The risk of significant financial fraud may be lower for not-for-profit organizations than it is for for-profit entities, but its impact can be just as paralyzing.
Not-for-profit organizations represented only 9 percent of the Association of Certified Fraud Examiners’ study of 2,690 fraud cases in its 2018 Report to the Nations. Regardless of the incidence, there’s an obvious financial impact from fraud. Total fraud cases in the 2018 Report to the Nations resulted in estimated losses of $7.1 billion, which the ACFE acknowledged is only a fraction of the true cost of global fraud. The study concluded that the median cost of fraud to not-for-profit organizations was $75,000, but these costs do not include the cost of attorneys, forensic accountants, and other specialists who will be called upon to assist with the investigation.
There are less tangible consequences that are equally, if not greater in cost for not-for-profit organizations. Allegations involving financial misconduct may bring irreparable reputational harm to organizations that rely on community support to further their missions. The endless media scrutiny will also further challenge senior management’s ability to effectively address the most pressing concerns while attempting to shield the organization from any lasting effects on its name.
Organizations that fail to grasp the implications of the public relations frenzy that is certain to follow a fraud incident will suffer the lost confidence of their supporters. A thorough internal investigative and remedial action plan that addresses the shortcomings that led to the underlying fraud will help rebuild the lost trust and demonstrate to the public the not-for-organization’s commitment to fraud prevention. The following steps can serve as a useful guide for recovering trust and confidence in the wake of a fraudulent scandal.
Step 1: Own the Problem
One of the realities a not-for-profit organization may face is the potential misconception that senior management is involved in the fraudulent scheme or at least condoned the actions of the employees who perpetuated the scheme. Added to that misconception will be the appearance of a lax internal control environment that allowed the fraudulent scheme to flourish without detection, thus making the not-for-organization an unsympathetic victim.
Acknowledgement of these issues from the outset is paramount when publicly addressing the underlying allegations. A not-for-profit organization’s credibility and transparency, or lack thereof, will be on full display when it is asked to explain what the organization knew and when it knew it. In other words, a not-for-profit that decides to “own the problem” and be forthright in sharing how it plans to respond to the allegations will quickly put the organization in the right direction of a speedy recovery. Anything short of this will only exacerbate the problem and likely diminish any remaining credibility an organization may have.
Step 2: Hire an External Team
Once the fraud is discovered, a not-for-profit organization will experience an onslaught of issues that will necessitate immediate action. One of the most critical decisions to be made is selecting the investigative team. This team should consist of experienced lawyers and accountants who have conducted similar investigations in the past and/or have prior experience as prosecutors and investigators. Their experience and knowledge will signal to stakeholders that the organization is committed to ensuring the investigation will be fact-driven and include remedial actions to prevent a similar incident from happening in the future.
Attorneys with past prosecutorial experience will also assist not-for-profits in determining whether it is in the best interest of the organization to cooperate with regulatory and law enforcement agencies. Attorneys and in-house counsel must weigh the downside of disclosing the results of an internal investigation and cooperating with government agencies, since there is no guarantee that disclosure will help the organization avoid criminal prosecution or garner any leniency from governmental prosecutors. Attorneys and in-house counsel also must consider ramifications of likely parallel civil proceedings that can complicate their decision-making process.
During the investigation, the investigative team will interview witnesses, review all necessary documents (including financial records and text and email messages), and quantify the financial damages suffered by the organization. The investigation will also document where the company’s internal control structure failed and where policies and procedures were ignored.
Step 3: Documenting the Investigative Findings
At the conclusion of the investigation, a detailed written report should be prepared that will address the underlying problem(s), how they arose, the employees believed to be involved, and the financial losses suffered by the organization. In addition to quantifying financial losses, accountants will be able to provide a detailed analysis of how the internal control structure was compromised, and why it failed to detect and prevent the scheme.
The majority of internal investigations uncover evidence of red flags or some indicia of fraud that existed prior to the discovery of the fraud. Unfortunately, most senior and mid-level employees lack the skillset to interpret these clues and take appropriate action, thus allowing the fraud to metastasize over time.
Another reason that fraud often goes undetected is the misconception that independent audits will uncover the existence of fraud. In reality, independent audits account for only a small portion of all discovered frauds. Anonymous tips received by the organization are far and away the most prominent form of detection—tips were the initial detection of fraud in 40 percent of the fraud cases reported in the 2018 Report to the Nations findings.
Of equal importance will be the changes the organization will implement on the advice of the investigative team. The remedial actions designed to prevent similar matters from occurring in the future will telegraph to its employees and regulatory and law enforcement agencies the organization’s commitment to fraud prevention, and that the changes to be implemented will assist in changing the culture that contributed to the fraud.
The investigative results should be presented to senior management and board members to ensure they are fully aware of the investigative findings and recommendations.
Step 4: Follow Through on Changes
Restoring one’s credibility hinges on the ability of an organization to demonstrate that its proposed changes are meaningful and will affect change within the organization. It’s simply not enough to itemize action items that the not-for-profit plans to take without effective follow through.
In today’s environment, all organizations that emerge from a lengthy internal investigation are expected to embrace a remedial plan of action to underscore their commitment to the prevention and detection of fraud. In addition to changing policies and procedures and strengthening the internal control environment, not-for-profit organizations should consider implementing the following three changes:
- Introduction of a tip hotline;
- A new or improved whistleblower policy, and;
- An agreement to allow the organization to be monitored by an independent third party.
Tip hotlines allow employees to alert organizations to ongoing fraud without jeopardizing their identities, thus helping organizations detect fraud earlier, reducing the cost of the fraud to an organization. The 2018 Report to the Nations found that organizations with hotlines detect fraud by tips more often than those that do not have hotlines: 46 percent of fraud cases were detected by a tip when the organization had a hotline. Organizations who did not have a tip line detected only 30 percent of the fraud cases.
Whistleblower programs, similar to the protections offered by a hotline, allow an individual to divulge critical information to senior management without the fear of reprisal. Most employees who are aware of fraud in their organization are simply afraid of retaliation, not only from management, but also from their peers at work. With promises of confidentiality and an organization’s legal responsibility to protect the whistleblower, employees are inclined to approach senior management with critical information rather than remaining silent.
Finally, a monitoring program overseen by an independent third party for a fixed period of time helps to assuage lingering concerns regulators, law enforcement, and supporters may have. Knowing that an organization’s newly implemented changes are done under the watchful eye of an independent monitor greatly decreases the likelihood of organization’s return to its previous behavior.
Keep in mind that even with the most thorough recovery effort, the restoration of a not-for-profit organization’s credibility will take some time. Supporters and regulators will begin to trust an organization once evidence of those changes begins to emerge, and they are satisfied that those changes will have a permanent impact on the organization.
For more information about how you can prevent and recover from fraud, please contact us.
- How Not-For-Profits Can Stay Ahead of Fraud
- 4 Ways Not-For-Profits Can Manage Their Fraud Risks
- Preventing Fraud: Tips for Nonprofit Organizations
John E. Mulvaney, Jr. is the Practice Leader of the White Collar and Government Enforcement Practice in the Corporate Recovery and Litigation Services Group. He specializes in government and internal investigations, as well as complex civil and criminal matters. He can be reached at 617.761.0569 or JMulvaney@cbiz.com.