Immediate Gains Immediate Vault Immediate Access

Detecting and Confronting Procurement Fraud

Accountancy firm Crowe and credit rating company Experian have said that large enterprises and governments experienced 59% of procurement fraud in the United Kingdom, costing them $120 billion (£89 billion) collectively. It is estimated that over $2 trillion (£1.6 trillion) total is lost each year due to procurement fraud, or 4-8% percent of an organization’s procurement spending. This figure dwarfs other areas such as corporate tax avoidance, where HMRC estimates that $94 billion (£70 billion) was avoided between 2011 and 2015.

The main difference is that procurement fraud is so varied that it makes it virtually impossible to detect. More importantly, procurement fraud is difficult to detect because it is often embedded in a genuine expense. For example, when a construction contractor submits an invoice for 100 hours of work in a week, eight of those hours may be fraudulent. This may seem negligible, but when you consider that every purchase in an organization can include an element of fraud, the scale of the problem becomes clear. It is not just about the financial loss; there are many reputational issues too.

Why Procurement Fraud? 

There are two main reasons: greed and opportunity. In terms of motive, we see both individuals and groups committing acts of fraud because they want something for themselves. They might be looking for personal gain, or trying to get away from someone else, or simply seeking revenge on a competitor.

Several studies have shown that around 50% of fraudsters are motivated by either monetary reward or benefits gained by committing a crime. For example, in 2018, a Massachusetts Bay Transportation Authority (MBTA) procurement official was indicted for receiving over $300,000 in illegal bribes and gratuities from a construction company that performed work for MBTA.

Individuals may also notice a weakness in a business process, as trivial as a broken approval process, that allows for invoices to be paid to existing suppliers without checking the outstanding purchase order amount. The problem is that weaknesses can surface at virtually every step of the procurement lifecycle, across the entire supply chain. Additionally, fraud often occurs when suppliers become close with an individual with authority inside an organization that can provide undetected access. Fraudsters see an opportunity to profit from weaknesses and begin exploiting them.

What Can Be Done?

Here are three ways to help your business become less vulnerable to fraudulent activity:

1. Use data analytics tools: Data analytics tools give you access to information about how well suppliers perform against agreed standards. You can use this information to identify potential risks early on, which could save your company millions in wasted spending.

2. Choose suppliers carefully: The larger and more complex your supply chain, the greater the risk for procurement fraud. If you buy goods and services from many suppliers, you should try to choose suppliers based on quality rather than price. Quality is not always reflected in the cost, but this means you need to be wary of the cheapest option. Using data to draw definitive conclusions about a supplier’s performance is a good way to remain objective when selecting.

3. Create a robust process: It is important that have a robust supply chain management process in place. You should be able to trace back how a supplier was added to your supply chain, the selection criteria for any awarded contracts, their ongoing financial standing, and the people involved in managing the relationship.

Six Considerations Impacting Strategic Regulatory Change Management

Regulatory change management (RCM) is one of the most important risk and compliance related domains in 2021, thanks to two key drivers. First, the shift from Republican deregulation to Democratic control and an expected uptick in regulatory requirements. Second, similar to the 2008 crash, the pandemic-induced economy and focus on Paycheck Protection Program (PPP) loans caused many banks to relax their regulatory exams and requirements, while regulators gave companies extra runway for transitioning processes and policies for remote/work-from-home models.

Sometimes regulatory changes are significant enough to change business strategy. In 2021, chief risk officers must be prepared to quickly adapt and react to a historically volatile risk management environment. When thinking about an updated, strategic regulatory change management program, here are six considerations for chief risk officers:

1. Lax compliance during the pandemic in 2020 may have introduced hidden risk for activities that normally would have had deeper oversight. 
Sometimes rule changes can also introduce new risks or eliminate a previous risk that needed to be managed, such as potential new default rates around extensions, forfeiture and other things. For example, historically low interest rates present a vexing risk for banks dealing with less profit but just as many loans to process. What kind of new risk may be found within those loans?

2. When communicating change across the enterprise, establish responsibility to manage it.
Once you understand which regulations have changed, prioritize those that present the most risk, identify what department’s products and processes are impacted, and determine who is responsible for managing those policies. Having a secure central repository for communicating, storing and managing compliance documentation, versus relying on employees storing information on devices outside corporate servers, is ideal. 

3. If conducting quarterly testing of compliance requirements, it may be challenging to identify key areas in advance that could slip, such as controls around IT/cybersecurity.
When the risk portfolio changes, the controls to manage those risks must be updated accordingly. Firms that may now be less dependent on management oversight and more dependent on confirmations that processes are being followed should put automated controls in place to verify those activities.

4. Companies should shift to best practice or common checklists that can be standardized and shared across the enterprise. 
Assessment checklists are a great way to ensure that all requirements are being met for a wide variety of business processes. Once checklists have been updated, cloud-based software systems can track who has access and can also notify when changes happen. 

5. Historically done manually in-house by visible teams, monitoring and testing for compliance purposes will be conducted remotely. 
The visibility of those tests presents significant challenges, and it is critical to determine how errors and issues will progress and be communicated to the remote testing teams, management, and the organization at large. 

6. Verifying and certifying online training for remote employees can be daunting. 
Creating courses formalized for online training represents a major compliance and process change, particularly for companies in industries with limited work-from-home models, such as financial services. Training materials will need to be updated for new employees, while previously trained employees will need to be retrained. 

Spending Risks Shift as the Pandemic Continues

When Twitter offered permanent work-from-home status to all of its 4,600 employees in response to the COVID-19 pandemic, it did so with a $1,000 stipend per employee to furnish and set up functional home office spaces.

For many organizations, such a sweeping move would carry higher risk as more employees, especially those not trained in company spending policy, would be expensing items. During COVID-19, enterprises of all sizes contend with the changing financial implications of adjusting business practices.

Data scientists at Oversight—a global leader in spending management technology—saw out-of-pocket spending increase 17% from April to May and expected this number to rise further in June as more employees without a corporate card make COVID-related expenses. These findings are published in the company’s Spend Insights Report, which analyzed information derived from customer interviews, market observations and Oversight data.  

Several Oversight clients reported finding big-screen TVs and soundbars on expense reports for work-from-home setups. Any of these could ultimately be for personal use or resold for personal gain. One client found that one of its employees spent $7,000 in corporate funds to set up a new home office space.

The months since COVID-19 forced employers everywhere to pivot their office strategies and open expensing capabilities to a broader subset of the employee base. As a result, the fundamental assumptions about spending and risk management in finance operations no longer apply.

New patterns of risk are emerging from these new transactions. However, finance operations teams that take the time to analyze these patterns can develop best practices.

Five key lessons enterprises should understand about spending risk in the 2020 business environment are:

1. Good and Bad Spending Have Reversed Roles

When the rapid shutdown of normal business operations forced the global workforce to shelter in place, travel discontinued abruptly. Airline and transportation activity plummeted in both March and April, as did hotel spending. But purchasing activity was higher than expected in the high-risk categories of mail/phone orders and miscellaneous stores (including merchants such as Amazon, Best Buy and Apple), while out-of-pocket expenditures in the name of business continuity increased dramatically. The result was a business scenario in which much of the historically “good” spending, like travel expenses, was suddenly deemed wasteful to the organization. In contrast, much of the traditionally categorized “bad spending” was now necessary.

2. The Pattern of Risk is Shifting, As is Mitigation Collaboration

Because the risk looks significantly different than it did before the pandemic, finance operations teams are applying more scrutiny to employee spending, and collaborating more. Operations teams are engaging more than ever with counterparts in forecasting, tax and audit to navigate the nuances of risk during the crisis, creating a new best practice that makes identifying and mitigating spending risk easier.

3. Rising Miscellaneous and Out-of-Pocket Costs Cause Payment Platform Risk

Third-party payments increased 40% year-over-year in April according to the Spend Insights Report, as the pandemic drove a significant increase in online shopping activity. That shift to online—as reflected in rising miscellaneous and out-of-pocket spending—was often processed using third-party payment platforms like PayPal and Stripe. When employees spend using these platforms, organizations are exposed to greater risk due to limited visibility into transaction and vendor data.

4. New People Spending is New Risk

Regardless of COVID-19’s impact on an organization, one good rule is that risk is a function of people. According to Oversight data, 70% of employees are good stewards of corporate funds. An additional 25% may make errors or act out-of-policy in certain circumstances, but these individuals are not intentionally involved in waste or fraud. The remaining 5% of employees could use opportunities like COVID-19 to spend maliciously or otherwise act outside of corporate compliance guidelines. Every organization’s goal should be to engender visibility into the 5% of bad actors, while simultaneously seeking to better inform the remaining 25% about the steps they can take to adhere to policy. 

5. Align your Teams and Tools to Ensure Visibility into Spending

By quickly understanding as an organization what employees are spending on today, and at what frequency, leaders will be better suited to manage and mitigate risk. While the profile may be different than before the pandemic, the same tools that guided visibility into spending and risk are available to help organizations understand and analyze spend in the new business climate.

The situation at most organizations is fluid. The essential take-away is to develop a framework and process for near-real-time awareness of employee spending and the associated risks. By recalibrating your sense of the necessary expenditures now, organizations can ultimately ensure continuous control over risks as they emerge.

Putting Risk Management on the Front Line

Businesses in India expressed an overwhelming desire to approach risk management more strategically in this year’s Excellence in Risk Management India report, with 68% of respondents deeming “integrating risk management into strategic planning” their top priority. Today, managing risk intelligently is everyone’s responsibility—not just the company’s executives—and the question of how to enable risk management at the front line of defense (FLoD) was a key theme for Marsh’s “Enabling the First Line of Defense” panel discussion at the RIMS Risk Forum India 2019. Consistently taking the initiative is key to risk management, and panelists discussed a number of proactive strategies for enabling front-line employees to address risk.

Enabling the First Line of Defense

As risk responsibilities move to the front line, organizations will need to review how their risk framework can be adapted. To equip everyone to confidently handle risk, risk management needs to be more intuitive. Data and analytics can also play a significant role in making the process more collaborative, measurable and strategic. Backed by technology, many firms are now not only able to prevent downside risks, but have capitalized on new markets, opportunities and changes in demand.

Panelists expressed that risk management was not a priority for frontline staff like sales executives, who are more likely to be encouraged to meet sales KPIs. Reflecting on his time within financial services, panelist Sudip Basu, Hinduja’s group head of risk, said that during peak times, risk was not an important consideration, and rarely outweighed more immediate profit and success motivations. Of course, self-examination happens during down-turns, which the sector has experienced over several tumultuous decades, both in India and globally. Basu said that this was definitely the case after the global financial crisis.

Bake Risk Management into KRAs

One key activity that the panelists flagged was baking risk management into key responsibility areas (KRAs) so that risk management messaging cascades down to the front line and into business activities. However, the panelists also expressed concern about the level of monitoring being implemented alongside these KRAs, stressing the need for follow-through on good intentions and highlighting this as an area of development needed for success.

Celebrate Successes

Celebrating success is far from an unfamiliar concept, though firms may need to address how success is measured and at what level. According to panelist Jyotsna Sharma, Bridgestone India’s chief financial officer and head of IT, firms are very good at celebrating risk management successes at the senior levels, but not as good at recognizing it for front-line teams. Sharma said that it would be beneficial to build in small acknowledgements for front-line teams and employees who have done exceptional work, have been proactive or have demonstrated risk management best practices.

Acknowledge Incremental Gains

The panelists also stressed the importance of incremental gains. A  change in the front line’s perception of risk management is not likely to happen overnight. If only key milestones or large events are recognized, it could be harder to gain buy-in and ongoing support from teams on the ground. Much like celebrating wins achieved by the FLoD, acknowledging incremental gains helps the team to view the journey to success as a process, and could help FLoD initiatives to more easily gain momentum.

While the FLoD is traditionally associated with operational management, as risks grow increasingly complex and interrelated, risk management is no longer only the purview of control functions, particularly when major influences from regulatory and broader economic environment exist. Ensuring that there is adequate awareness of risks—while rewarding successes across various levels of the organization—is critical for organizations to cope with risk in the current business environment.