

figures bode favorably upon companies
that have cultures of reporting and robust
whistleblower or hotline programs. Other
detectors of fraud include management
review (22%), accidental discovery (14%),
internal audit (14%), suspicious superi-
ors (10%), or some combination of the
foregoing.
What Risks Does Employee Fraud Present?
Employee fraud presents obvious financial
risks such as missing money or disappear-
ing assets. Almost 42% of the fraudsters
studied by the KPMG investigators in
Global Profiles of the Fraudster
cost their
companies at least $1 million. Businesses
must also take into account costs associ-
ated with investigating, remediating, and
litigating disputes and regulatory issues
stemming from the fraud. “When a [major]
corporation is caught in a government
investigation, the legal fees can quickly
exceed $100 million—and that’s before the
lawsuits even begin.” Peter J. Henning, The
Mounting Costs of Internal Investigations,
NewYorkTimes
(Mar. 5, 2012). Even small
businesses can experience relatively large
legal and investigation costs associated
with fraud.
Employee fraud also presents repu-
tational risks, sometimes referred to as
“organizational stigma.” According to
The
Scandal Effect
, Harvard Business Review
(Sept. 2016), “[o]ther organizations may
sever relationships with them or try to
take financial advantage of the situation”
and they may be “mocked in the media,
have their charitable donations rejected, see
employee morale plunge, and experience
an exodus of talent.”
The directors, executives and other
managers of multi-owner businesses face a
unique set of liabilities. Management owes
a fiduciary duty of care to shareholders,
partners and LLC members. These duties
translate directly into “oversight” respon-
sibilities. Not every employee fraud will
result in liability to management. How-
ever, where management “utterly failed to
implement any reporting or information
system or controls” or, having done so,
“consciously failed to monitor or oversee
its operations thus disabling themselves
from being informed of risks or problems,”
liability may attach.
In re Huron Consulting
Group, Inc. Shareholder Derivative Litig.
,
2012 IL App (1st) 103519 103519, ¶49,
971 N.E.2d 1067, 1083.
Frauds involving customer funds or
information involve additional litigation
risks. For example, when executives at
futures commission merchant MF Global
were accused of having misappropriated
customer funds to cover bad proprietary
bets, the company faced an onslaught
of litigation from regulators such as the
Commodity Futures Trading Commission,
customers whose funds were misappropri-
ated, and shareholders demanding to be
made whole by management. Likewise,
when Home Depot suffered a cyber breach
involving customer information, it was
faced with class action litigation and had
to fund a $13 million settlement and the
costs of credit monitoring for impacted
customers.
What Role Do “Internal Controls” Play?
“Internal controls” broadly refer to a
company’s system for protecting company
assets, whether financial, physical or intel-
lectual. The types of internal controls are
unlimited and can be tailored to the size
and nature of the business at issue.
One universal truth, however, is that
weak internal controls are a significant
contributing factor to employee fraud.
According to
Global Profiles of the Fraud-
ster
, 61% of fraud is the product of weak
internal controls, and another 11% is the
product of collusion circumventing good
internal controls.
Obviously, the more complex the
organization, the more complex the inter-
nal controls. These controls should be
designed by taking into account universal
guidelines such as those contained in the
Internal Control--Integrated Framework
published by the Committee of Sponsoring
Organizations of the Treadway Commis-
sion. However, simply designing controls
won’t be sufficient, as an organization must
regularly test and assess the effectiveness
of its control environment: this is critical
for maintaining an effective mechanism to
assist with preventing and detecting fraud.
Even small businesses can implement
controls that help prevent and detect
employee fraud risk. For example, busi-
nesses that receive payments by cash or
check should not have the employee who
receives payments also record the transac-
tions in the books or reconcile accounts.
Rather, separate employees should be desig-
nated or, at minimum, the business should
have a high-level manager or owner directly
28
JANUARY 2017