Limiting Fraud Losses
Respondents were asked whether the victim organizations in the cases they reviewed
had certain anti-fraud measures in place at the time the frauds occurred. The three
measures tested for were anonymous reporting mechanisms (typically hotlines),
internal audit or fraud examination departments, and external audits. The following
chart shows the percent of victim organizations that had adopted these measures at the
time of their frauds. The numbers are very similar to the results from our 2002 surveys.
Anonymous Fraud Hotlines
In order to test the effectiveness of each anti-fraud control in limiting losses, we
measured the median loss for organizations that had each control, versus the median
loss in organizations that did not. Using this
test, we found that anonymous reporting
mechanisms showed the greatest impact on
fraud losses. Organizations that did not have
reporting mechanisms suffered median losses
that were over twice as high as organizations
where anonymous reporting mechanisms had
been established. This was consistent with the
findings of our 2002 Report.
This result is also consistent with the data we gathered showing that the most common
way for frauds to be discovered is through tips. Obviously, hotlines and other reporting
mechanisms are designed to facilitate tips on wrongdoing. The fact that tips were the
most common means of detection, combined with the fact that organizations which had
reporting mechanisms showed the greatest reduction in fraud losses, indicates that this
is an extremely valuable anti-fraud resource, and gives further support to Sarbanes-
Oxley’s mandate for confidential reporting mechanisms. As was discussed earlier, the
effectiveness of these reporting mechanisms is significantly higher when they are made
available to customers, vendors, and other third parties, not just employees.
Organizations that rushed to implement employee hotlines to comply with Sarbanes-
Oxley may not have incorporated those valuable additional sources of information.
Curiously, anonymous reporting mechanisms were the least common anti-fraud measure
of the three we tested for. Only a little over one-third of victim organizations in our
study had established anonymous reporting structures at the time they were victimized.
Given the data from our study, we believe that anonymous hotlines and other reporting
mechanisms provide real, measurable anti-fraud benefits, and given their relatively low
cost compared to other anti-fraud controls, it would seem advisable for more
organizations to implement them.
Internal Audits
About 57% of the victim organizations in our study had internal audit or internal fraud
examination departments. These organizations suffered a median loss of $80,000,
compared with the median loss of $130,000 in organizations where there was no
internal audit department.
The impact on fraud losses associated with internal audits was much greater than the
impact associated with external audits (see below). Additionally, the data presented
earlier on Initial Detection of Occupational Frauds shows that schemes were identified
by internal audits at over twice the rate of external audits, despite the fact that victim
organizations in our study were more likely to have external audits. The discrepancy
between internal and external audits may be largely due to the fact that internal
auditors generally are full-time employees of the victim organization, whereas external
auditors spend a limited amount of time in a number of different organizations. In
addition, external auditors are responsible only for frauds that may have a material
impact on the financial statements as a whole. Nevertheless, the discrepancies
between the two disciplines suggest a need for greater fraud training for external
auditors, particularly given the enhanced fraud detection responsibilities imposed on
them by auditing standard SAS No. 99.
External Audits
The most common anti-fraud measure among the victims in our study was the external
audit. Seventy-five percent of victims employed independent auditors. However, the
effectiveness of external audits in reducing fraud losses was not observable in our
study. In fact, the median loss was actually higher in organizations that had external
audits, as opposed to those that did not. Of course, there are several factors that
contribute to the presence and size of fraud. But it was disappointing to find no trend
indicating reduced losses as a result of external audits (such a trend did exist in 2002).
The absence of a measurable impact as a result of external audits is consistent with the
data we gathered on fraud detection, which showed that external audits generally
ranked low – behind By Accident – as a means of catching fraud.