Suspicious Minds & Frauds

Risk of fraud is lurking on every business. A recent survey suggested that fraud is increasing at the rate of 15 percent per year. Turn on the television or read the newspapers, it is common to find a story relating to fraud or financial manipulation. Frauds stories involving insurance, medical, securities, government, payroll, banking, telecommunication or credit card are just to name a few. These frauds involve but are not limited to inflated sales or profits, over stating expenses, employee or management misappropriations, related party transactions and security manipulations. Our story is no different.

It was late in night when Prabhakar called Deven. He wanted to know if Deven had any serious suspicion during the last audit at Axel, an advertising firm and a crucial client of Prabhakar & Co. Deven wondered why Prabhakar would have called up so late enquiring about an audit which had closed six months back. Prabhakar wanted to know if there were any suspicious circumstances like long outstanding in debtors' ageing statement or alteration of invoices etc. Deven soon sensed a seriousness and urgency in his voice. ''Is everything alright?'' asked Deven, an Audit Manager with Prabhakar & Co.

Prabhakar had a meeting with Mr. Raj Tilak, Chairman of the Audit Committee at Axel that evening for discussing a recently discovered fraud at Axel wherein the COO of the company was found to be involved. Prabhakar revealed to Deven that the audit committee chairman has held him negligent in failing to detect and report the suspicious circumstances.

Deven asked curiously why Prabhakar was asking about the debtors' ageing statement and alteration of invoices. Prabhakar told Deven that many invoices sent to a client company were understated compared to the copy of those invoices which were used to account for the revenue in the books of Axel. Prabhakar disclosed to Deven that there was a conspiracy between the COO and one of the Account Payable Staff of the client company. This staff of the client company had provided the COO with a fudged balance confirming statement to cover up the mischief. The COO wanted to meet his annual sales target and was to reverse the scheme in the subsequent periods.

Deven immediately understood which client Prabhakar was talking about. He recalled asking the COO about the unrealized amount in the ageing statement. He also remembered the COO assuring him of recovery of the said amount as he himself was after the client company for its recovery. The COO had also showed him a letter from the company confirming the balance. Also, when he had located two invoices with the same number but having different amount, the COO had provided a vague explanation and suggested it to be a one of error.

Deven remembered how the Chief Internal Auditor of Axel had insisted him to remove the audit observation on long outstanding debtors from the report before the closing meeting. Deven had suspected the authenticity of the statement confirming the balance from the client company but the Chief Internal Auditor had told him that the third party evidence is always one of the most reliable evidences. He had told him that in his career of 25 years as an Internal Auditor he have never doubted the third party evidence and Deven still needs to learn how to use his skepticism appropriately.

Prabhakar told Deven that we have definitely missed on our duties. Deven just kept mum during the entire communication.

Internal Auditor should be reluctant to accuse anyone when a fraud is suspected and give the person the benefit of doubt until the facts and circumstances warrant otherwise. The auditor has a duty to review all situations that seem unusual. Be a skeptic even though you are criticized for being so. Only thing to keep in mind as an Internal Auditor is to focus on the audit strategy rather than abusing somebody when encountered with suspicious circumstances. Also, reporting suspicious circumstances is not enough as you have a duty to dispel your doubts by employing more procedures and documentation.

Do you think you have ever been in a position similar to that of Prabhakar or Deven or the Chief Internal Auditor of Axel?

If your answer is No, enjoy the video herein below.

Scientific Testing Of Internal Controls

No internal control can ever be proven to be 100% effective. The effectiveness assertion can only be supported or rejected. If our observation of the internal controls finds no issues related to the effectiveness assertion, then the assertion is reinforced and our reliance on that internal control increases. Each time the assertion is tested and found to be valid, it becomes more useful as an explanation of how controls work. But if any future event or testing finds the same internal control to be weak, the internal control must be rejected or modified. This modified internal control must in turn, be tested again. This is how our knowledge of internal control advances.

However, many of us form a hard opinion about the internal controls that have been found to be effective or otherwise in the past. Hence, possibility exists in such cases that all evidences that are needed to prove the assertion are not being collected and thus the evidence collection procedure is not corroborative. We often want an internal control to work in a certain way. The tendency in such cases is always to look only for confirming evidence and neglect denying evidence. But, when we step back a pace from our opinion and are willing to see our testing proving the assertion right or wrong, we are following the scientific method.

Einstein once said that no amount of experimentation can ever prove him right but a single experiment can prove him wrong. Let us understand how most of us search for evidence and how we should be doing it scientifically from the following exercise.

You have been told that the cards with light grey faces have a circle on the other side. Now suppose before you are four cards laid out, two having its face up and two having its face down as shown below.

What is the minimum number of cards you may need to flip to test whether the statement that all the light grey cards have a circle on their other side is true of false?

Think about the answer before you read ahead.

This simple exercise examines your tendency as to how you collect evidence. Many people opt to flip the cards that confirm the rule. They flip the cards with the light grey face, and leave it at that. Or they may also turn over the card with the circle. Flipping the card with circle does not add to the evidence because it could show either a light grey or a dark grey surface with the rule being still true as dark grey cards may also have circle.

The correct answer is two. You should first flip the card showing up the light grey face. If the reverse side of the light grey card is a circle, the rule is confirmed. But this does not give you all evidence you need. Now you must see on the other side of the square and not the circle. If that shows a light grey face, the proposed rule is false, because you have found a light grey card which does not have a circle on the other side and if it is a dark grey, or anything else, the rule remains intact.

So, if you are a next generation Internal Auditor, be clear with your logic of various assertions to be tested and use the scientific method whenever possible. Don't rely on internal controls at their face value, but observe them carefully, test them and be willing to adjust your opinion about them based on the evidence you gather.

Balanced Internal Audit

The goals and objectives of Internal Audit department should be capable of being accomplished within specified operating plans and budgets, and to the extent possible, should be measurable. Frustrations at all levels are frequently due to the lack of clearly defined objectives and delegated responsibilities. The result can be mechanical auditing even when possessed with latest knowledge or technological skills just in order to meet the activity targets and creating the final output. Read the extract from a chat which I had recently with one of my professional friend working in the Internal Audit department of a multinational company.

Vimal: Hi, how are you?
Me: I am fine. How was your training?
Vimal: Cool. I have learnt some data analytics at the training.
Me: Are you going to use the learnt techniques in your IA job?
Vimal: May be to some extent to justify the training.
Me: Why so?
Vimal: I think we are more into designing our final presentation to the Audit Committee than to find trends in the business data.
Me: But that must help you to find the problem areas for reporting.
Vimal: Yes, true. But see, the experienced people in our audit committee think they know how IA has to be done. We remain more concerned about the comments they make reading our reports in presence of the auditees.
Me: What you want to say?
Vimal: You know auditees. They turn back many times after initially agreeing to a point. We just end up fighting on the facts and the languages used in our report at the time of final presentation. Moreover, timely reporting is a big issue while getting consensus from everyone is the most difficult and time consuming aspect of our job. What to say when our audit committee is so fussy about the reporting language and quantification.
Me: What is wrong in that?
Vimal: Even the properly drafted statutes and legal documents can be misinterpreted depending on the objectives of the parties involved then what to say about our Internal Audit reports. In spite of our taking all the care to report only fact based observations, misinterpretations are inevitable.
Me: Are you saying your training should have been to improve writing skills instead?
Vimal: No Man! Training is just to know what is going on in the industry. It's good to be updated from a career perspective. Practically speaking, Internal Auditors should keep everyone happy and remain popular.
Me: So, what is your strategy?
Vimal: Get into all sort of training when your company has a training budget. On the work front, simply get the final report vetted by the management and auditees. Remove all the objectionable points and keep it clean. Praise the efforts of auditees.
Me: That's a good practice. We as an Internal Auditor should not only be finding faults.
Vimal: No Man. I am just talking about cutting it short and false praising to keep them in check so they don't create issues for us while presenting the final report.

We have allusion of a duck swimming serenely along the top of the water. Underneath the water, however, its feet move frantically to make a mile a minute.

The duck parable is relevant to our new age internal auditing as well. It can be seen that final internal report has certain observable components; namely, the Executive Summary points. This observable dimension is like the duck floating calmly on the surface of the pond. This is all that the casual observer notices. Underneath the water's surface, however, two rapidly paddling webbed feet perform the work. One of these feet is the technological skill of the internal auditor, while the other is the knowledge of innovative internal audit strategies and techniques.

Emphasizing only one of these dimensions (just the technology or just the knowledge) will result in a one-legged duck swimming around in circles. Emphasizing only the logistics of producing executive summary or the final presentation to the audit committee or the top management without much emphasizing on the above mentioned dimensions results in what can only be termed as a 'dead duck'.

The emphasis on all the three areas moves the Internal Audit toward the readiness required for keeping up with the set expectations. Technological skills are needed for high efficiency and to provide with cutting edge solutions. Pedagogical models and strategies are for building intelligent business insights and know-how as well as maintaining cordial auditor-auditee relationship. Finally, the Internal Audit team, Management team, and Audit Committee should work together to add value in real terms.

The Risk Muscle

An organized retail chain into fresh food retailing recently decided to rollback its expansion plan in few states after aggravated agitation against it by the local vegetable vendors. The business leaders face complex decision making situations too often. When you make right decision no one remembers but when you make a wrong one no one forgets. The saying goes like - don't limit yourself to few alternatives but open your mind to different view points. I want all decision makers to look at different paradigms through this interactive case study.

Assume that you are a farmer and you need to plant one crop over all your land. You have a choice of three kinds of seeds. There will be three possible weather conditions, say good, average, and poor. It is impossible to predict which condition will realize, since each is equally likely to happen. The Profit & Loss for the possible weather conditions are summarized in the following matrix.

Which crop would you plant? Why?

There is no correct or incorrect answer as all options have same probable outcome i.e. 6. All depends on your risk muscle. The buzzword used many times is Risk Appetite but I would like to use the word Risk Muscle.

When you have confronted with a yes-or-no decision or a this-or-that decision take out a coin, assign one alternative to heads, the other to tails, and flip the coin. Look at the coin for the result and immediately ask yourself how you felt. Albert Einstein had suggested this method saying it is useful to incorporate your feeling into your decision making. Only after a choice is made, the risk assessment becomes meaningful.

The business managers are trained to make knowledgeable decisions based on factual and experimental analysis and observations. To validate assumptions, informed enquiries are also made. The biggest of assumptions is more the facts available, better the decision making. In reality the business managers often face Dharam Sankat situation in Decision Making.

Suppose you are a doctor working in an Indian Village, and 600 people have come down with deadly dengue fever. Two possible treatments exist. If you choose treatment A, you will save exactly 200 people. If you choose treatment B, there are 1/3 chances that you will save all 600, and a 2/3 chance that you will save none. Which treatment do you choose?

The majority choose option A.

Imagine again that 600 people have come down with deadly dengue fever. Two possible treatments exist. If you choose treatment C, exactly 400 people will die. If you choose treatment D, there is a 1/3 chance that no one will die, and a 2/3 chance that everyone will die. Which treatment do you choose?

Now the majority choose option D.

Now suppose one of your close friends is suffering from a life threatening disease. When your friend is unconscious, the doctors seek your choice between the available two treatments as you are the only one available at that moment. Treatment P which has 100 % success rate but a side-effect that your friend will lose his eyesight and Treatment Q which has only 20 % success rate. Think about your choice first and then think how your friend would have decided if he were to make the choice. Then, think about his close relatives' possible choice and effect of outcome of your decision on them and your friend.

A timely decision is far superior to a perfect decision that is late. Over optimism can kill whereas keeping near to reality helps.

When you are in a leadership position, you have to consider view points of all the stakeholders and effect of your choice on your environment. Remember prospect of loosing is more profound than the satisfaction of winning. It is not difficult to forgo what is not yours at present but it is difficult to forgo what is yours at present. Remember the funny incident from a bollywood movie where a miser pays off his debt in cash to the person owing in front of dacoits. :)

The point I am making will be more clear from the following anecdote. Perhaps apocryphal, about the man who approached Coca-Cola when the company was in the business of manufacturing Coca-Cola syrup. He took two years before the business leaders at Coca-Cola spared their two minutes to listen to his idea which he gave in just two words: 'Bottle It', the rest is history. It may not be procrastination but surely risk aversion of the decision makers to forgo their valuable two minutes (their current ownership) to listen to the future business idea (their future ownership).

Please provide with your valuable comments.