Uncovering hidden risks: with angry stakeholders and regulators demanding a harder line on fraud, firms must go on the offense to uncover hidden risk with a triple layer of controls that prevent, detect and actively manage threats.

Bad economies tend to expose the dark underbelly of corporate activities: namely fraud. Market deterioration has brought old schemes to light and new ones are being committed at an alarming rate. Once hidden under rising performance figures, many investment frauds, mortgage frauds and complex Ponzi schemes--such as the Bernard Madoff scam--are collapsing in the tight economy.

But the same economy responsible for exposing fraud is also making it easier for employees to find ways to set schemes in motion. A new breed of offenders is finding cunning ways to do so in a marketplace ripe for criminal activity.

Losses from fraud are mounting. To wit: the Association of Certified Fraud Examiners reported that organizations in the United States lost an estimated 7 percent of their annual revenues, or $994 billion, last year to fraud, up from $652 billion (about 5 percent of revenues) in 2006. A lack of adequate internal controls was cited by the examiners as one of the most common factors allowing fraud to occur.

Despite laws and federal actions to curb abuse, the trend is expected to continue. Earlier this year, John S. Pistole, deputy director of the Federal Bureau of Investigation, reported to the Senate Judiciary Committee an "exponential rise" in white-collar crime cases. These include financial statement manipulation, accounting fraud and insider trading.

Angry stakeholders, regulators and the public are demanding that companies take a harder line on fraud. To limit losses in this volatile environment, organizations must go on the offense to uncover hidden risk with a triple layer of controls that prevent, detect and actively manage the threats most organizations face from fraud.

Countering fraud in a high-risk environment requires targeted controls that reduce the opportunities and emotional distress that can lead to it in the first place. These measures must be integrated into every business process, every employee task and every training module corporate-wide to be truly effective.

Identify High-Risk Areas

A fraud risk assessment and a cultural assessment can provide valuable insight into staff attitudes and the extent of opportunity to commit fraud. Armed with this understanding, organizations can begin to identify where additional controls should be placed for maximum benefit.

A fraud risk assessment identifies where organizational activities currently take place: what activities are outsourced, moved between trading partners and transferred across borders; and which activities are performed by the board of directors, top managers, employees, suppliers, customers, competitors and external contractors.

This assessment can determine, for example, the likelihood that a contract-hire is bribing, or has the opportunity to bribe, a foreign official. Based on the likelihood and potential impact of that incidence, managers can design proper prevention and detection mechanisms to minimize risk associated with this opportunity.

Obtaining a baseline for the emotional pulse of an organization is possible with a cultural assessment or survey that identifies the ethical tone of the organization and pressure points that could motivate employees to cross the line. Employees are asked probing questions about business operations, performance targets and the ethical standards of the organization.

Skewed employee responses can indicate that top managers have not adequately conveyed reasonable performance and cultural expectations to the employees. When such expectations are unclear, employees might be more motivated and ready to rationalize fraudulent or corrupt behavior.

Develop Additional Controls

With the completion of these two assessments, organizations can highlight gaps to be filled with additional controls capable of whittling away at the pressures, opportunities and rationalizations that can lead to fraud.

Security and access controls--such as dual authority or monetary transaction caps--as well as competent, objective internal auditors and frequent transaction monitoring help to combat fraud.

Job rotation and mandatory vacation requirements should also be enforced to limit opportunity. From a security and privacy standpoint, organizations should perform regular ethical and social hacking to make sure Internet access and system controls are secure. Internal auditors should be charged with ensuring the effectiveness of the organization's internal controls and reporting their results directly to the audit committee.

Equally important, but often overlooked, is an organization's cultural environment. A strong tone at the top with middle-manager buy-in contributes to a cultural environment conducive to ethical behavior. Organizations must have a code of ethics that sends the message that business will always be conducted in accordance with applicable laws, in a moral and honest manner.

The consequences of violating the rules, including the punishment of violators, should be clear. Annual organization-wide ethics training ensures that a consistent message is delivered to all employees. Most organizations find that a strong ethical environment encourages self-policing, thereby increasing the level of oversight far beyond what internal control methods alone provide.

Detecting Fraud

All organizations are exposed to fraud risk in any process where human input is required, regardless of controls, audits or the corporate culture.

Fraud risk is the probability that fraud will occur and the potential gravity or cost to the organization when it does. All companies are breeding grounds for fraud that often develops slowly over several years. In today's high-risk environment, it is essential that organizations detect actual and potential fraud early to minimize losses.

The principal mechanism for deterring fraud is strong corporate governance, which includes sound internal controls and effective monitoring procedures.

Organizations have a duty to do more than confirm words on paper. They have a professional obligation to look beyond written policies, procedures and internal control checklists to the actions and behaviors that confirm whether anti-fraud mechanisms are truly effective. The only way to do so is to routinely ask questions about what, where and why activities and transactions are occurring organization-wide.

Financial executives should use a combination of internal audits, surprise audits and senior management reviews to ensure that the right questions are being asked and answered at all levels.

This oversight should also extend to remote locations. As more workers operate offsite, monitoring should include rotational audits that give auditors and controllers a chance to observe and question employees that work in remote locations. Employees who know their activities will be checked regularly have an incentive to ensure those activities are genuine.

Shared services are particularly effective in cutting down opportunities for employees to cut bogus checks, create unauthorized vendor services or otherwise engage in fraudulent behavior that is not easily detected. Shared services centralize activities such as check writing and vendor contracts under one roof so auditors and controllers can more closely monitor these activities.

Financial executives should make it a practice to review all internal controls with auditors and controllers annually or whenever the organization undergoes significant changes, such as a merger or a management shuffle, to ensure that controls adjust in a timely manner to the changing business environment.

Create Safe Avenues for Tipsters

According to the Association of Certified Fraud Examiners, almost one-half of the fraud cases were detected from tips by employees, customers, vendors and other sources. Employees are the most likely individuals to notice when a co-worker is showing signs of having financial difficulties, living beyond his or her means or feeling excessive pressure to perform.

Impartial avenues--like third-party, anonymous whistleblower hotlines--are the most effective way to ensure that employees are protected when reporting suspected fraud. Fraud and cultural risk surveys can also give employees an anonymous avenue to report perceived lapses in the company's ethics policy.

For example, if an employee knows that a co-worker bribed someone in India to get company products across the border more quickly, a cultural survey gives that employee a chance to safely notify senior managers, internal auditors and controllers, who can deal with the situation as they see fit without compromising the employee's identity.

Employees should be familiar enough with corporate ethics policies and reporting procedures to know where to turn when fraud is suspected. Rewarding employees for standing up for what is right can further management's drive to instill integrity throughout the organization.

Ongoing investigations should be reported to more than one person--a committee, the board of directors or others--to shed light on possible fraudulent activity taking place at a higher level of management.

The chairman might be responsible for overseeing an investigation of suspected fraud committed by the chief executive officer, whereas a human resources executive might be responsible for investigations into staff expense reimbursement fraud.

Additional Measures

Risk profiles and trends can change rapidly along with company activities, economic conditions and employee makeup. Regular fraud risk and cultural risk assessments can reveal many of these changes in time for organizations to proactively manage risk and avoid surprises. But additional measures are still necessary.

To minimize the possibility of a costly government investigation, firms can implement a rapid-response plan with strategies for investigating, reporting and prosecuting misconduct, fraud or corruption. Follow-up procedures are critical to ensuring questionable behavior is not overlooked. The excuse, "We just didn't know what was going on," is now unacceptable.

Firms that approach anti-fraud management with an attitude of healthy curiosity and skepticism are more likely to ask the types of questions that uncover cracks in the armor. When a situation feels safe or under control is precisely when financial executives need to be on guard.

JONATHAN T. MARKS, CPA, CFE, CFF ([e-mail]), is an executive with accounting and consulting firm Crowe Horwath LLP in New York.