SYS-CON MEDIA Authors: Liz McMillan, Carmen Gonzalez, Zakia Bouachraoui, Roger Strukhoff, David Linthicum

Blog Feed Post

Ten Early Warning Signs Of Fraud In Organisations

Anti-fraud consultancy UKFraud.co.uk (www.ukfraud.co.uk) has published a list of ten common early warning signs which could alert management that fraud may be occurring in their organisation. The list draws upon UKFRAUD.co.uk's substantial experience across an international client base, ranging from major financial institutions, public sector bodies and corporations to SMEs and non-profit making organisations. The list works on the assumption that whatever tools they use, be it IT based cons and false accounting or other traditional scams, the warning signs are often the same. As UKFraud.co.uk believes that awareness of the signs and a sound approach to countering them can often deter many opportunistic incidents of fraud, they have published the list here to help executives benchmark their own operations. In the list suggested actions that can be taken to counter the risk of fraud are given following each sign. The early warning signs can include:

1. ERRATIC REPORTING: This sign is just as applicable to suppliers and contractors as it is to internal departments and functions within the organisation. Erratic, incomplete, late or excuse laden management reporting is often a classic sign that something is wrong. One of the possibilities is the existence of fraud. Further investigation will reveal that lip service and increasingly tenuous explanations are given assertively to thwart follow up activity. Common excuses used are often the frequent occurrence of IT failures, technology compatibility issues between different company systems or international systems. It is also often the case that once reports are complete; there are typically delays in them reaching those who need to review the data.

ACTION: Insist on up-to-date reporting, within a set timetable and then build this into the internal GRC (Governance Risk and Compliance) systems. Wherever appropriate adopt an enterprise-wide approach to technology to help with systems issues.

2. APPARENT PROCESS LAZINESS: A weakening of anti-fraud and data security systems can happen naturally, over time; and is normal - especially when things get busy. This occurs where the sage precautions and risk-avoidance measures get by-passed or ignored in practice as time goes by. This could just be the natural adjustment of systems to the practicalities of working life and busy peaks or it could be deliberate and sinister. However, with the seemingly right processes in place, top level management are often lulled into a false sense of security that they are actually being used, whilst the fraudster is busy at work getting around them.

ACTION: Make sure you implement the suggestions of your internal compliance managers and organise appropriate training to reinforce attitudes and practise. Ensure that the control processes, especially in tendering, purchasing, invoicing and customer controls and identifications are ALWAYS kept strong, managed and regularly reviewed. Where systems/processes are under pressure when used in practise, introduce a review process - and then adapt them promptly.

3. ORGANISATIONAL CHANGE AND THE DESIRE TO DUMP DATA: A major indicator can be the act of deletion or pressure on staff to delete, remove or otherwise dump past records following a restructure, a new division launch, a JV or acquisition. An excuse of, "oh I'm sorry those files were destroyed." should be cause for alarm. It will be an even bigger problem where international operations are involved as it's far harder to find or recreate evidence in a foreign territory.

ACTION: Take care to establish and log where paper documents are and when they should and should not be stored. Identify who is in control of the system processes and who is responsible for and has ownership of the records. They are not always the same person of course. Ensure that scanning, and indexing works properly and that no-one can intercept/edit documents. Also ensure that storage capacity is enough and controlled properly. Where acquisitions and mergers are concerned, ensure that all documents are available and stored appropriately and securely, especially those that relate to IP protection, IP development records, audit trails and staff contracts. In particular, if you are acquiring a business make sure that you have indemnities/penalty clauses built into the acquisition agreements that relate to the availability of data, logs, audit trails and so forth.

4. DATA INCONSISTENCIES OR ABSENSE IN THE ARCHIVES: Whether it is archive data or cross reference checks that are missing or wrong; factual inconsistencies will also occur naturally. The cheats who seek to defraud an organization will use the possibility to explain such inconsistencies and hide their fraud.

ACTION: Make sure that all files are electronically stored, with appropriate back-ups as part of your compliance systems and that no-one has the access to any files that include a DELETE capability. It is also worth having internal or external auditors sample check key files from time to time as a part of the audit programme. In addition arrange for the HR department to make it a gross misconduct issue to destroy data without recorded approval from above. This may not deter the fraudster but if nobody else is doing it the fraudster is more likely to be spotted at an early stage.

5. AUDIT-TIME DELAYS: Excuses, confusion or wild goose chases when disclosing to auditors, be they internal or external, can be a telltale sign too. We need to remember though that the audit team is not there to find fraud, rather to ensure that the correct processes are in place that will deliver appropriate protection.

ACTION: Ensure that everyone treats audits as important and make sure that they are completed on time and properly, and with appropriate audit skills. Where there have been delays or difficulties investigate why this was the case by drilling down into the detail. Make sure that the business critical and financial exposure areas take a priority and act upon all failings both quickly and completely; with follow-up audits if necessary.

6. BEHAVIOURAL ANOMALIES: These can range from acute defensiveness and resistance to attending review meetings, through to blaming strategies or even aggression when specific questions are asked about processes or figures. These behavioural anomalies have probably already been noticed through the assessment process or by HR staff. Research shows that internal fraudsters are most likely to be either 'youngsters who cut across the processes and systems' or 'middle aged executives with the authority and a gripe'.

ACTION: Get HR more closely involved. Then if you still have concerns about such people upon closer inspection, all the relevant files need to be pulled and checked, or you might even consider a private investigator to look deeper into the processes used by such high risk people.

7. GOSSIP MONGERS IN OVERDRIVE: Staff whispers and rumours "that all is not right" should always be taken seriously. These are, however, so often overlooked by senior management.

ACTION: Listen, take all such rumours seriously and investigate the reality.

8. TWITCHY NON-EXECS: Good non-execs provide a considered, independent and external perspective. Often they bring in specific expertise from outside the board's immediate experience and their skills can vary from financial knowledge through to IT. When their comfort factor 'goes south' or when they have a 'bee in the bonnet' about something that does not add up or make sense, they often have good reason to worry. So must you.

ACTION: It is always good for the business to maintain a fresh supply of new thinking, new approaches and new concerns. Thus if non-execs have concerns about particular issues, one should fund their thinking by allowing them to bring in the appropriate specialist experts that can investigate matters more deeply.

9. UNOFFICIAL IT WORK: Technical staff working around the enterprise conducting unsupervised IT activity often outside normal hours, can also be a worrying sign, both from a risk and a cost perspective. Not every company is large enough to have a full IT department that might spot such issues through system audit trails. This is more common in smaller organisations where some are working more to help themselves than to help the organization that is paying for their IT equipment and the software they use.

ACTION: Do the IT security staff look and think further than just password expiry issues? Make sure that someone is on the look out for data-theft, IPR theft, time theft (people spending all day on facebook etc.), or simple theft of IT assets. Make sure you have a proper asset register and IT audit system in place.

10. SCAPEGOATING: Where people are given a title but without actual responsibility, it can effectively cover up what is going on with those who do have responsibility or power in a situation. The fraudster's hope is that should the balloon go up the scapegoat takes the blame, at least long enough for records to be destroyed and evidence removed.

ACTION: Make sure that you have strong and cascaded accountabilities. Ensure that people know what they should be doing, and that they are doing what is required of them. Make sure that everyone is contributing to the business objectives. Make sure HR is involved in creating or reviewing job specifications.

UKFraud.co.uk believes that by introducing a series of straightforward and cohesive processes and systems, organizations can greatly reduce the risk of fraud and in doing so, alert management to the early warning signs, should they be prevalent.

Says Bill Trueman CEO of UKFraud.co.uk "My first question is always to ask executives 'do you really know how safe your own organisation is?' Some do reply confidently. Most do not. Fraud can happen anywhere, anytime, but it is relatively straightforward to deter or discover at an early stage with the right systems and procedures in place. However, putting those systems in place and more importantly maintaining and updating them over time is the hard bit. There are always conflicting priorities and constraints in any organization. By averting or saving fraud losses though, organisations can protect their bottom line from taking an unexpected hit. However, only by having a cohesive anti-fraud strategy as part of the core management culture of the organisation is this be possible. There are generic anti-fraud processes and systems systems that can help support any strategy introduced and consultants such as UKFraud.co.uk are on hand to help introduce the required checks and procedures if required.

"It is our hope that having published this list, that those who read it might at least ask themselves if they recognise any of the signs in their own organisations. We hope too that it might help make things that much harder for the fraudster."

Those companies who have read the list and are worried that fraud may exist in their organisation can contact UKFraud.co.uk's help-centre by sending an email to [email protected].

Ends

About UKFRAUD.co.uk (www.ukfraud.co.uk)
UKFRAUD.co.uk is a leading UK based consultancy, with an impressive international track record of eliminating the risk of fraud. Its founder Bill Trueman is widely accepted as one of Europe's leading fraud experts and a frequent commentator and writer on the issues involved. Trueman has extensive experience of the banking, insurance and the financial services sectors and is a thought leader at the forefront of many industry wide and international debates.

For further information, please contact:
Bill Trueman
UKFRAUD.co.uk
+44 20 8133 7575
[email protected]

Or

Leigh Richards
The Right Image
+44 844 561 7586
+44 7758 372527
[email protected]

Read the original blog entry...

More Stories By RealWire News Distribution

RealWire is a global news release distribution service specialising in the online media. The RealWire approach focuses on delivering relevant content to the receivers of our client's news releases. As we know that it is only through delivering relevance, that influence can ever be achieved.

Latest Stories
The platform combines the strengths of Singtel's extensive, intelligent network capabilities with Microsoft's cloud expertise to create a unique solution that sets new standards for IoT applications," said Mr Diomedes Kastanis, Head of IoT at Singtel. "Our solution provides speed, transparency and flexibility, paving the way for a more pervasive use of IoT to accelerate enterprises' digitalisation efforts. AI-powered intelligent connectivity over Microsoft Azure will be the fastest connected pat...
There are many examples of disruption in consumer space – Uber disrupting the cab industry, Airbnb disrupting the hospitality industry and so on; but have you wondered who is disrupting support and operations? AISERA helps make businesses and customers successful by offering consumer-like user experience for support and operations. We have built the world’s first AI-driven IT / HR / Cloud / Customer Support and Operations solution.
ScaleMP is presenting at CloudEXPO 2019, held June 24-26 in Santa Clara, and we’d love to see you there. At the conference, we’ll demonstrate how ScaleMP is solving one of the most vexing challenges for cloud — memory cost and limit of scale — and how our innovative vSMP MemoryONE solution provides affordable larger server memory for the private and public cloud. Please visit us at Booth No. 519 to connect with our experts and learn more about vSMP MemoryONE and how it is already serving some of...
Darktrace is the world's leading AI company for cyber security. Created by mathematicians from the University of Cambridge, Darktrace's Enterprise Immune System is the first non-consumer application of machine learning to work at scale, across all network types, from physical, virtualized, and cloud, through to IoT and industrial control systems. Installed as a self-configuring cyber defense platform, Darktrace continuously learns what is ‘normal' for all devices and users, updating its understa...
Codete accelerates their clients growth through technological expertise and experience. Codite team works with organizations to meet the challenges that digitalization presents. Their clients include digital start-ups as well as established enterprises in the IT industry. To stay competitive in a highly innovative IT industry, strong R&D departments and bold spin-off initiatives is a must. Codete Data Science and Software Architects teams help corporate clients to stay up to date with the mod...
As you know, enterprise IT conversation over the past year have often centered upon the open-source Kubernetes container orchestration system. In fact, Kubernetes has emerged as the key technology -- and even primary platform -- of cloud migrations for a wide variety of organizations. Kubernetes is critical to forward-looking enterprises that continue to push their IT infrastructures toward maximum functionality, scalability, and flexibility. As they do so, IT professionals are also embr...
Platform9, the leader in SaaS-managed hybrid cloud, has announced it will present five sessions at four upcoming industry conferences in June: BCS in London, DevOpsCon in Berlin, HPE Discover and Cloud Computing Expo 2019.
At CloudEXPO Silicon Valley, June 24-26, 2019, Digital Transformation (DX) is a major focus with expanded DevOpsSUMMIT and FinTechEXPO programs within the DXWorldEXPO agenda. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of business. Only 12% still survive. Similar percentages are found throug...
When you're operating multiple services in production, building out forensics tools such as monitoring and observability becomes essential. Unfortunately, it is a real challenge balancing priorities between building new features and tools to help pinpoint root causes. Linkerd provides many of the tools you need to tame the chaos of operating microservices in a cloud native world. Because Linkerd is a transparent proxy that runs alongside your application, there are no code changes required. I...
In his general session at 21st Cloud Expo, Greg Dumas, Calligo’s Vice President and G.M. of US operations, discussed the new Global Data Protection Regulation and how Calligo can help business stay compliant in digitally globalized world. Greg Dumas is Calligo's Vice President and G.M. of US operations. Calligo is an established service provider that provides an innovative platform for trusted cloud solutions. Calligo’s customers are typically most concerned about GDPR compliance, application p...
Modern software design has fundamentally changed how we manage applications, causing many to turn to containers as the new virtual machine for resource management. As container adoption grows beyond stateless applications to stateful workloads, the need for persistent storage is foundational - something customers routinely cite as a top pain point. In his session at @DevOpsSummit at 21st Cloud Expo, Bill Borsari, Head of Systems Engineering at Datera, explored how organizations can reap the bene...
"NetApp's vision is how we help organizations manage data - delivering the right data in the right place, in the right time, to the people who need it, and doing it agnostic to what the platform is," explained Josh Atwell, Developer Advocate for NetApp, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Druva is the global leader in Cloud Data Protection and Management, delivering the industry's first data management-as-a-service solution that aggregates data from endpoints, servers and cloud applications and leverages the public cloud to offer a single pane of glass to enable data protection, governance and intelligence-dramatically increasing the availability and visibility of business critical information, while reducing the risk, cost and complexity of managing and protecting it. Druva's...
Kubernetes as a Container Platform is becoming a de facto for every enterprise. In my interactions with enterprises adopting container platform, I come across common questions: - How does application security work on this platform? What all do I need to secure? - How do I implement security in pipelines? - What about vulnerabilities discovered at a later point in time? - What are newer technologies like Istio Service Mesh bring to table?In this session, I will be addressing these commonly asked ...
BMC has unmatched experience in IT management, supporting 92 of the Forbes Global 100, and earning recognition as an ITSM Gartner Magic Quadrant Leader for five years running. Our solutions offer speed, agility, and efficiency to tackle business challenges in the areas of service management, automation, operations, and the mainframe.