Kenya AMC Presentation 2

FORENSIC ACCOUNTING & VALIDATION FORUM 2015

7 July 2015

Intercontinental Hotel, Nairobi, Kenya

Fraud Risk Management “in the first 48 hours”By

Mr. Felix T. Maromo, CFE, CPFA, Msc.Financial Crime Compliance ManagerStandard Charted Bank Zimbabwe

CONTENTS

1.Why Commit Fraud

2.Proactive Vs. Reactive Action

3. Fraud happened & we detected it, What next!!!

4. Conclusion - What to do if I suspect fraud

5. Question & Answer Session

Disclaimer:Information and views in this presentation represents solely the presenter's personal views and comments.

Why Commit FraudFraud – Common definitionsThere are many definitions, common few are:a)Is categorized as an offense that can be

charged by law, depending on the specific circumstances of the case.

b)Abuse of position, or false representation, or prejudicing someone's rights for personal gain.

c)A false representation of a matter of fact—whether by words or by conduct, by false or misleading allegations, or by concealment of what should have been disclosed—that deceives and is intended to deceive another so that the individual will act upon it to her or his legal injury.

My definition Refers to a situation where a person makes a material false statement; the victim relies on that statement; and subsequently there are criminal benefits to perpetrator.

Why Commit Fraud

Why Commit Fraud Cont’d…ACFE – Fraud Tree - Types of Fraud

Proactive Vs. Reactive Action

Proactive Reactive

Predictive Modeling Data Mining & Analysis

Fraud Prevention Fraud DetectionPredictive Modeling Commonly used statistical technique to predict future behavior. A form of data-mining technology that works by analyzing historical and current

data and generating a model to help predict future outcomes. Involves data collection, formulating statistical model, making predictions and

validating (revising) the model as additional data becomes available.

Proactive Vs. Reactive Action Cont’d…Data Mining and AnalysisHistorical data is gathered and analyzed in an effort to further understand it. Proven methodologies: Data analysis, especially in the field of forensic

accounting; Use of filters, expressions or equations; Sorting/indexing/summarization; Gap & duplicate detection; Statistical or digital analysis; Sampling, stratification, cross tabulation or pivot

tables; aging, joining/relating, trend analysis, regression

analysis or parallel simulation; or,Or the combination of one or more of these techniques.

Fraud Prevention Assessment

Fraud Detection Bank reconciliations Positive pay Filtering & Screening Process Alerts Management Audits and reviews Watch for warning signs/ Red

flags Alert Employees & Whistle

blowing

Fraud Red Flags Opportunity Red Flags Personal Characteristics Red Flags Situational Pressure Red Flags Characteristics Of Top-Management Fraud Indicators of Possible Fraudulent Activities Understanding Symptoms/Red Flags of Fraud

Fraud happened & we detected it, What's next!!!Model 1Model 1

The current model used to fight against fraud in many organizations.

There are four stages in the model shown on the diagram.Fraud Incident Raising consciousness, while training and other prevention

criteria are out of question. In such an environment, fraudulent event occurs. Company moves to crisis mode because it wants to identify

the fraudster. Company will be too eager to prevent the event from

becoming known publicly, save losses, and reduce the impact of fraud on the organization.

Investigation Stage All security procedures and internal control are included in this

stage. Much of the investigation will be conducted by interviewing

and document examination. The investigation might not end up with a decision. The investigation could take long time and be costly at the

end of the day. Before the third stage begins, investigation should be completed.

Albrecht and Albrecht , 2003, p 98

Fraud happened & we detected it, What's next!!! Cont’d…

Action The company decides how to take action against the fraudster. There are four possible decision actions:

do nothing, fire the fraudster, transfer the fraudster to another section, or fire the fraudster and start legal proceeding.

Resolution The investigation file is closed; the employee is changed; new controls are applied or not applied; and, the problem is resolved.

QUIZ QUESTION: Has case been handled effectively, thereby addressing Fraud Risk to the fullest

Pair Discussions!!!


Conclusion- In Model 1, nothing is done after this fourth stage until a new fraudulent event takes place.

- Fraudulent events do not decrease and they might in fact become a chronic problem. Model 2 - Fraud Savvy Model

1

2

3

6

5

4

Moral Rules

Training

Risk &

Con

trols

Reporting & Control

Proactive

Detectio

n

Inve

stig

atio

n &

Pros

ecut

ion

Fraud happened & we detected it, What's next!!! Cont’d…There are six elements in fraud savvy model. a) Moral Rules:

The developed rules must be embraceable by everyone working in the companyCreating a proper behaviour model

b) TrainingTraining of employees on a series of consequences of fraud.Training employees on how to act when fraud is suspected.

This assist in preventing the incidence of fraudc) Risk & Controls

This entails risk assessment and a good internal control system. Identifying where each fraud is stemming from, thus preventing possible frauds in

the future from its very source.d) Reporting and Control

Reporting of fraud should be facilitated. Fraud could continue for several years if hotlines and other reporting systems are

not used frequently.Reporting includes conveying, the fraud-related information to the people

concerned. i.e. communicating the fraudulent activity to auditors security personnel, managers, employees, and those concerned.

Monitoring includes: watching the performance of internal auditors, external auditors and managers

and investigations. In companies with tight monitoring and reporting systems, fraudulent events are

likely to decrease.No matter how good the prevention efforts are, fraud could still be committed.

d) Proactive Detection Initial detection of fraud is important. Today computer software is used for initial detection of fraud.

d) Investigation & Prosecution In an organisation investigation procedure, the following must be determined:

Who will conduct the investigation? How will the event be communicated to management? Whether or not the law enforcing authorities should be brought in? Who will determine the scope of investigation? Who will determine the methods of investigation? Who will trace secret information in suspected fraud? Who will interview, examine documents, and undertake other stages of

investigation? Who will determine the company’s reaction against fraud?

Finally, Taking lawsuit against the perpetrator should be preferred, instead of passive reaction.



Fraud happened & we detected it, What's next!!! Cont’d…Communication Risk Members of the investigatory team are potential witnesses in any subsequent civil or

criminal proceedings. A lawyer could be consulted on whether the investigation should be recorded in

writing and should advise on how this should be done in order to maximize privilege. A lawyer can also advise on how all communications between team members, and

between team members and third parties, should be structured in order to protect confidentiality and privilege.

Investigator should formally and automatically communicate identified deficiencies and exceptions to appropriate leadership/management.

Law Enforcement Agencies Before contacting any external agency to report fraud, you could consider seeking

advice from your professional advisors and lawyers. Running an investigation solely within the company structure has certain benefits. The benefits can disappear upon law enforcement involvement. Should consider impact of decision Disclosure Control – regulatory and public

disclosures, i.e reputational risk with customers, suppliers, and the capital markets As there is no legal requirement for disclosure of these events, many companies

choose not to report the event or the full extent of the fraud to law enforcement or to the general public.

Once government in involved the disclosure control is weakened.



Scope of InvestigationWhen determining scope of investigation following should be considered:a) Number of input data/material flows

on the investigation contextb) Number of output data/material flows

on the investigation contextc) Number of business events within your

investigationd) Number of human systems adjacent to

the investigatione) Number of automated systems

adjacent to the investigationf) Number of stakeholders involved in

the investigationg) Number of uncertain connections

around your investigation


Taking lawsuit against the Perpetrator Role of Forensic Accounting Emerged since the 1980s in some Western countries, particularly in the USA and has

spread world over. Uses accounting, auditing, and investigative skills to conduct investigations into theft

and fraud. Provide an account analysis to determine the facts necessary to resolve a dispute

before it is brought before the court or the lawsuit process takes its course. Mostly used for engagements that result in actual or anticipated disputes or litigation. Can include fraud, valuation, bankruptcy, and a host of other professional services. Forensic accounting can be done by specific Accounting Professionals. Whereas, Fraud

examinations can be conducted by either accountants or non-accountants and refer only to antifraud matters.

Litigation ProcessThe publicity around the litigation process is usually extreme due to: the sums and range of parties involved; the range of tactics being deployed to achieve each side’s ends; the quantity of hearings and appeals; and, the zeal and determination of the Claimant to succeed, the perceived capacity of the

Claimant to achieve its purpose Usually it’s best for organisations to concentrate efforts towards recovery of lost funds/resources rather than to see perpetrator behind bars (POINT TO DISCUSS)

1. Fraud detection and investigation What has happened that makes you believe that fraud or corruption has taken place? What is the impact/financial loss to your company? How has this happened? Who is responsible for this? When did this take place? What evidence, if any, do you already have to support your belief?

2. If fraud has taken place internally For fraud committed by someone within your organisation: Seek advice from your professional advisors on how to proceed Conduct a full internal investigation Depending on the size of the fraud, you may want to consider taking remedial action against

those concerned If your organisation conducts own investigation with a view to reporting the matter to regulatory

or law enforcement agency, evidence should be preserved and handled with care. Complex matters, may be appropriate to refer to independent investigators.

3. If fraud was conducted by another company or external individuals Before contacting any external agency to report fraud, you could consider seeking advice from

your professional advisors and lawyers.4. Next steps

Dealing with fraud does not stop at reporting it to a law enforcement agency. Investigations can take a long time; hence communications between all stakeholders is key. Fraud Mitigations Measures/Internal control reviews should be conducted to mitigate damage

caused by fraud.

Conclusion - What to do if I suspect fraud

Question & Answer Session

End of PresentationThank You!!!

Kenya AMC Presentation 2

Documents