Modelling Fraud Prevention Process **

As frauds can catastrophically effect business performance, implementation of fraud prevention process can save companies from failure. If fraud risks are not identified and managed they can cause large losses and rapid company failure. Even if company survives losses caused by fraud, it can negatively impact company’s reputation and stakeholders trust.

Implementation of fraud prevention process saves organisation’s money, as fraud activities unnecessary takes money out of organisation. In today’s global competitive environment no one can afford to waste resources.

Frauds have become custom to such a degree that they are not exception but rather a standard behaviour in organisation. Every organisation that does not systematically protect itself from fraud increases its vulnerability to fraud and becomes fraud victim. Implementation of fraud prevention process increases trust from investors, shareholders, board members, audit committee, management and society. It is important that information from fraud prevention process is not ignored. If fraud prevention process shows weaknesses, they have to be corrected as fraud prevention process provides very important information for fraud revealing, reporting and repairing damages caused by fraud.

With the aim to battle a fraud in organisation it is important to rise awareness of all employees abut the harmful affects that could be caused by fraud. Training and cooperation with experts for fraud research its highly important as they can provide information about new scenarios and methods for doing fraud as well as information about using methods and techniques for detection and prevention of fraud. Management of fraud prevention control needs to start with efficient fraud prevention system. Software control of transactions and information system is very important as very efficient software for fraud detection and information system control already exists. Legal framework has to be implemented in such a way to discourage people to commit fraud and that process of investigation and sanctions of fraud is efficiently conducted.

In performing their tasks internal auditors should have necessary knowledge and skills for fraud prevention and control. However, in order for company to systematically battle fraud, it needs to teach and train sufficient number of auditors for fraud control and establish sector for fraud control.

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. (Supplemental Guidance 2012). Figure 1. Presents activities of internal audit in company.

Main cause of problem which leads to crises and failure of companies is conflict between manager’s personal goals and shareholders’ goals, known as agency problem. Asymmetric information between managers and shareholders can lead to moral hazard, that is to fraud.

Examples of fraud are: receiving bribe or gifts; shifting valuable and profit generating transactions outside organisation; illegal appropriation of organisation’s funds or assets as well as falsification of financial data in order to hide fraud activity; deliberate non disclosure or hiding of events, transactions or data; claims for goods or services that were never provided to organisation; deliberately not taking actions even dough its regulated by law and company’s rules; unauthorised or illegal use of confidential information; unauthorised or illegal use of information network or software; and theft.

Association of Certified Fraud Examiners (ACFE, 2014) divides frauds into corruption, asset misappropriation and financial statement fraud (Figure 2).

2010; Brennan, McGrath 2007), no social system (Burke 2010), no company is immune. Many foreign (Dyck, Morse and Zingales 2010) as well as domestic (Bešvir 2010) authors were dealing with this issue and trying to identify phenomenon of fraud or illegal activities (Cohen, Ding, Lesage, Stolowy 2010). Authors were dealing with profits of persons committing fraud (Dorminey, Fleming, Kranacher, Riley 2010), motivation for committing fraud (Ernst, Young 2010), forms of fraud and methods for possible solution of this problem (Hermanson 2009).

The total cost of fraud will be difficult to objectively assess, in particular, will be difficult to calculate the indirect damage caused by fraud. Some frauds will never be discovered. Therefore, we can only talk about estimated losses due to fraud. Association of Certified Fraud Examiners has in 20141 disclosed survey results based on national fraud reports. It is estimated that organisations around the world on average lose 5% of annual revenues to fraud. According to Global Fraud Study from 2014 it is estimated that world’s BDP for 2013 was 73.85 trillion USD, therefore 5% of BDP loss due to fraud is more than 3.7 trillion USD. Also, it is estimated that 5% of employees are always willing to commit fraud, 10% are willing to commit fraud, while 85% can tend to commit fraud in favourable circumstances.

It is estimated (OLAF 2014) that economy of EU only due to corruption has lost 120 billion EUR, whish is slightly less than annual budget of EU. Therefore, battening fraud contributes to competitiveness of EU and world’s economy.

Corporate scandals and frauds were reasons for development of OECD principles of corporate governance (Hussain 2011) with the aim of implementing best practices of governance into companies. Good corporate governance can help to prevent corporate scandals, fraud, and potential civil and criminal liability of companies (Todorovic, 2013).

Three factors impact committing fraud (Lord 2010). They are opportunity, motive and rationalization (Picard 2012). Although, auditors maybe can’t find motive and rationalization for committing fraud, they are expected to be knowledgeable enough with internal controls in order to find opportunities for fraud.

International Standards for the Professional Practice of Internal Auditing are based on principles and provide framework for implementation and improvement of internal audit (MOPP 2014). Standards are compulsory but they can not be interpreted in such a way that they are contrary to local legislations. Certain Standards shown in Figure 3. are linked to internal auditor’s duties in fraud control. Under fraud control in organisation we imply implementation of anti-fraud strategy with prevention, detection, investigation, monitoring and fraud report processes.

Paper only deals with accountability of internal auditors for fraud prevention. Fraud prevention implies actions that will discourage fraud doers and limit exposure to frauds (Wells 2010), through assessment, planning and implementation of controls that proactively prevent fraud (Coenen 2008). Fraud preventions is reached through: implementation of anti-fraud culture and zero fraud tolerance; testing and training of employees; implementation of procedures and processes for fraud prevention, effective communication, surveillance and control; maintaining effective internal control and risk evaluation framework.

Therefore, research hypothesis of paper is: “Designing and implementing fraud prevention process will discourage fraud doers and reduce frauds in organisation”.

Paper applies combined research methodology using both quantitative and qualitative methodologies of scientific research. Quantitative methodology helped us to gather numeric data, with aim of investigation and explanation of links between variables, establishing connections between examined phenomena. Qualitative research we have gathered data through interviews and surveys.

Data was gathered from the University Clinical Centre of the Republic of Srpska in Banja Luka which is the largest and the most significant public healthcare institution in the Republic of Srpska.

Interviews were conducted based on structured survey, where interviewees are asked about specific fraud questions that provide us with data for analysis of dependant and independent variables related to prevention and detection of fraud. Collected data helped us to test hypothesis.

Additional data was collected by questionnaires. Questions are written is such a way to reflect key criteria for fraud prevention. Criteria is determined based on International Standards for the Professional Practice of Internal Auditing, particularly segments regarding role of internal auditor’s in assessment of fraud risk and best practice for fraud prevention. Principles about fraud preventions are formed based on discussion with internal auditors and managers. Questionnaires main goal is to expand and improve quality of on data collect through interviews. Qualitative data collected by questionnaires is evaluated by Deming Cycle.

Results in table 1. and figure 4. show cumulative results of level of compliance with fraud prevention requirement.

Analysis of data regarding level of compliance with fraud prevention requirement for the University Clinical Centre of the Republic of Srpska (UKC RS) shows that UKC RS has score of 0.71 (14.20%) from maximum score of 5, which indicates that there is no evidence and that UKC RS does comply with fraud prevention requirement.

UKC RS had no compliance for 6 out of 9 fraud prevention requirements, that is had no procedure for fraud prevention, didn’t manage fraud risk, didn’t have established fraud prevention department, no fraud prevention training, no controls of suppliers and customers and no control of potential employees before employment. In other 3 there was a limited compliance with fraud prevention requirement (internal control system, internal audit and fraud reporting).

Because UKC RS didn’t comply with fraud prevention requirements and implemented anti-fraud procedures we were not able to identify impact of fraud prevention on fraud detection.

Therefore, we used different method to assess level of fraud prevention. Assessment of fraud prevention level was done by Balance Scorecard method and cumulative research results are shown in table 2 and figure 5.

Total cumulative score for fraud prevention is 12 out of maximum 100 which indicates that we have also identified with this method that level of fraud prevention of UKC RS is unsatisfactory because it’s under the 65% level. 2

Fraud prevention analysis indicates that UKC RS has low level of compliance with requirements which leads to conclusion that UKC RS does not have implemented fraud prevention process and that organisation is exposed to fraud activities.

In order for UKC RS to implement fraud prevention process and discourage fraud-doers we have designed fraud prevention process. Process is based on all fraud prevention requirements and principles. This fraud prevention process is described in flow chart shown on figure 6.

Model of fraud prevention process includes following activities: defining organisational policies regarding zero fraud tolerance and implementation anti-fraud culture; defining accountability for fraud prevention in Code of corporate governance; determining fraud risk; determining control points and establishing internal control in processes; fraud prevention training for employees and spreading anti-fraud culture; establishing reporting channels for fraud suspicion; establishing fraud prevention department; analysis of documentation and procedures for fraud prevention; identification of appropriate processes for fraud prevention and implementation of these processes.

Implementation of fraud prevention model will discourage fraud-doers and reduce fraud in organisation.

List of questions for fraud prevention has been designed by many organisations. In Report to the Nations on Occupational Fraud and Abusе from 2010 Association of Certified Fraud Examiners has designed checklist to help organizations test the effectiveness of their fraud prevention measures. This checklist is comprised of following questions:

1. Is ongoing anti-fraud training provided to all employees of the organization?

a. Do employees understand what constitutes fraud?

b. Have the costs of fraud to the company and everyone in it — including lost profits, adverse publicity, job loss and decreased morale and productivity — been made clear to employees?

c. Do employees know where to seek advice when faced with uncertain ethical decisions, and do they believe that they can speak freely?

d. Has a policy of zero-tolerance for fraud been communicated to employees through words and actions?

2. Is an effective fraud reporting mechanism in place?

a. Have employees been taught how to communicate concerns about known or potential wrongdoing?

b. Is there an anonymous reporting channel available to employees, such as a third-party hotline?

c. Do employees trust that they can report suspicious activity anonymously and/or confidentially and without fear of reprisal?

d. Has it been made clear to employees that reports of suspicious activity will be promptly and thoroughly evaluated?

3. To increase employees’ perception of detection, are the following proactive measures taken and publicized to employees?

a. Is possible fraudulent conduct aggressively sought out, rather than dealt with passively?

b. Does the organization send the message that it actively seeks out fraudulent conduct through fraud assessment questioning by auditors?

c. Are surprise fraud audits performed in addition to regularly scheduled fraud audits?

d. Is continuous auditing software used to detect fraud and, if so, has the use of such software been made known throughout the organization?

4. Is the management climate/tone at the top one of honesty and integrity?

a. Are employees surveyed to determine the extent to which they believe management acts with honesty and integrity?

b. Are performance goals realistic?

c. Have fraud prevention goals been incorporated into the performance measures against which managers are evaluated and which are used to determine performance-related compensation?

d. Has the organization established, implemented and tested a process for oversight of fraud risks by the board of directors or others charged with governance (e.g., the audit committee)?

5. Are fraud risk assessments performed to proactively identify and mitigate the company’s vulnerabilities to internal and external fraud?

6. Are strong anti-fraud controls in place and operating effectively, including the following?

a. Proper separation of duties

b. Use of authorizations

c. Physical safeguards

d. Job rotations

e. Mandatory vacations

7. Does the internal audit department, if one exists, have adequate resources and authority to operate effectively and without undue influence from senior management?

8. Does the hiring policy include the following (where permitted by law)?

a. Past employment verification

b. Criminal and civil background checks

c. Credit checks

d. Drug screening

e. Education verification

f. References check

9. Are employee support programs in place to assist employees struggling with addictions, mental/emotional health, family or financial problems?

10. Is an open-door policy in place that allows employees to speak freely about pressures, providing management the opportunity to alleviate such pressures before they become acute?

11. Are anonymous surveys conducted to assess employee morale?

Comparing checklist published in Report to the Nations on Occupational Fraud and Abuse with checklist which we have established for assessing level of fraud prevention, following advantages of checklist which is implemented in this research can be indicated:

• Checklist systematically included all important questions related to fraud prevention.

• Checklist is divided into five key sections: control environment, fraud risk assessment, control activities, informing public about fraud and monitoring.

• Checklist is comprised of 30 questions and 50 sub-questions.

• For assessing level of fraud prevention we have used Balance Scorecard methodology with integrated scoring scale, weighing factors and compliance score.

• Methodology is comparable with similar researches as it is based on assessing level of fraud prevention.

Based on established checklist we have created model for fraud prevention which is, with certain adjustments, applicable to most of organisations.

Fraud is problem in modern world, which are present in different forms and size, even in economy powerful, democratic and organised countries. Fraud presents a major problem for transitional countries in which democratic, institutional and value systems are not enough developed. In these countries, inadequately developed political and legal mechanisms can not provide effective battle against fraud on all levels.

Fraud in social sense influences changes in value system and rationalisation which tries to justify illegal behaviour. Fraud impacts legitimacy and credibility of government institutions, threatens implementation of legal system, causes mistrust of citizens in government and political instability by increasing the gap between elite and citizens. In Bosnia and Herzegovina fraud is key problem for legging behind in economics development of country. Even dough there is no exact data on fraud we assume that costs related to fraud are way over 5% and that Bosnia and Herzegovina is getting close to countries with extremely high corruption which lose more than 20% of revenues of organisations to fraud.

Previous strategies for battling fraud did not give any effect. Main problem is that previous strategic commitments which were passed on highest level of government were not passed down to business systems of organisations. Therefore, in paper we have presented original model for fraud prevention which is applicable to business systems in organisations. Fraud prevention model is based on following main activities: acceptance of zero fraud tolerance at the highest level in organisation; implementing anti-fraud politics in Ethical code; defining accountability for fraud prevention in Code of corporate governance; fraud risk assessment; implementation of internal controls; assessment of internal control processes, risks and corporate governance by internal audit and providing recommendations for improvement; fraud prevention training for employees; establishing reporting channels for fraud suspicion; controls of suppliers and customers and control of potential employees before employment.