5C HAPTER Fraud and Corruption Risk Assessment
Total Page：16
File Type：pdf, Size：1020Kb
ffirs.indd ii 3/14/09 11:06:21 AM Corporate Resiliency ffirs.indd i 3/14/09 11:06:21 AM ffirs.indd ii 3/14/09 11:06:21 AM Corporate Resiliency MANAGING THE GROWING RISK OF FRAUD AND CORRUPTION Toby J.F. Bishop Frank E. Hydoski John Wiley & Sons, Inc. ffirs.indd iii 3/14/09 11:06:21 AM Copyright © 2009 by John Wiley & Sons, Inc. All rights reserved. Published by John Wiley & Sons, Inc., Hoboken, New Jersey. Published simultaneously in Canada. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400, fax 978-646-8600, or on the Web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, 201-748-6011, fax 201-748-6008, or online at www.wiley.com/go/permissions. Limit of Liability/Disclaimer of Warranty: While the publisher and authors have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor authors shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages. For general information on our other products and services, or technical support, please contact our Customer Care Department within the United States at 800- 762-2974, outside the United States at 317-572-3993 or fax 317-572-4002. Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books. For more information about Wiley products, visit our web site at www.wiley.com. Library of Congress Cataloging-in-Publication Data Bishop, Toby J. Corporate resiliency : managing the growing risk of fraud and corruption / Toby J. Bishop, Frank E. Hydoski. p. cm. Includes bibliographical references and index. ISBN 978-0-470-40517-8 (cloth) 1. Fraud. 2. Corruption. 3. Risk management. I. Hydoski, Frank E. II. Title. HV6691.B476 2009 658.4'73—dc22 2008052097 Printed in the United States of America 10 9 8 7 6 5 4 3 2 1 ffirs.indd iv 3/14/09 11:06:22 AM Contents Foreword xi Preface xv Acknowledgments xix Introduction xxi Part One: Fraud and Corruption Today Chapter 1: Can We Eliminate Fraud and Corruption? 3 Not a pretty picture 3 Focusing on the larger picture 5 Potential for catastrophe 6 Why now? 7 Resiliency as a corporate goal 10 Chapter 2: The Growing Risk of Fraud and Corruption 12 Why should my company be especially concerned about fraud and corruption now? 12 Local problems, global pain 15 Awareness is crucial 17 Common sense and observable reality 18 Tailoring efforts to avert damage 18 Chapter 3: The Costs of Fraud and Corruption 20 Higher stakes 20 Casting a shadow on the future 22 v ftoc.indd v 3/16/09 2:23:14 PM vi Contents Cost and availability of capital 25 Bad news travels even faster than before 26 Don’t expect a slap on the wrist 26 Part Two: On Becoming Resilient: Strategies for Avoiding and Minimizing the Impact of Fraud and Corruption Chapter 4: Building a Resilient Corporation 31 What determines survivability? 31 Reducing vulnerability 32 Traits of a resilient corporation 32 Three key characteristics of resiliency 33 Why resiliency is achievable 33 Learn from the experience of others 34 What are the benefits of fraud and corruption risk management? 35 Five principles of fraud risk management 37 The first line of defense 39 How can companies use the new guidance? 40 Building resiliency by enhancing fraud and corruption risk management 40 Corporate resiliency self-assessment tool 42 Chapter 5: Fraud and Corruption Risk Assessment 45 Behind the facade 45 What is a fraud and corruption risk assessment? 46 How important is a good fraud and corruption risk assessment? 47 Implementing fraud and corruption risk assessments 50 Risk assessment reports: The good, the bad, and the invisible 58 Four quadrants; four risk management strategies 61 Questions to ask about your fraud and corruption risk assessment 64 ftoc.indd vi 3/16/09 2:23:14 PM Contents vii Chapter 6: Company-wide Anti-Fraud Controls: The Role of the Control Environment and High-Level Strategies 66 Creating an anti-fraud control environment 67 What exactly is a control environment and why is it important? 67 Tone at the top 68 The control environment as a bulwark 69 The control environment and governance 70 Put it in writing 71 Setting the tone 71 Internal audit’s role 73 Measuring tone at the top 73 Written code of ethics/conduct 74 Why is a code important? 74 Excerpts from Deloitte Code of Ethics and Professional Conduct 75 How does management create a successful code of ethics/conduct? 76 Ethics training for all employees—including management 77 Hotlines, helplines, and whistle-blower programs 78 The role of human resources—employee selection and discipline 80 Other general strategies of which fraud risk management is a component 81 Enterprise risk management 82 Fundamentals of ERM 82 Achieving risk intelligence 83 Fundamentals of GRC 84 Complicated, but worth the effort 85 Integrated versus nonintegrated GRC 85 Survey results show desire for integrated GRC 86 Key attributes of companies with robust GRC strategies 87 PACI, anti-corruption, and the control environment 88 ftoc.indd vii 3/16/09 2:23:14 PM viii Contents Chapter 7: Preventive Controls: Particular Fraud and Corruption Avoidance Strategies and Tactics 91 Getting down to brass tacks 91 Confronting fraud and corruption risks 93 Background checks and enhanced due diligence 95 Automation can be essential 96 Preventive controls and three broad categories of risk 96 Monitoring and evaluating preventive controls 100 Continuous controls monitoring 102 Correcting deficiencies 103 The roles of ERM and GRC 104 Chapter 8: Detective Controls and Transaction Monitoring 105 The importance of monitoring and detection 105 Monitoring and detection tactics 107 Whistle-blower hotlines 107 Risk-based internal audits as a fraud detection tactic 110 Manual monitoring 112 Technology-based detection tactics 112 Examples of fraud detection using data interrogation techniques 114 Continuous fraud monitoring 117 Is CFM for everyone? 119 The importance of lookbacks as a control check 120 Questions to ask about monitoring and detection 121 Chapter 9: Preparing for Fraud and Corruption Investigations and Remediation 122 Be prepared 122 An ounce of planning . 124 What to do when regulators come knocking . 125 Evaluating the allegation 126 Assembling the right investigation team 127 When to call for help 128 Establishing investigation protocols up front 129 ftoc.indd viii 3/16/09 2:23:15 PM Contents ix Collecting and preserving crucial data 130 Newer challenges, newer technologies 131 Communication—enough but not too much 133 The benefits of a case management system 133 Remediation—getting more value from investigations 134 Chapter 10: The Players’ Roles (Including Yours) 136 New rules, new responsibilities 136 The value of a cross-functional committee 146 The role of the compliance officer 147 Fraud and corruption risk management is everyone’s business 148 Conclusion: What the Future May Hold 151 Good fraud and corruption risk assessment is crucial 153 Embracing new roles and responsibilities 154 Measuring performance 155 We won’t predict the future, but . 155 Take your first steps now 156 Afterword 157 Appendix: Examples of Fraud Risk Factors 161 Recommended Reading 169 References 173 Disclosure 189 About the Authors 191 Index 193 ftoc.indd ix 3/16/09 2:23:15 PM ftoc.indd x 3/16/09 2:23:15 PM Foreword This book is for those of you who participate in corporate govern- ance and management, and are grappling with your organization’ s need to manage fraud and corruption risk in your operations and strategic planning. It is for those of you who do not have the time, and whose companies do not have the resources, to spend on inves- tigating and defending major fraud or corruption incidents in your organization. If you hold, or have held, any senior role in corporate man- agement or governance, you may already understand that you are doing so at a time when scrutiny of your role and the expectation that your organization will operate transparently and ethically have never been higher. The world ’ s economy and markets, stead- ily shrinking, have never provided so little in the way of resources or revenue to do so. And these circumstances have only increased political and public intolerance of corporate misfeasance and mis- management, especially in the areas of fraud and corruption. Add to this a revolution in global enforcement and regulation, which now follows commerce across borders with lightning speed. Ten years ago, it would have taken months for local or national prosecutors to obtain the attention, much less the assistance, of col- leagues on another continent.