Anti-fraud controls cut significantly into losses, new report finds

The presence of anti-fraud controls such as management reviews and telephone hotlines can greatly reduce the damage done by fraud schemes. And the use of such controls is slowly on the rise.

Those are two of the trends identified in the 2016 Report to the Nations on Occupational Fraud and Abuse, released Wednesday by the Association of Certified Fraud Examiners. The biennial report, which is based on thousands of fraud cases reported by fraud examiners worldwide, provides a detailed look into how fraud is being perpetrated, detected, and combatted in various industries and regions.

Fraud takes a significant toll on organizations. The fraud examiners who participated in the survey estimated that the typical organization loses 5% of revenues to fraud in a given year. The losses caused by fraud reported in the study totaled more than $6.3 billion, an average loss of $2.7 million per case. That average was boosted significantly by the 23.3% of cases with losses of $1 million or more. The median loss was $150,000.

The type of fraud most often reported was asset misappropriation, which took place in 83% of the cases but caused the smallest median loss at $125,000. In contrast, financial statement fraud was the culprit in less than 10% of cases but caused the biggest median loss at $975,000.

Anti-fraud controls appear to limit damage

Fraud schemes executed at organizations that implement anti-fraud controls continue for significantly less time and inflict much smaller losses, the study found. For instance, at organizations that engage in proactive data monitoring and analysis, fraud schemes last a median of 12 months, causing a median loss of $92,000. At organizations without that control in place, the median scheme lasted 24 months with a median loss of $200,000.

The 54% reduction in median loss experienced by organizations with proactive data monitoring and analysis was the largest among the 18 types of controls tracked in the survey, but all but one (external audit of financial statements) saw losses at least 36% smaller. In addition to proactive data monitoring, two other controls (management reviews and hotlines) reduced losses by 50% compared with those suffered by organizations without those controls.

Organizations seem to be getting the message that anti-fraud controls can limit the duration of and damage caused by fraud schemes. The percentage of organizations using hotlines, for example, topped 60% in 2016, up 9 percentage points since 2010. Organizations also increased their use of fraud training for employees (51.6%, up from 44%), anti-fraud policy (49.6%, up from 42.8%), and codes of conduct (81.1%, up from 74.8%).

Small organizations at most risk

Organizations with fewer than 100 employees were the most likely to suffer from fraud in the study, representing about 30% of the cases reported. The median loss suffered by those firms was $150,000, the same as those suffered by large organizations (10,000 or more employees) and more than organizations with between 1,000 and 10,000 employees.

Small organizations are particularly vulnerable to fraud because they have fewer resources to withstand losses. Small organizations also are much less likely to have anti-fraud controls in place than larger organizations. For example, while nearly three-quarters of organizations with 100 or more employees have hotlines, only about a quarter of small organizations do.

—Jeff Drew (jdrew@aicpa.org) is a JofA senior editor.