Share This on Linked In

Editor’s Note: This post is from regular contributor Norman Katz, Sourcing Innovation’s resident expert on supply chain fraud and supply chain risk. Catch up on his new column in the archives.

When do you draw the line between a person (or persons) being guilty of fraud versus the entire organization? The latter seems pretty sweeping, implying that every employee was guilty of perpetrating fraud; this is not the case, however.

Operational fraud — such as frauds that happen in the internal/external supply chain operations — can be divided into two basic classifications of fraud: organizational versus occupational.

When a person or persons commit occupational fraud, they have used their positions or roles to facilitate the perpetration of the fraud. A cashier who takes money from the till, an accounting person who falsifies deposits and pockets some cash, a buyer who accepts gifts, brides, or kickbacks for steering business to one supplier versus another, etc., are all examples of occupational fraud. Contractors and service providers can be guilty of occupational fraud, such as the attorney or technology consultant who submits bills for hours not worked. There is an implied trusted relationship that the person breaches in their less-than-trustworthy conduct.

When, at the highest levels of an organization, senior management (typically officers, but sometimes members of the board of directors) are guilty of perpetrating fraud via the use of the enterprise itself, in whole or in part, this is organizational fraud. What’s so unfortunate about organizational fraud is that many times honest employees in specific occupations are often left to suffer, such as when the organization folds. (Examples include Arthur Andersen, WorldCom, and Enron.)

Senior management and directors bear the burden of responsibility in their positions to set the right examples for the organization’s code of conduct. This is part of good governance for public companies as outlined in the COSO Sarbanes-Oxley compliance framework, but it is certainly applicable to private companies and government agencies alike.

The Sentencing Reform Act of 1984 provides guidelines for the penalties assigned to both individuals and organizations guilty of crimes. In brief, the penalties are assessed as follows:

(1) The greatest of the following:
(a) A base fine from an offense level table;
(b) The monetary gain to the organization;
(c) The loss suffered due to the intentional, knowingly reckless, behavior by the organization. (2) Application of a fine multiplier based on such factors as cooperation versus obstruction of justice, history of bad behavior, and whether the organization self-reported and accepted blame and responsibility.

In the tainted pet food scandal that hit the United States, melamine was added in China to the base ingredients to boost the tested protein levels and cover-up quality problems. A public official (an inspector) and an employee of the manufacturing company (a buyer, I believe) were both involved in the fraud: they used their occupations to perpetrate the fraud, which involved payoffs.

The pet food was then shipped from China to Canada where it was canned for distribution into the United States under various brand names. If, in the US or Canada, the corporate philosophy was to either not bother with quality assurance testing or not adequately fund quality assurance testingn (thus rendering it ineffective), in order to reduce cost-of-goods-sold and boost profits, this is, in my opinion, organizational fraud as perpetrated by the canning company in Canada and the US distributors.

Another good example is children’s toys in regards to the use of lead paint and design flaws which, even when manufactured to the specifications, represented a hazard.

The lesson here is very simple: You can outsource manufacturing, but you can’t outsource responsibility.

Norman Katz, Katzscan

Share This on Linked In

Editor’s Note: This is Norman Katz’s second post as a regular contributor on Sourcing Innovation. Norman, who has published dozens of articles on the subject, is a supply chain fraud and supply chain risk expert and will be covering these topics in his new column, which is indexed and archived.

Let’s start by taking a look at a real-life fraud story:

An accounting clerk who worked for Broward County (FL) workforce development agency perpetrated fraud that enabled her to walk away with $2.4M. Let’s learn a little bit about our fraudster:

• She had worked at this government agency for over 10 years
• She was hired with a criminal background (multiple convictions) but lied on her application
• She did not have more than a high school education
• She did not make more than $32,000 per year
• She was living, with her property-manager husband, in an $840,000 house, and owned another house plus several apartments

I want to be very clear that this fraud was not perpetrated by hacking the agency’s network infrastructure; these breaches get lots of airplay in the media typically because they are associated with stolen credit card information. This fraud did not require the use of viruses or other network penetration hacking techniques. This fraud did not require extensive technical knowledge or programming skills of any kind. This fraud was perpetrated from inside and within: inside the organization (by an employee) and within the protected network infrastructure.

How was this fraud perpetrated? The fraudster wrote checks to herself. Yes, that’s it. The accounting clerk simply wrote herself checks. The check amounts varied from $12,000 to $20,000 during the course of approximately 6 years.

(The fraud was discovered by a bank teller; fortunately for the agency, the fraudster banked at the same financial institution as the agency did. The agency’s management admitted that a failure — or rather, lack — of internal controls and monitoring enabled this employee to perpetrate the fraud.)

In fairness, this fraud likely found its way into the news because it was done at a government agency; there are plenty of serious frauds that occur at private and public companies that never see the light of day due to the reputation damage they could cause. As such, too many fraudsters are not prosecuted to keep the organization’s name out of the news spotlight; these perpetrators are simply let go and can move on to other organizations to exploit their gaps.

While it’s very important to protect your network infrastructure, too many companies fail to address risks from the inside. Reasons given for top management’s unwillingness to take a serious look at internal risks range from an assumed trust in their employees to a lack of belief that it could happen at “my company”.

When users have extended or unrestricted rights within a business software application, especially when such broad authority permits bypassing or exceeding controls, there is a (greater) chance of fraud perpetration. Typically, such employees are performing multiple tasks that would better be separated across multiple employees.

A good starting point would be to review your employee handbook. Does the employee handbook contain sections that educate the employee as to what is and is not acceptable behavior? Are the penalties for breaches of conduct clearly stated? (And is the organization willing to back up words with action?) I’m pretty certain that even if the employee handbook had included such information, this agency employee would still have perpetrated the fraud. But this is just a starting point on what needs to be a continuous journey to bring integrity into the workplace for people, operations, and software applications.

Norman Katz, Katzscan