieve their potential. Ernst & Young refers to the global organisation of member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organisation, please visit Ernst & Young, Australia. All Rights Reserved. SCORE No. AU This communication provides general information which is current at the time of production. The information contained in this communication does not constitute advice and should not be relied on as such. Professional advice should be sought prior to any action being taken in reliance on any of the information. Ernst & Young disclaims all responsibility and liability (including, without limitation, for any direct or indirect or consequential costs, loss or damage or loss of profits) arising from anything done or omitted to be done by any party in reliance, whether wholly or partially, on any of the information. Any party that relies on the information does so at its own risk. Liability is limited by a scheme approved under Professional Standards Legislation. 13