ACFE Report to the Nation_2006

8/14/2019 ACFE Report to the Nation_2006

1/64

2 0 0 6 A c e

RepoRt tothe NatioNon occupational Fraud & abuse


2/64

Letterfrom thePresident

ACFE Report to the Nation on Occupational Fraud & Abuse

On behal o the ACFE, I am pleased to present the2006 Report to the Nation on Occupational Fraud andAbuse, the most comprehensive examination o theeects o occupational raud to date.

Based on 1,134 raud cases reported by the Certied Fraud Examiners who investigatedthem, the 2006 Report categorizes the ways in which serious raud occurs and measures

the losses organizations suer as a result o occupational raud. It also examines the charac-teristics o the organizations that are victimized by occupational raud and abuse, as well asthe characteristics o the employees who commit these crimes.

Tis Report oers valuable lessons and insight about how raud is committed, how it is detected, and how its impact can bereduced. Tis inormation should be o great interest to all organizations, businesses, government agencies, and anti-raudproessionals that are working to limit their exposure to raud.

First published in 1996, the Report to the Nation was conceived by the ACFEs ounder and chairman, Joseph . Wells.Trough his dedication and advocacy, Mr. Wells has contributed more to the study o occupational raud than any personin the eld. In his honor, Dr. Gil Geis, ormer president o ACFE, originally named this study Te Wells Report.

Te Wells Report is available to the general public, organizations, practitioners, academicians and the media. By better edu-cating the public and proessionals about the threat o raud, we can more eectively make inroads towards combating it.

James D. Ratley, CFEPresidentAssociation o Certied Fraud Examiners


3/64


able o ContentsExecutive Summary ...........................................................................................................................................................................4Introduction ........................................................................................................................................................................................6

What is Occupational Fraud?Measuring the Costs o Occupational Fraud ................................................................................................................................8

Distribution o Dollar LossesHow Occupational Fraud is Committed .......................................................................................................................................10

Asset Misappropriation Cash vs. Non-Cash

How Cash is MisappropriatedHow Non-Cash Assets are MisappropriatedHow Financial Statements are FalsiedHow Corruption Occurs

Victims o Occupational Fraud & Abuse ......................................................................................................................................18Industries Afected in the StudyMethods o Fraud Based on IndustryIndustries with the Most Corruption CasesIndustries with the Most Financial Statement Fraud Casesypes o OrganizationsSize o the Victim Organization

Detecting Occupational Fraud ........................................................................................................................................................28How Fraud is First Discovered

Detecting Fraud by Owners and Executives; the Largest Frauds; in Small Business; in Not-or-Prot Organizations;in Government Agencies; in Publicly raded Companies; and in Privately Held Companies

Limiting Fraud Losses.......................................................................................................................................................................34Most Common Anti-Fraud MeasuresEfectiveness o Anti-Fraud MeasuresAnti-Fraud Measures by IndustryAnti-Fraud Measures in Small Business and Not-or-Prot Organizations

Te Perpetrators ................................................................................................................................................................................42Te Efect o the Perpetrators Position; Annual Income; enure; Gender; Age; Education; Department; Collusion; andCriminal Histories

Case Results ........................................................................................................................................................................................56Criminal Prosecutions

Prosecution Rates Based on IndustryWhy do Organizations Decide Not to Prosecute?Civil LawsuitsRecovering Losses Caused by Fraud

Methodology ......................................................................................................................................................................................60About the ACFE ...............................................................................................................................................................................62


4/64

Occupational raud and abuse imposes enormouscosts on organizations. Te median loss caused bythe occupational rauds in this study was $159,000.Nearly one-quarter o the cases caused at least $1million in losses and nine cases caused losses o $1billion or more.

Participants in our study estimate U.S. organizations

lose 5% o their annual revenues to raud. Applied tothe estimated 2006 United States Gross DomesticProduct, this 5% gure would translate toapproximately $652 billion in raud losses.In 2004, participants estimated 6% o revenue waslost to raud.

Occupational raud schemes can be very dicult

to detect. Te median length o the schemes in ourstudy was 18 months rom the time the raud beganuntil the time it was detected.

Our data supports the use o condential hotlinesand other reporting mechanisms as a rauddetection tool. Occupational rauds are more likelyto be detected by a tip than by other means suchas internal audits, external audits or internalcontrols. Te importance o encouraging tips isevident in cases involving losses o $1 million ormore. Forty-our percent o the million-dollar rauds

in this study were detected by tips. Tis is more thantwice the rate o detection by internal audits andthree times the rate o detection by external audits.

Certain anti-raud controls can have a measurableimpact on an organizations exposure to raud.In the cases we reviewed, organizations that hadanonymous raud hotlines suered a median loss o$100,000, whereas organizations without hotlineshad a median loss o $200,000. We ound similarreductions in raud losses or organizations that hadinternal audit departments, that regularly perormedsurprise audits, and that conducted anti-raud

training or their employees and managers.

ExecutiveSummary


Tis study is based on data compiled rom 1,134 cases o occupationalraud that were investigated between January 2004 and January 2006. In-ormation rom each case was reported by a Certifed Fraud Examiner whoinvestigated the case.

Approximately one-ourth o the rauds in

this Report caused atleast $1 million in losses.


5/64


Tis Report includes organizations representinga wide range o industries. Te industries with thehighest median losses per scheme were wholesaletrade ($1 million), construction ($500,000)and manuacturing ($413,000). Governmentorganizations ($82,000) and retail organizations($80,000) were among those with the lowest medianlosses.

Small businesses continue to suferdisproportionate raud losses. Te median losssuered by organizations with ewer than 100employees was $190,000 per scheme. Tis washigher than the median loss in even the largestorganizations. Te most common occupationalrauds in small businesses involve employeesraudulently writing company checks, skimmingrevenues, and processing raudulent invoices.

One reason small businesses sufer such highraud losses is that they generally do a poor job o

proactively detecting raud. Less than 10% o smallbusinesses had anonymous raud reporting systems,and less than 20% had internal audit departments,conducted surprise audits, or conducted raudtraining or their employees and managers. Tishelps explain why more small business rauds weredetected by accident than by any other means.

Te size o the loss caused by occupationalraud is strongly related to the position o the

perpetrator. Frauds committed by owners orexecutives caused a median loss o $1 million. Tisis nearly ve times more than the median loss causedby managers, and almost 13 times as large as themedian loss caused by employees.

Most o the occupational raud schemes in

our study involved either the accountingdepartment or upper management. Just over30% o the occupational rauds were committedby employees in the accounting department, andslightly more than 20% were committed by uppermanagement or executive-level employees. Te next-most-commonly cited department was sales, whichaccounted or 14% o the cases in our study.

Nearly two-thirds o the victim organizations in ourstudy routinely conducted background checks onnew employees. However, less than 8% o

the perpetrators had convictions prior tocommitting their rauds. Although backgroundchecks on new employees can be a valuableanti-raud tool, our data suggests that othermeasures such as raud training, surprise audits andanonymous reporting mechanisms can have a moresignicant impact in detecting raud.


6/64

Introduction


Tis denition is very broad, encompassing a wide rangeo misconduct by employees, managers, and executives.

Occupational raud schemes can be as simple as pilerageo company supplies or as complex as sophisticated nan-cial statement rauds.

All occupational raud schemes have our key elements incommon. Te activity:

Is clandestine;

Violates the perpetrators duciary duties to thevictim organization;

Is committed or the purpose o direct or indirectnancial benet to the perpetrator; and

Costs the employing organization assets, revenue orreserves.

In 1996, the ACFE released the rst Report to the Nationon Occupational Fraud and Abuse, which shed light on the

immense and largely undened costs that occupationalraud imposes on organizations. Te stated goals o therst Report were to:

Summarize the opinions o experts on thepercentage and amount o organizational revenuelost to all orms o occupational raud and abuse;

Examine the characteristics o the employees whocommit occupational raud and abuse;

Determine what kinds o organizations are victimso occupational raud and abuse; and

Categorize the ways in which serious raud and

abuse occurs.

All o the enumerated goals o the rst Report ell underone larger and more all-encompassing mission: to bettereducate the public and anti-raud proessionals about thethreat o occupational raud. Since that time, with eachsubsequent edition o the Report to the Nation, that hasremained our primary goal.

Te term occupational raud may be defned as: Te use o ones occupa-tion or personal enrichment through the deliberate misuse or misapplica-tion o the employing organizations resources or assets.

Occupational Fraud and Abuse is a widespreadproblem that aects practically every organization.


7/64


At the time the 1996 Report was released ve years be-ore the string o nancial statement rauds highlightedby Enron and WorldCom there was surprisingly littleresearch available on how occupational raud impactedcompanies and government agencies; this despite the actthat practical experience and anecdotal evidence clearlyindicated that the problem was one o enormous sever-ity. Ater we released the 1996 Report, we received a tre-mendous response rom anti-raud proessionals, many o

whom or the rst time had hard data to support whatthey already knew or suspected that occupational raudwas a signicant threat to their organizations.

We released updated editions o the Report in 2002 and2004. Like the rst study, each subsequent edition wasbased on detailed case inormation about specic raudsprovided by the CFEs who investigated those cases. EachReport has been structured along the same lines, ocusingon the methods used by employees, managers, and execu-tives to deraud their organizations; the losses caused bythose rauds; and the characteristics o both the perpetra-tors and the victims o these crimes. Te current editiono the Report is based on 1,134 actual cases o occupa-tional raud more than twice the number that made upthe data set in our 2004 Report. Te increased numbero cases has allowed us to analyze the data in a more de-tailed and thorough manner than in any previous editiono the Report to the Nation. For the rst time, we are able toprovide detailed data about how specic methods o raudaect various industries and also how those methods arerelated to particular departments or job types within or-ganizations.

We also made a signicant change in our methodologythat should be noted. In past editions o the Report, weasked respondents to provide a detailed report on any onecase they had investigated within the relevant time rame.In our 2006 survey, we asked respondents to report on thelargest case they had investigated in the past two years. Weincluded this criterion because we believe that in studyinghow raud aects organizations, where a limited numbero cases can be analyzed, it makes sense to ocus on the

cases that cause the most harm. Because o the changein survey methodology, we are not including any data inthis Report comparing raud losses to those rom previousstudies. A complete statement o our methodology in thisstudy is contained at the end o this Report.

We believe the current Report will prove to be the mostilluminating and useul edition to date. It is our hope thatthe inormation contained herein will provide valuableinsights to any person or organization concerned withdetecting, deterring, or preventing occupational raud andabuse.


8/64

MeasuringtheCostofOccupationalFraud


At the outset, it should be clear to anyone who has spent time dealing withthe subject o occupational raud that attempts to accurately measure therequency or cost associated with occupational raud in the United Stateswill be, at best, incomplete.

Fraud, by its nature, is hidden, and so the true amount o

raud taking place in U.S. businesses at any one time can-not really be known.

Even attempts to measure the amount o raud that has al-ready been detected will lead to incomplete results. Tereis currently no central repository where raud data is col-lected in the U.S. and a great deal o raud cases go un-reported, either because the victim organizations do not

recognize that they have been derauded, because they

choose not to report the crimes or ear o bad publicity orsimply because they do not want to deal with the repercus-sions. Furthermore, even when raud has been detected itmay not be possible to determine exactly how much wasstolen. Many rauds go undetected or years beore theyare caught, and organizations may nd it unproductive orunsettling to trace through years o historical nancial datato put a precise gure on the size o the crime.

Nevertheless, it is important that we try to learn as muchabout occupational raud as we can. Tis is a crime thataects, or has the potential to aect, every business in the

United States indeed, in the world. It is critical that wetry to understand, as best we can, the size o the threat thatconronts us all.

While there can be no precise measure o the cost o raudto U.S. business, we have asked each o the 1,134 CFEswho participated in our study to give us their best estimateo the percent o annual revenues that a typical organiza-tion in the U.S. loses as a result o raud. Te answers tothis question were based solely on the opinions o CFEs,not specic data rom cases they had investigated.

Te median estimate was that a typical organization loses

5% o its annual revenues to raud. o give the reader anidea o the scope o that gure, consider that the estimated2006 United States Gross Domestic Product is $13.037trillion.1 I we multiply that gure by 5%, the result wouldbe roughly $652 billion lost to raud.

1Based on U.S. Commerce Department rst quarter 2006 GDP growth estimate.

The typical organization loses 5% o itsannual revenues to occupational raud.


9/64


In the three previous editions o the Report, CFEs esti-mated typical raud losses at 6%. Optimistically, this re-duction could be viewed as progress in the war againstraud. However, because the responses are only estimates,the $652 billion gure should not be read as a literal rep-resentation o what raud costs U.S. organizations. Aswe stated above, the real cost most likely cannot be de-termined. Nevertheless, the 5% estimate does hold realvalue, because it represents the composite opinion o over

a thousand Certied Fraud Examiners proessionalswith specic expertise in the prevention and detection ooccupational raud. Given the obstacles to developing aprecise measure o rauds impact, their estimate may be asreliable a source as can be ound.

Distribution o Dollar LossesRegardless o what the exact cost o raud is, we know it isenormous. We examined over 1,100 cases o occupationalraud that were investigated over the last two years. Temedian dollar loss caused by these schemes was $159,000.As the ollowing chart illustrates, nearly one-ourth o thecases in our study (24.4%) caused losses o $1 million ormore. Although not shown in the chart as a separate cat-

egory, there were nine cases with reported losses o at least$1 billion.

0%

5%

10%

15%

20%

25%

30%

$1,000,000+$500,000-$999,999

$100,000-$499,999

$50,000-$999,999

$10,000-$49,999

$1,000-$9,999

$1-$999

Dollar Loss

PercentofCases

1.2%

9.1%

15.8%

11.6%

29.1%

8.8%

24.4%

Distribution of Dollar Losses


10/64

HowOccupationalFraudisCommitted

10 ACFE Report to the Nation on Occupational Fraud & Abuse

As was frst stated in the 1996 Report to the Nation, all occupational raudsall into one o three major categories: asset misappropriation, corruption orraudulent statements.

Types o Occupational Fraud & Abuse

Category Description ExamplesCases

Reported

% oall

Cases3

MedianLoss

AssetMisappropriations

Any shm that involvs th thtor misus o an organizationsassts.

raudulnt invoiing.

Payroll raud.

Skimming rvnus.

1,038 91.5% $150,000

Corruption Any shm in whih a prsonuss his or hr inun in abusinss transation to obtain anunauthorizd bnft ontrary tothat prsons duty to his or hrmployr.

Apting or payinga brib.

engaging in abusinss transationwhr thr is anundislosd onito intrst.

349 30.8% $538,000

FraudulentStatements

alsifation o an organizationsfnanial statmnts to mak itappar mor or lss proftabl.

Booking ftitioussals.

Rording xpnssin th wrong priod.

120 10.6% $2,000,000

Asset misappropriations were by ar the most commontype o occupational raud in our study, occurring in over90% o all cases. Meanwhile, cases involving nancial state-

ment raud were the least common, but had the largest im-pact when they did occur. Te median loss o $2 million in

schemes involving nancial statement rauds was 13 timesgreater than the median loss or schemes involving assetmisappropriations and nearly our times greater than the

median loss in cases that involved corruption.2

2For cases that involved more than one major category o occupational raud, we were unable to subdivide the losses to determine exactly how much wasattributable to each o the component schemes.

3Te sum o percentages in this table exceeds 100% because several cases involved schemes that ell into more than one category.


11/64


While the three major categories are distinct in the sensethat they each involve a specic aspect o raud, it is impor-tant to note that within a given occupational raud scheme,the perpetrator or perpetrators will oten engage in several dierent orms o illegal conduct. Tus, a single occupational

raud scheme might involve elements o each o the threemajor categories. Te ollowing table illustrates the distri-bution o cases based on the categories o raud that werecommitted.

Overall, approximately one-third o the cases in our study

involved more than one category o raud. Te most no-table correlation between two categories was the strong tiebetween corruption and asset misappropriation schemes.As we see in the corruption column o the table above,89.4% o the corruption cases also involved an asset mis-appropriation o some sort. (75.4% o cases were classi-ed as corruption and asset misappropriation, plus 14%

o cases involved all three categories.) A typical example

is a case in which an employee accepts kickbacks or otherbribes rom a vendor in order to process invoices or cti-tious goods or services. Tis type o raud clearly involvesan element o corruption (the acceptance o a bribe), butalso involves an element o asset misappropriation as well(causing the victim organization to issue payment or non-existent goods or services).

Distribution o Occupational Frauds by Category

Asset Misappropriation 1,038 Cases Corruption 349 Cases Financial Statement Fraud 120 Cases

Classication Cases% Asset

Mis.Classication Cases % Corr Classication Cases % FSF

Asst Mis. only 692 66.7% corruption only 31 8.9% S only 31 25.8%

Asst Mis. &corruption

263 25.3% corruption &Asst Mis.

263 75.4% S & Asst Mis. 34 28.3%

Asst Mis. & S 34 3.3% corruption & S 6 1.7% S & corruption 6 5.0%

All thr 49 4.7% All thr 49 14.0% All thr 49 40.8%


12/64



Asset MisappropriationsCash vs. Non-CashAs the data on the previous page show, asset misappropri-ations are by ar the most common orm o occupationalraud. Over 90% o the cases we reviewed involved someorm o asset misappropriation, which is consistent withdata rom our studies in 2004 and 2002.

As one would expect, the asset that raudsters target mostoten is cash (the term cash includes not only currency, butalso checks and money orders). Tere were 1,038 cases

o asset misappropriation in our study, and 910 o those(87.7%) involved the misappropriation o cash. A littleless than one-ourth o the cases we reviewed involved themisappropriation o non-cash assets such as inventory,equipment or proprietary inormation. Te median lossin schemes targeting non-cash assets was $200,000, whichwas slightly higher than the median loss in rauds involv-ing cash misappropriation.

4Te sum o percentages in this chart exceeds 100% because a number o cases involved the misappropriation o both cash and non-cash assets. In thosecases, we were unable to subdivide the losses to determine exactly how much was attributable to cash vs. non-cash schemes.

0% 20% 40% 60% 80% 100%

Cash ($150,000)

Non-Cash ($200,000)

23.4%

87.7%

AssetTargeted

Breakdown of Asset Misappropriations Cash vs. Non-Cash4

Percent of Cases


13/64


Schemes Involving Cash Receipts and Cash On Hand


Reported% o AssetMis. Cases

MedianLoss

Skimming Any shm in whih ash isstoln rom an organizationbefore it is rordd on thorganizations books and rords.

employ aptspaymnt rom austomr but dosnot rord th sal

196 18.9% $76,000

CashLarceny

Any shm in whih ash isstoln rom an organization afterit has bn rordd on thorganizations books and rords.

employ stals ash andhks rom daily riptsbor thy an bdpositd in th bank.

147 14.2% $73,000

How Cash is MisappropriatedCash Receipts and Cash on HandBased on past studies and research, we identied eightcommon methods by which raudsters steal cash romtheir employers. wo schemes cash larceny and skim-ming target incoming receipts or cash on hand. Te

ollowing table provides a summary o each scheme alongwith its relative requency and median loss. Skimming wasslightly more common than cash larceny; approximately19% o the asset misappropriation cases in our study in-volved skimming. Skimming also had a slightly highermedian loss at $76,000 as opposed to $73,000 or cashlarceny.5

5Readers should note that our method o measuring the median loss or asset misappropriation schemes has changed rom previous reports. Manyraud schemes involve multiple methods o raud, and in the past we have been unable to subdivide the losses in a given scheme based on the respectivemethods used. For example, i an occupational raud caused $100,000 in losses and involved both billing raud and payroll raud, we could notdetermine how much o the $100,000 was attributable to raudulent billings and how much to the payroll raud. In our 2006 survey, we askedrespondents to identiy the amount o losses directly attributable to each specic method o raud when more than one method was used in a scheme.So, in the example above, a respondent might note that $70,000 in losses was caused by billing raud and $30,000 was caused by payroll raud. Tischange allows us to present much more accurate data on the costs associated with various categories o asset misappropriation than in the past.


14/64



Schemes Involving Fraudulent Disbursements o Cash


Reported% o AssetMis. Cases

MedianLoss

Billing Any schm in which aprson causs his or hr m-ployr to issu a paymntby submitting invoics orfctitious goods or srvics,inatd invoics or invoicsor prsonal purchass.

employ rats ashll ompany and billsmployr or nonxistntsrvis.

employ purhassprsonal itms, submitsinvoi or paymnt.

294 28.3% $130,000

ExpenseReimbursements

Any shm in whih anmploy maks a laimor rimbursmnt o

ftitious or inatd businssxpnss.

employ flsraudulnt xpnsrport, laiming

prsonal travl,nonxistnt mals, t.

202 19.5% $25,000

Check Tampering Any schm in which aprson stals his or hrmployrs unds by orgingor altring a chck on on oth organizations bank ac-counts, or stals a chck thorganization has lgitimatlyissud to anothr pay.

employ stals blankompany hks, maksthm out to himsl or anaompli.

employ stalsoutgoing hk to avndor, dposits it intohr own bank aount.

177 17.1% $120,000

Payroll Any shm in whih anmploy auss his orhr mployr to issu apaymnt by making als

laims or ompnsation.

employ laims ovr-tim or unworkd hours.

employ adds ghostmploys to th payroll.

137 13.2% $50,000

Wire Transers Any shm in whih aprson stals his or hrmployrs unds byraudulntly wirtransrring thm out o thmployrs bank aounts.

employ auss undsto b wird romompany bank aountsto an aount ontrolldby mploy oraompli.

67 6.5% $500,000

RegisterDisbursements

Any shm in whih anmploy maks alsntris on a ash rgistrto onal th raudulntrmoval o ash.

employ raudulntlyvoids a sal on his ashrgistr and stals thash.

18 1.7% $26,000

Fraudulent DisbursementsTe remaining six cash schemes target outgoing disbursements o cash. Tey are: billing schemes, payroll schemes, expensereimbursements, check tampering, wire transers and register disbursements. Billing schemes were the most common ormo raudulent disbursement, occurring in over one-quarter o all the asset misappropriation cases in our study. Te medianloss attributed to billing schemes was $130,000, making them the second most expensive orm o raudulent disbursementbehind wire transers, which had a median loss o $500,000. Expense reimbursements ranked second in terms o requency,but they had the lowest median loss at $25,000.


15/64


How Non-Cash Assets are MisappropriatedTere were 243 cases that involved the thet or misappropriation o non-cash assets. Te majority o these schemes involvedthe thet o inventory or other physical assets such as equipment and supplies. A smaller proportion targeted proprietaryinormation or securities, but these schemes had higher median losses. For instance, although there were only 16 cases inour study involving the thet o securities, the median loss in these cases was $1.85 million.

Non-Cash Misappropriations

Category Description Examples CasesReported % o AssetMis. Cases MedianLoss

Inventory Any shminvolving th tht ormisappropriation ophysial, non-ash asstssuh as invntory,quipmnt or supplis.

employ stalsmrhandis romwarhous or sals oor.

employ divrts inomingshipmnts o invntory orprsonal us.

172 16.6% $55,000

Inormation Any shm in whih anmploy stals orothrwis misappro-priats propritaryonfdntial inormationor trad srts.

employ asssustomr rords orpurposs o ommittingidntity tht.

employ providsompany trad srts to

a omptitor.

37 3.6% $78,000

Securities Any shm involvingth tht or misappro-priation o stoks, bonds,or othr suritis.

employ raudulntlytransrs stok hld byompany to prsonalaount.

16 1.5% $1,850,000


16/64

HowOccupationalFraudsareCommitted


How Financial Statements AreFalsifedFinancial statement raud was much less common thanasset misappropriations. Tere were 120 reported caseso nancial statement raud, accounting or just over 10%

o all cases. Tis proportion is consistent with our earlierstudies. While nancial statement raud is not nearly ascommon as asset misappropriations, its consequences tendto be much more severe. As was stated above, the medianloss among nancial statement raud cases in our studywas $2,000,000. Generally speaking, nancial statements

Financial Statement Fraud Schemes


Reported

% oFSF

Cases6

ConcealedLiabilities

Shms in whih fnanialstatmnts ar misstatd byimproprly rording liabilitisand/or xpnss.

Organization omits signifant xpnss orliabilitis on its fnanial statmnts.

Organization rords rvnu-basd xpnssas apital xpnditurs, alsly inrasing bothnt inom and total assts in th urrntaounting priod.

54 45.0%

FictitiousRevenues

Shms in whih fnanialstatmnts ar inatd byrording sals o goods orsrvis that nvr ourrd, orby inating atual sals.

Organization rords th sal o invntory to aphantom ustomr.

Organization rats invois showing salo goods to xisting ustomr, but goods ar

nvr dlivrd. Sals ar rvrsd atbginning o nxt aounting priod.

52 43.3%

ImproperAsset

Valuations

Shms in whih th valuo an organizations assts israudulntly misstatd in thorganizations fnanialstatmnts.

Organization ails to writ o obsoltinvntory.

Organization inats its rivabls bybooking ftitious sals on aount tononxistnt ustomrs.

48 40.0%

ImproperDisclosures

Shms in whih manag-mnt ails to dislos mat-rial inormation in its fnanialstatmnts in an attmpt tomislad usrs o th fnanialstatmnts.

Organizations fnanial statmnts ail to notpotntially matrial ontingnt liability arisingrom a orporat guarant o prsonal loanstakn out by an ofr.

Organizations fnanial statmnts ail to notthat on o its largst supplirs is ownd by thorporations prsidnt.

45 37.5%

TimingDierences

Shms in whih fnanialstatmnts ar intntionallymisstatd by rording rv-nus in a dirnt aountingpriod than thir orrspondingxpnss.

Organization manipulats nt inom byrording sals that our in Dmbr o

Yar 1, but not rording th orrspondingxpnss until January o Yar 2.

34 28.3%

6Te sum o percentages in this table exceeds 100% because a number o cases involved the more than one method o alsiying nancial statements.


17/64


are be manipulated through one o ve methods: (1)reporting ctitious or overstated revenues; (2) concealingor understating liabilities or expenses; (3) timing dier-ences recording revenues or expenses in the wrongperiod; (4) improperly valuing assets; or (5) ailing to dis-close signicant inormation such as contingent liabilitiesor related-party transactions.

In cases where nancial statement raud was reported, we

asked respondents to identiy which o these ve methodswere utilized. Te preceeding table shows the number ocases in which each particular method was reported. Terewas a airly even distribution among the various methods;concealed liabilities were reported most oten (54 cases),while timing dierences were the least-cited method (34cases). In 55% o the cases we reviewed, raudsters usedmore than one method o nancial statement raud.

How Corruption OccursIn 349 cases, the respondent identied corruption ashaving occurred. Te median loss in these rauds was$538,000. We asked the CFEs who investigated thesecases to speciy which o the ollowing our corrupt prac-tices were present in the rauds: (1) conicts o interest;(2) bribery; (3) illegal gratuities; or (4) extortion. Te ol-lowing table shows the relative requency with which the

various orms o corruption were committed. Conicts ointerest were most requently cited (215 cases) while ex-tortion was reported least oten (59 cases).

Corruption Schemes

Category Description Examples

Cases

Reported

% o

CorruptionCases7

Conficts oInterest

Any shm in whih an mploy,managr or xutiv has an undis-losd onomi or prsonal intrstin a transation that advrsly atsth ompany as a rsult.

An mploy owns an undislosd intrst in asupplir. Th mploy ngotiats a ontratbtwn his mployr and th supplir,purhasing matrials at an inatd pri.

215 61.6%

Bribery Any shm in whih a prson ors,givs, rivs, or soliits somthingo valu or th purpos o inu-ning an ofial at or a businssdision without th knowldg oronsnt o th prinipal.

An mploy prosss inatd invois roma vndor and in rturn rivs 10% o thinvoi pri as a kikbak.

An mploy apts paymnt rom a vndorin rturn or providing onfdntial inormationabout omptitors bids on a projt.

149 42.7%

Illegal

Gratuities

Any shm in whih a prson ors,

givs, rivs, or soliits somthingo valu or, or baus o, an ofialat or businss dision withoutth knowldg or onsnt o thprinipal.

An ofial ngotiats an agrmnt with a

ontrator, and in appriation th ontratorprovids th ofial with a git suh as a rvaation.

104 29.8%

Extortion Th orion o anothr to ntrinto a transation or dlivr proprtybasd on wrongul us o atual orthratnd or, ar, or onomidurss.

An mploy russ to purhas goods orsrvis rom a vndor unlss th vndor hirson o th mploys rlativs.

59 16.9%

7Te sum o percentages in this table exceeds 100% because a number o cases involved more than one orm o corruption.


18/64

Victims ofOccupationalFraud &Abuse


Our survey was targeted to CFEs in the United States and was not designedto measure the requency o raud in various industries or types o organiza-tions. Tereore, the data below is not intended and should not be read asindicating whether certain types o organizations are more susceptible toraud than others.

o a large extent, the data in this Report is based on thetypes o organizations that retain Certied Fraud Exam-iners. Nevertheless, it is instructional to know what typeso victim organizations are represented in this Report sothat we can measure diferences in how various types oorganizations encountered and responded to raud.

Industries Afected in the StudyTe rauds in our study were spread over a wide range oindustries, as illustrated by the accompanying table. Temost common were banking and nancial services (148cases); government and public administration (119 cases)and manuacturing (101 cases).

Occupational Frauds Based On Industry Sorted By Frequency

Industry#

Cases%

CasesMed.Loss

Banking/FinancialServices

148 14.3% $258,000

Government andPublic Administration

119 11.5% $82,000

Manufacturing 101 9.7% $413,000

Health Care 89 8.6% $160,000

Insurance 78 7.5% $100,000

Retail 75 7.2 $80,000

Education 73 7.0% $100,000

Service (general) 60 5.8% $163,000

Service (proessional,scientifc or technical)

58 5.6% $300,000

Construction 35 3.4% $500,000

Utilities 34 3.3% $124,000

Oil and Gas 32 3.1% $154,000

Real Estate 30 2.9% $200,000

Wholesale Trade 30 2.9% $1,000,000

Transportation and

Warehousing

27 2.6% $109,000

Arts, Entertainmentand Recreation

22 2.1% $175,000

Communications/Publishing

16 1.5% $225,000

Agriculture, Forestry,Fishing and Hunting

8 0.8% $71,000

Mining 1 0.1% $17,000,000

The frauds in ourstudy were spreadover a wide rangeof industries.


19/64


Excluding mining, which only had one case (costing $17million), the highest losses occurred in the wholesale tradeindustry, which had a median loss o $1 million among 30cases. Next highest were construction, with a median losso $500,000 among 35 cases, and manuacturing, with amedian loss o $413,000 among 101 cases.

Among the industries that showed the lowest medianlosses were retail (median loss o $80,000 among 75 cases)

and government and public administration (median losso $82,000 among 110 cases).

Methods of Fraud Basedon IndustryIn the rst table in this section, we saw how all the raudswere distributed, based on the industry o the victim or-ganization. Our next step was to analyze the cases withineach industry to determine what orms o raud were mostcommon.

We limited this analysis to industries in which at least50 cases were reported so that we would have a sufcientsample to draw upon. Because 90% o all cases involve as-set misappropriations, we excluded corruption and nan-cial statement raud cases rom this analysis. In the nextsection, we have provided a breakdown o industries withthe most corruption and nancial raud statement cases,respectively.

Te ollowing tables show the most commonly reportedasset misappropriation schemes in each industry or whichat least 50 cases were reported.

Occupational Frauds Based On Industry Sorted By Median Loss

Industry#

Cases%

CasesMed.Loss

Mining 1 0.1% $17,000,000

Wholesale Trade 30 2.9% $1,000,000

Construction 35 3.4% $500,000

Manuacturing 101 9.7% $413,000

Service (proessional,scientifc or technical)

58 5.6% $300,000


148 14.3% $258,000


16 1.5% $225,000

Real Estate 30 2.9% $200,000

Arts, Entertainment

and Recreation

22 2.1% $175,000

Service (general) 60 5.8% $163,000

Healthcare 89 8.6% $160,000

Oil and Gas 32 3.1% $154,000

Utilities 34 3.3% $124,000

Transportation andWarehousing

27 2.6% $109,000

Insurance 78 7.5% $100,000

Education 73 7.0% $100,000

Government andPublic Administration

119 11.5% $82,000

Retail 75 7.2% $80,000

Agriculture, Forestry,Fishing and Hunting

8 0.8% $71,000


20/64



Banking & Financial Services 148 Cases

Scheme Cases %

Cash Larceny 29 19.6%

Non-Cash 23 15.5%

Skimming 21 14.2%

Billing 18 12.2%

Check Tampering 18 12.2%

Wire Transfers16 10.8%

Expense Reimbursements 13 8.8%

Payroll 10 6.8%

Register Disbursements 2 1.4%

Govt. & Public Administration 119 Cases

Scheme Cases %

Billing 26 21.8%

Non-Cash 26 21.8%

Payroll 25 21.0%


Skimming 22 18.5%



Wire Transfers 3 2.5%


Manufacturing 101 Cases

Scheme Cases %

Billing 34 33.7%Expense Reimbursements 29 28.7%

Non-Cash 28 27.7%

Skimming 16 15.8%

Payroll 13 12.9%


Cash Larceny 9 8.9%

Wire Transfers 7 6.9%


Banking and Financial ServicesNot surprisingly, two o the three most common schemesin the banking and fnancial services industry were cashlarceny and skimming. Tese schemes generally involvethe physical thet o incoming cash and cash on hand (orexample, in a vault). Among the 23 non-cash cases in thisindustry, the most common type o scheme involved thethet o proprietary inormation about bank customers.

Government and PublicAdministrationBilling schemes (procurement raud) and non-cash thetwere the most commonly reported orms o asset misap-propriation in the government and public administrationsector, each occurring in 26 o the 119 cases.

ManufacturingApproximately one-third o the cases reported rom themanuacturing industry involved raudulent billing. Ex-

pense reimbursements and non-cash schemes each alsooccurred in more than one-ourth o the cases in this in-dustry.

HealthcareFraudulent billings were also the most common type oraud reported among the 89 cases we received rom thehealthcare industry. False billings occurred in approxi-mately one-ourth o healthcare cases, and involved a widevariety o schemes, including submitting alse healthcareclaims and purchasing personal items with companyunds.

InsuranceFraudulent billings occurred in nearly 30% o the insur-ance industry cases we reviewed. Tese cases were nearlytwice as common as the next-most-requently reportedscheme, which was check tampering.


21/64

Health Care 89 Cases

Scheme Cases %Billing 22 24.7%

Skimming 17 19.1%


Non-Cash 14 15.7%


Payroll 11 12.4%


Wire Transers 3 3.4%


Insurance 78 Cases

Scheme Cases %

Billing 23 29.5%



Skimming 11 14.1%


Non-Cash 7 9.0%Payroll 4 5.1%




RetailNon-cash thet was the most commonly reported typeo raud in the retail industry. Tese schemes typicallyinvolved the thet o merchandise rom warehouses andsales oors. Skimming and cash larceny both o whichrequently involve the thet o cash at the point o sale were both cited in over 20% o the retail cases as well.

EducationBilling raud was the most common type o asset misap-propriation identied in the 73 cases we received rom theeducation industry, ollowed by non-cash thet, expensereimbursement raud, and skimming.

Service (general)Skimming was the most commonly reported orm o assetmisappropriation in the service industry cases we reviewed.Skimming involves the thet o unrecorded sales and is verycommon in service businesses such as restaurants and barswhere a large number o cash sales are processed and whereit is difcult to precisely match inventory to sales.

Service (proessional, scientifc ortechnical)In the proessional, scientic and technical service indus-try, we received 58 cases. Billing raud, check tampering,expense reimbursement raud, and payroll raud were eachidentied in over 20% o the cases rom this industry.

Education 73 Cases

Scheme Cases %Billing 26 35.6%

Non-Cash 16 21.9%


Skimming 15 20.5%

Payroll 13 17.8%





Retail 75 Cases

Scheme Cases %

Non-Cash 22 29.3%

Billing 16 21.3%

Skimming 16 21.3%Cash Larceny 16 21.3%




Payroll 4 5.3%



22/64



Service (proessional, scientic or technical) 58 Cases

Scheme Cases %

Billing 16 27.6%



Payroll 12 20.7%

Non-Cash 11 19.0%



Skimming 4 6.9%


Service (general) 60 Cases

Scheme Cases %

Skimming 18 30.0%

Billing 16 26.7%




Non-Cash 11 18.3%Payroll 7 11.7%



0

5

10

15

20

25

30

35Billing

Non-Cash

Payroll

ExpenseReimbursement

Skimming

CheckTampering

CashLarceny

WireTransfers

RegisterDisbursements

Service(professional,

scientific or technical)

Service(general)

EducationRetailInsuranceHealth CareManufacturingGovernmentand Public

Adminstration

Banking andFinancialServices

Industry

NumberofCases

Most Commonly Reported Asset Misappropriation Schemes


23/64


Industries with the MostCorruption CasesTere were 349 cases that involved some orm o corruption,and in 320 o those, the respondent identied the industryo the victim organization. Te ollowing table shows thenumber o corruption cases in each industry, as well as thepercent o corruption cases in the industry.

Industries with the Most FinancialStatement Fraud CasesAs reported earlier, 120 cases involved nancial statementraud. Te ollowing table shows the industries in whichthose nancial statement raud cases occurred, and thepercent o nancial statement raud within each industry.

Corruption Cases by Industry

IndustryAll

CasesCorrupt.

Cases

%Corrupt.

Cases

Mining 1 1 100%

Oil & Gas 32 15 46.9%

Manuacturing 101 39 38.6%

Utilities 34 13 38.2%


16 6 37.5%

Construction 35 13 37.1%


148 52 35.1%

Service (scientic,proessional ortechnical)

58 20 34.5%


27 9 33.3%

Education 73 24 32.9%

Insurance 78 24 30.8%

Retail 75 20 26.7%

Governmentand Public

Administration

119 31 26.1%

Agriculture,Forestry, Fishingand Hunting

8 2 25.0%

Healthcare 89 21 23.6%

Service (general) 60 14 23.3%

Arts,Entertainmentand Recreation

22 5 22.7%

Wholesale Trade 30 6 20.0%

Real Estate 30 5 16.7%

Financial Statement Fraud Cases by Industry

IndustryAll

CasesFSF

Cases

%FSF

Cases


16 4 25.0%

Wholesale Trade 30 6 20.0%

Manuacturing 101 20 19.8%

Service (general) 60 10 16.7%

Construction 35 5 14.3%

Healthcare 89 12 13.5%

Retail 75 10 13.3%


148 18 12.2%

Insurance 78 6 7.7%


27 2 7.4%

Service (scientic,proessional ortechnical)

58 4 6.9%

Real Estate 30 2 6.7%

Governmentand Public

Administration

119 5 4.2%

Education 73 3 4.1%

Utilities 34 1 2.9%

Arts,Entertainmentand Recreation

22 0 0.0%

Agriculture,Forestry, Fishingand Hunting

8 0 0.0%

Mining 1 0 0.0%

Oil & Gas 32 0 0.0%


24/64



ypes o OrganizationsIn addition to measuring the industries o the aectedorganizations, we also gathered data on the organizationtypes o the victims: were they privately held companies,publicly traded corporations, not-or-prot organizations,or government agencies?

Our Report represents a good cross-section o organiza-

tion types. Private companies were most heavily repre-sented at 36.8%, while not-or-prot organizations hadthe lowest representation at 13.9%.

Te ollowing chart shows the distribution o cases amongthe our organization types, and also illustrates the medianloss or cases in each group. As we can see, privately heldand publicly traded companies were not only the mostheavily represented organization types, they also sueredthe largest losses, at $210,000 and $200,000 respectively.

Methods o Fraud in Not-or-Prot OrganizationsTere is a great deal o anecdotal evidence suggesting

that non-prot organizations are uniquely susceptible toraud, and we requently receive requests or inormationconcerning the methods by which raud occurs in not-or-prot organizations. Te ollowing table lists the mostcommonly reported schemes among the 147 not-or-pro-it cases in our study. Corruption, billing raud and expensereimbursement raud were all cited in over 25% o the not-or-prot cases we reviewed.

Not-For-Prot Organizations 147 Cases

Scheme Cases %8

Corruption 43 29.3%

Billing 42 28.6%



Skimming 33 22.4%

Cash Larceny 26 17.7%Non-Cash 21 14.3%

Payroll 19 12.9%

Fraud Stmt 8 5.4%



8Te sum o percentages in this table exceeds 100% because several cases involved multiple methods o raud.

$0

$50,000

$100,000

$150,000

$200,000

$250,000

Not-for-Profit(13.9%)

Government(17.6%)

PublicCompany(31.7%)

PrivateCompany(36.8%)

MedianLo

ss

Frequency and Median Loss Basedon Organization Type of Victims

Organization Type(percent of cases)

$210,0

00

$2

00,0

00

$100,0

00

$100,0

00


25/64


Size o the Victim OrganizationNumber o EmployeesSmall businesses (those with ewer than 100 employees) can ace challenges in deterring and detecting raud that diersignicantly rom larger organizations. Our data show that these small organizations tend to suer disproportionately largeraud losses, which is similar to the ndings in our 2002 and 2004 Reports. Te median loss or raud cases attacking smallorganizations in our study was $190,000; this exceeded the median loss or cases in any other group. Small organizationswere also the most heavily represented group, making up 36% o all rauds in the study.

$0 $50,000 $100,000 $150,000 $200,000

10,000+

(18.9%)

1,000-9,999(24.8%)

100-999(20.3%)


26/64



Small Business (


27/64


Annual RevenuesAnother way to measure the size o an organization is based on its annual revenues (or, in the case o government organiza-tions, its budget). Te ollowing table illustrates the median losses and requency o cases based on the annual revenues othe victim organizations. Te largest rauds (median loss o $275,000) were committed in organizations with between $10million and $50 million in annual sales.

$50,000 $100,000 $150,000 $200,000 $250,000 $300,000

$500M+ (34.6%)

$50M - $500M (18.3%)

$10M - $50M (14.2%)

$1M - $10M (22.7%)


28/64

DetectingOccupationalFraud


How is raud frst discovered? Te ollowing chart shows how occupationalrauds were frst detected by the victim organizations. Te most commonmethod o detection was by a tip, which was also true in 2004.

We believe this indicates that anonymous reporting mech-anisms are a key component o eective anti-raud pro-grams. Unortunately, the majority o victim organizations

in our study did not have established reporting structuresat the time they were derauded (see pg. 35 ). It is impor-tant to remember that establishing hotlines is not the onlyway to encourage tips. Several other actors play into aneective reporting structure.

Organizations should conduct anti-raud training to edu-cate their employees on how to recognize and report il-legal conduct, and to impress upon those employees theact that such conduct is counterproductive and will notbe tolerated. Furthermore, organizations should generallyseek to oster open channels o communication among

employees and all levels o management so that question-able conduct can be brought to light beore it develops intooutright illegal activity.

Regarding the means by which rauds were rst discovered,we ound it discouraging to note that accidental discoverywas more commonly reported than internal audit, internalcontrols or external audit. Tis suggests that organizationsstill need to do a better job o proactively designing con-trols and audits to identiy raud.

10Te sum o percentages in this chart exceeds 100% because in some cases respondents identied more than one detection method. Te same is true orall charts in this Report showing how occupational rauds were detected.

0% 5% 10% 15% 20% 25% 30% 35%

Notified by Police

External AuditInternal Controls

Internal Audit

By Accident

Tip

DetectionMethod

Initial Detection of Occupational Frauds10

Percent of Cases

34.2%

25.4%

20.2%

19.2%

12.0%

3.8%

More rauds aredetected by tips

than by any othermethod.


29/64


Sources o ipsips were the most common means by which occupationalraud was detected in the cases we reviewed and the ma-jority o tips nearly two out o three were receivedrom employees. It is important to remember, though, thata signicant number o tips came rom outside sourcessuch as customers and vendors. As we stated in our 2004Report, an eective reporting system should be designed

to reach out not only to employees, but also to these third-party sources.

Detecting Fraud by Owners andExecutivesDetection o rauds by owners and executives can presentspecial problems because these individuals have high levelso authority within their organizations and are typically ina position to override controls to avoid detection. Tus, itis harder or these schemes to be detected through tradi-tional audits and anti-raud controls. Our data show that

nearly hal o owner/executive cases were detected througha tip, which ar exceeded the rate or all cases. Conversely,only 8.8% o owner/executive cases were detected throughthe operation o internal controls and only 16.2% were de-tected through internal audits, both o which were lowerthan the rates or all cases.

Tis data is important because losses associated withowner/exec schemes tend to be larger than or any othergroup, yet these schemes are much less likely to be detect-ed through normal audits or control unctions. Tis high-lights the importance o establishing anonymous reportingmechanisms, conducting anti-raud training and osteringopen channels o communication as discussed earlier.

Vendor

Customer

Anonymous

Employee

Percent of Tips by Source

64.1%18.1%

10.7%

7.1%

0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50%

All Cases

Owner/Exec.

Notified by Police

External Audit

Internal Controls

Internal Audit

By Accident

Tip

DetectionM

ethod

Detection of Frauds by Owner/Executives

Percent of Cases

48.0%

34.2%

25.4%

20.2%

19.2%

12.0%

3.8%

17.6%

16.2%

8.8%

21.6%

6.8%


30/64



Detecting the Largest FraudsWe also measured the detection methods or schemes thatcaused losses o $1 million or more. o some extent, thisdata will overlap with the owner/executive data shown onthe previous page. However, there is some distinction; notall $1 million schemes were committed by owner/execu-tives, and conversely, not all owner/executive schemes costover $1 million. Te purpose o analyzing the detection oowner/executive rauds was to help us understand how todetect rauds committed by those in the best position to

conceal it. Conversely, the purpose o analyzing the detec-tion o the cases with the largest losses is simply to helpus understand how best to catch the catastrophic raud asearly as possible.

Despite the diering goals o these two analyses, the re-sults are similar: we again see that tips are the most com-mon orm o detection. We also ound that the largestrauds were less likely to be detected by internal audits or

internal controls.

0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50%

All Cases

$1,000,000+

Notified byPolice

External

Audit

InternalControls

InternalAudit

ByAccident

Tip

DetectionMethod

Detection Method for Million Dollar Schemes

Percent of Cases

44.0%

34.2%

25.4%

20.2%

19.2%

12.0%

3.8%

24.4%

17.7%

12.0%

14.8%

7.7%

0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50%

All Cases

Small Businesses

Notified byPolice

ExternalAudit

InternalControls

InternalAudit

ByAccident

Tip

DetectionMetho

d

Detection of Frauds in Small Businesses

Percent of Cases

32.2%

36.3%

11.5%

13.6%

18.0%

3.1%

34.2%

25.4%

20.2%

19.2%

12.0%

3.8%


31/64


Detecting Fraud in SmallBusinessesFrauds in small businesses (those with ewer than 100 em-ployees) were less likely to be detected by a tip than occu-pational rauds in general. Tey were also less likely to bedetected by internal audit or internal controls, which maybe because many small organizations oten lack stronginternal control structures or any type o internal audit

department. For example, only 73 o the 381 small busi-nesses in our study had internal audit departments, yet in34 cases, small business rauds were detected by internalaudit. Tis translates to an adjusted rate o detection byinternal audit o 46.6%, which suggests that internal audit

departments can be eective in detecting raud when theyare utilized by small businesses. We also ound that raudsin small businesses were much more likely to be detectedby accident, suggesting that these organizations do not doa good job o proactively detecting raud.

Detecting Fraud in Not-or-ProftOrganizations

Te data or detection o raud in not-or-prot organiza-tions was largely consistent with the data resulting romall cases. ips were again the most common detectionmethod, ollowed by accidents.

0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50%

All Cases

Not-for-Profit

Notified byPolice

ExternalAudit

InternalControls

InternalAudit

ByAccident

Tip

DetectionMethod

Detecting Fraud in Not-for-Profit Organizations

Percent of Cases

34.4%

28.7%

16.4%

19.7%

14.8%

4.9%

34.2%

25.4%

20.2%

19.2%

12.0%

3.8%


32/64



Detecting Fraud in GovernmentAgenciesGenerally speaking, government agencies were much lesslikely to rely on accidental detection o raud, whereastheir rates o detection through tips, external audits andnotication by law enorcement each exceeded the rates orall cases.

Detecting Fraud in Privately HeldCompaniesPrivately held companies had the lowest rate o detectionthrough tips o any organization type in our study. Less than25% o cases in private companies were detected throughtips, whereas nearly 35% were detected by accident. Rates odetection by internal audit and internal controls also laggedbehind the overall rate, whereas private companies weremore likely to detect rauds through external audits.

Detecting Fraud in Publicly radedCompaniesPublicly traded companies had a higher rate o detectionthrough tips, internal audits and internal controls than wasound overall. Tis may be due to the impact o Sarbanes-Oxley, which mandates that publicly traded companiesestablish anonymous reporting mechanisms and places astrong emphasis on enhanced internal controls to detect

raud. However, the data in this respect are inconclusive,as the rates o cases detected by tips and through internalcontrols in public companies are both lower in the presentstudy than they were in our2004 Report.

0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50%

All Cases

Government

Notified byPolice

ExternalAudit

InternalControls

InternalAudit

ByAccident

Tip

DetectionMethod

Detection of Frauds in Government Agencies

Percent of Cases

39.7%

16.0%

20.5%

19.9%

15.4%

7.1%

34.2%

25.4%

20.2%

19.2%

12.0%

3.8%


33/64


0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50%

All Cases

Public Company

Notified byPolice

ExternalAudit

InternalControls

InternalAudit

ByAccident

Tip

DetectionMethod

Detection of Frauds in Publicly Traded Companies

Percent of Cases

40.2%

18.2%

26.9%

22.0%

4.5%

3.5%

34.2%

25.4%

20.2%

19.2%

12.0%

3.8%

0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50%

All Cases

Private Company

Notified byPolice

ExternalAudit

InternalControls

InternalAudit

ByAccident

Tip

DetectionMethod

Detection of Frauds in Privately Held Companies

Percent of Cases

24.7%

34.8%

16.2%

16.9%

15.9%

1.7%

34.2%

25.4%

20.2%

19.2%

12.0%

3.8%


34/64

LimitingFraudLosses


We asked each respondent to provide inormation on the anti-raud measuresthat were in place in the victim organizations at the time the rauds occurred.Our goal was to identiy which mechanisms were most commonly used andto measure each anti-raud measures relative efectiveness.

We tested or ve anti-raud measures:

Did the victim have a raud hotline oranonymous reporting mechanism?

Did the victim provide raud awareness or ethicstraining or employees and managers?

Did the victim have an internal audit or raudexamination department?

Did the victim perorm surprise audits on aregular basis?

Was the victim audited by external auditors?

1)

2)

3)

4)

5)

Most Common Anti-FraudMeasuresTe most common anti-raud measure among the victimorganizations in our study was the use o external audits,which were utilized by 75% o the victim organizations.Next most common was internal audits, at 59%. Fraudtraining and raud hotlines were both utilized by just un-der hal o the organizations we studied, while surprise au-dits were only reported in 29% o victim organizations.

It is interesting to note the discrepancy between the requencyo certain anti-raud measures here and the data we gathered

on detection o occupational raud. For example, we oundthat the most common means o detecting raud was throughtips (see pg. 28), yet as the ollowing chart shows, hotlinesranked ourth among anti-raud measures in terms o use,and were utilized by less than hal o the organizations in ourstudy. Given the relative eectiveness o tips as a detectionmethod, we would hope to see more organizations utilizinganonymous reporting mechanisms such as hotlines in orderto encourage and acilitate the reporting o illegal conduct.

On the other hand, external audits were by ar the mostcommonly reported anti-raud measure, yet external auditsranked th in terms o detecting occupational raud. Al-

though there are a number o actors that determine whatkinds o anti-raud measures will be used by an organiza-tion (external audits, or instance, are legally required orcertain types o organizations), there nevertheless seemsto be a certain level o disconnect between the anti-raudmeasures organizations employ and the eectiveness othose measures in detecting occupational raud11.

11Te eectiveness o these measures in deterringorpreventingoccupational raud is certainly a key actor in determining whether they should beemployed, but the deterrent capability o these mechanisms is outside the scope o our inquiry.

External auditswere the

most commonanti-raud

measure usedby victim

organizations.


35/64


Eectiveness o Anti-FraudMeasuresIn an eort to test the eectiveness o each anti-raud con-trol, we measured the median loss in cases where the anti-raud measure was present, then compared it to the medianloss in cases where the anti-raud measure was absent. Wealso measured the length o time it took to discover theraud, based on whether each o these actors was presentor not. Tese are obviously not precise indicators o thevalue o each respective control there are several actorsthat determine the size and duration o a raud but ithelps us get some sense o the impact the respective anti-raud measures had on raud losses.

Anonymous Fraud HotlinesTere were 479 organizations that had raud hotlines orother anonymous reporting mechanisms at the time therauds occurred, compared to 581 that did not. As the ol-lowing companion charts illustrate, organizations with hot-lines had a median loss o $100,000 per scheme and detectedtheir rauds within 15 months o inception. By contrast, or-ganizations without hotlines suered twice the median loss $200,000 and took 24 months to detect their rauds.

0%

10%

20%

30%

40%

50%

60%

70%

80%

SurpriseAudits

HotlineFraudTraining

InternalAudit

ExternalAudit

Frequency of Anti-Fraud Measures

PercentofCases

Anti-Fraud Measure

75.4

%

59.0

%

45.9

%

45.2%

29.2

%

$0 $50,000 $100,000 $150,000 $200,000

Yes

No

Median Loss Based on WhetherOrganization had Hotline

$200,000

$100,000

Median Loss

Hotline

0 5 10 15 20 25

Yes

No

Median Number of Months to DetectionBased on Whether Organization had Hotline

24

15

Months to Detection

Hotline


36/64

LimitingFraudLosses


Internal AuditsInternal audits also had a positive correlation with bothtime to detection and median loss. Fity-nine percent ovictim organizations we reviewed had an internal audit orraud examination department at the time o the raud.Tose organizations had median losses o $120,000, asopposed to $218,000 or organizations without an inter-nal audit unction. Similarly, organizations with internalaudit departments detected their rauds in 18 months, as

opposed to 24 months or those without internal auditdepartments.

External AuditsTe data rom our study on the eectiveness o externalaudits was counter-intuitive. Although external auditswere the most common anti-raud control among theorganizations in our study, we ound organizations thatutilized external audits had higher raud losses than thosethat did not.

Similarly, we ound no connection between the use o ex-ternal audits and the length o the scheme. Organizationsthat had external audits saw raud schemes with a medianlength o 23 months, while those with no external auditsexperienced schemes with a median length o 18 months.

$0 $50,000 $100,000 $150,000 $200,000 $250,000

Yes

No

Median Loss Based on WhetherOrganization had Internal Audits

$218,000

$120,000

Median Loss

InternalAudits

0 5 10 15 20 25

Yes

No

Median Number of Months to Detection Based onWhether Organization had Internal Audits

24

18

Months to Detection

InternalAudits


37/64


O course, there are other reasons why external audits canbe valuable to organizations, and with the increased ocuson raud in external audits that is mandated by SAS 99,we would hope to see these numbers trend up in uturereports, but in our current study we did not nd data toindicate that external audits were particularly eective atdetecting raud.12

Surprise Audits

Surprise audits are requently cited as an eective methodor both raud prevention and raud detection. We oundthat surprise audits were the least commonly utilized anti-raud control among those we tested or.

Only 29.2% o the victim organizations regularly conductedsurprise audits, yet those organizations had median losseso $100,000, as opposed to a median loss o $200,000 ororganizations that did not conduct them. Organizationsthat used surprise audits also had raud schemes with amedian length o 15 months; nine months less than in or-ganizations where surprise audits were not conducted.

12As we stated on pg. 28 o this Report, external audits ranked th out o six detection methods and were credited with identiying only 12% o thecases in our study.

$0 $50,000 $100,000 $150,000 $200,000

Yes

No

Median Loss Based on WhetherOrganization had External Audits

$125,000

$181,000

Median Loss

ExternalAudits

0 5 10 15 20 25

Yes

No

Median Number of Months to Detection Basedon Whether Organization had External Audits

18

23

Months to Detection

ExternalAudits

$0 $50,000 $100,000 $150,000 $200,000

Yes

No

Median Loss Based on WhetherOrganization had Surprise Audits

$200,000

$100,000

Median Loss

Surpris

eAudits

0 5 10 15 20 25

Yes

No

Median Number of Months to Detection Based onWhether Organization Conducted Surprise Audits

24

15

Months to Detection

Surpris

eAudits


38/64


39/64


Anti-Fraud Measures by IndustryIn addition to measuring the general requency and eec-tiveness o anti-raud measures, we also looked at the re-quency with which each anti-raud measure was employedin various industries. Tis inquiry was limited to indus-tries with at least 50 cases.

Banking and Financial Services

Not surprisingly, the Banking and Financial Services In-dustry had high rates o both external and internal audits.Over 90% o Banking and Financial Services organizationswere audited by external auditors, and nearly three-ourthshad internal audit departments. Although our data showthat raud hotlines can be very useul in detecting raud,less than hal o the banking and fnancial services organi-zations utilized them.

Government and Public AdministrationExternal audits and internal audits were the two mostcommon anti-raud measures reported among organiza-tions in the government and public administration sector.Fraud training, anonymous reporting hotlines and the useo surprise audits were all reported in less than hal o thegovernment organizations in our survey.

ManufacturingTree-ourths o organizations rom the manuacturingindustry utilized external audits, while 60% had internalaudits and approximately hal had raud hotlines. Onlyabout 16% used regular surprise audits as a raud detec-tion tool.

Banking and Financial Services 148 Cases

Control Cases %

External Audit 138 93.2%Internal Audit 109 73.6%

Fraud Training 86 58.1%

Surprise Audits 71 48.0%

Hotline 65 43.9%

Government and Public

Administration 119 CasesControl Cases %

External Audit 88 73.9%

Internal Audit 76 63.9%



Hotline 30 25.2%

Manufacturing 101 Cases

Control Cases %



Hotline 16 15.8%




40/64

LimitingFraudLosses


HealthcareBoth hotlines and raud training were utilized by over 50%o the healthcare organizations in our study. Tese gureswere relatively high compared to other industries.

InsuranceOverall, insurance organizations scored well in terms ohaving established anti-raud measures in place. Nearly70% o the organizations in the insurance industry con-ducted raud training or their employees and managers a higher rate than or any other industry we tested.Insurance organizations were also more likely to have ho-tlines than organizations rom any other industry. Finally,we ound that internal audit departments and external au-dits were both present in 80% o the insurance companiesin our study.

RetailGenerally speaking, retail industries tended to have eweranti-raud measures than other organizations. Te mostcommonly cited controls internal audit departmentsand external audits were each present in only a littlemore than hal o the retail organizations rom our survey.Fraud training, however, was more common in the retailindustry than in most others.

EducationOver 80% o education organizations had external audits,and two-thirds o these organizations had internal auditdepartments. Perhaps the most interesting inormation inthe ollowing table is the act that less than a third o edu-cation organizations utilized raud training. One wouldhave hoped educational organizations would have seenmore benet to educating their employees about raud.

Retail 75 CasesControl Cases %





Hotline 24 32.0%

Education 73 Cases

Control Cases %





Hotline 21 28.8%

Healthcare 89 Cases

Control Cases %


Internal Audit 45 50.6%Fraud Training 45 50.6%


Hotline 19 21.3%

Insurance 78 Cases

Control Cases %





Hotline 32 41.0%


41/64


Service (general)Overall, there was a low rate o anti-raud measures em-ployed by the general service organizations in our survey.External audits were utilized by 63% o service organiza-tions, but no other anti-raud control was reported in evenhal o the cases rom this industry.

Service (proessional, scientic or technical)Proessional service organizations were even less likelythan general service organizations to have established anti-raud measures. Less than 40% o these organizations hadexternal audits (the lowest rate or any industry) and eacho the other control mechanisms was cited in less thanone-third o our cases.

Anti-Fraud Measures in Small BusinessesOne o the reasons small businesses tend to suer dispro-portionately large raud losses may be because they tendnot to have many established anti-raud measures. A littleless than hal o small businesses we examined had exter-nal audits and no other anti-raud measure was cited ineven 20% o small business cases. Tis may help explainwhy more small business rauds are detected by accidentthan by any other means.

Anti-Fraud Measures in Not-or-Prot Organizationsips were the most common means by which rauds weredetected in not-or-prot organizations, yet less than one-third o the not-or-prots in our study had an establishedanonymous reporting mechanism. Fraud training and theuse o surprise audits were also ignored by the majority onot-or-prots.

Service (general) 60 Cases

Control Cases %





Hotline 9 15.0%

Service (proessional, scienticor technical) 58 Cases

Control Cases %





Hotline 12 20.7%

Small Business(


42/64

ThePerpetrators


Te perpetrators o occupational raud are the people who use their posi-tions within an organization or personal enrichment through the deliberatemisuse or misapplication o the organizations resources or assets.

In our survey, we asked respondents to provide detailedinormation about the perpetrators o the crimes they hadinvestigated.13 Tis data helps us see how certain actorsrelated to the perpetrator aect the nature o raud and thesize o losses inicted upon victim organizations.

Eect o the Perpetrators PositionOur past studies have indicated and our current study

conrms that the level o authority a person holds withinan organization will tend to have the most signicant impacton the size o the loss in a raud scheme. Te more authorityan individual has, the greater that individuals access to or-ganizational resources, and the more ability that person hasto override controls in order to conceal the raud.

We asked respondents to classiy the principal perpetratorin each scheme in one o three categories: (1) employee;(2) manager; or (3) owner/executive. As the ollowingcharts illustrate, most o the perpetrators were either em-ployees (41.2%) or managers (39.5%). Owner/executives

made up less than one-th o the perpetrators, but theyaccounted or the largest losses by ar. Te median loss ina scheme committed by an owner or executive was $1 mil-lion. Tis was nearly ve times more than the median lossin a scheme committed by a manager and almost 13 timesas large as the median loss caused by employees.

13In cases where there was more than one perpetrator, respondents were asked to provide data on the Principal Perpetrator, which was dened as theperson who worked or the victim organization and who was the primary culprit.

Position of Perpetrator Median Loss

Median Loss

Position

ofPer

petrator

$0 $200,000 $400,000 $600,000 $800,000 $1,000,000

Owner/Executive

Manager

Employee

$1,000,000

$218,000

$78,000

Owners/Executives made up less thanone-fth o the perpetrators, butaccounted or the largest raud losses.


43/64


Te Perpetrators Annual IncomeJust as raud losses tended to rise based on the perpetra-

tors level o authority within an organization, we also

ound that there was a positive correlation between the

perpetrators annual income and the size o raud losses.

As incomes rose, so did raud losses. Te median loss or

employees in the lowest classication was $75,000, where-

as the median loss or the employees with the highest

yearly incomes $500,000 or more was $8 million.Tis data correlates with our previous ndings on how a

raudsters position within the victim organization inu-

ences loss. We would expect that the employees with the

highest levels o authority would generally be the highest

paid as well. Tus, we believe annual income is only a sec-

ondary actor inuencing loss.

$0

$1,000,000

$2,000,000

$3,000,000

$4,000,000

$5,000,000

$6,000,000

$7,000,000

$8,000,000

$9,000,000

$1,000,0000

$500,000+$200,000-$499,999

$150,000-$199,999

$100,000-$149,999

$50,000-$99,999


44/64

ThePerpetrators


Te Eect o enureWe also ound a direct correlation between the length otime an employee had been employed by a victim orga-nization and the size o the loss in the case. Employeeswho had been with the victim or 10 years or more causedmedian losses o $263,000, whereas employees who hadbeen with their employers or one year or less caused me-dian losses o $45,000. o some extent, this data may also

be linked to the position data shown earlier. Te longeran employee works or an organization, the more likely itis that the employee will advance to increasing levels oauthority. However, we believe the critical actors most di-rectly inuenced by tenure are trust and opportunity.

It is axiomatic that the more trust an organization placesin an employee in the orms o autonomy and authority,the greater that employees opportunity to commit raud.Employees with long tenure will, by and large, tend to en-gender more trust rom their employers. Tey will alsobecome more amiliar with the organizations operationsand controls including gaps in those controls which

can provide a greater understanding o how to misappro-priate unds without getting caught. Tis is not to implythat all long-term trusted employees will commit raud;however, in general those employees will be better equippedto commit raud then their counterparts with less experi-ence. When long-term employees decide to commit raud,they will tend to be more successul.

Te Eect o GenderIn each edition o the Report to the Nation, we have oundthat median losses committed by men tend to be muchhigher than those committed by women. Tat act was

apparent again in our current study. Te median loss inrauds committed by males was $250,000, more thantwice as high as the median loss in rauds committed bywomen. Men also accounted or 61% o the cases. Wespeculate that the disparity in losses based on gender isa result o men tending to hold more management andexecutive-level positions in many organizations.

$0

$50,000

$100,000

$150,000

$200,000

$250,000

$300,000

10+ yrs(37.7%)

5-10 yrs(26.3%)

1-5 yrs(25.7%)


45/64


Te Eect o AgeTe rauds in our study were committed by persons rang-ing in age rom 16 to 80. We ound a strong correlation be-tween the age o the perpetrator and the size o the medianloss, which was consistent with our ndings rom previ-ous Reports. Although there were very ew cases commit-ted by employees over the age o 60 (2.8%), the medianloss in those schemes was $713,000. By comparison, the

median loss in rauds committed by those 25 or youngerwas $25,000. As with income and gender, we believe age ismost likely a secondary actor in predicting the loss associ-ated with an occupational raud, generally reecting theperpetrators position and tenure within an organization.

While rauds committed by those in the highest agegroups were the most costly on average, over two-thirdso the rauds reported were committed by employees inthe 31-50 age group. Te median age among perpetratorswas 42.

Te Eect o EducationAs employees education levels rose, so did the losses romtheir rauds. Te median loss in schemes committed bythose with only a high school education was $100,000,whereas the median loss caused by employees with a post-graduate education was $425,000. Tis trend was to beexpected given that those with higher education levels willtend to occupy positions with higher levels o authority.

$0

$100,000

$200,000

$300,000

$400,000

$500,000$600,000

$700,000

$800,000

>60(2.8%)

51-60(15.3%)

41-50(34.6%)

36-40(16.4%)

31-35(16.1%)

26-30(8.8%)


46/64

ThePerpetrators


Te Perpetrators DepartmentIn addition to classiying perpetrators based on broad de-mographic actors such as their age, income or general levelo authority within an organization, we also grouped thembased on the departments in which they worked.

When combined with inormation on the types o schemescommitted, this will hopeully provide organizations with

valuable inormation about the relative level o risk or spe-cic types o raud in dierent departments.

Survey respondents were provided with a list o 15 com-mon departments or job-type classications, and wereasked to select the one that best described the principalperpetrator in their case.

We received 823 usable responses. Te ollowing tableshows the number o cases based on the perpetrators de-partment. Te most heavily represented department wasaccounting, with over 30% o raudsters. Te next mostcommon category was executive o

ACFE Report to the Nation_2006

Documents

Transcript of ACFE Report to the Nation_2006