ACFE Report to the Nation-2010

8/9/2019 ACFE Report to the Nation-2010

1/84

REPORT TO THE NATIONSO N O C C U P A T I O N A L F R A U D A N D A B U S E

2010 Global Fraud Study


2/84

2 | 2010 RepoRt to the NAtioNs ON OccuPATIONAl FRAUD ANd AbuSE

Lr rm prdn

When the ACFE published its rstReport to the Nation on Occupational Fraud and Abuse in 1996,

it broke new ground in anti-raud research by providing an analysis o the costs, the methodologies

and the perpetrators o raud within U.S. organizations. The collective body o knowledge con-

tained in the rst ve editions o the Report to the Nation published between 1996 and 2008

has become the most authoritative and widely quoted research publication on occupational

raud.

Now, or the rst time, the data contained in the Report have been drawn rom raud cases

throughout the world. As readers will see, it refects the truly universal nature o occupational raud. This expansion o

our research is denoted in the modied title or this study, which has now become the Report to the Nations on Occu-

pational Fraud and Abuse.

The inormation contained in this report is based on 1,843 cases o occupational raud that were reported by the Certied

Fraud Examiners (CFEs) who investigated them. These oenses occurred in more than 100 countries on six continents,

and more than 43% took place outside the United States. What is perhaps most striking about the data we gathered is

how consistent the patterns o raud are around the globe. While some regional dierences exist, or the most part oc-

cupational raud seems to operate similarly whether it occurs in Europe, Asia, South America or the United States.

The Report to the Nations is the brainchild o the ACFEs ounder and Chairman, Dr. Joseph T. Wells, CFE, CPA who

throughout his career has contributed more to the study o raud and the development o the anti-raud proession than

any other person. On behal o the ACFE, and in honor o its ounder, Dr. Wells, I am pleased to present the2010 Report to

the Nations on Occupational Fraud and Abuse to practitioners, business and government organizations, academics, the

media and the general public throughout the world. The inormation contained in this Report will be invaluable to those

who seek to deter, detect, prevent or simply understand the global economic impact o occupational raud.

James D. Ratley, CFE

President,

Association o Certied Fraud Examiners


3/84

2010 RepoRt to the NAtioNs ON OccuPATIONAl FRAUD ANd AbuSE |

Table of Contents

Exetive Smmary .............................................................................................................................................................4

Introtion ..........................................................................................................................................................................6

The cost o Opationa Fra ..........................................................................................................................................8

Distribution o Losses

How Opationa Fra Is committe ............................................................................................................................10

Asset Misappropriation Sub-Schemes

Duration o Fraud Schemes

detetion o Fra Shemes .............................................................................................................................................16

Initial Detection o Occupational Fraud Schemes

Source o Tips

Impact o Hotlines

Detection Methods Based on Organization Type

Detecting Fraud in Small Businesses

Detection o Occupational Fraud Based on Region

Vitim Organizations ..........................................................................................................................................................24

Geographical Location o Organizations

Type o Organizations

Size o Organizations

Methods o Fraud in Small Businesses

Industry o Organizations

Anti-Fraud Controls at Victim Organizations

Anti-Fraud Controls at Small Businesses

Anti-Fraud Controls by Region

Eectiveness o Controls

Importance o Controls in Detecting or Limiting Fraud

Control Weaknesses that Contributed to Fraud

Modication o Controls

Perpetrators ........................................................................................................................................................................48

Perpetrators Position

Perpetrators Gender

Perpetrators Age

Perpetrators Tenure

Perpetrators Education Level

Perpetrators Department

Background Criminal and Employment History

Behavioral Red Flags Displayed by Perpetrators

Methooogy ......................................................................................................................................................................75

Appenix breakown o Geographi Regions y contry ..........................................................................................78

Fra Prevention chekist ................................................................................................................................................80

Aot the AcFE ..................................................................................................................................................................82


4/84


summary Fndng

Survey participants estimated that the typicalorganization loses 5% o its annual revenue toraud. Applied to the estimated 2009 Gross WorldProduct, this gure translates to a potential totalraud loss o more than $2.9 trillion.

The median loss caused by the occupationalraud cases in our study was $160,000. Nearlyone-quarter o the rauds involved losses o atleast $1 million.

The rauds lasted a median o 18 months beorebeing detected.

Asset misappropriation schemes were the mostcommon orm o raud in our study by a widemargin, representing 90% o cases though theywere also the least costly, causing a median losso $135,000. Financial statement raud schemeswere on the opposite end o the spectrum in bothregards: These cases made up less than 5% othe rauds in our study, but caused a median losso more than $4 million by ar the most costlycategory. Corruption schemes ell in the middle,

comprising just under one-third o cases andcausing a median loss o $250,000.

Occupational rauds are much more likely to bedetected by tip than by any other means. Thisnding has been consistent since 2002 when webegan tracking data on raud detection methods.

Small organizations are disproportionatelyvictimized by occupational raud. Theseorganizations are typically lacking in anti-raudcontrols compared to their larger counterparts,which makes them particularly vulnerable to raud.

The industries most commonly victimized in our

study were the banking/nancial services,manuacturing and government/publicadministration sectors.

Anti-raud controls appear to help reduce the costand duration o occupational raud schemes. Welooked at the eect o 15 common controls onthe median loss and duration o the rauds. Victimorganizations that had these controls in place hadsignicantly lower losses and time-to-detection thanorganizations without the controls.

High-level perpetrators cause the greatestdamage to their organizations. Frauds commit-ted by owners/executives were more than threetimes as costly as rauds committed by managers,and more than nine times as costly as employeerauds. Executive-level rauds also took muchlonger to detect.

excuv summary

This Report is based on data

compiled from a study of 1,843

cases of occupational fraud that

occurred worldwide between

January 2008 and December

2009. All information was pro-

vided by the Certied Fraud Ex-aminers (CFEs) who investigated

those cases. The fraud cases in

our study came from 106 nations

with more than 40% of cases

occurring in countries outside

the United States providing a

truly global view into the plague

of occupational fraud.

One-fourth of the frauds in this Reportcaused at least $1 million in losses.


5/84


More than 80% o the rauds in our studywere committed by individuals in one o sixdepartments: accounting, operations, sales,executive/upper management, customer serviceor purchasing.

More than 85% o raudsters in our study hadnever been previously charged or convicted ora raud-related oense. This nding is consistentwith our prior studies.

Fraud perpetrators oten display warning signs

that they are engaging in illicit activity. The mostcommon behavioral red fags displayed by theperpetrators in our study were living beyond theirmeans (43% o cases) and experiencing nancialdiculties (36% o cases).

Cnclun and Rcmmndan

Occupational raud is a global problem. Thoughsome o our ndings dier slightly rom region toregion, most o the trends in raud schemes, per-petrator characteristics and anti-raud controls aresimilar regardless o where the raud occurred.

Fraud reporting mechanisms are a criticalcomponent o an eective raud prevention anddetection system. Organizations should implementhotlines to receive tips rom both internal andexternal sources. Such reporting mechanismsshould allow anonymity and condentiality, andemployees should be encouraged to reportsuspicious activity without ear o reprisal.

Organizations tend to over-rely on audits. Externalaudits were the control mechanism most widelyused by the victims in our survey, but they rankedcomparatively poorly in both detecting raud andlimiting losses due to raud. Audits are clearly

important and can have a strong preventativeeect on raudulent behavior, but they should notbe relied upon exclusively or raud detection.

Employee education is the oundation opreventing and detecting occupational raud.Sta members are an organizations top rauddetection method; employees must be trained inwhat constitutes raud, how it hurts everyone inthe company and how to report any questionableactivity. Our data show not only that most raudsare detected by tips, but also that organizationsthat have anti-raud training or employees andmanagers experience lower raud losses.

Surprise audits are an eective, yet underutilized,tool in the ght against raud. Less than 30% ovictim organizations in our study conductedsurprise audits; however, those organizationstended to have lower raud losses and to detectrauds more quickly. While surprise audits can beuseul in detecting raud, their most importantbenet is in preventing raud by creating a percep-tion o detection. Generally speaking, occupationalraud perpetrators only commit raud i theybelieve they will not be caught. The threat osurprise audits increases employees perception

that raud will be detected and thus has a strongdeterrent eect on potential raudsters.

Small businesses are particularly vulnerable toraud. In general, these organizations have ar ewercontrols in place to protect their resources romraud and abuse. Managers and owners o smallbusinesses should ocus their control investmentson the most cost-eective mechanisms, suchas hotlines and setting an ethical tone or theiremployees, as well as those most likely to helpprevent and detect the specic raud schemes thatpose the greatest risks to their businesses.

Internal controls alone are insucient to ully

prevent occupational raud. Though it is importantor organizations to have strategic and eectiveanti-raud controls in place, internal controls willnot prevent all raud rom occurring, nor will theydetect most raud once it begins.

Fraudsters exhibit behavioral warning signs o theirmisdeeds. These red fags such as living beyondones means or exhibiting control issues will notbe identied by traditional controls. Auditors andemployees alike should be trained to recognize thecommon behavioral signs that a raud is occurringand encouraged not to ignore such red fags, as

they might be the key to detecting or deterring araud.

Given the high costs o occupational raud,eective raud prevention measures are critical.Organizations should implement a raud preventionchecklist similar to that on page 80 in order to helpeliminate raud beore it occurs.


6/84


A wide variety o crimes and swindles all under the um-

brella o raud. From Ponzi schemes and identity thet to

data breaches and alsied expense reports, the ways

perpetrators attempt to part victims rom their money are

extremely diverse and continually evolving. At their core,

however, all rauds involve a violation o trust.

For businesses, no trust violations have the potential to be

as harmul as those committed by the very individuals who

are relied upon to make the organization successul: its

employees. This report ocuses on the category o raud

occupational raud in which an employee abuses his

or her position within the organization or personal gain.

More ormally, occupational raud may be dened as:

The use of ones occupation for personal enrichment

through the deliberate misuse or misapplication of

the employing organizations resources or assets.

This denition is very broad, encompassing a wide rangeo misconduct by employees at every organizational level.

Occupational raud schemes can be as simple as pilerage

o company supplies or manipulation o timesheets, or as

complex as sophisticated nancial statement rauds.

One o the ACFEs primary missions is to educate anti-

raud proessionals and the general public about the seri-

ous threat occupational raud poses. To that end, we have

undertaken extensive research to provide an in-depth look

at the costs and trends in occupational raud. In 1996, theACFE released its Report to the Nation on Occupational

Fraud and Abuse, which was the largest known privately

unded study on the subject at the time.

The stated goals o the rst Report were to:

Summarize the opinions o experts on the percentage and amount o organizational revenue lost to allorms o occupational raud and abuse.

Examine the characteristics o the employees whocommit occupational raud and abuse.

Determine what kinds o organizations are victimso occupational raud and abuse.

Categorize the ways in which serious raud andabuse occur.

Since the inception o the Report to the Nation more than

a decade ago, we have released ve updated editions in

2002, 2004, 2006, 2008 and the current version in 2010. Like

the rst Report, each subsequent edition has been based

on detailed case inormation provided by Certied Fraud Ex-

aminers (CFEs). With each new edition o the Report, we

add to and modiy the questions we ask o our survey par-

ticipants in order to enhance the quality o the data we col-

lect. This evolution o theReport to the Nation has enabled

us to continue to draw more meaningul inormation rom

the experiences o CFEs and the rauds they encounter.

In our 2010 Report, we have, or the rst time ever, wid-

ened our study to include cases rom countries outside

the United States. This expansion allows us to more ully

explore the truly global nature o occupational raud and

provides an enhanced view into the severity and impact

o these crimes. Additionally, we are able to compare the

anti-raud measures taken by organizations worldwide inorder to give raud ghters everywhere the most appli-

cable and useul inormation to help them in their raud

prevention and detection eorts.

inrducn

A N Radr: Throughout this Report, we have included several comparisons o our current ndings with those rom our 2008 Report. However, it is important to note thatthe 2010 data include reported rauds rom CFEs in 106 countries, while the 2008 data pertain to rauds reported only by CFEs in the United States. Although the populations orespondents or the two studies are not entirely analogous, we have nonetheless included these prior-study comparisons, as we believe interesting and useul trends can be seenby comparing and contrasting the rauds reported in the two studies. To enhance data clarity, we have included comparisons o 2008 data with both all-case data and U.S.-only datarom our 2010 research when noteworthy discrepancies in our current ndings are present.


7/84


Opationa Fra an Ase cassifation System

Corruption

Conflicts ofInterest

Cash

FraudulentDisbursements

PurchasingSchemes

SalesSchemes

Bid Rigging

OtherOther

Larceny Skimming Misuse Larceny

AssetRequisitionsand Transfers

False Salesand Shipping

Purchasingand Receiving

UnconcealedLarceny

Sales

Unrecorded Write-offSchemes

LappingSchemes

Unconcealed

Understated

ReceivablesRefunds

and Other

Other

Cash onHand

From theDeposit

Billing Schemes Payroll SchemesExpense

ReimbursementSchemes

Check TamperingRegister

Disbursements

Forged Maker False Voids

False RefundsForged

Endorsement

ConcealedChecks

AuthorizedMaker

Altered Payee

MischaracterizedExpenses

GhostEmployees

CommissionSchemes

OverstatedExpenses

FictitiousExpenses

MultipleReimbursements

WorkersCompensation

Falsified Wages

Shell Company

Non-AccompliceVendor

PersonalPurchases

InvoiceKickbacks

Asset/RevenueOverstatements

TimingDifferences

FicticiousRevenues

ImproperDisclosures

ConcealedLiabilities and

Expenses

ImproperAsset

Valuations

Asset/RevenueUnderstatements

EmploymentCredentials

InternalDocuments

ExternalDocuments

IllegalGratuities

EconomicExtortion

Non-Cash

Non-Financial

Bribery Financial

AssetMisappropriation

FraudulentStatements


8/84


Measuring the cost o occupational raud is an important,

yet incredibly challenging, endeavor. Arguably, the true

cost is incalculable. The inherently clandestine nature

o raud means that many cases will never be revealed,

and, o those that are, the ull amount o losses might not

be uncovered, quantied or reported. Consequently, any

measurement o occupational raud costs will be, at best,

an estimate. Nonetheless, determining such an approxi-

mation is critical to illustrate the pandemic and destruc-

tive nature o white-collar crime.

We asked each CFE who participated in our survey to pro-

vide his or her best estimate o the percentage o annual

revenues that the typical organization loses to raud in a

given year. The median response was that the average

organization annually loses 5% o its revenues to raud.

Applying this percentage to the 2009 estimated Gross

World Product o $58.07 trillion1 would result in a pro-

jected total global raud loss o more than $2.9 trillion.

Readers should note that this estimate is based solely

on the opinions o 1,843 anti-raud experts, rather than

any specic data or actual observations; accordingly, it

should not be interpreted as a literal representation o the

worldwide cost o occupational raud. However, because

there is no way to precisely calculate the size o global

raud losses, the best estimate o anti-raud proession-

als with a rontline view o the problem may be as reli-

able a measure as we are able to make. In any event, it

is undeniable that the overall cost o occupational raud

is immense, certainly costing organizations hundreds o

billions or trillions o dollars each year.

t C occuanal Fraud

1United States Central Intelligence Agency, The World Factbook (https://www.cia.gov/library/publications/the-world-actbook/geos/xx.html)

Fraud, by its very nature, does

not lend itself to being scien-

tically observed or measured

in an accurate manner. One of

the primary characteristics of

fraud is that it is clandestine,

or hidden; almost all fraud in-volves the attempted conceal-

ment of the crime.

The typical organization loses 5% of itsannual revenues to occupational fraud.


9/84


Drbun L

We received inormation about the total dollar loss or 1,822 o the 1,843 rauds reported to us in our study.2 The median

loss or these cases was $160,000. Nearly one-third o the raud schemes caused a loss to the victim organization o

more than $500,000, and almost one-quarter o all reported cases topped the $1 million threshold.

distrition o doar losses

2Although this Report includes raud cases rom more than 100 nations, all monetary amounts presented throughout this Report are in U.S. dollars.

0%

5%

10%

15%

20%

25%

30%

$1,000,000and up

$500,000 $999,999

$100,000 $499,999

$50,000 $99,999

$10,000 $49,999

$1,000 $9,999

Less than$1,000

Dollar Loss

PercentofCases

2.4%

7.2%

18.4%

10.6%

29.3%

8.4%

23.7%


10/84


Previous ACFE research has identied three primary cat-

egories o occupational raud used by individuals to de-

raud their employers.Asset misappropriations are those

schemes in which the perpetrator steals or misuses an

organizations resources. These rauds include schemes

such as skimming cash receipts, alsiying expense re-

ports and orging company checks.

Corruption schemes involve the employees use o his orher infuence in business transactions in a way that vio-

lates his or her duty to the employer or the purpose o

obtaining a benet or him- or hersel or someone else.

Examples o corruption schemes include bribery, extor-

tion and a confict o interest.

Financial statement fraud schemes are those involving

the intentional misstatement or omission o material in-

ormation in the organizations nancial reports. Common

methods o raudulent nancial statement manipulation

include recording ctitious revenues, concealing liabili-

ties or expenses and articially infating reported assets.

As indicated in the ollowing charts, asset misappropriations

are by ar both the most requent and the least costly orm

o occupational raud. On the other end o the spectrum are

cases involving nancial statement raud. These schemes

were present in less than 5% o the cases reported to us,

but caused a median loss o more than $4 million. Corrup-

tion schemes ell in the middle category in both respects,

occurring in just under one-third o all cases involved in our

study and causing a median loss o $250,000.

hw occuanal Fraud i Cmmd

Based on previous ACFE

research we have broken down

the schemes reported to us

into three primary categories:

asset misappropriation,

corruption, and nancial

statement fraud.

Financial statement fraud is the mostcostly form of occupational fraud, causinga median loss of more than $4 million.


11/84


Opationa Fras y category Freqeny3

Opationa Fras y category Meian loss

3The sum o percentages in this chart exceeds 100% because several cases involved schemes rom more than one category.

0% 20% 40% 60% 80% 100%

2010

2008

Financial

Statement Fraud

Corruption

Asset

Misappropriation88.7%

32.8%

10.3%

86.3%

26.9%

4.8%

Percent of Cases

Typ

e

ofFraud

$0 $1,000,000 $2,000,000 $3,000,000 $4,000,000 $5,000,000

2010

2008


Corruption

FinancialStatement Fraud

Median Loss

Type

ofFraud

$4,100,000

$2,000,000

$250,000

$135,000

$150,000

$375,000


12/84


As previously mentioned, our 2010 data include raud cases rom countries throughout the world, while our 2008 data

contain only U.S.-based cases. In the ollowing charts, we isolated the U.S. cases rom our current study to make a more

direct comparison to our 2008 data. Interestingly, while nancial statement raud remained the least common and most

costly orm o raud among U.S. cases, there was a much lower percentage o nancial statement cases in this study

(our percent) as compared to 2008 (ten percent). Additionally, the median losses or all three categories o raud were

notably smaller in 2010 than they were in 2008.


Opationa Fras y category (u.S. ony) Freqeny4

4The sum o percentages in this chart exceeds 100% because several cases involved schemes rom more than one category.

0% 20% 40% 60% 80% 100%

2010

2008

Financial

Statement Fraud

Corruption

Asset

Misappropriation88.7%

21.9%

10.3%

89.8%

26.9%

4.3%

Percent of Cases

Type

ofFraud


13/84


In addition to observing the requency and median losses

caused by the three categories o raud, we analyzed the

proportion o the total losses suered based on scheme

category. The cases in our study represented a combined

total loss o more than $18 billion. As indicated in the chart

to the right, o the total reported losses that were attribut-

able to a specic scheme type, 21% were caused by asset

misappropriation schemes, 11% by corruption and 68%

by raudulent nancial statements.

Opationa Fras y category (u.S. ony) Meian loss

Perent o Tota Reporte doar losses

$0 $500,000 $1,000,000 $1,500,000 $2,000,000

2010

2008


Corruption

FinancialStatement Fraud

Median Loss

Typ

e

ofFraud

$1,730,000

$2,000,000

$175,000

$100,000

$150,000

$375,000

Financial Statement Fraud

68.0%

Asset Misappropriation

20.8%

Corruption

11.3%


14/84



A Marran sub-scm

With nearly 90% o occupational rauds involving some orm o asset misappropriation, it is instructional to urther de-

lineate the methods used by employees to embezzle organizational assets. We divided asset misappropriation schemes

into nine sub-categories, as illustrated in the table on page 15. The rst eight sub-categories represent schemes target-

ing cash; these rauds account or approximately 85% o all asset misappropriations.

Two o the sub-schemes skimming and cash larceny involve pilering incoming cash receipts, such as sales revenues

and accounts receivable collections. The next ve sub-categories billing, expense reimbursement, check tampering,

payroll and raudulent register disbursement schemes involve raudulent disbursements o cash. The eighth orm o

cash misappropriation targets cash the organization has on hand, such as petty cash unds or cash in a vault. The nal

sub-category o asset misappropriations covers the thet or misuse o non-cash assets, including inventory, supplies, xed

assets, investments, intellectual property and proprietary inormation. The table on page 15 provides the requency and

median loss associated with each asset misappropriation sub-category.

Duran Fraud scm

In addition to examining the monetary cost o the raud cases reported to us, we analyzed the length o time these schemes

lasted beore being detected. The median duration the time period rom when the raud rst occurred to when it was

discovered or all cases in our study was 18 months. Not surprisingly, cases involving nancial statement raud the

most costly orm o raud lasted the longest, with a median duration o 27 months. Fraudulent register disbursements,

on the other hand, were not only the least costly orm o raud in our study, but also tended to be detected the soonest.

Meian dration o Fra base on Sheme Type

0 5 10 15 20 25 30

Register Disbursement

Non-Cash

Larceny

Skimming

Cash on Hand

Corruption

Billing

Payroll

Expense Reimbursements

Check Tampering

Financial Statement Fraud 27

24

24

24

24

18

18

18

18

15

12

Median Months to Detection

SchemeType


15/84


Asset Misappropriation S-categories

Cagry Dcrn examlCa

Rrd

prcn

all ca5Mdan

L

scm invlvng t Ca Rc

Skimming Any scheme in which cash is stolen roman organizationbefore it is recorded on theorganizations books and records

Employee accepts payment rom acustomer, but does not record the sale,and instead pockets the money

267 14.5% $60,000

Cash Larceny Any scheme in which cash is stolen roman organizationafterit has been recordedon the organizations books and records

Employee steals cash and checks romdaily receipts beore they can bedeposited in the bank

181 9.8% $100,000

scm invlvng Frauduln Dburmn Ca

Billing Any scheme in which a person causeshis employer to issue a payment bysubmitting invoices or ctitious goods orservices, infated invoices or invoices orpersonal purchases

Employee creates a shell company andbills employer or services not actuallyrendered

Employee purchases personal itemsand submits invoice to employer or

payment

479 26.0% $128,000

ExpenseReimbursements

Any scheme in which an employee makesa claim or reimbursement o ctitious orinfated business expenses

Employee les raudulent expensereport, claiming personal travel,nonexistent meals, etc.

278 15.1% $33,000

Check Tampering Any scheme in which a person steals hisemployers unds by intercepting, orgingor altering a check drawn on one o theorganizations bank accounts

Employee steals blank companychecks, makes them out to himsel oran accomplice

Employee steals outgoing check to avendor, deposits it into his own bankaccount

274 13.4% $131,000

Payroll Any scheme in which an employee causeshis employer to issue a payment bymaking alse claims or compensation

Employee claims overtime or hours notworked

Employee adds ghost employees to thepayroll

157 8.5% $72,000

Cash Register

Disbursements

Any scheme in which an employee makes

alse entries on a cash register to concealthe raudulent removal o cash

Employee raudulently voids a sale on

his cash register and steals the cash

55 3.0% $23,000

or A Marran scm

Cash on HandMisappropriations

Any scheme in which the perpetratormisappropriates cash kept on hand at thevictim organizations premises

Employee steals cash rom a companyvault

121 12.6% $23,000

Non-CashMisappropriations

Any scheme in which an employee stealsor misuses non-cash assets o the victimorganization

Employee steals inventory rom awarehouse or storeroom

Employee steals or misuses condentialcustomer nancial inormation

156 16.3% $90,000

5The sum o percentages in this table exceeds 100% because several cases involved asset misappropriation schemes rom more than one category.

N: Because asset misappropriation schemes are both so common and so diverse in their methods, or the remainder

o the Report, we will break down our analysis o the raud schemes into 11 categories corruption, nancial statement

raud and the nine sub-categories o asset misappropriation so as to provide a meaningul understanding o the ull

spectrum o ways in which employees deraud their employing organizations.


16/84


One o the principal goals o our research is to identiy

how past rauds were detected so that organizations can

apply that knowledge to their uture anti-raud eorts.

Tips were by ar the most common detection method in

our study, catching nearly three times as many rauds as

any other orm o detection. This is consistent with the

ndings in our prior reports. Tips have been ar and away

the most common means o detection in every study

since 2002, when we began tracking the data.

Management review and internal audit were the second

and third most common orms o detection, uncovering

15% and 14% o rauds, respectively. It is also noteworthy

that 11% o rauds were detected through channels that

lie completely outside o the traditional anti-raud control

structure: accident, police notication and conession. In

other words, 11% o the time, the victim organization ei-

ther had to stumble onto the raud or be notied o it by a

third party in order to detect it.

Dcn Fraud scm

Initia detetion o Opationa Fras

Respondents to our survey

were asked to identify how the

frauds were rst discovered.

Three times as many frauds in

our study were uncovered by a

tip as by any other method.

Frauds are much more likely to bedetected by tips than by any other method.

0% 10% 20% 30% 40% 50%

IT Controls

Confession

Notified by PoliceSurveillance/Monitoring

External Audit

Document Examination

Account Reconciliation

By Accident

Internal Audit

Management Review

Tip 40.2%

15.4%

13.9%

8.3%

6.1%

5.2%

4.6%

2.6%

1.8%

1.0%

0.8%

Percent of Cases

Dete

ctionMethod


17/84


surc t

Not surprisingly, employees were the most common

source o raud tips. However, customers, vendors, com-

petitors and acquaintances (i.e., non-company sources)

provided at least 34% o raud tips, which suggests that

raud reporting policies and programs should be publi-

cized not only to employees, but also to customers, ven-

dors and other external stakeholders.

imac Annymu Rrng

Mcanm (hln)

While tips have consistently been the most common way

to detect raud, the impact o tips is, i anything, understat-

ed by the act that so many organizations ail to implement

raud reporting systems. Such systems enable employees

to anonymously report raud or misconduct by phone or

through a web-based portal.6 The ability to report raud

anonymously is key because employees oten ear making

reports due to the threat o retaliation rom superiors ornegative reactions rom their peers. Also, most third-party

hotline systems oer programs to raise awareness about

how to report misconduct. Consequently, one would ex-

pect that the presence o a raud hotline would enhance

raud detection eorts and oster more tips.

This turns out to be true. As seen on page 18, the pres-

ence o raud hotlines correlated with an increase in the

number o cases detected by a tip. In organizations that

had hotlines, 47% o rauds were detected by tips, while

in organizations without hotlines, only 34% o cases were

detected by tips. This is important because tips have

repeatedly been shown to be the most eective way to

catch raud. The better an organization is at collecting andresponding to raud tips, the better it should be at detect-

ing raud and limiting losses.

In 67% o the cases where there was an anonymous

tip, that tip was reported through an organizations raud

hotline. This strongly suggests that hotlines are an eec-

tive way to encourage tips rom employees who might oth-

erwise not report misconduct. Perhaps most important, as

noted on page 43, organizations that had raud hotlines su-

ered much smaller raud losses than organizations without

hotlines. Those organizations also tended to detect rauds

seven months earlier than their counterparts.

6For simplicitys sake, we will reer to all reporting mechanisms as hotlines in this study.

0%

10%

20%

30%

40%

50%

Perp

etrator's

Acquaintan

ce

Compe

titor

Shar

eholde

r/

Owne

rVe

ndor

Anon

ymou

s

Custom

er

Employ

ee

49.2%

17.8%

13.4%12.1%

3.7%2.5% 1.8%

Source of Tips

P

ercentofTips

Sore o Tips


18/84


Dcn Md Bad n organzan ty

The chart on page 19 shows how rauds were detected based on the victims organization type. We see that privately

owned companies tended to have the ewest rauds detected by tip and the most rauds caught by accident, both o

which were also true in our 2008 study. Publicly held companies tended to detect more rauds by management review

and internal audit than their counterparts. Government agencies had the highest rate o detection by tips and had a pro-

portionately high rate o rauds caught through external audit.

Dcng Fraud n small BunSmall businesses historically tend to suer disproportionately high occupational raud losses, according to our previ-

ous reports. The trend was not as pronounced in this study as in past years, but we still saw that 31% o all occupa-

tional rauds were committed against small businesses (the highest rate o any category) and the median loss in those

schemes was $155,000 (see page 29). One reason that small businesses are particularly good targets or occupational

raud is that they tend to have ar ewer anti-raud controls than larger organizations (see page 39).

Dcn Fraud scm

Impat o Hotines

0% 10% 20% 30% 40% 50%

Organizations With Hotlines

Organizations Without Hotlines

Confession

Notified by Police

IT Controls

External Audit

Surveillance/Monitoring


By Accident

Account Reconcilliation

Management Review

Internal Audit

Tip

Percent of Cases

DetectionMethod

47.1%

33.8%

15.7%

15.7%

16.5%

11.2%

4.6%

4.7%

7.8%

3.7%

1.4%

3.0%

1.0%

0.9%

1.4%

2.2%

2.3%

1.1%

0.4%

6.5%

7.3%

11.9%


19/84


When we look at how small businesses detect rauds, it is apparent that they catch a much lower proportion o schemes

through tips or internal audits than larger organizations. According to the chart on page 20, only 33% o small business

rauds are detected by a tip, and only 8% are detected by an internal audit. Additionally, a relatively large percentageo rauds are caught by accident at small companies nearly twice as many as at larger organizations. Many o these

discrepancies are likely due to the low rates o control implementation at small businesses.

Initia detetion Metho y Organization Type

0% 10% 20% 30% 40% 50%

Government

Public Company

Private Company

Not-for-Profit

IT Controls

Confession

Notified by Police


External Audit


Account Reconcilliation

By Accident

Internal Audit

Management Review

Tip

Percent of Cases

DetectionMethod

43.2%

13.0%

10.7%

6.5%

8.9%

6.5%

6.5%

1.2%

1.8%

1.2%

0.6%

15.4%

11.6%

11.2%

8.2%

6.0%

5.2%

2.6%

2.5%

1.0%

0.5%

17.6%

16.7%

6.8%

3.9%

5.0%

2.3%

3.0%

1.2%

1.1%

1.2%

11.6%

15.1%

5.3%

4.6%

3.9%

7.4%

2.8%

1.4%

1.4%

0.4%

35.8%41.1%

46.3%


20/84


Dcn Fraud scm

Initia detetion o Fras in Sma bsinesses

Dcn occuanal Fraud Bad n Rgn

The ollowing charts show how rauds were detected based on the region in which they occurred.7 In every region, tips

were responsible or detecting the most occupational rauds by a wide margin. The percentage o cases detected by tips

ranged rom a high o 50% (in Arica) to a low o 38% (in the United States). In all but two regions, management review

and internal audit were the second and third most common means o detection, ollowing tips.

detetion in the unite States 1,001 cases

7See Appendix or a listing o countries included in each region.

0% 10% 20% 30% 40% 50%

100+ Employees


21/84


detetion in Asia 293 cases

detetion in Erope 155 cases

0% 10% 20% 30% 40% 50%

IT Controls

Notified by PoliceConfession




External Audit

By Accident

Management Review

Internal Audit

Tip 42.3%

11.3%

14.3%

8.9%

5.5%

4.4%

5.8%

2.7%

1.7%

2.4%

0.7%

Percent of Cases

D

etectionMethod

0% 10% 20% 30% 40% 50%

Confession

IT Controls

Notified by Police


External Audit



By Accident

Management Review

Internal Audit

Tip 40.0%

16.1%

17.4%

6.5%

5.8%

5.2%

3.9%

3.2%

1.3%

0.0%

0.6%

Percent of Cases

DetectionMethod


22/84


Dcn Fraud scm

detetion in Aria 111 cases

detetion in canaa 97 cases

0% 10% 20% 30% 40% 50%

IT Controls

ConfessionDocument Examination

External Audit

Notified by Police



By Accident

Internal Audit

Management Review

Tip 49.5%

11.7%

9.9%

9.0%

6.3%

0.9%

1.8%

5.4%

4.5%

0.9%

0.0%

Percent of Cases

D

etectionMethod

0% 10% 20% 30% 40% 50%

IT Controls

Confession

Notified by Police


External Audit


By Accident


Internal Audit

Management Review

Tip 46.4%

15.5%

12.4%

5.2%

6.2%

4.1%

4.1%

4.1%

1.0%

1.0%

0.0%

Percent of Cases

DetectionMethod


23/84


detetion in centra/Soth Ameria an the cariean 70 cases

detetion in Oeania 40 cases

0% 10% 20% 30% 40% 50%

IT Controls

By AccidentNotified by Police

Confession




Internal Audit

External Audit

Management Review

Tip 44.3%

14.3%

10.0%

0.0%

8.6%

4.3%

12.9%

4.3%

0.0%

1.4%

0.0%

Percent of Cases

D

etectionMethod

0% 10% 20% 30% 40% 50%

IT Controls

Confession

Notified by Police


External Audit



Internal Audit

By Accident

Management Review

Tip 45.0%

20.0%

10.0%

12.5%

2.5%

0.0%

2.5%

7.5%

0.0%

0.0%

0.0%

Percent of Cases

DetectionMethod


24/84


Ggracal Lcan organzan

As mentioned previously, or the rst time in the history

o our research on occupational raud, we opened up our

study to include raud cases investigated by CFEs out-

side the United States. As a result, the cases discussed in

this Report represent rauds perpetrated in 106 countries

around the world. We received inormation on the location

o 1,797 o the cases that were reported to us. O these,

43% occurred outside the United States, providing us with

a true insight into the global plague o occupational raud.

The chart below shows the number and median loss o

the cases reported to us, broken down by region. For vic-

tim organizations with locations in more than one coun-

try, we asked survey participants to choose the location

where the primary perpetrator was located. For example,

a raud perpetrated at a European arm o a Japanese com-

pany would be classied as occurring in Europe. Similarly,

a case involving raud perpetrated at the Canadian oce

o a South American company would be considered a

raud that occurred in Canada. The regional breakdowns

on case data throughout this Report should consequently

be read within this ramework. Additionally, due to the

large number o U.S. cases reported, we separated North

America into the United States and Canada, and grouped

the remaining countries by continent.

Vcm organzan

Geographia loation o Vitim Organizations8

Rgn Numbr Ca prcn Ca Mdan L (n U.s. dllar)

United States 1,021 56.8% $105,000

Asia 298 16.6% $274,000

Europe 157 8.7% $600,000

Arica 112 6.2% $205,000

Canada 99 5.5% $125,000

Central/South America and the Caribbean 70 3.9% $186,000

Oceania 40 2.2% $338,000

8See Appendix or a listing o countries included in each region.

As part of our survey, we asked

each respondent to provide

demographic information

about the organization that

was defrauded.

Small organizations are particularlyvulnerable to fraud.


25/84


The ollowing tables illustrate the requency o the 11 occupational raud schemes nancial statement raud, corrup-

tion and the nine asset misappropriation sub-schemes or each region.9

unite States 1,021 cases

scmNumbr

Ca

prcn

Ca

Billing 282 27.6%

Corruption 224 21.9%

Check Tampering 173 16.9%

Skimming 165 16.2%

Non-Cash 160 15.7%

Expense Reimbursements 154 15.1%

Cash on Hand 117 11.5%

Payroll 108 10.6%

Cash Larceny 98 9.6%

Financial Statement Fraud 44 4.3%

Register Disbursements 25 2.4%

Erope 157 cases

scm Numbr Ca prcn Ca

Corruption 79 50.3%

Billing 41 26.1%

Non-Cash 31 19.7%



Skimming 17 10.8%



Payroll 10 6.4%



Asia 298 cases

scmNumbr

Ca

prcn

Ca


Billing 56 18.8%

Non-Cash 55 18.5%


Skimming 38 12.8%





Payroll 12 4.0%


Aria 112 cases


Corruption 55 49.1%

Billing 38 33.9%

Non-Cash 24 21.4%




Skimming 13 11.6%


Payroll 6 5.4%



9The sum o percentages in these tables exceeds 100% because several casesinvolved schemes rom more than one category.


26/84


corrption cases y Region

Rgn Numbr Crrun Ca prcn all Ca n Rgn Mdan L

Asia 152 51.0% $330,000

Europe 79 50.3% $1,000,000

Arica 55 49.1% $208,000

Central/South America and the Caribbean 33 47.1% $250,000

Oceania 16 40.0% $800,000

United States 224 21.9% $175,000

Canada 21 21.2% $163,000

Vcm organzan

canaa 99 cases

scmNumbr

Ca

prcn

Ca

Billing 21 21.2%

Corruption 21 21.2%



Non-Cash 15 15.2%

Payroll 12 12.1%

Skimming 12 12.1%


Cash on Hand 9 9.1%



Oeania 40 cases

scmNumbr

Ca

prcn

Ca

Corruption 16 40.0%

Non-Cash 12 30.0%

Billing 11 27.5%


Skimming 5 12.5%



Cash Larceny 3 7.5%

Payroll 2 5.0%



centra/Soth Ameria an the cariean 70 cases

scmNumbr

Ca

prcn

Ca

Corruption 33 47.1%

Billing 20 28.6%

Non-Cash 13 18.6%


Skimming 9 12.9%





Payroll 3 4.3%


Crrun Ca by Rgn

We compared the proportion and cost o cases involving

corruption among the regional categories in our study. The

results are presented in the ollowing table.

Readers should keep in mind that this data does not neces-

sarily refect overall corruption levels within each region; it

only refects the specic raud cases that were investigated

and reported to us by the CFEs who took part in our study.


27/84


ty organzan

More than 40% o victim organizations in our study were privately owned businesses, and nearly one-third were publicly

traded companies, meaning that almost three-quarters o the victims represented in our study came rom or-prot enter-

prises. Sixteen percent o the rauds reported to us occurred at government agencies. Not-or-prot organizations were the

least represented category, with less than 10% o rauds taking place at these entities.

In addition to experiencing the most rauds, private and public companies were also victim to the costliest schemes in

our study; the median loss or the cases at these businesses was $231,000 and $200,000, respectively (see page 28).

In contrast, the losses experienced by government agencies and not-or-prot organizations were about hal as much.

Government agencies had a median loss o $100,000, while not-or-prots lost a median o $90,000.

Organization Type o Vitim Freqeny

0% 10% 20% 30% 40% 50%

2010

2008

Not-for-Profit

Government

Public Company

Private Company39.1%

28.4%

32.1%

14.3%

42.1%

16.3%

18.1%

9.6%

Percent of Cases

TypeofVictimO

rganization


28/84


Vcm organzan

Organization Type o Vitim Meian loss

Continuing the trend observed in our prior studies, small

organizations those with ewer than 100 employees

suered the greatest percentage o the rauds in our 2010

study, accounting or more than 30% o the victim orga-

nizations. However, the variation between size categories

is relatively small, with 23% o victims having between

100 and 999 employees, 26% having 1,000 to 9,999 em-

ployees and 21% having more than 10,000 employees.

This relatively small disparity contrasts with our previous

studies, in which small organizations were involved in a

much higher percent o rauds than any other category.

Additionally, our research has historically shown that

smaller organizations suer disproportionately large loss-

es due to occupational raud. Organizations with ewer

than 100 employees experienced the greatest median

loss o all categories o victim organizations in our 2008

study. The same was true in our 2006 study. However,

that was not the case when we looked at the ull body

o data rom our current survey. Consequently, we under-

took additional analyses to see what eect, i any, the in-

clusion o cases rom countries outside the United States

had on these ndings.

sz organzan

$0 $50,000 $100,000 $150,000 $200,000 $250,000 $300,000

2010

2008

Not-for-Profit

Government

Public Company

Private Company$231,000

$278,000

$200,000

$142,000

$100,000

$100,000

$109,000

$90,000

Median Loss

TypeofVic

timO

rganization


29/84


Size o Vitim Organization Freqeny

Size o Vitim Organization Meian loss

$0 $50,000 $100,000 $150,000 $200,000

2010

2008

10,000+

1,000 9,999

100 999


30/84


Vcm organzan

I we make a direct comparison o the U.S. cases rom our current study to the data rom 2008, we can see that, though

the median loss in each category is smaller absolutely, the median losses suered by the smallest organizations are

greater than those suered by larger organizations. This nding is similar to our observations in previous studies and

suggests that small companies in the United States are indeed disproportionately harmed by occupational raud.

Size o Vitim Organization (u.S. ases ony) Meian loss

An analysis o the nature o losses at small businesses becomes more interesting when we expand our examination to each

region represented. For the rauds perpetrated in Europe, Asia, Canada and the United States, the median losses were signi-

cantly greater at small organizations than at those with more than 100 employees. Conversely, the median losses experienced by

small organizations in Central/South America and the Caribbean, Arica and Oceania were notably less than those experienced

by their larger counterparts.

$0 $50,000 $100,000 $150,000 $200,000

2010 (U.S. only)

2008

10,000+

1,000 9,999

100 999


31/84


Size o Vitim Organizations Meian loss y Region

Md Fraud n small Bun

Because the challenges aced by small businesses in

combating occupational raud are numerous and unique,

it is helpul to know the types o rauds that are most

prevalent within these organizations. Such observations

may help small businesses target their limited resources

to those areas that pose the greatest risk.

O course, the specic risks aced by any organization are

largely dependent on its particular industry, operating envi-

ronment, processes, culture and many other actors. None-

theless, examining which raud schemes are most com-

monly perpetrated at small companies can aid us in better

understanding the raud issues aced by these businesses.

Sma bsinesses(


32/84


Vcm organzan

As the chart below illustrates, check tampering schemes were much more common at small organizations than at all

other entities. Skimming and payroll rauds were also more common in small organizations. These trends stand to rea-

son, as the unctions aected by such schemes the check writing, cash collection and payroll unctions, respectively

are more likely to be perormed by a single individual, such as a bookkeeper, and are oten subject to less oversight

within a small organization than in a large company where duties are more segregated and authorization o transactions

is more ormalized. In contrast, although corruption schemes were the third most common raud scheme aced by small

businesses, they were less requent within small companies than in bigger organizations.

Methos o Fra y Size o Vitim Organization

0% 5% 10% 15% 20% 25% 30% 35% 40%


33/84


indury organzan

We looked at the industry classication o the organizations victimized by the raud cases in our study. It is important to view

this data as a representation o the companies that had CFEs investigate internal raud cases within the last two years, rather

than as an indication o which industries are more or less likely to be victimized by raud. However, the ollowing tables do

draw attention to some dierences in the requency and cost associated with occupational rauds among dierent sectors.

For example, the banking and nancial services industry had the most cases, accounting or more than 16% o the rauds

reported to us. The period o time covered by our survey calendar years 2008 and 2009 was lled with news stories o

raud in the banking sector, so this nding is not unexpected. In contrast, the mining industry experienced the ewest rauds

in our study, but those cases caused a median loss o $1 million by ar the largest o any o the industries we examined.11

Instry o Vitim Organizations(sorte y Freqeny)

induryNumbr

Ca

prcn

Ca

Mdan

L

Banking/Financial Services 298 16.6% $175,000

Manuacturing 193 10.7% $300,000

Government and PublicAdministration

176 9.8% $81,000

Retail 119 6.6% $85,000

Healthcare 107 5.9% $150,000

Insurance 91 5.1% $197,000

Education 90 5.0% $71,000

Services (other) 88 4.9% $109,000

Construction 77 4.3% $200,000

Technology 65 3.6% $250,000

Transportation andWarehousing

62 3.4% $300,000

Oil and Gas 57 3.2% $478,000

Real Estate 57 3.2% $475,000

Services (proessional) 51 2.8% $110,000

Arts, Entertainment andRecreation

49 2.7% $180,000

Utilities 45 2.5% $120,000

Wholesale Trade 42 2.3% $513,000

Religious, Charitable orSocial Services

41 2.3% $75,000

Telecommunications 37 2.1% $131,000

Agriculture, Forestry, Fishingand Hunting

27 1.5% $320,000

Communications/Publishing 16 0.9% $110,000

Mining 12 0.7% $1,000,000

Instry o Vitim Organizations(sorte y Meian loss)

induryNumbr

Ca

prcn

Ca

Mdan

L

Mining 12 0.7% $1,000,000

Wholesale Trade 42 2.3% $513,000

Oil and Gas 57 3.2% $478,000

Real Estate 57 3.2% $475,000

Agriculture, Forestry, Fishingand Hunting

27 1.5% $320,000

Manuacturing 193 10.7% $300,000

Transportation andWarehousing

62 3.4% $300,000

Technology 65 3.6% $250,000

Construction 77 4.3% $200,000

Insurance 91 5.1% $197,000

Arts, Entertainment andRecreation

49 2.7% $180,000

Banking/Financial Services 298 16.6% $175,000

Healthcare 107 5.9% $150,000

Telecommunications 37 2.1% $131,000

Utilities 45 2.5% $120,000

Services (proessional) 51 2.8% $110,000

Communications/Publishing 16 0.9% $110,000

Services (other) 88 4.9% $109,000

Retail 119 6.6% $85,000

Government and PublicAdministration

176 9.8% $81,000

Religious, Charitable or SocialServices

41 2.3% $75,000

Education 90 5.0% $71,000

11There was a small sample o only 12 cases in this industry, which may impact the reliability o the median loss data.


34/84


banking/Finania Servies 298 cases

scm Number of Cases prcn Ca



Billing 37 12.4%


Non-Cash 33 11.1%

Skimming 32 10.7%

Larceny 29 9.7%


20 6.7%


Payroll 9 3.0%


Government an PiAministration 176 cases


Corruption 57 32.4%

Billing 43 24.4%


32 18.2%

Non-Cash 30 17.0%Larceny 25 14.2%


Skimming 23 13.1%


Payroll 20 11.4%



Manatring 193 cases


Corruption 75 38.9%

Billing 73 37.8%

Non-Cash 45 23.3%


43 22.3%


Skimming 20 10.4%

Payroll 20 10.4%


Larceny 14 7.3%



Retai 119 cases


Non-Cash 39 32.8%

Corruption 26 21.8%

Skimming 19 16.0%

Larceny 17 14.3%

Billing 16 13.4%





8 6.7%


Payroll 3 2.5%

12The sum o percentages in these tables exceeds 100% because several casesinvolved schemes rom more than one category.

Vcm organzan

In the ollowing tables, we have presented the distribution o raud schemes or all industries in which there were more

than 50 reported cases.12 Many o the ndings are not surprising. For example, thet o cash on hand which includes the

thet o cash rom a bank vault accounted or just 12% o all cases combined, but occurred in 22% o the cases involv-

ing the banking and nancial services industry. Similarly, both thet o non-cash assets and raudulent register disburse-

ments were much more common in the retail industry than in other sectors. This makes sense, as retail establishments

tend to have more inventory- and cash-register-based transactions than entities in other industries. Examining the variation

in schemes among industries underscores the need or organizations to consider the specic raud risks they ace when

determining which processes and unctions merit additional resources devoted to raud prevention and detection.


35/84


Heathare 107 casesscm Number of Cases prcn Ca

Corruption 31 29.0%

Skimming 24 22.4%

Billing 23 21.5%

Non-Cash 21 19.6%



12 11.2%

Payroll 10 9.3%

Cash on Hand 9 8.4%

Larceny 8 7.5%



Eation 90 casesscm Number of Cases prcn Ca

Billing 38 42.2%

Corruption 22 24.4%

Skimming 19 21.1%


15 16.7%

Non-Cash 11 12.2%

Larceny 11 12.2%

Payroll 9 10.0%


Cash on Hand 7 7.8%



constrtion 77 casesscm Number of Cases prcn Ca

Corruption 35 45.5%

Billing 23 29.9%Check Tampering 14 18.2%

Skimming 12 15.6%

Non-Cash 12 15.6%


10 13.0%

Payroll 7 9.1%

Larceny 7 9.1%


Cash on Hand 3 3.9%


Insrane 91 casesscm Number of Cases prcn Ca

Corruption 30 33.0%

Billing 19 20.9%


Skimming 13 14.3%

Non-Cash 9 9.9%

Cash on Hand 9 9.9%

Larceny 8 8.8%

Expense

Reimbursements

7 7.7%

Payroll 6 6.6%



Servies (other) 88 casesscm Number of Cases prcn Ca

Corruption 25 28.4%

Skimming 22 25.0%

Billing 22 25.0%


Payroll 13 14.8%


12 13.6%

Non-Cash 11 12.5%

Larceny 9 10.2%

Cash on Hand 8 9.1%



Tehnoogy 65 casesscm Number of Cases prcn Ca

Corruption 28 43.1%

Billing 19 29.2%


17 26.2%

Non-Cash 16 24.6%



Skimming 6 9.2%

Cash on Hand 5 7.7%

Payroll 4 6.2%

Larceny 4 6.2%



36/84


Transportation an Warehousing 62 cases


Corruption 22 35.5%

Billing 20 32.3%

Non-Cash 16 25.8%

Payroll 9 14.5%

Skimming 8 12.9%

Larceny 7 11.3%

Financial StatementFraud

5 8.1%



5 8.1%

Cash on Hand 4 6.5%


Real Estate 57 cases


Billing 19 33.3%


Corruption 12 21.1%

Expense

Reiumbursements

12 21.1%

Skimming 11 19.3%

Larceny 9 15.8%

Payroll 8 14.0%


Non-Cash 7 12.3%


2 3.5%


Oil an Gas 57 cases


Corruption 31 54.4%

Billing 18 31.6%


9 15.8%

Non-Cash 8 14.0%


Skimming 4 7.0%

Cash on Hand 4 7.0%

Larceny 3 5.3%


2 3.5%

Payroll 2 3.5%


Servies (professional) 51 cases


Billing 15 29.4%

ExpenseReiumbursements

14 27.5%


Skimming 9 17.6%

Corruption 6 11.8%

Payroll 5 9.8%

Cash on Hand 5 9.8%

Larceny 5 9.8%


4 7.8%

Non-Cash 2 3.9%


Vcm organzan


37/84


Crrun Ca by indury

Just as corruption is oten observed to be particularly prominent in specic regions, certain industries are requently

thought to be more susceptible to corrupt business practices than others. For example, the mining, oil and gas, and con-

struction industries all appear in the top ve sectors or both bribery and state capture (two types o corrupt practices)

in Transparency Internationals2008 Bribe Payers Index.13 These three industries had three o the our highest rates o

corruption cases in our study. More than 45% o the rauds that occurred in these industries, along with those in the

wholesale trade sector, involved some orm o corruption.

corrption cases y Instryindury Numbr Ca Number of Corruton Cases prcn Crrun Ca

Mining 12 7 58.3%

Oil and Gas 57 31 54.4%

Wholesale Trade 42 20 47.6%

Construction 77 35 45.5%

Technology 65 28 43.1%

Manuacturing 193 75 38.9%

Agriculture, Forestry, Fishing and Hunting 27 10 37.0%

Utilities 45 16 35.6%

Transportation and Warehousing 62 22 35.5%

Banking/Financial Services 298 101 33.9%

Insurance 91 30 33.0%

Government and Public Administration 176 57 32.4%

Communications/Publishing 16 5 31.3%

Healthcare 107 31 29.0%

Services (other) 88 25 28.4%

Arts, Entertainment and Recreation 49 13 26.5%

Education 90 22 24.4%

Retail 119 26 21.8%

Telecommunications 37 8 21.6%

Real Estate 27 12 21.1%

Religious, Charitable or Social Services 41 6 14.6%

Services (proessional) 51 6 11.8%

13Transparency International, 2008 Bribe Payers Index (Berlin: Transparency International, 2008). http://www.transparency.org/content/download/39275/622457


38/84


An-Fraud Cnrl a Vcm organzan

We asked survey participants which o several common anti-raud controls were in place at the victim organization during

the perpetration o the raud. A distinction should be made between the ollowing data and the prior discussion on raud

detection methods. The ollowing analysis covers the mere presence o each control not necessarily its role in detect-

ing the raud once it started. More than three-quarters o the victim organizations in our study had their nancial statements

audited by external auditors, while two-thirds had dedicated internal audit or raud examination departments, and almost 60%

had independent audits o their internal controls over nancial reporting. Additionally, nearly 70% o the organizations had a

ormal code o conduct in place at the time o the raud, though only 39% extended that to include a ormal anti-raud policy.

As mentioned in our discussion on raud detection methods (see page 16), tips are the number one means by which raud

is detected. However, less than hal o the victim organizations in our study had a hotline in place at the time the raud oc-

curred. There is evidence that the presence o a hotline improves organizations ability to detect raud and limit raud losses

(see page 43), which should cause more organizations to implement raud hotlines.

Vcm organzan

Freqeny o Anti-Fra contros14

14The sum o percentages in this chart exceeds 100% because many victim organizations had more than one anti-raud control in place at the time o the raud.

15KeY:

External Audit o F/S = Independent external audits o the organizations nancial statements

Internal Audit / FE Department = Internal audit department or raud examination department

External Audit o ICOFR = Independent audits o the organizations internal controls over nancial reportingManagement Certication o F/S = Management certication o the organizations nancial statements

0% 10% 20% 30% 40% 50% 60% 70% 80%Rewards for Whistleblowers

Job Rotation/Mandatory Vacation

Surprise Audits

Anti-Fraud Policy

Fraud Training for Employees

Fraud Training for Managers/Executives

Employee Support Programs

Hotline

Independent Audit Committee

Management Review

Management Certification of F/S

External Audit of ICOFR

Internal Audit/FE Department

Code of Conduct

External Audit of F/S 76.1%

69.9%

66.4%

59.3%

58.9%

53.3%

53.2%

48.6%

44.8%

41.5%

39.6%

39.0%

28.9%

14.6%

7.4%

Percent of Cases

Anti-Fraud

Control15


39/84


An-Fraud Cnrl a small Bun

We have long hypothesized that many small companies are particularly susceptible to raud at least partially due to the

limited resources they devote to anti-raud controls. To test this theory, we compared the presence o anti-raud controls at

those companies with ewer than 100 employees to the controls at companies with more than 100 employees. Our ndings

conrm what we suspected: The small companies in our study did indeed have ewer controls in place than the larger orga-

nizations, a actor that may contribute to the disproportionate impact o raud on these companies. While discrepancies in

levels o certain controls are somewhat expected given the associated costs or resources required to enact them, the gap

between controls in small businesses as opposed to larger organizations is striking. For example, it would be expected that

small businesses would have a lower rate o external audits and that ewer small companies would have a ormal internal

audit or raud examination unction. But even less expensive controls were oten absent in small businesses. While 64% o

large companies had some sort o management review o controls, processes, accounts or transactions, less than hal as

many small businesses had the same type o monitoring in place. Likewise, ormal codes o conduct and anti-raud policies

cost very little to implement, but serve as an eective way to make a clear and explicit statement against raudulent and

unethical conduct within an organization. Yet only 41% and 16% o small businesses had these policies (respectively) in

place when the raud occurred numbers dwared by the 83% and 50% rates o larger organizations.

Perhaps most concerning is that only 15% o small businesses had a hotline in place, compared to 64% o larger orga-

nizations. As previously discussed, our research shows that hotlines are consistently the most eective raud detection

method. Further, as discussed on page 43, the median loss or rauds at companies with hotlines was 59% smaller than

the median loss or rauds at organizations without such a mechanism. Arguably, enacting hotlines would go a long wayin helping small-business owners protect their assets rom dishonest employees.

Freqeny o Anti-Fra contros y Size o Vitim Organization

0% 20% 40% 60% 80% 100%

100+ Employees


40/84


An-Fraud Cnrl by Rgn

To examine how organizations in dierent regions approached the ght against raud, we analyzed the presence o

controls in victim organizations based on where they were located. The ollowing tables illustrate the percentage o

organizations within each region that had the corresponding control in place at the time o the raud.

It is interesting to note the variations in use o controls by region. Specically, or some anti-raud controls, the propor-

tion o victim organizations utilizing the control was markedly greater in regions containing developing countries than in

those regions primarily made up o developed nations. For example, the organizations in Central/South America and the

Caribbean had the highest rate o external audits o both nancial statements and internal controls over nancial report-

ing, as well as o hotlines. Similarly, codes o conduct, internal audit or raud examination departments, management

certication o nancial statements, independent audit committees, anti-raud policies and rewards or whistleblowers

were all most common among the Arican organizations in our study, and management review, surprise audits and job

rotation or mandatory vacation policies were most oten implemented by Asian organizations. On the opposite end o

the spectrum, the United States had the lowest rate o presence or several o these controls.

Vcm organzan

Externa Ait o Finania Statements

Rgn prcn Ca

Central/South America and the Caribbean 87.1%

Europe 86.0%

Arica 85.7%

Asia 83.9%

Canada 80.8%

Oceania 75.0%

United States 70.4%

Internal Auit/Frau Examination department

Rgn prcn Ca

Arica 84.8%

Europe 76.4%

Asia 73.2%


Canada 61.6%

United States 60.9%

Oceania 50.0%

coe o cont

Rgn prcn Ca

Arica 80.4%


Europe 73.9%

Canada 73.7%

Oceania 72.5%

Asia 68.5%

United States 68.0%

Externa Ait o IcOFR16

Rgn prcn Ca


Asia 64.4%

Arica 64.3%

United States 58.2%

Canada 57.6%

Europe 56.7%

Oceania 52.5%

16External Audit o ICOFR = Independent audits o the organizations internal controlsover nancial reporting.


41/84


Management certifationo Finania Statements

Rgn prcn Ca

Arica 68.8%

Canada 65.7%

Oceania 65.0%

Asia 62.8%

Europe 62.4%

United States 56.0%

Central/South America and Caribbean 51.4%

Inepenent Ait committee

Rgn prcn Ca

Arica 63.4%

Canada 59.6%

Oceania 57.5%

Asia 54.7%


Europe 54.1%

United States 50.8%

Empoyee Spport Programs

Rgn prcn Ca

Canada 57.6%

United States 54.8%

Oceania 45.0%

Arica 38.4%


Europe 28.0%

Asia 22.5%

Fra Training or Empoyees

Rgn prcn Ca

United States 42.7%

Arica 39.3%

Europe 37.6%

Asia 37.2%


Canada 29.3%

Oceania 22.5%

Management Review

Rgn prcn Ca

Asia 59.4%

Europe 54.8%

Canada 53.5%

Arica 52.7%

Oceania 52.5%

United States 51.6%


Hotine

Rgn prcn Ca


United States 52.0%

Arica 47.3%

Europe 45.9%

Asia 43.3%

Canada 41.4%

Oceania 25.0%

Fra Training orManagers/Exetives

Rgn prcn Ca

United States 44.5%

Arica 41.1%

Asia 40.9%

Europe 37.6%


Canada 30.3%

Oceania 25.0%

Anti-Fra Poiy

Rgn prcn Ca

Arica 49.1%

United States 38.7%


Canada 38.4%

Asia 36.6%

Europe 36.3%

Oceania 32.5%


42/84


Srprise Aits

Rgn prcn Ca

Asia 39.3%

Arica 30.4%

Canada 28.3%

United States 27.2%

Europe 24.8%


Oceania 15.0%

Rewars or Whisteowers

Rgn prcn Ca

Arica 9.8%

Asia 9.4%

United States 7.4%


Canada 4.0%

Europe 3.8%

Oceania 2.5%

Jo Rotation/Manatory Vaation

Rgn prcn Ca

Asia 21.8%

Arica 20.5%

Europe 14.0%

Canada 13.1%

United States 12.6%


Oceania 5.0%

Vcm organzan

ecvn Cnrl

We compared the median loss experienced by those organizations that had a particular anti-raud control against the

median loss or those organizations without that control at the time o the raud. Hotlines were the control with the great-

est associated reduction in median loss, reinorcing their value as an eective anti-raud measure. Employee support

programs, surprise audits and raud training or sta members at all levels were also associated with median loss reduc-

tions o more than 50%. Interestingly, nancial statement audits the most commonly implemented control was

among the controls with the smallest associated reduction in median loss.


43/84


Meian loss base on Presene o Anti-Fra controsCnrl17 prcn Ca imlmnd Cnrl n plac Cnrl N n plac prcn Rducn

Hotline 48.6% $100,000 $245,000 59.2%

Employee Support Programs 44.8% $100,000 $244,000 59.0%

Surprise Audits 28.9% $97,000 $200,000 51.5%

Fraud Training or Employees 39.6% $100,000 $200,000 50.0%

Fraud Training or Managers/Execs 41.5% $100,000 $200,000 50.0%

Job Rotation/Mandatory Vacation 14.6% $100,000 $188,000 46.8%

Code o Conduct 69.9% $140,000 $262,000 46.6%

Anti-Fraud Policy 39.0% $120,000 $200,000 40.0%

Management Review 53.3% $120,000 $200,000 40.0%

External Audit o ICOFR 59.3% $140,000 $215,000 34.9%

Internal Audit/FE Department 66.4% $145,000 $209,000 30.6%

Independent Audit Committee 53.2% $140,000 $200,000 30.0%

Management Certication o F/S 58.9% $150,000 $200,000 25.0%

External Audit o F/S 76.1% $150,000 $200,000 25.0%

Rewards or Whistleblowers 7.4% $119,000 $155,000 23.2%

Similarly, we compared the duration o raud schemes at organizations with and without anti-raud controls. As refected

in the table below, the presence o each control correlated with a reduction in the duration o raud. We ound it interest-

ing that the controls associated with the greatest reduction in scheme lengths are not the same as the ones that had the

most impact on median loss.

dration base on Presene o Anti-Fra controsCnrl17 prcn Ca imlmnd Cnrl n plac Cnrl N n plac prcn Rducn

Management Review 53.3% 12 months 24 months 50.0%

Internal Audit/FE Department 66.4% 14 months 24 months 41.7%

External Audit o ICOFR 59.3% 15 months 24 months 37.5%

Code o Conduct 69.9% 15 months 24 months 37.5%

Surprise Audits 28.9% 12 months 19 months 36.8%

Hotline 48.6% 13 months 20 months 35.0%

Management Certication o F/S 58.9% 15 months 23 months 34.8%

Rewards or Whistleblowers 7.4% 12 months 18 months 33.3%Job Rotation/Mandatory Vacation 14.6% 12 months 18 months 33.3%

External Audit o F/S 76.1% 16 months 24 months 33.3%

Anti-Fraud Policy 39.0% 13 months 18 months 27.8%

Fraud Training or Employees 39.6% 13 months 18 months 27.8%

Fraud Training or Managers/Execs 41.5% 13 months 18 months 27.8%

Independent Audit Committee 53.2% 15 months 20 months 25.0%

Employee Support Programs 44.8% 15 months 18 months 16.7%

17KeY:

External Audit o F/S = Independent external audits o the organizations nancial statements


External Audit o ICOFR = Independent audits o the organizations internal controls over nancial reporting

Management Certication o F/S = Management certication o the organizations nancial statements


44/84


imranc Cnrl n Dcng r Lmng Fraud

Not all controls are eective against all rauds. Most control mechanisms are more likely to detect or deter some raud

schemes than others. Likewise, some perpetrators are more adept than others at circumventing particular controls, and

some controls are more susceptible to being overridden than others.

We thought it useul to examine which controls had the greatest eect on the rauds reported in our study. We asked the

CFEs who took part in our survey to rank the importance o several anti-raud controls in detecting or limiting the raud.

The ollowing chart shows the respondents opinions regarding each controls useulness.

Vcm organzan

Importane o contro in deteting or limiting Fra

18

KeY:External Audit o F/S = Independent external audits o the organizations nancial statements


External Audit o ICOFR = Independent audits o the organizations internal controls over nancial reporting

Management Certication o F/S = Management certication o the organizations nancial statements

0% 10% 20% 30% 40% 50% 60% 70% 80%

Not at all Important

Somewhat Important

Very Important

External Audit of F/S

External Auditof ICOFR

Rewards forWhistleblowers

Hotline

Job Rotation/Mandatory Vacation

Surprise Audits

Management Review

Internal Audit/FE Department

Percent of Respondents

Control18

60.8%

50.3%

49.0%

42.0%

41.3%

38.3%

36.0%32.4%

29.4%

31.5%

40.7%

45.4%

27.9%23.0%

24.5%

17.9%

25.3%21.4%

25.7%

25.3%31.2%

19.3%

23.5%

19.2%


45/84


Cnrl Wakn ta Cnrbud Fraud

We also asked survey respondents to identiy which o several common issues they considered to be the primary actor that

allowed the raud to occur. A lack o internal controls, such as segregation o duties, was cited as the biggest deciency in 38%

o the cases. In more than 19% o the cases, internal controls were in place but were overridden by the perpetrator or perpetra-

tors in order to commit and conceal the raud. Interestingly, even though hotlines are cons

ACFE Report to the Nation-2010

Documents

Transcript of ACFE Report to the Nation-2010