Norman Marks on Governance, Risk Management, and Internal Audit

Every year, the Association of Certified Fraud Examiners (ACFE) publishes a report on fraud. The latest is the 12^th in the series, Occupational Fraud 2022: A Report to the nations.

My congratulations and thanks go to the ACFE for an excellent report. I remember how early reports included the employees’ use of company assets like computers in their definition of fraud. I am pleased to see that gone, with every inch of this long report dedicated to information that has value.

The first point that jumps out at me is no surprise. ACFE estimates that the average organization loses 5% of its revenue each year to fraud. Now, 5% is a lot. But does it mean that fraud is a risk to the organization so high that it should be made a priority for internal audit, and a focus of the limited time of the audit committee of the board? I will let you form your own opinion.

Building on that, the median loss per case is $117,000 (down substantially from prior years), while the average loss per case is $1,783,000. As many as 21% of the cases topped a million dollars in losses. Some would have to be several million to explain the difference between the median and the average.

Compare that to the cost of control, or even the cost of investigating fraud. I am not saying that we shouldn’t have controls to prevent or detect fraud, or audits to ensure either than the controls are adequate or to detect fraud ourselves. Just pointing out that the cost may dwarf the benefit if we are not careful.

The largest type of fraud was financial statement fraud, with a median loss of $593,000. It’s interesting that it’s not more, as this number would not be material to most organizations’ financial statements.

Another interesting statistic is that 40% of cases involved more than one type of fraud. 32% appropriated assets and had some form of corruption scheme. Just 2% stole assets and committed accounting fraud.

The average duration of a fraud before it is detected is 12 months. That is faster than in previous years, but still unacceptable. As the paper explains, the longer a fraud scheme continues, the bigger the loss. In addition, if we are not careful others may see an opportunity and fraudulent activity expands.

However, fewer organizations than in prior years are pursuing criminal prosecution, favoring civil litigation. That is the trend over ten years, but the number of those working with the authorities to prosecute fraudsters is still higher at 58% than those suing them civilly (29%). That means 13% are not taking any legal action – presumably because of the cost.

62% are committed by owners or managers/executives, and more involve collusion (up to 58% now).

One important area is how frauds are detected. The 2022 results are:

• 42% – Tip
• 16% – Internal audit
• 12% – Management review
• 6% – Document examination
• 5% – By accident
• 5% – Account reconciliation
• 4% – Automated monitoring
• 4% – External audit
• 3% – Surveillance
• 2% – Law enforcement
• 1% – Confession
• 1% – Other

The total of the internal controls-related detections is 30%, so a tip remains the most frequent source of detection. No change there, except that internal controls and internal audit are doing better.

Another interesting factoid is that organizations without a hotline suffered double the fraud loss when there was a fraud than those that did. I am going to guess that it is probably because organizations that invest in a hotline are likely to also invest in better internal controls.

People have been saying that fraud risk is higher now because of the pandemic. The ACFE study explains that this is due in many cases to staffing shortages and other changes, rather than any change in morale or employee attitudes. But contrast that to the information that the typical fraud cost is less than it was.

As you might expect, the higher the fraudster is in the organization, the greater the loss – and the less likely they are to be fired. Interestingly, the longer the individual has been with the company, the higher the loss. The same goes for the age of the perpetrator. (That makes me a high risk.)

One surprise was that 58 cases (3%) involved the board of directors! Median loss was $500,000.

That’s what I found interesting. What jumped out at you?