Fraud: the human factor; Many discount behavioral explanations for fraud, but as the incidence of fraud continues to grow, placing the spotlight on behavioral factors may be an important approach not only to detection, but to deterrence as well.

Eighty percent of respondents to a National Association of Corporate Directors (NACD) survey of public company audit committees felt that failure resulting from poor risk management couldn't happen to them. However, 50 percent thought it could happen to other companies.

[ILLUSTRATION OMITTED]

This feeling of relative "invincibility" is similar to the statistically impossible "Lake Wobegon" effect--where "all the women are strong, all the men are good-looking and all the children are above average." Could this Lake Wobegon effect--which results from the human tendency to overestimate one's achievements and capabilities in relation to others--extend to an organization's assessment of its vulnerability to fraud risk?

Fraud is a human endeavor, involving deception, purposeful intent, intensity of desire, risk of apprehension, violation of trust, rationalization, etc. So, it is important to understand the psychological factors that might influence the behavior of fraud perpetrators. The rationale for drawing on behavioral science insights is evident from the intuition that one needs to "think like a crook to catch a crook."

Many business professionals, especially those in the finance arena, tend to discount behavioral explanations. But as the incidence of fraud continues to grow, placing the spotlight on behavioral factors may be an important approach to not only fraud detection, but to deterrence as well.

The 2006 Report to the Nation issued by the Association of Certified Fraud Examiners (ACFE) noted that U.S. organizations lose almost 5 percent of their revenue to fraud, and that the Gross Domestic Product (GDP)-based annual fraud estimate for the U.S. was a whopping $652 billion. In light of such sobering statistics, it behooves each and every organization to understand the root causes of fraud and proactively manage fraud risk.

Why Focus on Fraud Risk?

Among the catastrophic risks afflicting organizations of all sizes is the risk of financial fraud. A single allegation of material fraud has such devastating financial consequences, including irreparable reputational damage, that few companies survive such a crisis unscathed. Fraud tends to be frequently a hidden risk, particularly because its perpetrators take extreme care to conceal their activities; hence, it also remains an unman-aged risk in organizations.

Nevertheless, it is rare that any company deliberately sets out to perpetrate a massive fraud. Instead, fraud is the unfortunate consequence of a multitude of mostly behavioral factors that drives otherwise honest people to do dishonest things. The sociology and criminology literature describes fraud perpetrators as "trust violators." In other words, trust violators are people you wouldn't normally suspect of committing fraud.

Behavioral Root Causes of Fraud

Much has been written about the root causes of fraud and the "fraud triangle," with its three vertices of opportunity, pressure/incentive and rationalization, as referred to in the ACFE 2005 Fraud Examiner's Manual.

What often goes unrecognized is that all three elements of the fraud triangle are fundamentally behavioral constructs. Personal incentives and perceived pressure drive human behavior, and the need to rationalize wrongdoing as being somehow defensible is very much psychologically rooted.

To some extent, even the assessment of the opportunity to commit fraud--including the likelihood of being caught--is a subjective, behavioral assessment. Accordingly, to understand the root causes of fraud, psychological answers and explanations rather than logical ones should be sought.

The decision to deviate from the norm and commit fraud is not taken lightly; it involves "rationalization," or the ability to justify one's own questionable actions to oneself and others. A tragic example is Enron Corp.'s Cliff Baxter, who couldn't come to terms psychologically with what had happened, and took the extraordinary step of committing suicide.

While corporate governance reform legislation such as the Sar-banes-Oxley Act of 2002 can help limit the opportunity for fraud, succumbing to perceived pressure and the ability to rationalize fraudulent acts are outside the scope of law. As such, fraud deterrence and detection should focus on how to deal with the underlying behavioral dynamics--the psychology of fraud perpetrators, as well as the psychology of those responsible for governance, including auditors.

Psychology of Fraud Perpetrators

An understanding of what motivates the fraudster, whether acting alone or in collusion with others within or outside an organization, can go a long way in identifying behavioral risk factors that may indicate fraud. A simple means-motives-opportunity analysis would show that motives are the crux of the matter, because fraud requires the establishment of intent to deceive another.

So, it is crucial to know what it is that a fraud perpetrator desires: money (bonus, stock-based compensation), status ("keeping up with the Joneses," fame or celebrity status), revenge, a catch-me-if-you-can game, parity with others (everybody else is doing it, why can't I?), etc.

If opportunities do not exist, the motivated fraud perpetrator can create them by a careful analysis of weaknesses in controls or by exploiting a generally lax environment. However, once fraud perpetrators take the initial steps, they frequently find themselves unable to turn back and escape the ruinous consequences.

Organizations must communicate to employees acceptable standards of behavior through a well-crafted code of conduct that is endorsed by leadership and enforced when necessary. Organizations should also develop a track record of acting swiftly and decisively whenever wrongdoing comes to light.

And, in every case, organizations must go to extreme lengths to protect a whistleblower's identity and safety (from retaliation). Otherwise, potential fraud perpetrators are likely to exploit the inertia or complacency in addressing fraud risk adequately. As ACFE founder Joe Wells counsels, "Let them know you're watching."

Understanding Financial Statement Fraud

Thus, erstwhile honest and well-meaning executives who have earned the trust of others are often the ones who end up perpetrating fraud. Fraud does not start with dishonesty; it starts with pressure: Pressure to achieve aggressive financial performance goals, or meet analyst expectations, frequently leads those who are expected to make the numbers to simply "make up" the numbers. Like many other organizational risks, fraud usually starts small before it snowballs, becomes widespread, rampant and material. Not surprisingly, the gray areas of accounting ripe for abuse are those that are complex, ambiguous and subjective. Complexity can help mask fraud.

Among reasons managers cook the books are:

1. to meet analyst expectations and forecasts about earnings;

2. to smooth earnings and income to reduce volatility (to mask financial distress and negative cash flows);

3. to benefit from compensation or bonuses tied to earnings or to stay within debt covenants imposed by lenders; and

4. to avoid sanctions by deliberately deflating current earnings or to win subsidies or import relief as a protectionist advantage.

In such contexts, the award of executive stock options provides further incentives to manipulate earnings, including enlisting the support and cooperation of junior, economically dependent and vulnerable staff and employees.

In all circumstances, tone from the top is critical, and there is no excuse for senior executives or other employees to be active participants in a corrupt organizational culture.

Approaches to Deterring and Mitigating Financial Fraud Risk

From an organizational perspective, the goal is to create an environment that endorses a "good ethics is good business" philosophy, encourages doing the right thing at every turn and makes perpetrating fraud an unattractive option to most people in the organization.

It is true that economics and ethics do not mix very well--there are numerous examples of how incentives have trumped personal ethics and values. Nevertheless, cultural assimilation into a system of high integrity and values represents a form of programming of the human mind that cannot be easily compromised. A culture of ethics has significant potential in reducing integrity risks. Rewarding people for doing the right thing sends the right signal to others in the organization, while shooting the messenger in the case of a whistleblower allegation sends the wrong signal.

To discharge their monitoring and oversight function effectively, audit committees need a primer on the psychology of the fraud perpetrator(s), as well as insight about their own and the auditors' cognitive weaknesses.

The audit committee, with assistance from the internal and external auditors, as well as other risk management specialists and the board, is responsible for monitoring the behavior of management, especially with respect to financial reporting. However, in the current corporate governance climate, this mandate sometimes extends beyond financial reporting matters.

One important behavioral insight is recognizing that high-level fraud is frequently a team sport that often involves collusion. Internal control systems that presume proper segregation of duties are not effective against collusion and management override of controls. In fact, a COSO Fraud Study published in 1999 found that in 83 percent of the frauds examined, the CEO and the CFO had colluded.

Still another problematic area is the well-known "groupthink" bias at the board level. Groupthink discounts contrarian opinions or tends to sway the group into making a "feel good" decision. When there is an active tendency to ignore bad news due to either indifference or sheer laziness, board members may miss important signals of potential fraud.

External and internal auditors need to learn that "absence of evidence is not evidence of absence." Just because no red flags or fraud indicia are observed does not mean that fraud does not exist. The trusted relationships that subsist between external auditors and their clients sometimes make auditors let their guard down.

When encountering fraud scenarios, human tendencies such as the confirmation bias (seeking confirmation of one's beliefs) and selective perception (seeing only what one wants to see) limit auditors' ability to exercise an appropriate level of professional skepticism.

Interestingly, the significance of behavioral science insights increases even more when we move into the domain of fraud investigation. But that is clearly the subject of another article.

DR. SRIDHAR RAMAMOORTI is a Partner in the National Corporate Governance Group of Grant Thornton LLP in Chicago who leads the firm's thought leadership efforts relating to governance and accountability. WILLIAM OLSEN is a Principal in the Economic Advisory Services practice of Grant Thornton LLP and has experience conducting fraud investigations.

RELATED ARTICLE: Behaviorally Oriented Solutions for Fraud Risk Factors

Among behavioral approaches and solutions to the fraud risk factors are:

* Sound tone at the top, with management "walking the talk";

* Align incentive structures within the organization in a way that does not encourage fraud perpetration;

* An active board and audit committee overseeing management performance and activities (as well as the work by external and internal auditors);

* Nurture a culture of integrity and ethics, supported by an organizational code of conduct;

* Periodic ethics audits and enforcement of noted violations of the code;

* Maintain an ethics and/or whistleblower hotline;

* Explicitly reward good behavior;

* Routine background checks for new and experienced hires, as well as for making senior leadership appointments (human resources needs to lead this effort);

* Swift, decisive action to respond to incidents of fraud so that employees and others are aware of the organization's serious commitment to dealing with fraud issues head-on;

* Fraud awareness training, perhaps delivered by internal audit professionals or outside consultants, including description of ethics hotlines and guidance on what to do when fraud is encountered; and

* Control self-assessments that consist of process risk owners performing risk and control mapping (and including fraud risk considerations in such exercises).

RELATED ARTICLE: TAKEAWAYS

** Fraud is a human endeavor that involves deception, purposeful intent, intensity of desire, risk of apprehension, violation of trust, rationalization, etc.

** The Association of Certified Fraud Examiners found that U.S. organizations lose almost 5 percent of their revenue to fraud and that the GDP-based annual fraud estimate for the U.S. was $652 billion in 2006.

** An understanding of what motivates fraudsters can go a long way in identifying behaviorial risk factors.

** Organizations need to create environments that endorse ethics and doing the right thing at every turn, making perpetrating fraud an unattractive option.