Building an Anti-Fraud Control Plan

1 Building an Anti-Fraud Control plan Patrick Risch, CFE, CIA, CCSA BNP Paribas Fortis, fraud Prevention & Detection President ACFE Chapter Belgium 2 DISCLAIMER The views expressed in this presentation are the views of the speaker and do not necessarily reflect the views or policies of BNP Paribas Fortis or any other company of the Group BNP Paribas Any organisation of which the speaker is a member The purpose of this presentation is to share ideas and promote discussion. Examples are purely for illustrational purposes, and may have been modified or simplified in order to clarify a point. Neither the speaker, nor the company and organisations he belongs to, accepts responsibility for any consequence of the use of (parts of) the framework presented today. However, we invite you to participate in the discussion today and later on.

2 Patrick Risch 3 Outline Introduction fraud Risk Framework The need to manage fraud risk Why do people commit fraud ? Steps in fraud Risk Management fraud Risk Management: putting it into practice Three lines of defense fraud and the Three Lines of Defense Anti-Fraud Control plan Conclusion 4 | 14-11-2013 | Patrick Risch 5 | 14-11-2013 | Patrick Risch 6 | 14-11-2013 | Patrick Risch 7 | 14-11-2013 | Patrick Risch | 19-04-2011 | Patrick Risch 8 Outline Introduction Purpose of the presentation BNP Paribas Fortis fraud Risk Framework The need to manage fraud risk Why do people commit fraud ? Steps in fraud Risk Management fraud Risk Management: putting it into practice Three lines of defence fraud and the Three Lines of Defence Anti-Fraud Control plan Conclusion 9 The need to manage fraud risk You only see what you re looking for Will you see the fraudulent loans that are not reimbursed?

3 Will you see the fraudulent travel expenses? Looking for the real cost of fraud .. and it s impact on business | 24-03-2014 | Patrick Risch 10 Why do people commit fraud ? Some people are honest all of the time. Some people are dishonest all of the time. Most people are honest some of the time. Some people are honest most of the time. Tommie Singleton, PhD, University of Alabama Honest Dishonest Situational 11 A fraud -deterrent Control environment Avoid hiring Bad People Do not isolate Good People Put Situational People in a healthy Control environment No opportunity Balanced target settings and good care for people Organisational culture that cherishes integrity, compliance and team spirit | 24-03-2014 | Patrick Risch 12 Conclusion There will always be fraud .. Mindset of people Pressure Opportunity So we have to manage the risk The earlier we detect it, the better Reputation Financial 13 fraud Risk Management Preventive medicine Surgery Autopsy 14 fraud Risk Management Prevention and Early Detection fraud Case Management Repair and Remediation 15 fraud Risk Management: Putting it into practice Anti-Fraud Policy Set the tone at the top Walk the talk Expected behaviour Consequences Implementation of Anti-Fraud framework in the organisation | 24-03-2014 | Patrick Risch 16 Who deals with fraud risk?

4 | 24-03-2014 | Patrick Risch Operational Management Dedicated fraud specialists 17 Patrick Risch Three lines of defence .. and fraud First line of defence - Operational management Ownership, responsibility and accountability for assessing, controlling and mitigating risks Second line of defence - Risk management/Compliance Facilitates and monitors the implementation of the framework Assist the risk owners in reporting Third line of defence - Internal Audit Provide assurance to the organisation s board and senior management 18 Patrick Risch Three lines of defence .. and fraud First line of defence - Operational management Ownership, responsibility and accountability for assessing, controlling and mitigating risks Training on how to recognise fraud Training on how to react when confronted with fraud Tone at the top Preventive controls Detective controls Investigate incidents Learning organisation Anti-Fraud 19 Three lines of defence.

5 And fraud Prevention and Early Detection Case Management Repair and Remediation 1st Line Install a culture of fraud risk awareness Provide fraud Awareness Training to staff Include fraud Risk in the overall Risk Assessment process Incorporate fraud preventive and detective controls in the operating procedures: segregation of duties, monitor adherence to policies and procedures .. Ensure that a fraud Alert Line is installed and known to everyone in the organisation Set up a process for the management of fraud cases Make the necessary accounting entries and register losses. Reimburse customers Take disciplinary action towards the perpetrator Take legal action against the fraudsters Improve internal Control Recovery activities Communication: internal, external (prepare press release) Investigate all fraud cases in a professional and objective way | 24-03-2014 | Patrick Risch 20 Patrick Risch Three lines of defence.

6 And fraud Second line of defence - Risk management/Compliance Facilitates and monitors the implementation of the framework Assist the risk owners in reporting Policy setting Oversight Set the example Independent view Proposing detective controls Give advice Knowledge centre Methodology 21 Three lines of defence .. and fraud Prevention and Early Detection Case Management Repair and Remediation 2nd line Oversight on fraud Risk Management activities within the organisation Give guidance, advice and recommendations to Line Management fraud Risk Assessment methodology and oversight on roll out Knowledge Centre on fraud Risk Report on fraud risk exposure Post Mortem analysis and recommendations to Line Management Monitoring of evolution of fraud Risk exposure | 24-03-2014 | Patrick Risch 22 Patrick Risch Three lines of defence.

7 And fraud Third line of defence - Internal Audit Provide assurance to the organisation s board and senior management ASSURANCE fraud Risk Framework Incidents 23 Three lines of defence .. and fraud Prevention and Early Detection Case Management Repair and Remediation 3rd Line Provide assurance to the organisation s board and senior management, that fraud risk is managed in an effective way by the organisation. | 24-03-2014 | Patrick Risch 24 Patrick Risch Conclusion Prevention and Early Detection Investigation of fraud Cases fraud Repair And Remediation Install a culture of fraud risk awareness Provide fraud Awareness Training to staff Include fraud Risk in the overall Risk Assessment process Incorporate fraud preventive and detective controls in the operating procedures: segregation of duties, monitor adherence to policies and procedures.

8 Ensure that a fraud Alert Line is installed and known to everyone in the organisation Set up a process for the management of fraud cases Make the necessary accounting entries and register losses. Reimburse customers Take disciplinary action towards the perpetrator Take legal action against the fraudsters Improve internal Control Recovery activities Communication: internal, external (prepare press release) Investigate fraud cases in a professional and objective way Oversight on fraud Risk Management activities within the organisation Give guidance, advice and recommendations to Line Management fraud Risk Assessment methodology and oversight on roll out Knowledge Centre on fraud Risk Report on fraud risk exposure Post Mortem analysis and recommendations to Line Management Monitoring of evolution of fraud Risk exposure Provide assurance to the organisation s board and senior management, that fraud risk is managed in an effective way by the organisation.

9 25 Three lines of defence .. and fraud investigations First line of defence activity Linked with operational activities of the business Subject to policy and oversight by the second line, and periodical Control by the third line. But: need for an independent and objective inquiry Specific skills and competences Destruction or falsification of evidence, Cover up management responsibilities Confidentiality | 24-03-2014 | Patrick Risch 26 Three lines of defence .. and fraud investigations External fraud part of the business-as-usual processes, usually well-known to the operational management. investigation of incidents by the operational department Internal fraud a dedicated competence centre or third party investigators | 24-03-2014 | Patrick Risch 27 Outline Introduction Purpose of the presentation BNP Paribas Fortis fraud Risk Framework The need to manage fraud risk Why do people commit fraud ?

10 Steps in fraud Risk Management fraud Risk Management: putting it into practice Three lines of defence fraud and the Three Lines of Defence Anti-Fraud Control plan Conclusion 28 Anti-Fraud Control plan Purpose of the Control plan Give reasonable assurance that the framework is in place and is functioning as intended Major risks are under Control Formal controls on a continuous basis In the first line In the second line Control of controls Direct controls | 24-03-2014 | Patrick Risch 29 Anti-Fraud Control plan The framework = the policy Training Risk assessment Consequence management Governance Operational incidents reporting | 24-03-2014 | Patrick Risch 30 | 17-04-2012 | Patrick Risch Anti-Fraud Control plan - Training Control objectives 1st LoD Control 2nd LoD Control Training program and materials contain relevant topics Review