A perfect storm of human errors — six of them to be exact — caused the biggest nuclear accident to date, the Chernobyl disaster in 1986. An IT mistake prompted 425 million Microsoft Azure users to experience 10.5 hours of downtime. Lack of communication between maintenance crews caused what would have been a simple fix to, instead, lead to the crash of a 1.4 billion dollar stealth bomber.

While there are many sources of enterprise risk, probably the most dynamic and difficult to contend with are those driven by or otherwise impacted by human capital — that is, people. The fact is, most risks start and end with people. The decisions people make, how they perceive situations, how closely they follow policies and procedures… these and other human-driven factors can significantly influence how risks are identified, managed, and addressed.

In our work in the realm of human capital risk, we see many areas where people have the potential to positively or negatively impact the organization from a risk management standpoint. Unfortunately, when people fail, they sometimes fail in big ways. Here are some of the places where human capital risk can rear its head, causing damage to people, brands, and profits:

1. Cybersecurity

Staying secure goes beyond technology (think servers, network, firewalls, etc.); it requires the aid of humans to maintain that secure digital environment. And while most employees get some degree of IT security awareness training in the course of their jobs, mistakes still happen.

IBM estimates the average number of records lost to data breaches annually to be 25,575, and the average cost per breach of USD $3.92 million. Social engineering, malware, and phishing attempts continue to pay dividends for the fraudsters who deploy them. We all know we’re not supposed to click on that link or divulge sensitive information over the phone, but still, people do it. Lapses in judgment, failure to follow a process, having a sense of overconfidence or the feeling that it won’t happen to them, whatever the reason, humans have the ability to sidestep even the strongest cybersecurity protocols.

2. Occupational Fraud

Risk doesn’t always stem from human error; sometimes it’s the result of deliberate actions by employees. Common types of occupational fraud include asset misappropriation, corruption, and financial statement fraud. In 2017, these types of fraudulent activities resulted in $7 billion in losses, according to ACFE’s 2018 Report to the Nations.

When the workplace lacks internal controls, fails to have separation of duties, or neglects to invest in data monitoring and technologies that could flag anomalies, unscrupulous employees see their opening.  Bookkeepers set up fictitious employees in payroll systems in order to cut checks, executives find ways to alter records and financial statements, and line workers take home company property for personal use. These incidents have a median per-loss cost of $114,000, as noted in the ACFE Report.

3. Physical Security

Check with most workplaces and you’ll find they have certain security protocols in place or at least policies that address physical security. Visitors may be asked to check-in at a front desk, employees might be required to wear ID badges, and doors might be required to be locked at all times.

Unfortunately, over time, employees become complacent and policies become outdated. People forget, or simply choose to ignore, the basics they’ve been taught. They leave doors propped open, inviting strangers to come in the building. They neglect to report a broken lock or missing lightbulb. They forget to keep up their annual emergency exit drill schedule. Or, they fail to log off a computer just as someone else decides it’s okay to let a guest circumvent the front desk sign-in because they “know this person.”

These small, but meaningful, errors in judgment often mean the difference between a workplace that remains physically secure and one that opens itself to the risks of theft, data breaches, or even active shooter situations.

4. Workplace Violence

Workplace assaults resulted in 18,400 injuries and illnesses and 458 fatalities in 2017. Assaults range in severity from threats and verbal assault to stabbings, rape, and intentional shootings. In fact, mass shootings at workplaces, schools, and public venues have become the new norm with an average of at least one happening per day in the United States.

We can’t always know which employees are at high risk for engaging in workplace violence, but experts have begun to identify the behaviors that often precede events like these. They include the inability to focus, crying, social isolation, threatening behavior, concerning posts on social media, or complaints of unfair personal treatment. A sudden change in behavioral patterns, or in the frequency or intensity of these behaviors, is also a red flag.

5. Negligent Hiring and Retention

Exercising due diligence in hiring is the best line of defense against negligent hiring and retention lawsuits. Background checks, of course, are the first course of action in rooting out applicants who might disproportionately introduce risk into the workplace. Gathering criminal background records, doing drug testing (as appropriate), and verifying references and credentials are all critical to mitigating your hiring risks.

Beyond background checks, organizations need to have effective fraud detection methods in place. This is particularly relevant considering 96 percent of fraud perpetrators had no prior fraud conviction, and fraudsters who were employed for more than five years stole twice as much, $200,000 vs $100,000 for newer employees! They need to understand the elements of human risk that can be an early indicator of fraudulent activity, including employees who live beyond their means, are experiencing financial difficulties, or have an unwillingness to share job duties.

Manage Your People, Manage Your Risk

Humans are, well, human. They introduce a spectrum of risk into any workplace, from purposeful criminal behavior on one side to unintentional, garden-variety mistakes on the other.

Managing those risks is an ongoing challenge, particularly when it’s difficult to pinpoint the precise human factors that contribute to failures. If you’d like help identifying those areas in your organization that are most susceptible to the human element of risk – whether it’s your cybersecurity program or your hiring processes — request a meeting with a risk management professional.

As the ACFE’s 2019 Fraud Awareness Week comes to a close, it’s a good time to create your plan for fraud prevention in the year ahead. These seven fraud prevention strategies, drawn from the 2018 Report to the Nations by the Association of Certified Fraud Examiners (ACFE), will go a long way in fortifying your organization against the conditions that can facilitate occupational fraud at the workplace.

1. Tone from the Top

A robust anti-fraud program that is embraced from the top of the organization to the bottom creates a culture of honesty and fairness. A solid program starts with a code of ethics, signed by all employees, and continues with anti-fraud policies, training, internal controls, and periodic employee surveys which help gauge the extent to which employees believe management acts with honesty and integrity. Many organizations also include fraud prevention objectives as a part of their employee performance goals.

2. Anti-fraud Training

Practical, hands-on training that educates employees on how to detect fraud, what to look for, how internal controls work, and how to report fraud are instrumental to any anti-fraud program. For instance, make employees aware of the research that demonstrates how fraudsters attempt to conceal their activities, such as through the creation of fraudulent documents, altered accounting transactions, or fraudulent journal entries.

3. Clear Reporting Methods

Fifty-three percent of fraud cases in the ACFE’s 2018 Report to the Nations were reported by employees, and the research also revealed that hotlines were effective in encouraging such reporting. So, whether you create a dedicated fraud hotline, or rely on emails, web forms or in-person reporting, do be sure that all employees know their options for reporting suspected fraud.

4. Proactive Detection

Commit to having anti-fraud efforts remain at the forefront of your organization. This means sending out regular messages to the team, conducting surprise audits, performing regular account reconciliation, and implementing continuous monitoring software to detect anomalies. Organizations with proactive detection methods like these caught fraudulent activities months earlier than those with passive detection. For example, frauds detected actively by IT controls tended to last five months and cause a median loss of $39,000, compared to schemes detected passively (e.g., through notification from law enforcement), which tended to last two years and cause a median loss of almost $1,000,000. If you’re not sure where to start, begin with a fraud risk assessment to identify and mitigate any vulnerabilities you find.

5. A Strong Auditing Team & Internal Controls

The one-two punch of a strong auditing team and solid internal controls will mean the difference between sleeping well at night or potentially having massive losses. Your auditing team should have adequate resources and authority to operate effectively and without undue influence from senior management. In addition, the ACFE’s 2018 study found that weaknesses in internal controls were responsible for nearly 50 percent of all fraud cases! Anti-fraud controls are paramount to preventing or detecting fraud. Here are a few of the most important controls:

• External audits of financial statements
• Internal audit department
• Management certification of financial statements
• External audit of internal controls over financial reporting
• Management review
• Reporting hotline
• Code of ethics and anti-fraud policy
• Proper separation of duties
• Job rotations

6. Diligent Hiring Practices

Background checks should always be a part of any hiring practice, and attention to criminal history, credit reports, and reference checks are particularly important in the context of preventing fraud. However, since 96 percent of fraud perpetrators in the AFCE study had no prior fraud conviction, the next step is understanding the behavioral red flags associated with fraudsters. Eighty-five percent of perpetrators displayed at least one of these red flags: living beyond means; financial difficulties; unusually close relationship with vendor/customer; control issues, unwillingness to share duties; divorce/family problems; and a “wheeler-dealer” attitude.

7. Employee Support Programs

Employee support programs are valuable for a variety of reasons, but in the context of occupational fraud, they can help address some of the underlying issues that present themselves as “red flag behaviors.” An open-door policy that welcomes employees to speak freely about financial, family or addiction pressures can help alleviate them before they become acute or lead to destructive behaviors.

The most cost-effective way to limit fraud losses is, of course, to prevent fraud from occurring. With these strategies in-hand, your organization will be off to a strong start. If you’d like an experienced team to help create an anti-fraud program or investigate suspected fraud, please reach out at any time.

Occupational fraud, referring to fraud caused by an organization’s own employees or executives, is among the most preventable fraud risks that a company faces. While preventable, this form of fraud is also one of the most prevalent in organizations.

To take a closer look at this phenomenon, the Association of Certified Fraud Examiners (ACFE) performs a bi-annual report. Its latest report, the 2018 Report to the Nations, studied 2,690 cases of occupational fraud across 125 nations. In addition to exploring its impact, the report looks at various fraud detection measures and their effect on the duration of the fraud and the size of loss incurred.

The ACFE report offers the latest stats on occupational fraud to inform your risk management and fraud prevention plans. Here are 8 notable findings:

1. Occupational fraud resulted in $7B in total losses in 2017.

The ACFE report identifies three categories of fraud: asset misappropriation, corruption, and financial statement fraud. Asset misappropriation was the most common type of fraud and occurred 89% of the time. However, financial statement fraud led to much greater median losses – $800,000 versus $114K median loss in asset misappropriation.

Of all asset misappropriation cases, altering checks and payments led to the greatest median losses, but billing fraud and non-cash were nearly tied for the highest overall incidences in asset misappropriation schemes.

2. Fraud cases resulted in losses greater than $1M or more in 22% of cases.

The 2018 ACFE report indicates that most companies either lose a relatively small sum (less than $200K) or a significantly larger amount. The differences are extreme. In 55% of cases, losses were below $200K, yet nearly a quarter of businesses incurred more than $1M in losses. The total loss values in between these two extremes were relatively less common, ranging from 2% to 11% in prevalence for this cohort. Of the 2,690 fraud cases examined, the median loss was $130K.

3. 40% of fraud cases were detected by a “tip.”

Early detection is key when it comes to limiting the losses associated with occupational fraud.  According to the ACFE study, the vast majority of fraud detection (40%) comes from tips, which far surpasses the second highest detection source, internal audit (15%).

Tips can come from anyone, but generally they come from within the company. In ACFE’s report, 53% of tips were received internally whereas 32% were from an outside source. Hotlines go hand-in-hand with tips as an effective way to detect fraud. Of the companies analyzed, those with an accessible hotline detected fraud cases 46% of the time, compared to a 30% success rate for companies without hotlines.

4. 96% of occupational fraud perpetrators had no prior fraud conviction.

Detection activities should take place throughout an employee’s tenure. Only 4% of fraudsters in the ACFE’s study had a history of criminal fraud. This is important information, as a pre-hire background check is likely insufficient on its own in preventing fraud. These first-time offenders require active and effective detection efforts to continuously protect the organization.

The ACFE was able to identify the six most common behavioral tendencies shared among fraudsters:

1. Living outside of one’s financial means.
2. Financial hardship.
3. Unnecessary levels of closeness to certain clients.
4. Controlling tendencies and reluctance to delegate with others.
5. Issues at home (e.g. divorce).
6. “Wheeler-dealer” tendencies.

5. Data monitoring and analysis combined with surprise audits reduce fraud loss by more than 50%.

Surprise audits and data monitoring are a powerful combination according to ACFE’s 2018 findings. Together, these contributed to significant reductions in fraud loss. When in place, proactive data monitoring and surprise audits got fraud cases under control in approximately half the time. Compared to cases where these controls were not in place, it reduced fraud losses by more than half.

Despite their effectiveness, neither proactive data analysis nor surprise audits tops the list for commonly used fraud control measures, each were only used by 37% of the companies examined in the 2018 study.

6. Weak internal security was responsible for almost half of the fraud instances.

Internal security can be a valuable line of defense for companies. When companies were asked about what opened the doors to fraud, 30% cited insufficient fraud controls as the top enabler. While 19% said that their systems were too weak and therefore overly easy for fraudsters to override.

7. Fraudsters who had been employed for more than 5 years stole twice as much.

According to the ACFE, employee tenure correlates with median fraud losses. The study found that fraudsters who had been a company for more than five years stole twice as much than relatively newer employees: $200K median loss versus $100K. Employees at a company for less than a year posed notably the least risk to companies, incurring median losses of $40K.

8. Collusion between two perpetrators doubles the loss.

Collusion is common in occupational fraud: 49% of cases investigated in ACFE’s study involved more than one fraudster. This holds especially true when executives and owners are involved – occurring in 66% of cases instigated by higher ups.

The involvement of multiple perpetrators is also more costly. The median loss in cases with one perpetrator was $74K, whereas that number rose to $150K for two perpetrators, and up to $339K when three or more were involved.

When it comes to occupational fraud, prevention and detection requires ongoing, diligent efforts. Whether it’s through surprise audits or providing channels for informants to report suspicious behavior, the team at Lowers & Associates can help establish your fraud prevention plan. Talk to a risk management expert today.