Catching Fraud On the Inside.

Internal auditors can be an insurer's main line of defense against internal fraud.

To most people who work in the insurance industry, the word "fraud" evokes thoughts of bogus claims and policyholder misrepresentations. Although these types of occurrences have an enormous impact on insurers, another type of fraud significantly affects insurers' operations: internal fraud.

Unlike other crimes, which may be witnessed, fraud by its very nature typically entails concealment by its perpetrators. Thus, the question arises as to who in an insurance company is in the best position to detect and prevent fraud, particularly asset misappropriation, the most common type of internal fraud.

A Costly Crime

Internal fraud and abuse costs U.S. organizations more than $400 billion annually, according to the 1996 Report to the Nation on Occupational Fraud and Abuse (The Wells Report), which was produced by the Association of Certified Fraud Examiners. The average organization loses about 6% of its total annual revenue to fraud and abuse committed by its own employees. To put this in perspective, the net profit margin of many businesses is often less than 6% of total annual revenue.

The 1994 KPMG Peat Marwick Fraud Survey of large and midsize firms found that 77% of companies had experienced internal fraud in the previous year. The median loss per fraud incident was $145,000 for large firms and $90,000 for midsize companies. Banking and insurance firms had median losses per fraud incident of $200,000 and $72,000, respectively. As some insurers expand their operations to include lending activities, they now must be concerned with many of the internal fraud issues faced by traditional lending institutions.

Given the frequency of offenses involving asset misappropriation, internal insurance auditors can be an important defender against internal fraud. Unlike internal auditors, external insurance auditors lack the continuous presence necessary to detect fraud and to establish and implement fraud prevention and deterrence programs.

Key areas for internal auditors include deterrence, detection, investigation and reporting of fraud as outlined in standards established by the Institute of Internal Auditors. The institute's fraud-related standard clearly indicates that deterrence of fraud is management's responsibility, but it is well established that internal auditors are responsible for examining and evaluating the adequacy and effectiveness of management's actions. Specifically, internal auditors have the responsibility to:

* have sufficient knowledge of fraud to be able to identify symptoms that fraud has been committed. This knowledge includes the characteristics of fraud, techniques used to commit fraud and types of fraud associated with the activities audited;

* be alert to situations, such as control weaknesses, that could allow fraud. If significant control weaknesses are detected, internal auditors should perform additional tests to detect other fraud symptoms;

* evaluate the symptoms that fraud may have been committed and decide whether further action is necessary or whether an investigation should be recommended; and

* notify the authorities in the organization if there are sufficient fraud symptoms to warrant a fraud investigation.

Clearly, the internal auditor can have a significant impact on the level of fraud that may occur within an insurance company.

The Fraud Triad

Fraud research has identified three key indicators that an individual will commit fraud: perceived pressure, perceived opportunity and the person's rationalization or attitude. All three factors usually are necessary for fraud to result.

Pressure relates to the employee's actual or perceived need for assets. The pressure need not be real or visible to a third-party observer. Research indicates that 95% of all fraud cases involve either financial or vice-related pressures. These pressures result in the perpetrator having an immediate need for cash or assets. Few people who commit fraud have been known to save or hoard stolen assets. Hence, it is critical for insurance company internal auditors and managers to know and understand their fellow employees and the pressures that prevail.

Opportunity deals with an employee's ability to perpetrate and conceal a fraud. A lack of proper controls or nonenforcement often promotes opportunity. While insurance company internal auditors cannot regulate the pressure employees feel, they can help mitigate the opportunity to commit fraud. Typical failures in insurer internal control that enhance the opportunity for fraud include:

* lack of appropriate segregation of duties;

* lack of an audit trail;

* lack of appropriate board/management oversight;

* lack of an appropriate system of authorization and approval of transactions;

* poor accounting records;

* poor physical safeguards over cash, investment or fixed assets;

* failure to discipline perpetrators;

* lack of controls over access to information; and

* breakdown of procedures, for example, inappropriate computer access.

The third element of the fraud model is rationalization. Individuals do not commit fraud unless they can justify it as being consistent with their own personal code of ethics. Personal integrity may be the most important factor in keeping a person from misappropriating assets. Some investigators believe a strong moral code can prevent individuals from using rationalization to justify illicit behavior.

Insurance company internal auditors, however, should assume that anyone is capable of justifying the commission of fraud. Internal auditors should exercise "professional skepticism," particularly since fraud frequently is committed by people who seem trustworthy. This is often a function of the fact that those who are trusted are placed in positions where fraud may be committed--for example, when trusted individuals are given opportunity to manage and control assets.

Certain employee attitudes or rationalizations are often associated with acts of fraud:

* feeling of being underpaid;

* belief of being overworked;

* feeling that "everybody else is doing it";

* belief that rank has its privileges;

* low self-esteem or morale;

* a desire to seek revenge;

* rationalization that it is a loan that will be repaid;

* belief that nobody will get hurt; and

* feeling that it's for a good purpose.

Rationalization is a factor often viewed as out of the control of management and internal auditors. After all, how does a member of management or an insurance company internal auditor keep a person from justifying his or her own actions? Yet if fraud prevention is routinely discussed with employees as part of an ongoing program, the subject of rationalization can be addressed. If only a small percentage of potential fraud schemes are discouraged, the cost of such a program is probably justified.

Employee Fraud Targets

Risk of misappropriation of assets is related to specific assets owned by the insurance firm, especially cash. Cash fraud schemes involve relatively high average losses. Thus, insurance company internal auditors should focus their efforts on the prevention, deterrence and detection of fraud involving cash.

As insurers enter the business of banking, loan fraud may become an area of greater concern. Although occurrences may be few, the dollar amount per loan-fraud incident is often large. The banking and savings and loan crisis of the late 1980s and the large increase in the number of nonperforming loans in the early 1990s in insurer portfolios underscore this point. Between 1986 and 1992, cumulative losses from loan-fraud schemes perpetrated on failed banks and savings and loans amounted to $8.4 billion.

Loans to nonexistent borrowers is one loan-fraud scheme. In the case of collusion between an insurance firm employee and an outsider, a false loan application, perhaps with an inaccurate financial statement, is knowingly accepted as the basis for a loan. A dishonest insurance loan underwriter working alone also could employ a false loan application and financial statement. In some collusive situations, loan underwriters make loans to accomplices who then share all or part of the proceeds with them. Sometimes the loans are charged off as bad debts or the bogus loans are paid off with the proceeds of new fraudulent loans in a pyramid scheme.

Fertile Conditions

The occurrence of all three fraud indicators--pressure, opportunity and rationalization--appear to be increasing, which raises the risk to insurers. Financial demands seem to be high for many employees. Changing technology provides previously unrecognized fraud opportunities for employees of insurance firms. And a perceived deterioration in ethics may have created an acceptance of less-than-honest behavior by some employees. The potential for employee fraud demands a sharpened focus by insurers' internal auditors and the use of effective, common-sense steps to help reduce the occurrence of fraud.

William Hillison, the Arthur Andersen professor of accounting at Florida State University, Tallahassee, Fla.; Carl Pacini, assistant professor of accounting, Georgia Southern University, Statesboro, Ga.; David Sinason, assistant professor of accounting, Northern Illinois University, DeKalb, III; James M. Carson, the Katie Research professor of risk management, Illinois State University, Normal, Ill., and David Marlett, assistant professor of risk and insurance, Illinois Wesleyan University, Bloomington, Ill.