Intelligent fraud fighting: an Internal Organization Security Intelligence system can assist in the prevention, deterrence, and detection of fraudulent activity.

NICHOLAS AMATATA'S CAREER with ABC Motors Ltd. was full of promise. He was a hard-working, amiable sales representative who quickly earned the trust of customers and fellow staff members. One day, shortly into his fourth year of service to the company, he began working with a customer who eventually ordered four fishing boat engines. Because of Amatata's honest appearance, the customer quickly trusted him and agreed to send installment checks directly to Amatata's personal account, with the understanding that the money would be forwarded to ABC. Because the company's accountant also trusted Amatata, nobody suspected any wrongdoing--that is, until US $12,500 had already been stolen from the organization.

As it turned out, the fraud was uncovered by a fellow employee--a company driver. Amatata had asked the driver to accompany him to town, pick up some items he had purchased, and deliver them to his residence. To his surprise, the driver learned that the delivery included several expensive household items such as a bed worth US $1,667. At the time, Amatata's sales position paid less than US $166 per month--a typical amount for the region in which he worked. After the trip, Amatata gave the driver US $14 for lunch and instructed him not to tell anybody what he had seen, because it may make other employees envious. This instruction made the driver suspicious, and he immediately shared the full story with his close friend, the company accountant, who subsequently launched an investigation. After the scheme was discovered, Amatata was dismissed.

This sales representative's scheme was detected by an observant employee with a solid ethical foundation and a channel--albeit an informal one--through which to communicate his suspicions. Imagine then if all employees had ethics and fraud training, were encouraged to be observant and forthcoming for the sake of the organization, and were given a formal channel through which to report suspicious behavior. That is the goal of an Internal Organization Security Intelligence (IOSI) system, a method for gathering information and building resources that help protect the organization from harm such as computer security breaches, burglars and other intruders, industrial espionage, and frauds committed by employees, suppliers, and customers.

WHAT IS AN IOSI?

Although many organizations have internal security departments that provide physical controls over the movement of both people and tangible assets in and out of the organization, this conventional type of security arrangement relies solely on gate guards and watchmen working under a chief security officer. In contrast, an IOSI operation involves not only watchmen, but also loyal staff, customers, suppliers, and stakeholders that help provide controls. The system helps keep honest employees honest, deprives dishonest employees of an opportunity to commit fraudulent acts, and prevents other would-be fraudsters from even setting foot in the organization.

The primary aim of an IOSI system is prevention, as opposed to cure. The idea stems from a system practiced by Kenya's National Security Intelligence System (NSIS), which helps prevent crime throughout the nation. NSIS officers and informers are densely situated throughout the country, and their abundant presence helps preempt criminal activity. Even when criminals dodge security and commit an offense, they are usually apprehended soon afterward by the police upon receiving tips from the intelligence officers.

By teaching all those who deal with the organization about the symptoms of fraud and increasing awareness of the IOSI system, frauds can be prevented--or at least detected early through timely tips or reports. Well-informed suppliers, customers, and employees can serve as both deterrents and informants. In other words, those loyal to the organization can form a protective team that keeps a watchful eye over the organization, somewhat like neighbors who establish a neighborhood watch group to protect their homes.

The system is centered around a full-time IOSI department staffed with professionals who possess a variety of skills in fraud prevention, investigation, and internal controls. Their primary responsibilities consist of intelligence gathering and providing anti-fraud training across the organization. To expand its reach, the department enlists staff members from other areas of the company to serve as informants, or "agents." These individuals gather intelligence undercover in their respective departments and deliver it to the IOSI professionals for analysis and further investigation. The full-time IOSI employees also help formulate the organization's anti-fraud policy, continually review and amend the policy as deemed necessary, and cooperate with customers and suppliers on policy enforcement.

Typically, the IOSI team operates under a chief internal security intelligence officer (CISIO) who reports to the board of directors or the audit committee. Reporting to the audit committee is ideal, as the CISIO's duties will typically include surveillance of the main board's activities to ensure board members do not commit financial statement fraud or otherwise deceive stakeholders for personal gain.

To achieve its objectives, the IOSI system should involve everyone in the organization. That is, all departments should cooperate in the organizationwide vigilance. The human resources department, for example, can contribute by recruiting employees with integrity, and the legal team can assist with procedures involving fraud investigations and prosecution of wrongdoers. Common fraudulent activities that can be prevented or detected early through a comprehensive IOSI system include bribery, kickbacks, management override, and cash skimming.

WHERE IOSI MEETS AUDITING

The IOSI system is designed to reinforce the fraud-fighting power of internal auditing by helping detect frauds earlier and prevent them altogether. Although the two groups' responsibilities differ in many ways (see "Comparison of Internal Audit and IOSI Duties" on this page), several commonalties also exist. Having an IOSI system in place can enhance internal auditing's effectiveness, because internal auditors and IOSI professionals share many areas of responsibility, including fraud detection and prevention, fraud investigation, and controls improvement. By working with IOSI agents, internal auditors can detect fraud better as well as enhance the perception of detection, thereby acting as a fraud deterrent. Both groups are also concerned with preventive controls and, in fact, the IOSI's wide information-gathering network actually acts as such a control.

Auditors and IOSI agents can also work together to investigate frauds. Typically, the IOSI group will be staffed by certified fraud examiners, offering specialized expertise in this area. By combining resources, IOSI agents and auditors are more likely to identify loopholes for fraud, and together they can recommend that management implement appropriate controls to reduce the possibility of fraud in those areas.

Security agents are trained to collect evidence or clues by being observant and asking good questions. They cultivate positive relationships with suppliers, customers, and employees--without compromising their professional independence. Any of these individuals could inadvertently leak information leading to the discovery of a well-hidden fraud scheme. Even former employees and clients have been known to divulge such vital knowledge. By keeping communication channels open with everyone they encounter, IOSI professionals, in conjunction with internal auditors and other loyal staff members, can serve as the organization's best informants. A productive, close relationship between internal auditing and the IOSI team can provide auditors with enhanced access to confidential information on fraud schemes and hence increase the likelihood of discovery and opportunities for preventive or corrective measures.

LAUNCHING IOSI

The IOSI department should be established by a committee elected by the board of directors. The chief audit executive and chief financial officer would be ideally suited to coordinating this committee, given their direct involvement in safeguarding the origination's assets, tangible or otherwise. Once the department has been established, setting up the IOSI system involves eight key steps.

1. FORMULATE THE IOSI DEPARTMENT'S RESPONSIBILITIES. Those in charge of forming the IOSI department should ask a series of questions to help establish the department's responsibilities and priorities, including: What is the objective of the IOSI? How will those objectives be achieved? To whom will the IOSI report? With whom will the IOSI cooperate? The department's priorities should also be consistent with the security-related objectives of the overall organization.

2. DEVELOP A CODE OF ETHICS. The code should specify both the dos and the don'ts of the organization and set expectations for every employee. For example, the don'ts list should include clear rules against bribery, corruption, and false claims; the dos should include items such as reporting wrongdoers to the appropriate authority through the established channels.

3. RAISE AWARENESS AND PROVIDE TRAINING. The code of ethics should be the first document supplied to new employees, and all staff members should be required to sign a compliance declaration. The organization should also embark on rigorous ethics training for employees--and even suppliers and customers--so that all who deal with the organization are aware of the code. During the training, all officers should be alerted that the organization will not tolerate misconduct of any kind. Likewise, employees should be informed of the consequences of unethical behavior and should be asked to report any suspicion of misconduct to an appropriate officer for investigation and further action.

4. ESTABLISH A WHISTLEBLOWING POLICY. A whistleblowing policy that covers harmful, dangerous, fraudulent, and other types of illegal activities should be established. The policy should include hotlines and other anonymous reporting channels so that suspected cases of misconduct can be reported immediately. After all, according to the Association of Certified Fraud Examiners' 2006 Report to the Nation, the majority of fraud cases are detected by tips or anonymous reporting. Whistle-blowers' anonymity should be guarded, and the organization should spell out tough measures--such as dismissal--for those who attempt to retaliate against or victimize whistleblowers.

5. DESIGN A REWARD SYSTEM. In many cases, frauds are committed by employees of the victim organization. For this reason, employees are often in a position to provide security and audit personnel crucial information about what they have heard or witnessed. After all, fraudsters typically work alongside other employees who know them well. With the right incentives in place, these employees can provide the names of the culprits to appropriate authorities for investigation and prosecution.

Still, blowing the whistle can be risky, particularly when the wrongdoer is the whistleblower's supervisor. To provide incentive for reporters, the organization should reward those who give tips that lead to fraud discovery. The reward system should be openly communicated to staff through internal newsletters and other channels.

In addition, the organization should establish an annual award for staff members who assist in fighting fraud by providing helpful tips. The reward system may also include all employees who perform beyond expectations, thus fostering loyalty among the staff. Employees who feel good about the organization often make the best informers, as they are typically invested in the organization's well-being.

6. CONSIDER DISCIPLINARY MEASURES. The organization should clearly establish disciplinary measures for employees found guilty of raising a false alarm, discouraging employees from malicious, unwarranted accusations. Such measures may include issuing a written warning or terminating the employee. However, a thorough investigation should be conducted so that no one is falsely accused, and it should be completed before a decision is made to reject or accept the alarm.

7. EMPLOY AND PROMOTE THE RIGHT PEOPLE. Criminologists generally agree that no one is born wicked and that people are typically forced into criminal activities by circumstances. Still, some philosophers have argued that a criminal, just like a dormant seed, requires favorable conditions to flourish. Therefore, it's important to consider the need for a solid background check before any candidate is offered an employment opportunity with the organization. While human behavior is often unpredictable, employing someone with a history of unethical or illegal behavior, for example, may be akin to planting a time bomb in the organization.

8. ESTABLISH AN EMPLOYEE COUNSELING PROGRAM. Employees grappling with stressful and overpowering predicaments such as drug and alcohol abuse or financial strain may find themselves tempted to engage in fraudulent activities if their problems are left unchecked. For this reason, the organization may benefit from investing in a counseling program for employees to reduce the probability of fraud.

UNOFFICIAL CHANNELS

Security intelligence in and around an organization can involve official communication channels, such as hotlines, and unofficial channels, including informal conversations and word of mouth. The grapevine, for example, is an important unofficial channel for the IOSI because it is a fast, natural way to disseminate information (see "The IOSI Grapevine" on this page). Communication spreads particularly quickly through the grapevine when it involves "bad news" such as fraud suspicion.

Although gossip is one of the oldest and most common methods of sharing information, it is also known for introducing errors and slight variations that distort the original message. Therefore, any information received through the grapevine should be subject to a thorough investigation before any conclusions are drawn.

If the right precautions are taken, informal communication channels can be a valuable tool for early fraud detection. In one automotive company, an asset theft scheme was uncovered just three months after it began by way of an informal IOSI system. One of the company's workshop supervisors had found a way to sneak small but valuable motor vehicle parts past two security checks and off company premises. A female employee with whom he was having a romantic relationship soon became aware of the accumulated merchandise, which he had stashed under his bed for future sales. The woman, who worked in housekeeping, had a close relationship with the office manager--a friendly, unassuming gentleman who socialized with all levels of staff. One day, the manager joked that she had taken some coins he left on his desk. After they shared a laugh, the manager complimented her and told her he knew that both she and the workshop supervisor were honest, trustworthy employees. At that point, she told the manager that the supervisor was not honest, for he had amassed many stolen automotive parts under his bed. Her response prompted the manager to initiate a fraud investigation that led to the recovery of the stolen parts.

PROACTIVE SECURITY

An effective IOSI system will go a long way toward minimizing incidences of fraud and corruption. It will also assist the auditor in spotting danger signs of fraud early and thus help to reduce the organization's fraud loss. Although the IOSI system will not eliminate fraud entirely, constant integrated vigilance over organizational activities will help stem the problem by defusing fraud situations while still in their infancy.

To comment on this article, e-mail the author at [e-mail].

SOSTHENES NYABUTO BICHANG'A, MIIA, CPA, CFE 

ACCOUNTANT, CMC MOTORS GROUP LTD.

NAIROBI, KENYA

RELATED ARTICLE: The IOSI Grapevine

In an IOSI system, information doesn't just flow through official vertical or horizontal channels; instead, it flows in all directions--much like a grapevine. Getting information from this system depends on how well one is attuned to it; hence the value of IOSI informants or "agents" throughout the organization.

[GRAPHIC OMITTED]

Comparison of Internal Audit and IOSI Duties

Internal Auditor                    IOSI Agent

Appraises internal controls.        Gathers anti-fraud intelligence in
                                    and around the organization.
Examines the books of accounts.     May examine the books and vouchers
                                    during an investigation.
May investigate fraud.              Investigates fraud and takes
                                    statements from the suspects.
Recommends internal controls for    Proactively looks for fraud danger
mitigating fraud and other errors.  signs and follows them to
                                    conclusion.
Helps maintain effective controls.  Maintains physical security over the
                                    assets of the organization.