It’s common knowledge that internal controls are important for preventing and detecting fraud. Separation of duties, multiple layers of review, two check signers for large disbursements, and written policies and procedures to formalize everything; these are all good elements for a strong internal control system. But poor tone at the top can undermine the whole puzzle.
To see the importance of tone at the top, we can examine this fraud in Lincoln County, West Virginia. The unfolding story involves a CEO of a not-for-profit medical facility who was charged with making personal purchases on a company credit card to the tune of $100,000. The purchases included home improvement supplies for two of his houses, baseball memorabilia and equipment, cell phones, headphones, and a radio, all of which were for personal use and not business-related according to the indictment.
Over a two year period, the CEO allegedly instructed staff of the organization to work on home renovations for his residences during regular work hours. From the indictment, he then altered time sheets to cover this up, resulting in falsified tax returns.
All of these actions were against the organization’s written policies. The credit card usage policy prohibited non-business use. The board was supposed to authorize any deviations from policy, and apparently, they were not aware of these transactions. The article also mentions co-conspirators who helped the activity take place.
We don’t know if the organization had an anonymous whistleblower hotline in place, but without one, it’s unlikely that anyone would come forward to report the boss. When upper management openly flaunts the rules and regulations, who knows what other fraud is occurring lower down in the ranks? Ignoring protocol becomes “the way things are done around here.”
Boards need to take their duty of obedience seriously and ensure the organization is following its own policies and procedures, not to mention laws and regulations. Board oversight should include regular evaluations of the CEO. Organizations should also ensure they have a mechanism for anonymous reporting of concerns by employees, with the board or other oversight body receiving reports that are about upper management. If the tone at the top is inappropriate, employees need a venue to make their voices heard.
If you have questions regarding tone at the top and internal controls, contact one of our Clark Nuber fraud professionals.
© Clark Nuber PS and Focus on Fraud, 2019. Unauthorized use and/or duplication of this material without express and written permission from this blog’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Clark Nuber PS and Developing News with appropriate and specific direction to the original content.