Fraud risk management - CIMA - Chartered …

1 Fraud risk managementA guide to good practice1 This guide is based on the fi rst edition of Fraud Risk management : A Guide to Good Practice. The fi rst edition was prepared by a Fraud and Risk management Working Group, which was established to look at ways of helping management accountants to be more effective in countering Fraud and managing risk in their second edition of Fraud Risk management : A Guide to Good Practice has been updated by Helenne Doody, a specialist within CIMA Innovation and Development. Helenne specialises in Fraud Risk management , having worked in related fi elds for the past nine years, both in the UK and other countries.

2 Helenne also has a graduate certifi cate in Fraud Investigation through La Trobe University in Australia and a graduate certifi cate in Fraud management through the University of Teeside in the their contributions in updating the guide to produce this second edition, CIMA would like to thank: Martin Birch FCMA, MBA Director Finance and Information management , Christian Katzenberg Chief Financial Offi cer, RITC Syndicate management Finn Senior Lecturer, Southampton Solent Stephen Hill E-crime and Fraud Manager, Chantrey Vellacott Sharp BSc, FCMA, MBA Assistant Finance Director (Governance), Kingston Hospital NHS McDonagh Managing Director, Hibis Europe Robinson andMia Campbell on behalf of the Fraud Advisory Panel.

3 CIMA would like also to thank those who contributed to the fi rst edition of the guide. About CIMACIMA, the Chartered Institute of management accountants , is the only international accountancy body with a key focus on business. It is a world leading professional institute that offers an internationally recognised qualifi cation in management accounting, with a full focus on business, in both the private and public sectors. With 164,000 members and students in 161 countries, CIMA is committed to upholding the highest ethical and professional standards of its members and students. CIMA 2008. All rights reserved. This booklet does not necessarily represent the views of the Council of the Institute and no responsibility for loss associated to any person acting or refraining from acting as a result of any material in this publication can be accepted by the authors or risk management : a guide to good practice2 Contents Introduction.

4 5 Fraud its extent, patterns and causes .. 7 What is Fraud ? .. 7 The scale of the problem .. 9 Which businesses are affected? .. 11 Why do people commit Fraud ? .. 13 Who commits Fraud ? .. 15 Summary ..16 Risk management an overview .. 17 What is risk management ? .. 17 Corporate governance .. 17 The risk management cycle ..19 Establish a risk management group and set goals ..20 Identify risk areas ..20 Understand and assess the scale of risk ..20 Develop a risk response strategy ..22 Implement the strategy and allocate responsibilities.

5 22 Implement and monitor suggested controls ..22 Review and refi ne and do it again ..22 Information for decision making ..22 Summary ..23 Fraud prevention .. 24 A strategy to combat Fraud .. 24 Developing a sound ethical culture ..26 Sound internal control systems ..32 Summary ..36 Fraud detection .. 37 Detection methods .. 37 Indicators and warnings ..39 Tools and techniques .. 41 Summary ..43 Responding to Fraud ..44 Purpose of the Fraud response plan ..44 Corporate policy ..44 Defi nition of Fraud ..45 Roles and responsibilities.

6 45 The response .. 47 The investigation ..48 Organisation s objectives with respect to dealing with Fraud ..50 Follow-up action ..50 Summary .. 51123453 AppendicesAppendix 1 Fraud and the law ..52 Appendix 2 Examples of common types of internal Fraud ..57 Appendix 3 Example of a risk analysis ..60 Appendix 4 A sample Fraud policy .. 61 Appendix 5 Sample whistleblowing policy ..62 Appendix 6 Examples of Fraud indicators, risks and controls ..64 Appendix 7 A 16 step Fraud prevention plan ..67 Appendix 8 Outline Fraud response plan ..68 Appendix 9 Example of a Fraud response plan.

7 69 Appendix 10 References and further reading ..77 Appendix 11 Listed abbreviations ..80 FiguresFigure 1 Types of internal Fraud .. 8 Figure 2 The Fraud triangle .. 13 Figure 3 The CIMA risk management cycle ..19 Figure 4 Anti- Fraud strategy ..25 Figure 5 Ethics advice/services provided ..28 Figure 6 Methods of Fraud detection .. 37 Case Studies Case study 1 Fraud doesn t involve just money ..10 Case study 2 Size really doesn t matter .. 12 Case study 3 A breach of trust .. 14 Case study 4 management risk ..16 Case study 5 A fi ne warning ..35 Case study 6 Vet or regret? ..36 Case study 7 Tipped off.

8 38 Case study 8 Risk or returns ..42 Case study 9 Reporting Fraud ..45 Case study 10 TNT roots our Fraud ..4845 Periodically, the latest major Fraud hits the headlines as other organisations sit back and watch, telling themselves that it couldn t happen here. But the reality is that Fraud can happen anywhere. While only relatively few major frauds are picked up by the media, huge sums are lost by all kinds of businesses as a result of the high number of smaller frauds that are committed. Surveys are regularly carried out in an attempt to estimate the true scale and cost of Fraud to business and society. Findings vary, and it is diffi cult to obtain a complete picture as to the full extent of the issue, but these surveys all indicate that Fraud is prevalent within organisations and remains a serious and costly problem.

9 The risks of Fraud may only be increasing, as we see growing globalisation, more competitive markets, rapid developments in technology, and periods of economic diffi other fi ndings, the various surveys highlight that: organisations may be losing as much as 7% of their annual turnover as a result of Fraud corruption is estimated to cost the global economy about $ trillion each year only a small percentage of losses from Fraud are recovered by organisations a high percentage of frauds are committed by senior management and executives greed is one of the main motivators for committing Fraud fraudsters often work in the fi nance function Fraud losses are not restricted to a particular sector or country the prevalence of Fraud is increasing in emerging the serious risk that Fraud presents to business.

10 Many organisations still do not have formal systems and procedures in place to prevent, detect and respond to Fraud . While no system is completely foolproof, there are steps which can be taken to deter Fraud and make it much less attractive to commit. It is in assisting organisations in taking such steps that this guide should prove valuable. The original guide to good practice was based on the work of CIMA s Fraud and Risk management Working Group that was established as part of the Institute s response to the problem of Fraud . Since the publication of the original guide, we have continued to see high profi le accounting scandals and unacceptable levels of fraudulent behaviour.