Chris Bjorklund: You’re listening to the AllBusiness podcast. I’m Chris Bjorklund. If you’re getting this through iTunes and RSS feed or an online streaming media player, you can hear interviews with other experts at AllBusiness.com.

Bjorklund: Business fraud committed by employees is common and prevalent. But you can head it off if you know how. Tracy Coenen, a business fraud expert and blogger for AllBusiness is talking about the red flags and warning signs to watch for so you can detect and eliminate fraud in your operation. Coenen, president of Sequence Inc., a forensic accounting firm, has been detecting, investigating and preventing business fraud since the early 1990s. Tracy, you say in articles that you’ve written that while fraud is prevalent, most of it is preventable. So what kinds of things are being overlooked by the companies that become victims?

Tracy Coenen: Surprisingly, companies are overlooking some very simple techniques that can help them prevent fraud. I know that a lot of people think that fraud prevention has to be expensive and have to be an extensive project that they undertake but it doesn’t necessarily have to be that way. There are in fact some pretty easy, simple, basic ways that a company can help prevent fraud.

Bjorklund: So let’s get into them.

Coenen: OK, the first one is basic internal controls are being overlooked. And when we talk about internal controls, we’re basically talking about checks and balances to make sure that employees aren’t stealing. And so, in smaller companies, what we see is there aren’t many of these checks and balances in place. In larger companies, the checks and balances are there but often, they’re not followed.

Bjorklund: Well, an example of that might be let’s say, a cash kitty sitting around for emergency expenses and no one really knows how much is there to start and when you take it out, there’s no system for reporting how much you’ve taken out?

Coenen: Right, that could be one example. Another example of a poor control over it would be to have one person in the office with complete control over the cash kitty. If that person is the only person who is ever counting the money, distributing the money, looking for receipts regarding that money, if that one person is in charge of all that, it’s pretty simple to steal. On the other hand, if you’ve got a second person involved and you have the first person maybe responsible for giving out the money and checking in receipts, you may another person in the office then take care of reconciling that account at the end of the month, making sure that all the receipts were received and a proper amount of money was given out.

Bjorklund: So that’s a good example of some sort of checks and balances on a system.

Coenen: Exactly. Another really good example of checks and balances, even in a very small company where you may have one bookkeeper and the owner involved in the daily operations of the company, is to have the bookkeeper do their daily work and then have the owner come behind that bookkeeper and double check some thing. For example, the owner of the company might want to be responsible for receiving the bank statement directly from the bank, that it comes to the owner unopened, sealed envelope all intact from the bank, that owner breaks open that envelope and checks through the checks and the bank statements to make sure that the bookkeeper hasn’t written out any checks that shouldn’t have been written or otherwise tampered with the bank funds.

Bjorklund: What else can companies do if, I mean, besides these basic internal controls, what are some of the other general categories?

Coenen: One really basic control is to implement good hiring practices and I think owners and executives always want to hire good employees but we need to really be thinking about how these employees might function when presented with the opportunity to commit fraud. So what I’m interested in having owners and executives look at is, let’s make sure we’re verifying past employment, let’s make sure we are doing those reference checks because we never know what we might find out about a potential employee during that check and we should check criminal records when the law allows us to. Simple things like this can stop a company from hiring bad employees.

Bjorklund: Are there things that you can do that are sort of on the psychological level too? Some kind of simple testing that’s, I mean, maybe there’s a pre-existing kind of test that you can use to do some initial screening or is that, you’re getting into dangerous waters there?

Coenen: There are some tests that can be given that will help determine the honesty of employees and things like that. That is somewhat of a touchy area. I know that the employment attorneys like to take control of that area and determine or not that’s an OK thing to do for a position. One of the things that I would caution employers about is that if they’re going to use something like that, they need to stop and think about how that is going to affect the impression of the company for those potential employees. There are some really good employees who get turned off by those types of tests and they would just really ask that the company consider the cost benefit there. Is there a benefit to that test that always is potentially turning off good employees who might otherwise do well for us.

Bjorklund: What about a code of ethics? Is that something that small companies, I mean, that’s probably a fairly simple thing to do, to develop your own code of ethics.

Coenen: Yes, a code of ethics is really important for a company of any size and I think with smaller companies, they sometimes overlook that code of ethics either feeling they don’t have the resources to put one together or because they’re so small that they don’t need something like that. And what I found in my practice is that by laying out the rules and expectations for employees, the company sets itself up to have more ethical behavior. We can’t automatically assume that employees know exactly what we expect of them in terms of honesty and dishonesty. So the code of ethics can helpful in laying that out and setting forth those guidelines for the employees. Now, we can’t just create a code of ethics and expect employees to abide by it. We need to educate them on it, offer them an opportunity to ask questions about it so that we are sure that they understand it. And then we need our owners and executives to model ethical behavior and really strictly abide by that code of ethics so that the employees are going to see that behavior and hopefully behave just as ethically as well.

Bjorklund: And so can you just give us an example of a statement that might be in a code of ethics? Is it about expectations?

Coenen: Well, when you’re developing a code of ethics, what I find is it’s really important to first include some general guidelines about the fact that as a company we value ethical behavior and honesty on the job. And from there you can get more specific on the things that are expected. Probably detailing some things like conflicts of interest, expense report honesty, what should be done if you suspect fraud or you see some suspicious behavior on the job? So there’s a number of things, I can go through a fairly lengthy list of things that you might want to touch on in the code of ethics and then, on occasion, it is recommended that you be very specific about certain things, if they are strictly prohibited. Maybe something like receiving gifts from a vendor is strictly prohibited for whatever reason.

Bjorklund: Now, you talk in some of your blogs and articles that I’ve read also about how important it is to enlist your own employees as watchdogs, that educating them about fraud and employee theft practices is really a kind of an important step to take because then you have more eyes on the prize, so to speak.

Coenen: You’re absolutely right. First of all, if we go on the general premise that employees are generally honest, we can use them to our benefit at the job to help us look for dishonest behavior but employees can’t be expected to find dishonest behavior that are important to us if they don’t know what it looks like. And we really what them to report things to us because studies have found that fraud is most often detected by a tip from an employee. So we already know that they are willing to help us find fraud and they’re willing to report it. So by educating them about what fraud looks like and feels like and what types of things we want them to come to us and report, we’re going to help them help us.

Bjorklund: Exactly. Well, what about some of the risk factors? You know, within a small to medium sized business, you know, from an operational standpoint, if you take a look at your own risk factors, I would imagine you kind of have a leg up in terms of identifying potential fraud.

Coenen: That’s right and there are lots and lots of risk factors about a company can have that may put it at risk of being more susceptible to fraud but let me outline for you a few of the most common risk factors that I see in companies who have become victims of employee fraud. And the first one is a company that is operating in what I call crisis mode or fire drill mode. What we have with a company in that situation is where people are running around and constantly putting out fires, constantly responding to a crisis and the employees really never get a chance to see what normal operations look like within the company. So how would that employee ever be able to flag something as unusual or potentially fraudulent? They don’t know what normal operations look like because they’re always frenzied. And it’s really hard for employees to pay attention to the details at the job when they’re constantly running this race and this race never ends.

Bjorklund: So that’s a huge red flag.

Coenen: Absolutely. We want to establish some level of normalcy within the company so that employees can really get into a groove with their jobs, really get an understanding of how business is supposed to be done, what transactions are supposed to be coming through, how they normally look so that if there is something unusual, they’re able to stop that.

Bjorklund: You find some companies have not established, OK, maybe they have the normalcy thing down to a point, you know, they’ve established, as you said, some sort of what a normal operation should look like but they really haven’t identified clear lines of authority within, sort of the chain of command.

Coenen: I do find that sometimes. You know, there are some companies that have really rigid chains of command and pecking orders within companies but often at smaller companies, there isn’t such a well-known pecking order. We all know who the owner is or who the president of the company is but sometimes, it’s not well established who an employee goes to if they have a concern. Employees really need to be made aware of you who should receive complaints or who should receive a report about suspicious behavior. An employee needs to know who a direct supervisor is and who that person’s supervisor is and how the employee would go up that chain of command if they saw something unusual. And one of the things that has been really popular over the last several years is having employees more involved in creating more of a team atmosphere where a lot of employees are heavily involved in decision making and making them really feeling empowered to do things at work, that’s a great method as long as the employees still know who do I go to if I suspect a problem.

Bjorklund: Well and they also want to feel that if they report a problem that there will be some sort of follow through, some investigation, some maybe protecting them, you know, their anonymity but you know, I would imagine that’s an important part of the process.

Coenen: That is right. They do need to feel that they won’t be retaliated against if they do report something and that’s why sometimes employees have to be real careful which manager and person they go to with their report. So we want them to understand exactly who they can go to and how their complaint will be treated.

Bjorklund: Now what are some of the other problems within the accounting arena in terms of how you know, money is authorized and spent and controlled and reviewed and monitored and so on.

Coenen: When I talked about basic internal controls before, I mentioned segregation of duties and having some checks and balances in place and that’s really important. Certain parts of the accounting process really need to be divided up so that one person doesn’t have too much control over an area of the company or too much access to information. And a really good example of that is the process of receiving customer payments. The employee who actually receives those checks should not necessarily be responsible for updating customer accounts. We don’t want to give that person an opportunity to receive a customer check, keep that check for himself and then update the customer account to reflect the check having been received when the employee has actually stolen it. So the key idea here is that we’re going to separate the duties between enough employees so that one employee can’t control the process and cover a theft.

Bjorklund: What percentage of companies that you consult with, would you say are not doing this kind of thing?

Coenen: I think to some extent, almost all of the companies that I’ve worked with have some improvement that they can make in this area. I would say, if the problem is more prevalent at smaller companies but big companies do have problems as well because they may have good segregation of duties across a number of areas in the company but they still have certain areas where they aren’t paying as good attention to that as they should. So my response to you would really be that I found almost every company I’ve worked with has had some room for improvement to be made.

Bjorklund: Let me tell you about one business fraud I was intimately involved with. There was a successful and trusted employee who was submitting receipts for pizza at her local pizza parlor for every Friday night. And I’m wondering why this kind of expense, business expense, it went on for a long time, why don’t think it was caught earlier?

Coenen: I think there can be two things in play in this type of situation. One of the things is that someone’s probably not looking really closely at some of the receipts. I see that as a very common problem whether or not looking at the details of it to see when the meal occurred or who might have been present. They’re not looking at the receipts to see, “Hey wait a second. This is already charged on the company credit card and now, she’s sending in this receipt looking for cash reimbursement as well.” Those types of things I see overlooked real often. The second thing that could be in play could be that someone did notice what was going on and decided to overlook it. I do see that as a problem in a lot of companies where there is a certain level of fraud that is allowable and acceptable at the company and as long as you don’t take advantage of the system too much, no one’s going to say anything to you. I’ve seen lots and lots of companies do this in terms of expense report abuse where they sort of have an unwritten policy that we will allow a certain amount of fraud within an expense reporting purpose and we kind of think of that as a perk to our employees. We’re not going to crack down on that issue and our employees will be happy because they are allowed some latitude in that area. Unfortunately, the problem comes when it snowballs. And that expense report theft starts creating an attitude among the employees that we can steal so long as we don’t steal too much. Well, where do they draw that line? What is too much and do you really want your employees applying their own personal judgment to what is too much of a theft.

Bjorklund: You’re listening to an AllBusiness podcast with business fraud expert, Tracy Coenen. So Tracy, you say that big fraud starts small.

Coenen: That’s right. Every fraud has to start somewhere and in my experience investigating fraud, almost every fraud starts on a very small scale. It may start as a situation where an employee is in need of a couple of hundred dollars to pay a bill and convinces himself that he is just borrowing some money from the company and he’ll pay it back later or maybe it is a situation where an employee sees that an improper charge went through the system and no one noticed it. And the employee sees that as an opportunity to commit fraud. It starts there and it grows from there. Every fraud has to start somewhere and so, the growth begins when there may be an attitude of greed. There may be an attitude of need. The greedy employee starts to want more. He sees that the fraud isn’t being detected and takes that as a green light to grow that fraud. And then there is the situation where it is some sort of need and that could be real need or it could be what I call a perceived need. And a perceived need is something more along the lines of an employee who wants to buy extravagant gifts for family. That’s not a real life need but in their minds they do feel that it is. On the need side, a fraud can grow because that need can be ever growing as well. You know, the high from committing a fraud and getting away with it may be isn’t quite as easily obtained anymore and so I have to steal a larger amount to get that high or we may be able, looking at a situation where a manager has inflated sales during a quarter to meet certain goals. And then the next quarter, he is going to inflate sales even more to meet that quarter’s goals because someone is always looking for growth out of his department. So you see how it’s easy for a fraud to start to grow and at some point grow exponentially.

Bjorklund: Can you give us a profile of the typical thief who engages in business fraud? I mean, it’s people just like you and me.

Coenen: It really is. There is not one typical profile, of course, of a person who commits fraud because every fraud is so different and every individual is different. But what we do see is that there is a strong correlation between a person’s level of access and power within a company and the amount that they are able to steal. The more access the employee has because of a position in the company, the larger the fraud that usually occurs. Some of the things that we do look for in individuals that might tip us off to a fraud or at the very least, an unusual situation, I look for things like a change in behavior at work, a person who is a chronic rule breaker who doesn’t ever seem to want to play by the rules that everyone else has to. So certain negative behaviors like that can tip us off that something is going. Unfortunately what we do see often is that the person who is a very trusted employee is ending up committing the fraud. Why is that the case? Well, when we place trust in the employee, we give them access to assets and access to information and that’s what allows them to create the theft. I always say, if you have an employee that you suspect would steal from you, you’re not going to send him to the bank with your bank deposit, are you? No, you’re going to send it with someone that you trust and so that person who has gained that trust really has that opportunity to commit fraud.

Bjorklund: So you talk about the fraud triangle being opportunity, motivation and rationalization. Does this come from the crime field?

Coenen: It does. It’s an old concept in criminology that still holds true today and some people put their little spin on it but these three core parts of it are still the most widely recognized as 3 components to every single fraud. First, we’ve got the opportunity and that is where the employee actually has a chance to steal and cover it up. So, you know, we’re looking at an employee who has access to money, assets, information. Therein is the opportunity for them to potentially commit a fraud and then later on conceal it. Motivation is the component of fraud in which a person feels a certain pressure or a need to commit the fraud. Again, this could be a true financial need, maybe someone with high debts who needs to pay some of them down, maybe a person who has been in a house fire and needs to replace personal belongings. The need could also be, that perceived need like I mentioned before where someone desires to have material goods but can’t afford them. And so, the motivating factor behind a fraud is whatever need that person is trying to fulfill and really, the need does not necessarily have to be financial at the core. It can really be any pressure in a person’s business or personal life that could become the motivation to commit fraud. And then finally, the third piece is rationalization. And that’s the process by which an employee tells himself or herself that committing the fraud is OK. It’s where that person justifies committing the fraud. This could potentially be a situation where the person says, “Well I need the money more than the company does so that makes it OK in my mind.” Or it may be rationalized by some other sort of excuse in their mind that the employee didn’t receive a bonus or a raise that he or she felt was deserved and therefore the theft is going to make up for it. So you’ve got these 3 pieces of a fraud triangle and companies really have no control over the rationalization component of it. They can’t control the employee’s mind and how the employee may justify committing fraud. But management can control the opportunity portion of the fraud triangle. So don’t give employees opportunities to commit fraud and we do that by limiting access to the assets, monitoring what our employees are doing, monitoring what is being recorded in the accounting system, etcetera.

Bjorklund: Tracy, for small to medium-size businesses, many owners really do have to work up their own plan for fraud prevention and I think talking about that fraud triangle is really a good framework but if you were to give any advice to these small to medium sized business owners, what would say are maybe the three most important things they can do to prevent fraud by their employees?

Coenen: The first one is being actively involved in safeguarding the company’s assets. Owners should be very careful to review their bank statements and review their accounting records on a regular basis. If employees know that the owner is involved consistently and is regularly looking over the books and monitoring the bank accounts and other assets, it is less likely that an employee will attempt a theft. The second way that owners of small businesses can set themselves up for success in fighting fraud is making sure that the employees have a way to report fraud. Again this goes back to educating employees on the fraud risks in your company and in your industry, maybe offering them a fraud hotline where they can confidentially report their suspicions of fraud and definitely on a daily basis, encouraging employees to speak with management about issues related to fraud. An open-door policy and an atmosphere which encourages employees to talk with management can be very helpful in preventing fraud because employees will hopefully feel more comfortable reporting fraud. And then finally, small-business owners need to hire the right employees and again this goes back to what I discussed earlier in terms of carefully screening applicants and looking for employees who seem to exhibit ethical and responsible behavior. Now the key to developing that ethical corporate culture starts with individual integrity and I would be looking for owners and executives to model that behavior for their subordinates.

Bjorklund: Tracy, you’re our very own fraud broad on AllBusiness. You have a blog there so I’m hoping that our listeners will look for that. Can you recommend other resources for us?

Coenen: Yes I can recommend other resources. My book, Essentials of Corporate Fraud is going to be on book shelves and it is going to a great book for executives, small-business owners, attorneys and auditors to learn more about fraud. It really introduces them to many of the basic fraud concepts and it’s going to offer them some insight in fraud investigations and fraud prevention efforts. So it’s a really nice book for a beginner to start to learn some of the important aspects of fraud and fraud prevention. Also my corporate website has lots of articles on fraud detection, investigation and prevention. In addition to my fraud blog which features some daily posts on the latest news and developments in the world of fraud.

Bjorklund: So it’s the fraud blog from the fraud broad?

Coenen: It absolutely is.

Bjorklund: Thanks so much for all the fraud fighting you do and for talking to us today.

Coenen: You’re welcome.

Bjorklund: AllBusiness blogger and business fraud expert, Tracy Coenen has been our featured guest. She runs a forensic accounting firm, Sequence Inc. based in the Midwest. You can send your feedback on this show and ideas for future guests to podcasts@allbusiness.com. I’m Chris Bjorklund, thanks for listening.