x

A PHP Error was encountered

Severity: Notice

Message: Undefined variable: content_category

Filename: user/transcript.php

Line Number: 106

A PHP Error was encountered

Severity: Warning

Message: Invalid argument supplied for foreach()

Filename: user/transcript.php

Line Number: 106

Strengthening Corporate Governance: Effective Mechanisms for Reporting, Investigating and Remediating Fraud

Total Views  :   1270
Total Likes  :  0
Total Shares  :  0
Total Comments :  0
Total Downloads :  1

Add Comments
Presentation Slides

1) uStrengthening Corporate Governance: Effective Mechanisms for Reporting, Investigating and Remediating Fraud There are numerous resources available that guide those charged with governance (referred to as audit committees) toward building programs to include anti-fraud controls and cultivation of anti-fraud environments.1 When put into place and followed, these programs go a long way in the prevention and deterrence of fraud. However, even when the strongest fraud prevention programs are in place and operating as designed, fraud may still occur. This practice aid is intended to briefly cover the key elements of an anti-fraud environment and responsibilities for such with emphasis on the structure, policies and procedures that audit committees need to ensure are in place before fraud occurs and the specific action steps to take if and when alleged fraud is suspected. Let’s first dispel some common misconceptions: Myth: Handling alleged instances of fraud committed within an organization is solely the responsibility of company management. Truth: Establishing effective mechanisms for the reporting, investigating and remediating of fraud is a shared responsibility with the company’s audit committee: Section 301 of the Sarbanes-Oxley Act specifically requires the audit committee “to establish procedures for the receipt, retention, and treatment of complaints received by the issuer regarding accounting, internal accounting controls, or auditing matters; and the confidential, anonymous submission by employees of the issuer of concerns regarding questionable accounting or auditing matters.” The SEC’s interpretative guidance for management with respect to internal controls2 states: “Management’s evaluation of the risk of misstatement should include consideration of the vulnerability of the entity to fraudulent activity (for example, fraudulent financial reporting, misappropriation of assets, and corruption), and whether any such exposure could result in a material misstatement of the financial statements. Management should recognize that the risk of material misstatement due to fraud ordinarily exists in any organization, regardless of size or type, and it may vary by specific location or segment and by individual financial reporting element...” While the SEC’s guidance does not specifically address the role of the audit committee, it does note: “We would ordinarily expect a board of directors or audit committee, as part of its oversight responsibilities for the company’s financial reporting, to be reasonably knowledgeable and informed about the evaluation process and management’s assessment as necessary in the circumstances.” Additional guidance may be found in auditing literature including PCAOB Auditing Standards (AU 316) that state: “…it is management’s responsibility to design and implement programs and controls to prevent, deter and detect fraud… Management, along with those charged with governance, should set the proper tone, create and maintain a culture of honesty and high ethical standards… When management and those charged with governance fulfill those responsibilities, the opportunities to commit fraud can be reduced significantly.3 Myth: Fraud is primarily found in large, multi-national organizations. Truth: Fraud is not limited to companies of a certain size and composition. A finding of the 2010 study released by COSO, “Fraudulent Financial Reporting: 1998-2007 – An Analysis of U.S. Public Companies,”4 indicates that the companies charged with fraudulent reporting by the SEC, as represented within the study over a ten-year period, included startups with no assets or revenues as well as much larger companies. Myth: It is not possible to predict potential fraud before it happens, so creating a plan in advance to deal with suspected fraud would be a waste of time and resources. Truth: While not every instance of fraud may be predictable, companies and their audit committees are best served by gaining an understanding of fraud risk factors and establishing a plan in advance to deal with suspected fraud expeditiously if and when it arises rather than scrambling to identify and pull together adequate resources in the midst of a crisis. 1 Refer to the appendix of this practice aid for a listing of several recommended anti-fraud program resources 2 Refer to SEC interpretative release Commission Guidance Regarding Management’s Reporting on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934 available at: http://www.sec.gov/rules/interp/2007/33-8810.pdf 3 Refer to paragraphs .01-.12 of the AICPA’s Statement on Auditing Standards No. 99, “Consideration of Fraud in a Financial Statement Audit,” which is included in the PCAOB’s interim standards (AU 316) available at: http://pcaobus.org/Standards/Auditing/Pages/AU316.aspx 4 Refer to the Committee of Sponsoring Organizations of the Treadway Commission’s (COSO) 2010 study “Fraudulent Financial Reporting: 1998-2007 – An Analysis of U.S. Public Companies” available at: http://www.coso.org/documents/COSOFRAUDSTUDY2010.pdf © 2010 BDO USA, LLP. All rights reserved. www.bdo.com 1

2) Creating an Anti-Fraud Environment Building an anti-fraud environment can serve to significantly reduce the risk of fraud and increase the likelihood that, if fraud does occur, it will be detected at an early stage. Step 1: Understanding the fraud risk factors an organization faces. This requires an on-going assessment of risks along with the controls that a company has in place to mitigate those risks on an enterprise-wide basis. The activities associated with building a company’s fraud risk profile include: •  identifying susceptibility of the organization to various types of fraud (e.g., asset misappropriation, financial reporting fraud and corruption) and who is likely to commit fraud (e.g., internal - management, employees; external); •  understanding industry “red flags;” •  determining likelihood and significance of potential frauds; and •  assessing effectiveness of anti-fraud controls in place. Step 2: Setting the tone at the top with regard to the effectiveness and visibility of board and audit committee oversight. The activities associated with oversight include: •  understanding what the most significant fraud risks are and where the organization may be susceptible to pressure, opportunity and rationalization to commit fraud (“warning signs”) •  reviewing significant relevant transactions, asking difficult and probing questions, and developing alternative sources of information about what is happening in the company with respect to fraud risks •  evaluating the programs and controls that management has developed for managing fraud risks •  cultivating an ethical corporate culture by ensuring a comprehensive and accessible Code of Conduct is developed and actively supported by management and the audit committee •  independently assessing and monitoring effectiveness of the anti-fraud environment on a periodic basis. Step 3: Evaluating the organizational structure in relation to existing anti-fraud policies and procedures. The activities associated with this step rely on consideration of the: •  susceptibility of the organization structure to fraud – e.g., opportunity for management override of internal controls; locations where cultural differences may overtly or inadvertently lead to the occurrence of fraud •  effectiveness of policies and procedures designed to prevent/detect fraud – e.g., performing background investigations of newly hired employees and existing employees on a periodic basis, establishing whistle-blower hotlines, disclosure to regulatory and law enforcement authorities, and developing controls over information security and records retention •  development of protocols and procedures in advance to handle suspected fraud if and when it does occur. See CAQ Guidance section for the Center for Audit Quality’s (CAQ’s) 10 question guide for audit committees in exercising skepticism when inquiring about financial reporting fraud. © 2010 BDO USA, LLP. All rights reserved. www.bdo.com 2

3) Effective Mechanisms for Reporting, Investigating and Remediating Fraud Even when there is effective oversight and the risk of fraud within an organization is significantly reduced as a result, there is always the possibility that fraud will still occur. So, what does the audit committee need to do now to detect fraud at an early stage and be able to remediate the system of internal control and minimize damage? As required under the Sarbanes-Oxley Act of 2002, public entities are required to maintain effective whistleblower hotlines to handle employees’ allegations of financial reporting fraud. In addition to these hotlines, allegations of fraud can be identified through many other sources including external and internal auditors, consultants, customers, vendors, anonymous tips, the SEC5 and others. Regardless of the source, audit committees should demand immediate access to information supporting allegations of significant fraud occurring within the organization and give such matters the highest priority. Once suspected fraud comes to the attention of the audit committee, it should evaluate the need to conduct an independent investigation6 into the alleged fraud. Fiduciary responsibility is first and foremost! The focus of independent investigations involves the following protocols and scoping considerations and often needs to be a flexible and an iterative process. The audit committee may fulfill its responsibility by engaging investigative counsel and forensic accountants, as appropriate7: •  identify who should be involved, both within and external to the company •  define specific roles and responsibilities of individuals •  perform an initial assessment to gather evidence and determine the potential scope/magnitude of the fraud •  identify individuals to interview and conduct thorough interviews •  determine additional procedures required (e.g., computer-assisted data analysis techniques, customer calls/confirmations, etc.) •  ensure regulatory or statutory requirements are appropriately met •  evaluate results and remediate •  determine whether disciplinary actions are appropriate or criminal charges should be brought •  ensure proper disclosures are made •  document findings (how the matter arose; who was involved; who was interviewed; what other evidence was discovered; how the matter was handled; results and why certain conclusions were reached and how they were communicated) •  based upon above, take preventive measures for the future, including making enhancements to internal controls Regardless of whether an investigation is conducted in-house or is outsourced to an independent third party, the audit committee must be involved in every step of the process and must have a plan in place in advance to “triage” instances of suspected fraud to ensure that it is handled properly and handled by the right individuals. Along these lines, a best practice is to cultivate relationships with external advisors before their services may be needed. Audit committees need to be prepared to spend time and effort throughout the process, as these investigations often take on a life of their own. At the end of this experience, ensure that there is proper reflection on what went wrong and that adjustments are made to policies, procedures and controls and that education is provided throughout the organization to help prevent future recurrence. For further guidance on conducting investigations, refer to the BDO Consulting’s “Investigative Tips for the Non-Investigator” publication available at: http://www.bdoconsulting.com/resources/thought-leaders/investigative%20tips.pdf Summary Facing allegations of fraud within an organization can be a frustrating and challenging time for those charged with governance. Cultivating an ethical culture and having established policies/procedures and identified resources in advance of fraud allegations will allow those with oversight responsibility the wherewithal to react quickly and effectively to combat fraud and minimize the damage to the organization. 5 The SEC may issue a letter known as a Wells Notice to individuals or companies when it is planning to bring an enforcement action against them. The Wells Notice indicates that the SEC staff has determined it may bring a civil action against an individual or company, and provides the opportunity to the individual or company to provide information as to why the enforcement action should not be brought. 6 Refer to the Ac’senseSM November 2010 Internal Investigation program for further insight into conducting an effective and efficient internal investigation at: http://www.bdo.com/ acsense/events/InternalInvestigations.aspx. 7 Note: Many of the protocols outlined can and should be established before fraud occurs and should be considered as part of the audit committee’s creation of an anti-fraud environment. © 2010 BDO USA, LLP. All rights reserved. www.bdo.com 3

4) CAQ Guidance: Inquiring about Financial Reporting Fraud – A Guide for Audit Committees8 The following is a list of questions prepared as a guide for audit committees excerpted from the Center for Audit Quality’s (CAQ’s) 2010 report, “Deterring and Detecting Financial Reporting Fraud – A Platform for Action.” The questions were prepared by the CAQ as a starting point in order to “advance the thinking of audit committees around the most likely sources of weakness, with a particular eye for business pressures that may influence accounting judgments or decisions.” Audit committees should customize these questions further to apply to their organizations: 1. What are the potential sources of business influence on the accounting staff’s judgments or determinations? 2. What pressures for performance may potentially affect financial reporting? 3. What about the way the company operates causes concern or stress? 4. What areas of the company’s accounting tend to take up the most time? 5. What kind of input into accounting determinations does non-financial management have? 6. What are the areas of accounting about which you are most worried? 7. What are the areas of recurring disagreement or problems? 8. How does the company use technology to search for an unnatural accounting activity? 9. If a Wall Street Journal article were to appear about the company’s accounting, what would it most likely talk about? 10. If someone wanted to adjust the financial results at headquarters, how would they go about it and would anything stop them? 8 Refer to the CAQ’s report on “Deterring and Detecting Financial Reporting Fraud – A Call to Action” available at: http://www.thecaq.org/Anti-FraudInitiative/CAQAntiFraudReport.pdf. © 2010 BDO USA, LLP. All rights reserved. www.bdo.com 4

5) Recommended Anti-Fraud Program Resources9: •  BDO Consulting’s Fraud Prevention Program includes the following elements designed to assist management and audit committees in the prevention, detection and remediation of fraud: – Fraud risk assessment – Fraud education – Ethics awareness and education – Background investigations – Mechanisms for reporting and investigating fraud – Board and audit committee oversight For further information on how BDO Consulting can assist your company in forming an effective anti-fraud program, please visit: http://www. bdoconsulting.com/services/fraud-prevention-consulting.aspx •  BDO’s Ac’senseSM program includes several CPE-worthy webinars/self-study courses on the topics of ethics (e.g., Ethics and the Corporate Board) and fraud within the Focus on Fraud Series: – Internal Investigations (2010) – Focus on Fraud: Lessons Learned (2010) – Focus on Fraud: Fraud and Misconduct in the Corporate World (2009) – Focus on Fraud: The Series Continues (2009) For further information and access to archived courses, visit: http://www.bdo.com./acsense/archive.aspx The CAQ’s anti-fraud initiative site is available at: http://www.thecaq.org/Anti-FraudInitiative/index.htm. As part of this initiative, consider the CAQ’s 2010 report “Deterring and Detecting Financial Reporting Fraud – A Platform for Action,” which focuses on financial reporting fraud at publiclytraded companies of all sizes and is available at: http://www.thecaq.org/Anti-FraudInitiative/CAQAnti-FraudReport.pdf. Association of Certified Fraud Examiners’ (ACFE) Fraud Resources available at: http://www.acfe.com/resources/resources.asp The AICPA Anti-Fraud and Corporate Responsibility Center provides various tools and information to professionals in combating fraud available within: http://www.aicpa.org AICPA Fraud and Forensics publications – while aimed at CPAs, these resources may provide additional guidance useful to management and audit committees and are available at: http://www.aicpa.org/Publications/Fraud/Pages/Fraud.aspx 9 At the time of release of this practice aid, the PCAOB has announced that it is in the process of establishing the Financial Reporting Fraud Resource Center to facilitate the prevention and detection of financial reporting fraud. Its primary objectives will be to maintain and develop information related to financial reporting fraud, which can arise from a broad array of factors, including accounting and disclosure, auditing, corporate governance, insider trading, executive compensation, economic and other environmental circumstances, among other things. The Center will publish public reports on risks, and assist in developing educational materials, related to financial reporting fraud. Material discussed in this guide and related practice aids is meant to provide general information and should not be acted upon without first obtaining professional advice appropriately tailored to your individual circumstances. © 2010 BDO USA, LLP. All rights reserved. www.bdo.com 5