Assignment
Anyone who has been exposed to employee fraud knows how unsettling it can be to learn that someone known and trusted has betrayed co-workers and the organization itself. Shocked employees wander the office halls, whispering to each other, "I would never have suspected him of doing something like that."
And the perpetrator may, indeed, be a likable, friendly person who maintained cordial relationships with colleagues. Even good people occasionally stumble.
Internal auditors are responsible for understanding and assessing the red flags that may indicate that such a stumble is being considered or has already occurred. Proactive recognition and response can go a long way toward protecting the enterprise from the financial and reputational damage a successful fraud can create.
HOLDING THE LINE
Fraud represents one of the many risks associated with an unhealthy culture (see "It Starts With Culture" on page 49), and one that internal audit can address directly in its capacity as the third line of defense. The first line, management, sets, communicates, and models desired values and conduct. The second line, oversight functions such as an ethics office, monitors risks related to employee conduct and compliance with policies and procedures. Internal audit assesses various functions and lines of business and determines whether values and behaviors that drive strategy and good performance are embedded in the organization.
Although this role may be clear to internal auditors, how to approach it may be less apparent. The job can be tackled in many ways, but two objectives should remain paramount: understanding behaviors (red flags) associated with fraud--remembering that no one, even a "good" person, is immune from forces that may lead to misconduct--and considering the possibility of fraud on every audit.
Understanding Behaviors Associated With Fraud Criminologist Donald Cressey's fraud triangle theory indicates that frauds require three elements: pressure, opportunity, and rationalization. Fraudsters are often experiencing some type of pressure, at work or at home, real or imagined. They seek an opportunity to alleviate the pressure (via misdeed), and they must then be able to justify the behavior to themselves ("I deserve it," "Everyone is doing it," "No one will know"). Knowing this chain of events makes it easier to understand how employees who are generally esteemed and respected may suddenly commit fraud. When people faced with a non-sharable financial problem realize they can alleviate that problem through violation of a position of financial trust, and are able to convince themselves that their dishonest actions don't run afoul of their personal codes of conduct, they make a transition Cressey describes as going from "trusted persons" to "trust violators."
The fraud triangle's opportunity element may be easier for internal auditors to identify, as it often arises through a lack of controls. It may be more difficult to discern when someone is feeling pressured--especially because, in some organizations, working under pressure represents the norm. One indicator of pressure may be a sudden change in working hours: arriving early or leaving late may hint at trouble at home or a desire to be alone at the workplace. Or an employee may display a sudden enhancement of lifestyle not commensurate with his or her salary, demonstrated through luxuries such as an expensive car, a high-end watch, an upgraded wardrobe, or an exotic vacation. Fraud may have supplied the original funding for these items, and pressure to maintain them may lead to repeated misconduct.
How do internal auditors balance their responsibility to identify suspicious employee behavior against their need to maintain good relationships? They apply healthy skepticism, which is not an automatic and cynical predisposition to distrust, but the appropriate use of questioning to see beyond the superficial.