How not-for-profits can combat fraud

The nature of not-for-profit organizations can make them vulnerable to fraud.

Not-for-profits often have religious affiliations, and their missions often are to do good for less fortunate people. This do-good culture can make not-for-profits susceptible to placing a greater trust in their employees than for-profit businesses.

“Trust is not an internal control,” warned Gregory Capin, CPA, a partner at CapinCrouse LLP in Atlanta.

“As soon as there is unbridled trust, the environment is ripe for illegal activity,” said Nancy Young, CPA, a senior manager with the business assurance services group at Moss Adams in Portland, Ore.

Capin and Young spoke last week at the AICPA Not-for-Profit Industry Conference in Washington, where fraud was a frequent topic of discussion. Problems not-for-profits encounter include:

• Low pay in the not-for-profit sector can cause employees to rationalize fraudulent behavior because they may think they could make more money at a for-profit company and therefore feel entitled to compensation that is not rightfully theirs.
• A lack of segregation of duties, which is an important preventive control, because staffs can be small and resources scarce.
• Accounting systems that don’t have robust abilities to limit access of employees to functions that are related to their own duties.
• Susceptibility to management override of controls.
• Reluctance by management to implement appropriately severe corrective controls because of a culture of forgiveness that can exist at not-for-profits.

These factors—as well as the trust factor—mean that not-for-profits need to be especially attentive to the topic of fraud.

“That’s the thing that we would preach, that you need to be more vigilant to protect the people, to protect the organization, to protect the reputation,” Capin said.

The absence of preventive controls such as segregation of duties means detective controls are especially important at not-for-profits, according to Young. Detective controls she recommends include:

• Exception reports. Review payroll to see who was paid this period who wasn’t paid last period, and check with HR to make sure the person being paid is legitimate. Taking a close look at employees who claim more than 20 federal and state exemptions also may be prudent, Young said.
• Watching for warning signs. Employees who complain or are disgruntled; are financially needy; have close relationships with vendors or suppliers; excessively resist process changes; or work long hours and never take vacations may be exhibiting warning signs of fraudulent behavior.
• Creating an anonymous fraud hotline. Tips by fellow employees are recognized as the most frequent identifier of fraud.

Board members with extensive financial experience also can play an important part in preventing and detecting fraud. And Young recommends that CPAs who serve on boards become trained in fraud awareness.

When fraud is detected, the corrective controls are critical to preventing future illegal behavior, Young said. She said organizations that merely accept the employee’s apology and transfer him or her to another department are leaving themselves vulnerable to potential fraud from other employees who see that illegal behavior does not result in serious consequences.

Young applauded a client that discovered on a Friday that an employee was committing fraud. By Saturday, law enforcement officers were ready to go to the employee’s house to make an arrest. But management told the police to wait until 10 a.m. Monday to make the arrest. Officers came into the office and led away the employee in handcuffs in full view of the rest of the staff, making an impression unlikely to be forgotten.

Capin recommends that clients who discover fraud consult with legal counsel immediately so they can comply with laws and regulations in addition to reviewing their governing documents to determine a response.

At a not-for-profit or any other business, Young said, that response needs to send a message.

“Management needs to take a hard line and take a corrective action that hurts,” she said. “… It needs to hurt. Because if it doesn’t hurt, it doesn’t mean anything.”

—Ken Tysiac (ktysiac@aicpa.org) is a JofA senior editor.