A Culture of Fraud Prevention: It’s Everyone’s Responsibility
23-08-2021 | treasuryXL | Kyriba |
It seems like every day there is a new fraud headline. As a result, companies are learning that preventing fraud needs to be a responsibility of all employees in the organisation. To prevent fraud, an organisation needs to focus on education through training, standardized controls, and IT policies on top of a strong technology solution.
The threat of fraud has grown dramatically in recent years. In fact, according to the 2021 AFP Fraud and Control Study, overall, 74% of companies have experienced fraud or attempted fraud. Your organisation needs to be prepared and Treasury activities need to support identifying and preventing fraud. Recently, I had a conversation with a Treasurer who said, “if it’s (fraud) not on your mind in Treasury, you’ve already lost”. He went on to talk about how much more difficult it is to manage fraud when you have a decentralized Treasury team.
Best in class fraud prevention is about having a strong overall ecosystem, culture and technology – the fabric of an organisation. Fraud prevention must be top of mind for everyone in the company. Specific training should be included in introductory orientation as well as ongoing training and annual awareness campaigns. Individuals need to be able to identify potential phishing and Business Email Compromise (BEC) campaigns to ensure they don’t become victims. It only takes one person to make a poor judgment call to allow access into a company’s system. It’s also important to consider cultural differences for offices in other parts of the world. Fraudsters are taking advantage of cultural norms. In some Asian countries it’s natural to defer to individuals with seniority. For example, receiving a message from the CFO to make a payment wouldn’t normally be questioned. Make sure that all individuals have a way to share, escalate and/or stop a transaction when there could be potential problems.
Standardised procedures are essential. With BEC, fraudsters assume that using the name and email of senior members of the management team, such as the CEO or CFO, will cause employees lower in the organisational hierarchy to do as instructed without question. To combat this, it is imperative that the procedures set up require strict adherence, and that senior management provides an environment where fewer senior members of the team are comfortable asking whether a payment is legitimate. If multiple ERP systems exist, ensure that consistent approval processes are in place across all systems. For smaller regional offices, set up procedures and approvals to ensure that separation of duties is in place and that you have visibility to the activities in remote offices. Some fraudsters like to target attacks on regional offices in hopes of bypassing some of the more stringent processes that are in place at headquarters.
Having an IT focus on fraud prevention and policies that support these efforts is also essential. IT should ensure that employees are password protected and that their passwords aren’t easily guessed. They should maintain strong firewalls and keep current on technology to identify potential hacker activity. In addition, it is helpful to randomly test employees with phishing emails to assist employees in recognizing fraudulent emails.
Finally, technology solutions to identify fraud are a critical component of fraud prevention. Solutions should include rules-based fraud detection that identifies multiple scenarios, for example situations where a vendor bank account number has changed. These transactions should be flagged and sent for validation. An individual should call the company using a phone number that is listed in the system of record. Or, the transaction should be sent for account verification allowing for confirmation that the bank account is owned by the organisation that is to be paid, and not some fraudulent entity. Account verification is a new tool that is being added to rules engines. It allows you to increase your confidence that the account is owned by the entity with which you have a relationship without having the time-consuming process of having to reach out to the entity directly to verify. The verification is quick and doesn’t slow down legitimate payments. Your fraud technology solution should also identify other fraud situations that you and a community of your peers have experienced or considered.
Machine learning to identify payment anomalies based on transaction history is also critical. It allows for patterns to be identified in the immense amounts of transactional data that your organisation has accumulated and then to match that in real-time to your specific transactions to identify potential fraud. This added layer of protection looks for behaviours that may not be identified by the human eye – timing of invoice receipt or change in the frequency of payment requests. The system continually adapts based on the information that it is tracking and provides suggestions when it identifies potentially fraudulent behavior.
Fraudsters continue to attack since they only need to find that one weak link on one day with a single person in your organisation. It’s up to you to make sure that the individuals in your company are prepared for the attack. Ensure that you have a training program that helps your employees identify potential fraud attempts. Define, monitor and enforce policies that support segregation of duties and consistent processes throughout the organisation. Confirm that your IT department is staying on top of technology that identifies and prevents hackers and supports best practices when establishing policies across the organisation. Last, but certainly not least, make sure that you are utilizing best-in-class technology to identify potentially fraudulent payments to stop those payments from going out your door. Some treasury solution providers use the terminology fraud detection tools to refer to having sanction screening or workflow tools in place while others notify you of a fraudulent item after the transaction is sent to the bank. A best-in-class technology solution combines workflow tools and approvals in addition to a robust rules engine and machine learning to identify potentially fraudulent transactions in real-time. Giving you an opportunity to stop any transaction before it leaves your organisation.
Preventing fraud is something that everyone in your organisation needs to commit to in order to prevent fraudsters from being successful.
