Profiling The Fraudster. Padgett Simon

out that way for many years. This may be a reflection on their culture or background.

      The ACFE estimates that some $3.5 trillion of fraud is happening worldwide. The National Fraud Authority in the United Kingdom publishes its Annual Fraud Indicator every year, which estimates that fraud in 2011 was costing the UK economy over £38 billion a year, equating to a shocking £765 per adult per year. This figure includes estimated undetected losses.

      In the Compliance Reporter article “UK Fraud at Record Level” (2012), KPMG reported the actual 2011 UK fraud to be £3.5 billion. The 2011 FraudTrack Report, released by accountancy firm BDO, revealed a significant increase in both the number and value of reported frauds in the United Kingdom in the previous year to the highest level of fraud since the report began in 2003. In 2010, there were 372 cases of reported fraud with an average value of £3.7 million each. This had risen to 413 cases with an average value of £5 million each.

      The Fight against Fraud

      The nature and threat of occupational fraud is universal, according to the ACFE. Although the research in its 2012 Report to the Nations noted some regional differences in the methods used to commit fraud, as well as organizational approaches to preventing and detecting it, many trends and characteristics are similar regardless of where the fraud occurred. Whereas this may make writing a textbook on how to deal with fraud a little easier in that much of the approach may take a standardized approach, this is certainly not the case when we start to consider profiling. Profiling the human being cannot be a standard process with a one-size-fits-all solution. Each human being has unique characteristics and behavioral attributes, thereby giving a unique angle to what may be described as universal fraud.

      Providing individuals with a means to report suspicious activity is a critical part of any antifraud program. Fraud reporting mechanisms, such as communication channels and whistleblowing hotlines, should be set up to receive tips from both internal and external sources and should ideally be externally managed, should offer anonymity and toll-free calling, and should allow confidentiality. Management should actively encourage employees to report suspicious activity, offering a reporting process free of reprisals and with the maximum protection for the whistleblower. In many jurisdictions this protection comes through the legal system with whistleblower protection embedded in local law. Interestingly, where I have worked on introducing whistleblowing mechanisms in organizations in jurisdictions where there is no legal protection for whistleblowers, I strongly advise that the organization's CEO or chairman state in his launch address as well as in his preamble in the whistleblowing policy that he personally guarantees the protection of whistleblowers and that their actions will not be detrimental to them in any way, irrespective of legal protection or its absence.

      External audits should not be relied on as an organization's primary fraud detection method, says the ACFE. Such audits were the most commonly implemented control in the study; however, they detected only 3 percent of the frauds reported and they ranked poorly in limiting fraud losses. While external audits serve an important purpose and can have a strong preventive effect on potential fraud, their usefulness as a means of uncovering fraud is limited. Both internal and external auditors, however, have access to and are therefore crucial to the collection and analysis of the information and data required to set up a profiling mechanism in the organization.

      Targeted fraud awareness and sensitization training for employees and managers is a critical component of an effective antifraud program and is a proven method of preventing and detecting fraud. Not only are employee tips the most common way occupational fraud is detected, but the research shows that organizations that have antifraud training programs for employees, managers, and executives experience lower losses and shorter fraud durations than organizations that do not have such programs in place. At a minimum, staff members should be sensitized as to what fraud actually is, what actions constitute fraud, how fraud harms everyone in the organization, and how to report suspected fraudulent activity.

      Research continues to show that small businesses are particularly vulnerable to fraud. These organizations typically have fewer resources than their larger counterparts, which often translates to fewer and less-effective antifraud controls. In addition, because smaller businesses have fewer resources, the losses they experience tend to have a greater impact than they would in larger organizations. Managers and owners of small businesses should focus their antifraud efforts on the most cost-effective control mechanisms, such as hotlines, employee training, and setting a proper ethical tone at the top and within the organization. Additionally, assessing the specific fraud schemes that pose the greatest threat to the business can help identify those areas that merit additional investment in targeted antifraud controls. The fraud risk assessment process is invaluable in determining fraud risk exposure and is a fundamental element of fraud profiling.

      Profiling as a Solution

      In terms of profiling, most fraudsters exhibit behavioral traits that can serve as warning signs of their actions. These red flags, such as living beyond one's means or exhibiting excessive territorial control issues, generally will not be identified by traditional internal controls that are designed to focus on the organization's processes rather than human behavior. Managers, employees, and auditors should be educated through the training and sensitization programs on these common behavioral patterns and encouraged to consider them, particularly when noted in tandem with other anomalies, to help identify patterns that might indicate fraudulent activity.

      The cost of occupational fraud, both financially and, possibly more important, to an organization's reputation, can be acutely damaging. With nearly half of victim organizations unable to recover their losses, proactive measures to prevent fraud are critical. Management should continually assess the organization's specific fraud risks and evaluate its fraud prevention programs in light of those risks. Profiling of the fraudster and his modus operandi will be a valuable addition to the fraud fighter's toolkit.

      The fact that the level of reported fraud is up is worrying, but not at all surprising. When the economic climate is difficult there is even more focus on the bottom line and driving out unnecessary costs, so fraud is more likely to be uncovered. Companies should have a proactive approach to fraud protection to avoid increases in the level of fraud. Organizations need to be taking a profit-and-loss approach to fraud risk. If companies continue to take a reactive approach to preventing fraud, it will continue to rise year after year. You cannot design all fraud risk out of a business, but you can put tripwires in place.

      Chapter 2

      Types of Occupational Fraud and Corruption

      MOST OCCUPATIONAL FRAUD AND CORRUPTION SCHEMES use one or more of the following embedded techniques: abuse of power, embezzlement, misuse of business time, computer fraud, stock and equipment pilferage, and expense abuse.

      • Abuse of power. This scheme involves making inappropriate financial decisions to benefit the employee rather than the organization. For example, the employee signs contracts with more expensive outside vendors and receives a kickback in return. Kickbacks are a form of corruption, also defined as an abuse of one's position of power.

      • Embezzlement. One of the most common occupational frauds is the manipulation of accounting records to steal business funds. Financially astute employees may be able to devise sophisticated schemes to cover their theft. This is called misrepresentation, one of the characteristics of fraud.

      • Misuse of business time. Employees who perform nonwork-related functions while at work are committing fraud because they are depriving the business of employee productivity during that time. The act of fraud itself is also included in this category. Alternatively, running a personal business from the employment office constitutes theft of time, as does the time occupied by committing fraudulent activity.

      • Computer fraud. The advent of modern technology has provided more opportunities for employees to commit computer or electronic fraud, facilitating the electronic manipulation of business funds so as to deposit them into personal or other third-party accounts. Not only do computers facilitate the fraudster's activities, but they are also essential in fraud detection.

      • Stock and equipment pilferage. The theft of stock and capital equipment