The high risks of Corona on fraud
The high risks of Corona on fraud
Due to the COVID-19 crisis and the measures that governments and companies have taken, a significant increase in fraud risks becomes apparent. The main reason being an extremely vulnerable control environment.
In this article we look into the different risks based on three components of fraud: Pressure, Opportunity and Rationalization.
Everybody is looking to the right, where Corona is, while fraud is happening on the left. Management is focusing on limiting the impact of Corona on the daily business routines. As a result, little to no time is allocated to monitor relevant key risks. This leads to blindness for weak spots in the business' processes. Over the last couple of days large and smaller companies have instructed their employees to work from home. This creates a number of opportunities for increased fraud risks, such as:
- Deviation from checks and controls normally included in the process. Regular procedures and checks on possible breaches of regular control frameworks are interrupted. This becomes even more at risks in case of internal restructuring of processes or temporary capacity problems.
- Increased caution is required regarding the already proven effective methodology of "CEO fraud". More meetings and agreements will be handled via phone and e-mail. Means that can be easily manipulated, as we learnt from cases in the past. Look for example at the 19 million fraudulent payment done by Pathé Cinemas.
- A reduction in physical control of assets. Is what is indicated to be in stock actually available? If this is controlled by less employees than under normal circumstances, this could result in the lack of physical checks.
Over the last few days stock markets and companies have taken a hit based on the uncertainty of the impact of the COVID-2019 virus. A decrease in demand due to companies delaying orders, reduction of the production in factories and postponing investment decisions, have a direct impact on the local and international economies. As a result, for companies that fear difficult financial times contain a higher risk of management override of controls. Pressure can lead to manipulation of the financial results. For instance either to comply with bank covenants (1) or to be eligible for governmental fund regulations (2):
- We see banks are allocating more staff to their special management department (the department handling accounts that experience credit problems). This leads to more pressure on companies to show that they are in control, they have sufficient working capital and can survive a long period of uncertainty. Many companies are already facing a decline in their order books. Employees are not able to work but still need to be paid. In times of financial stress, banks will closely monitor covenants of their clients that are under financial duress and this puts severe pressure on management. On top of this, budgets and financial planning made based on pre COVID-2019 scenario's might lead to liquidity issues.
- Governments are creating facilities that might possibly impact the way companies are reporting their current financial situation. One of the examples is the measure the Dutch government has taken to allow companies to delay the payment of taxes until a later moment, when certain conditions are met. This might lead to an incentive to fraudulently present company figures in a way to meet criteria.
When the tension is high and much is uncertain, deviant behavior is easily justified. One example is the extreme hoarding of mouthpieces and medicines. Hospitals in multiple parts of the Netherlands have recently centralized their supply of medical resources in an attempt to stop the 'disappearance' of these items. Another example is the large purchase of toilet paper, medicines and hand sanitizer by consumers who fear an overall shortage. Even when governments specifically request citizens not to stock up on products.
Examples of companies taking advantage of the situation popped up quite quickly too. The FDA and the FTC last week identified seven companies that were marketing illegal, unapproved drugs and making deceptive or scientifically unsupported claims. In the first days of the outbreak, many small companies popped up offering mouth masks for extreme prices.
The rationalization effect on management level is often a result of trying to keep the company afloat. Management rationalizes: "in this difficult times I have many employees and their families to protect therefore unprecedented measures are for once allowed" or "if we shift some result between periods we will not breach our covenants, we will resolve this on a later moment when the crisis is averted".
A reversed effect is also often shown in crisis situations. Because everyone is focusing on the crisis, this is used as an excuse to make unfavorable decisions (restructuring, discontinuing the production of certain products). Employees or staff are paying less attention. Or the measures are labeled as unforeseen necessity: we have to act to save the company.
So how to protect your company from these high risks?
An important measure not to be underestimated, is to follow-up on suspicions of fraud and investigate. The tendency of companies in crisis situations is to keep looking at the right when a quick and thorough investigation can help reduce the (financial) losses. As a valuable by-effect, investigating results in lessons learned on how to improve the robustness of your procedures.
Following our experience, we know the next elements can help you protect your business from fraud risks:
Changes in capacity
- Are employees able to perform their tasks from a remote location without loss of efficiency or encountering physical constraints?
- Are key controls in the primary processes covered?
- What additional controls should be considered regarding exposure to external influences?
- Is there sufficient IT capacity to facilitate the tasks that are usually handled offline?
- How is the performance of checks and controls monitored when employees work from home?
- To prevent information loss when employees work in shifts, is there an information log?
In- & Outside risks
- Is there sufficient awareness for external manipulation in processes? E.g. CEO fraud, fraudulent invoices, standard encrypted file transfer locations, verification of email recipients/senders.
- Is there a standardized way of working from an external location?
- Does a decrease in available employees lead to an increased risk of misappropriation of assets?
- How is the performance of the company and is there an additional risk arising from the current situation?
- Are there significant deviations from original budget and forecasts?
- Are there profit warnings/ unexpected losses/ order cancellations/ risks of covenant breaches?
- Is the company eligible for facilities provided by the government?
- Does the company increase prices or facing increased prices from suppliers?
In short, this is the moment to reflect on your fraud risk management system and review its robustness in the current situation. For a quick overview of the weaknesses and possible blind spots in your current (crisis) processes and procedures, including recommendations on how to mitigate these risks, please feel free to reach out. We perform a thorough and in-depth review, working remotely.
Do not hesitate to contact Heleen Hoynck Van Papendrecht.
© 2021 KPMG N.V., een Nederlandse naamloze vennootschap en lid van de wereldwijde KPMG-organisatie van onafhankelijke ondernemingen gelieerd aan KPMG International Limited, een Engelse vennootschap “limited by guarantee”. Alle rechten voorbehouden.