What is Fraud Triangle?
Revised by: Bachir El Nakib
Most fraudulent acts, goes back to three circumstances lead to the commission of fraud: the incentive to commit fraud, the opportunity to carry out the fraudulent act, and the ability to rationalize or justify the fraud.
The fraud triangle involves three major components; pressure, opportunity and rationalization. Mixed together, these ingredients explode causing significant losses for businesses of all classifications. Recent reports indicate that a typical organization loses 5% of annual revenues to fraud.
Developing a keyword library for FT
When building your keyword library around the Fraud Triangle, it’s important to consider the type of fraud you're analyzing such as asset misappropriation, corruption, or financial misstatement Further, it s critical to incorporate industry and company-specific jargon, acronyms, and cultural slang that might he used within the specific group being analyzed- Global organizations might also have to develop language-specific libraries.
To get you started, here are some sample keywords for a corruption analysis:
Incentive/ pressure keywords
meet the deadline, make the number, under the gun, make the deal (make the sale), under pressure, afraid, problem, just book it, lose my job, get fired
Opportunity keywords
cookie jar, facilitation fee, process fee, release expense, handover fee (or handover payment), hush money, improper payment, cash only, kick back, off the books
Rationalization keywords
everyone does it, it's the culture, trust me, therefore, they owe me, sounds justified, fix it later, nobody will notice, just an error, the boss told me to
Identifying Incentive
Management usually perpetrate fraud differently from non-management employees. For non-management employees, incentive takes place when an employee has an overriding reason to steal from the company. Sometimes the employee has bills she can’t pay or a money-sucking addiction. Many times the incentive springs from not wanting a spouse, child, or parent to know about the problem. The employee resorts to self-help rather than risk being embarrassed by admitting that her debt is out of control.
Pressure is felt by potential fraudsters. It may stem from financial, health, blackmail, psychological, lifestyle dependency or other issues that are of monumental importance to the affected individual. He or she looks for some way to relieve the pressure by eliminating the immediate issue, if only temporarily, until they can find a more permanent fix.
Here are some red flags to consider when looking for fraud among non-management employees:
- The employee’s spouse has lost a job.
- The employee is divorced and has expensive child or spousal support payments.
- The employee or his spouse or child is involved in civil or criminal proceedings.
- The employee has a drug, alcohol, or gambling problem.
- The employee purchased a new home with an accelerating variable rate mortgage.
- The employee never takes a vacation (in an attempt to conceal the fraud).
To identify at-risk employees, consider whose pay-checks are being garnished by the court system in order to pay for child support or alimony. Also, look at payroll records to see who has accrued substantial vacation or sick leave.
Managers are often motivated to commit fraud because of the way they’re compensated. For example, a department manager may be angling for a higher raise at year’s end. How well each department performs could be upper management’s method of allocating available bonuses to the managers. A common performance measure is comparing actual department expenses to the budget.
People in upper management often have a relatively low salary with the bulk of their compensation coming from bonuses tied to company results.
Recognizing Opportunity
Opportunity is present when the fraudster identifies and takes advantage of circumstances in order to illegally and deceitfully obtain personal gain. For example, a bookkeeper may supplement his or her income by issuing checks to a fictitious vendor. Or, a legitimate vendor may collude with a company manager to receive undue payment for fraudulent invoices. Regardless of the strength of the incentive, fraud can take place only if the opportunity is present. The opportunity for fraud can come from many different directions:
Ø Weak internal controls: Strong internal controls are a business’s first line of defense.
Ø No separation of duties: This occurs when one employee handles many different related tasks. For example, the same employee opens the mail, logs in payments, and prepares and takes the deposit to the bank.
Ø Indifferent management: Sometimes management doesn’t enforce the internal controls set in place.
Ø Ineffective monitoring of management: This takes place when the company is small and has few managers.
Keep in mind that collusion among employees can circumvent even the strongest of internal controls.
Who’s likely to get caught in the middle of the fraud triangle?
Companies are often shocked when they discover the identity of fraud culprits. As mentioned in the details about fraud triangle ingredients, in many cases the wrongdoer is an internal team member. You may assume that someone who is established within the company, trusted by company executives and knowledgeable about company operations to be the least likely to commit fraud. But, you would be mistaken. Statistics from 2015 report that $50,000,000,000 is stolen annually by employees of U.S. businesses.
Recognizing Rationalization
Rationalization is used to placate the offender’s feelings of guilt or criminality. He or she thinks what they did isn’t so bad because the company has an overflow of money and it’s not like anyone was really hurt. An employee may also think illegally obtained funds and resources are owed to them because they feel undervalued and underpaid. Many times the individual considers the theft a loan because they fully intend to repay what they stole. Think back to any less-than-optimal decision you’ve ever made. Usually, the more harum-scarum the decision, the more you had to talk yourself into the wisdom of going down that rocky road. Employees go through the same process to justify fraud — at least to themselves.
Among smaller clients, the employee’s rationale is usually that he works harder than the owner. In the employee’s eye, the owner is vastly overpaid, and, therefore, a little fraud on the part of the employee levels the playing field. A major red flag of rationalization on the part of management is firing or forcing an auditor to withdraw from the engagement. When the company starts telling the auditor how to do the job, that’s the ultimate in rationalization.
Here are some other common rationalizations:
Ø “I’m just borrowing the money.” This one tops the list. The employee sometimes does have the best of intentions to replace the stolen funds. However, there’s a snowball effect. The longer the employee gets away with the fraud, the more casual she becomes about the situation. The fraud usually escalates to the point where the employee is unable to pay back the stolen money.
Ø “They done me wrong.” Some event, such as being passed over for a promotion, leads the employee to feel that taking home company assets is his right.
Ø “There’s no other way to manage my problems.” The employee believes he’ll lose everything dear to him, including his home and family, unless he steals the money.
The following graph obtained from ACFE (Association of Certified Fraud Examiners) provides a breakdown of the most recent employee fraud statistics.
2016 ACFE Report to the Nations
Types of Fraud
Types of internal fraud include, but are not limited to:
o Skimming,
o expense reimbursements,
o check tampering,
o billing,
o corruption,
o payroll,
o register disbursements,
o misuse of resources,
o larceny and financial statement.
Not only does fraud occur at the hands of internal miscreants, businesses must also beware of those lurking on the outside. They too look for opportunities to alleviate personal pressure. Ergo, circumstances frequently lead them to commit fraud against businesses. In a previously discussed fraud triangle scenario the vendor who submitted fraudulent invoices would be considered an external perpetrator. Other types of fraud committed by outsiders include, but are by no means restricted to:
o check fraud,
o executive impersonations,
o data breaches,
o IP (Intellectual Property) theft and account hacks/takeovers.
For instance, executive email account hacks continue to be a widely used tactic by external fraudsters. Due to email account manipulation, I’ve personally investigated wire fraud cases with losses exceeding $250,000.00 for a single event. On August 12, 2016 Leoni , one of the world's largest cable manufactures announced that they had been victimized by a single cyber fraud event which cost them 44 million dollars.
Steps Businesses and Organizations can Take to Mitigate Fraud Burns
All organizations have inherent risks. That's just one of the casualties of doing business. However responsible operations have a duty to detect and extinguish fraud when possible by being aware of pressures and how they relate to the company's overall fraud risk, by applying strong internal controls and by promoting a culture of upstanding ethical behavior throughout the organization.
Ø Segregation: Implement separation of duties for employees.
Ø Control: Implement dual controls or a solid checks-and-balance system.
Ø Vacation: Require employees to take vacation.
Ø Audit: Conduct thorough audits periodically.
Ø Culture: Set up a fraud hotline or at least install an open-door culture so employees feel comfortable addressing issues or concerns.
Ø Risk-based Control: Make sure that proper controls are in place by limiting authorizations and access based on necessary employment responsibilities.
Ø Governance, Risk and Compliance: Implement and publicize policies & procedures regarding fraud detection and disciplinary measures
Ø Monitor employees for discrepant behavior or lifestyle, which is often the first red flag that something is awry.
Ø Be mindful of the information provided on websites, brochures, social media and etc. Proprietary data is often obtained from these sources and is used to commit fraud.
Ø Monitoring: Consistently use fraud monitoring, detection and analytic software.
Ø Employ or become familiar with reputable IT professionals.
Ø If possible, use a post office box, which is more secure than a free standing mailbox.
Ø Develop a secure procedure for outgoing and incoming mail.
Ø Awareness: educate employees about securing confidential company data and workstations.
Ø Implement specific procedures regarding responding to executive email requests to disburse funds. Some type of authentication and confirmation process should be included.
Ø Make sure team members use secure passwords, change them periodically and do not share them internally or externally.
Ø Passwords: immediately change default passwords for product software used within the company.
Ø Limit outsourcing: vendor access credentials to company systems as much as possible.
Ø Data Protection: take advantage of fraud protection banking products such as:
- Positive Pay,
- ACH Monitor,
- Paperless Statements,
- Account Alerts, and etc .