In one of his early short stories, F. Scott Fitzgerald famously wrote: “Let me tell you about the very rich. They are different from you and me.” Years later, when he recounted the line in a short story of his own, Ernest Hemingway added the equally famous reply, “Yes, they have more money.”
Hemingway’s retort playfully ignored Fitzgerald’s point, which was that the wealthy tycoons of the Jazz Age viewed the world in a way that was fundamentally different from their contemporaries’ view.
Today, a similar point can be made about another group of individuals who are much more sinister and even less understood: white-collar criminals. It’s not that they simply have (or want) more money — they actually think in ways that differ from their more trustworthy peers.
All too often, boards and management fail to grasp this fundamentally different world view as they carry out anti-fraud efforts. Most board members and executives do not think as fraudsters do — which is a good thing, of course. Unfortunately, this can also make it difficult for them to develop controls that reduce their organizations’ exposure to fraud risk.
The challenge has been summed up succinctly by Sam Antar, onetime chief financial officer for the electronics chain Crazy Eddie, who was convicted of fraud and served time in prison in the 1980s. Today, he lectures regularly to the government, law enforcement, corporate groups and students about how to prevent white-collar fraud, Antar often points out, “My normal at Crazy Eddie was not your normal.”
By understanding how a fraudster’s normal differs from theirs, executives, managers and board members can develop more effective anti-fraud programs that take into account the behavioral and environmental factors that are common in cases of white-collar crime.
Behavioral Elements of White-Collar Crime
What type of person commits fraud on a large scale? By taking a closer look at executives who perpetrated massive fraud at corporations like Enron Corp. and Worldcom Inc., it is possible to identify a pattern of behavioral elements that are common to white-collar criminals. They include:
Lack of a Moral Compass. All organizations rely to some extent on individuals’ moral compasses to guide behavior in the workplace. Moreover, as much as corporations would like to maintain a separation between the personal and professional lives of their employees, the two are linked when it comes to ethical behavior. A pattern of questionable personal lifestyle choices — in areas such as spending or salacious conduct, for example — can indicate an individual’s lack of moral compass.
Troubling Friends, Family and Relationships. To help them in their crimes, fraudsters often look for people who share the same social background or ambitions or who are gullible and easily manipulated. In his 2005 book, Sarbanes-Oxley and the Board of Directors: Techniques and Best Practices for Corporate Governance, Scott Green notes: “Those who are willing to commit fraud recruit from the corporate employee pool weak or needy personalities, and go to lengths to reward and protect them.”
Deception. Deception and cover-up are the hallmarks of white-collar crime. A 2010 working paper by the Rock Center for Corporate Governance at Stanford University found that the language used by executives often contains clues to deception. Researchers studied the words of executives at companies that later had to restate earnings, a frequent occurrence after fraud detection, and identified some key indicators of possible deception.
For example, they found that deceptive executives tend to disavow ownership by using words like “the company” or “the team” when they talk about their company, rather than saying “I.” Such executives also emphasize extreme positive emotions, using words such as “fantastic” instead of merely “good” or “solid” to mask mediocre performance, and often answer questions indirectly with short, prepared statements before redirecting conversation.
Arrogance. After interviewing former Enron CEO Jeffrey Skilling, Dr. Archelle Georgiou summed up the man in a 2010 Fortune magazine article: “Was he arrogant? Yes. But that’s not a surprise. After all, arrogance springs from the same well of confidence that led him to the big chair at Enron.”
When confidence and pride grow into true arrogance, it can indicate an attitude of superiority and entitlement — and the sense that corporate policies and procedures simply do not personally apply.
Cleverness and Creativity. Businesses naturally seek out clever and creative people. Unfortunately, like confidence, these traits that make executives successful can also be associated with dishonesty and unethical behavior.
The authors of a recent Harvard Business School working paper concluded that creative people are motivated to think outside the box and are well-suited to change — two characteristics that also allow them to reinterpret their behavior and rationalize their moral transgressions. While companies need smart, savvy people on the payroll, appropriate controls must be in place to keep creativity flowing in a positive direction.
Environmental Elements of White-Collar Crime
In addition to identifying individuals who may be more likely to commit fraud, it is also important to identify the settings in which fraud is more likely to occur. In his white-collar fraud presentations these days, Antar recounts the Crazy Eddie corporate culture, infused by tight family ties that aided and abetted his illicit activities.
It was, according to the former CFO, an environment that promoted fraud from within and tried to keep as much money as possible within the family (as opposed to going to the government or investors who weren’t family members).
An organization does not need to be as free-wheeling as Crazy Eddie to be vulnerable to white-collar fraud. The cultural or environmental characteristics that increase fraud risk are not always so blatant. They include:
Weak Tone From the Top. “Tone from the top” refers to a collective message from senior management that enhances the ethical fiber of the organization and the moral backbone of staff members. Leadership that doesn’t support a rock-hard ethical and moral ideal — and doesn’t lead by example with strong character and evident values — can leave the organization exposed to fraudulent behavior.
Interacting and regularly listening to and testing senior management, management and employees by asking probing questions can help to determine whether the tone from the top is resonating throughout the organization.
Vulnerable Culture. Although criminals are unlikely to be deterred by moral constructs or an ethical corporate culture, such an environment can help encourage co-workers to blow the whistle on crime rather than allow criminal activities to go unreported.
An ethical culture is also the foundation of good corporate governance and arguably the most powerful control in any organization. Training, coupled with regular surveys of employees, can help management determine whether the culture of the organization is bedrock or sand.
Loose Links Between Ethics and Compensation. Compensation structures can have direct social and moral effects, which is why executive compensation is a critical corporate governance issue that must be overseen closely. Compensation structures that do not include an ethics component can encourage the wrong types of behavior.
For example, a large pay increase that is tied to unreasonable performance targets could help an individual to rationalize unethical and excessive risk-taking. Stock options, profit sharing, bonuses, executive retirement benefits, severance policies and other perks should be aligned with a corporate commitment to ethical behavior.
It is important to note that the existence of any or all of these elements does not necessarily mean fraud is occurring. It does mean, however, that management needs sound internal controls to deter any inappropriate behavior and detect patterns of inconsistencies in order to get at the truth if the controls are overridden.
Formal Risk Assessment
In addition to establishing an ethical environment, board members and management must also take the lead in implementing and maintaining a formal fraud risk management program. One key element of such a program is a fraud risk assessment, which should be updated annually at a minimum or more frequently if conditions warrant.
The risk assessment should identify fraud schemes that could potentially occur, possible concealment strategies that could be used by the fraudster to avoid detection, the individuals or gatekeepers who pose the highest risk of committing fraud, controls that are in place to deter or detect fraud and a list of warning signals or red flags that can be used to educate the organization and assist the internal auditor in designing risk assessment procedures.
These red flags can be organized into four general categories:
1. Data
• Transactions conducted at unusual times of day, on weekends or holidays or during a season when such transactions normally do not occur;
• Transactions that occur more frequently than expected — or not frequently enough;
• Accounts with many large, round numbers or transactions that are unusually large or small; and
• Transactions with questionable parties, including related parties or unrecognized vendors.
2. Documents
• Missing or altered documents;
• Evidence of backdated documents;
• Missing or unavailable originals;
• Documents that conflict with one another; and
• Questionable or missing signatures.
3. Lack of Controls
• Unwillingness to remediate gaps;
• Inconsistent or nonexistent monitoring controls;
• Lack of clear management position about conflicts of interest;
• Inadequate segregation of duties;
• Lax rules regarding transaction authorization; and
• Failure to reconcile accounts in a timely manner.
4. Behavior
• Rationalization, changes in behavior, contradictory behavior or recurring negative behavior patterns;
• Lack of stability;
• Inadequate income for the individual’s lifestyle;
• Resentment of superiors and frustration with job;
• Emotional trauma in home or work life; and
• Undue expectations from family, company or community.
Implementing Controls
In meeting its responsibility to identify gaps and develop fraud controls, management must take special care to avoid complacency. Don’t assume that if fraud occurs “the auditors will catch it.” Using the external auditor as a control is not acceptable. By the time the external auditor uncovers fraud it is usually too late to prevent significant financial damage, and almost always too late to prevent the reputational damage that will follow.
Following are some important principles to keep when developing more proactive anti-fraud control policies:
An Effective and Empowered Audit Committee is Essential. The committee should be completely independent from management and authorized to hire outside counsel and other advisers. At least one audit committee member should be an audit committee financial expert, but individuals with nonfinancial skills and expertise are also needed to provide different perspectives.
Establish and Enforce a System of Effective Controls, Both Internal and External. Internal controls limit opportunities to hide the fraud trail and can discourage all but the most arrogant fraudsters. Common tools include security and access controls, such as dual authority or monetary authorization limits, as well as audits, inspections and transaction monitoring.
Establish the Right Tone From the Top. Although mentioned before, this principle bears repeating. Mere mechanical compliance with internal controls can still leave the organization vulnerable, which is why the attitudes and actions of management are so important.
Actively and visibly promoting an ethical environment that resonates throughout all levels of the organization will embolden honest employees and encourage self-policing.
Provide a Clear Process for Reporting Suspicious Behavior. In its Report to the Nations on Occupational Fraud and Abuse: 2012 Global Fraud Study, the Association of Certified Fraud Examiners found that tips were responsible for uncovering nearly three times as many frauds as any other form of detection, including management reviews, surprise inspections, audits and surveillance devices.
Even without a formal whistle-blower program or ethics hotline, employees should be familiar with corporate protocol so they know where to turn if they suspect fraud.
Document Ethics Initiatives at All Levels. Informal conversations, even frequent ones, are not enough. Boards and executives should schedule and fully document discussions related to ethical issues, while also implementing effective internal controls and a proactive risk assessment policy. Board members should also be required to complete a conflict-of-interest statement annually.
Develop a Response Plan in Case Deterrence Fails. In spite of everyone’s best efforts, fraud still can occur. Often the initial reaction of executives or board members is to confront the suspected fraudster outright or, if there is doubt, to begin collecting paper or electronic evidence. Perhaps the most common impulse is to dismiss the offender, limit the damage and hope the story can be kept quiet.
All too often, these are exactly the wrong things to do and could compromise an organization’s ability to prosecute. Word almost always gets out eventually, and the associated rumors are likely to cause even more reputational damage.
What’s more, the protocol for dealing with an employee suspected of cheating on an expense report is different from that for an executive involved in falsifying financial statements. To avoid various unintended consequences, every organization should develop appropriate strategies — in advance — for dealing with specific types of fraud or other misconduct.
A Matter of Ethics — And Good Business
Ultimately, strong ethics are also good business. An ethical climate can improve employee morale, recruitment and retention, as well as instill a more positive environment that fosters creativity and innovation. Companies with a reputation for fairness and integrity also are more likely to have loyal customers and suppliers — and to attract investors as well.
By establishing an environment in which ethical behavior is expected — and by understanding how white-collar criminals look at the world differently — it is possible to begin closing the gaps in internal controls, develop a proactive fraud risk assessment and response program and significantly reduce the financial and reputational risks associated with fraud.
Jonathan Marks, CPA, CFF, CITP, CFE, is a partner with Crowe Horwath LLP in the New York office.