Would you leave the front door unlocked to your business or not-for-profit organization? Of course not. That would give thieves easy access to your assets. Yet a surprising number of organizations don't have strong antifraud controls in place to protect against dishonest people inside their organizations. And theft from insiders — also referred to as "occupational fraud" — can be costly.
Fraud losses vary significantly, depending on the nature of the scam and how soon it's detected. Globally, the median loss is $130,000, according to the findings from the 2018 Report to the Nations on Occupational Fraud and Abuse by the Association of Certified Fraud Examiners (ACFE). Here's a closer look at who was affected and how much was lost, as reported in the latest version of this biennial study.
Victim Organizations
Fraud can strike any organization regardless of the nature of its operations or its size. The latest ACFE study included 2,690 fraud cases occurring between January 2016 and July 2017.
While the news media focuses on high profile fraud incidents involving public companies, the median loss for those companies was only $117,000. Private companies suffered far greater losses — their median loss was a whopping $164,000. By comparison, the median losses for government and not-for-profit entities were approximately $118,000 and $75,000, respectively.
In addition, there are subtle distinctions between the types of fraud schemes that strike small and large organizations.
Top 5 Fraud Schemes by Size
Percent of Cases
| Rank | < 100 Employees | 100+ Employees |
| 1 | Corruption (32%) | Corruption (43%) |
| 2 | Billing (29%) | Non-cash schemes (22%) |
| 3 | Check tampering (22%) | Billing (18%) |
| 4 | Expense reimbursement (21%) | Cash on hand (14%) |
| 5 | Skimming and cash on hand (20%) | Expense reimbursement (11%) |
To Catch a Thief
Small and large organizations also differ in how they catch fraudsters. Tips were the detection method in 29% of the cases involving small entities, compared to 44% of the cases involving large ones. This could result from the prevalence of reporting hotlines, which are more common among larger companies than small ones with limited resources.
Overall, tips are the most common way fraud is initially detected. But it's important to remember that outside stakeholders can also provide tips on unethical behavior. In the 2018 study, 21% of tips came from customers and 9% came from vendors. So, it's important to educate your supply chain partners about any reporting mechanisms you set up.
Internal Controls
Beyond tips, a robust system of internal controls can help detect and prevent fraud. The latest study found that 15% of frauds were detected by internal audit procedures and 13% by management review.
What are the critical elements of an internal control system? In terms of lowering fraud losses, the most effective internal controls in the 2018 study were:
| Control | Percent Reduction in Fraud Loss |
| Code of conduct | 56% |
| Proactive data monitoring and analysis | 52% |
| Surprise audits | 51% |
| External audits | 50% |
| Management review | 50% |
| Hotline | 50% |
On the flip side, weak internal controls often provide dishonest people with the opportunity to steal assets or "cook the books." In the 2018 study, a lack of internal controls and the ability to override internal controls were cited as the leading factors that contributed to fraud. Together, these factors were present in nearly half of the fraud cases in the latest study.
In addition, the 2018 ACFE study inquired about the types of antifraud controls fraud victims had implemented. The report revealed that 25% of frauds at larger organizations were caused by a lack of internal controls. In contrast, 42% of frauds at small organizations stemmed from weak controls. This finding helps explain why fraud seems to hit smaller organizations harder than larger ones.
Lessons Learned
Over the last two decades, the ACFE's fraud report has taught important lessons including: No organization is immune to white collar crime. Driven by this report and recent high-profile public fraud cases, companies have increasingly implemented antifraud controls in recent years.
How do your internal controls measure up? Although strong internal controls don't guarantee that fraud won't occur at your organization, they can minimize your losses. Your auditor or accountant can help evaluate your internal controls and recommend areas of improvement. He or she can also investigate suspicious behaviors and anomalies for signs of white collar crime.
| How to Fight Fraud Head-On Honest employees are an organization's first line of defense against white collar crime. Here are some ways you can encourage employees to join in the fight: Invest in training. Educate staff on the red flags associated with fraud from within and outside the organization. This helps detect and prevent fraud. It also sends a powerful message about your intention to fight fraud no matter where it originates. Employees must perceive a high probability that fraudulent activity will be detected. The perception of detection is often sufficient enough to dissuade those inclined toward unethical behavior. Engage management in the fight. Managers must be seen and heard reviewing controls and urgently correcting weaknesses that might be detected. If your organization's managers are perceived to be unwilling or unable to review the controls, they may inadvertently be sending a message that it's safe to commit fraud. Set up a hotline. Anonymous fraud reporting hotlines are an effective method of obtaining tips about unethical behavior. Unfortunately, many small organizations shy away from this option, because they see it as too expensive and difficult to administer. A number of providers offer hotlines designed with small organizations in mind. The cost per employee is minimal in relation to the fraud it can help to uncover and the losses avoided. The 2018 Report to the Nations found that employers were much more likely to be tipped off if they offer reporting hotlines. The study found that tips led to the detection of fraud in 46% of the cases involving organizations with reporting hotlines, but only 30% of the cases involving organizations without hotlines. Another interesting finding: More than half of complaints were submitted via email or an online form. This suggests that companies with telephone-only reporting hotlines should consider adding more technology-based channels for reporting fraud. |