JUNE 2016
WWW.INTERNALAUDITOR.ME
Tips for Developing & Operating Whistle-blowing Hotlines Fraud Trends in the Arab World INTERNAL AUDITOR MIDDLE EAST
Actively Combating Procurement Fraud in Construction Projects
Fraud Detection and Data Analytics Bolstering Anti-Fraud Programs by Effectively Identifying Anomalies & Red Flags
Insights on Governance, Risk Management and Control
From The President
Fraud Special Issue Thanks to the efforts of the UAE Internal Auditors Association’s (UAE-IAA) Fraud Subgroup, we have launched a Special Issue on Fraud. The articles in this Special Issue only cover Fraud and related topics. Fraud has always fascinated people: how it is committed, how it gets discovered and what led the perpetrators to carry out these immoral actions in the first place. While internal auditors are not specialised fraud examiners, our stakeholders expect us to detect red flags and recommend prevention measures. This means that a majority of internal auditors are involved in responding to fraud risk, albeit in differing ways and with differing roles (For example, investigations, facilitating fraud risk assessments, fraud awareness training, etc). In this Special Issue you will learn about a variety of fraud related topics which include using data analytics to detect fraud, whistle blowing, procurement fraud as well as the role of internal auditing. Internal auditors can use these insightful articles to stay up to date and see how best to add value to the anti-fraud efforts at their companies. I would like to thank Meenakshi Rezdan of the Editorial Advisory Committee, who has taken on the bulk of the editorial work for this quarter. Without her efforts, this Special Issue would not have become a reality. In addition, I would like to thank the Fraud Subgroup for their support ideas and encouragement. Last but not least, a special thanks goes out to Robin Singh for his regular and insightful contributions to our magazine. On a different note, the Institute of Internal Auditors (IIA) and the UAE-IAA have worked extensively to prepare for the 2016 International Internal Audit Awareness Month which takes place during the month of May each year. The objective of this month is to actively promote internal auditing’s value to our stakeholders, to the business community and to students & academics. In 2015, the UAE-IAA was given the Building Awareness Champion award and we hope to achieve the same this year. I encourage all our members to participate and help advance our profession at your workplace and local community. I hope you all enjoy reading this Special Issue. Please feel free to email any feedback you may have to editor@internalauditor.me Sincerely,
Abdulqader Obaid Ali President
JUNE 2016
INTERNAL AUDITOR - MIDDLE EAST
01
Hotlines BY R OB IN S INGH
Effective Whistle-blowing Hotlines
Hotline pitfalls and solutions from the implementation stage to the commencement of an investigation. Whistle-blower is a term that is most dreaded by all concerned, but in hindsight it has a lot of benefits for everybody. Fraud is an ongoing activity and sometimes it comes to notice after many years. It is an activity that is deleterious not only to the health of a company but also to the society we live in. In the long run thus whistleblowing is an activity that can not only cut down on fraud, but in the overall scenario is a help to society. One of the methods is setting up a whistle-blowing hotline with an option for anonymous reporting.
Using an internal system will place the reporter, the alleged, the information and the issue / concern at high risks, simply because administrators and the super users will always have access to the information. Bottom line is everyone has friends! The purpose of anonymity, in substance, is to put in practice a system that prevents an individual and the associated elements from coming to any harm (e.g. retaliation, etc.). Thus, going with a third party provider is the best solution.
WHAT ARE SOME OF WHAT ARE THE 2 MAJOR IMPLEMENTATION MISTAKES? THE COMMON PITFALLS FROM THE TIME A CASE IS Assuming it’s about the money. REPORTED TO THE TIME Studies have shown that a majority of whistle-blowers don’t do it for pecuniary OF THE FINAL REPORT IS benefit; but for genuine well-being of the company. Hence companies which do RELEASED? not listen to internal complaints due to assuming the motives are not genuine, lose the benefit of information provided by a whistle-blower and the call rates drops dramatically and so does the faith in the company. Not investing in a third-party hotline. 20
INTERNAL AUDITOR - MIDDLE EAST
1. Does having zero calls in a company’s hotline convey lesser risk? One of the key cornerstone of success for a function like Ethics and Compliance, lies on the back of the whistle-blowing hotline’s success. Fewer calls could also mean that
people are afraid to report because of management’s reaction toward them or because people do not have faith in the system or just because of poor marketing.
How do you avoid this? The Ethics and Compliance function should expand its horizon to build efficient pipeline of interaction, information collection points and input beyond the hotline such that the information lands at the desk of a Compliance Officer. 2. Thinking that employees will always willingly report suspected fraud and/or misconduct. Many employees are apt to let matters rest and not make a report in the belief that that a report may well lead to some adverse action against them.
How do you avoid this? One of the cardinal principles of this entire scenario is to ensure that employees who are whistle-blowers are not going to face any sanctions against anyone in the hierarchy. In other words an employee JUNE 2016
TO COMMENT on the article, EMAIL the author at drobinsingh@gmail.com
must have the confidence that not only will his identity be respected. This can be best done by establishing whistle-blower protection program in the whistle-blowing policy which speaks about sanctions against any staff or a senior management involved in retaliation towards a whistleblower. 3. Should you treat anonymous reports as unreliable? This is a double-edged sword. Anonymous reports are to protect employees and in no way delegitimize the report. An employee’s information (not his /her name) is critical to the success of an investigation.
How do you avoid this? One important aspect of whistle-blowing is to ensure that vindictive reporting is not only ignored but the person involved cautioned against for the same. The ability to distinguish between valid and vindictive claim / allegation is an important part of the zig-saw puzzle.
“Effective hotlines are the best way to detect fraud” 4. Confusing between vindictive and genuine complaints The department must be able to differentiate between the two. Failure to do this can lead to diminishing confidence of the employees in management and functions like Ethics and Compliance.
How do you avoid this? It is advisable to have an initial information check An initial information check always helps, e.g. if an employees named look at the personal file, review declarations, speak to his/her manager in confidence, etc.. The cardinal principle of jurisprudence “Innocent until proved guilty” should be the guiding tenet. 5. Information versus integrity / honesty. Not being able to show a correct picture to a non-anonymous whistle-blower can lead to a collapse of the entire governance structure. Don’t keep a whistle-blower in JUNE 2016
Hotlines
the darkness of being able to protect his identity when you can’t.
8. Confidentiality and protecting alleged / suspect unless proven guilty.
How do you avoid this?
Information leaks are pretty common between Chinese walls during an investigation. An unexpected / negligent leak, before a conclusion, can ruin the reputation of the accused.
Key pillar of a governance structure is accountability with its nucleus being integrity. Non-anonymous Whistle-blowers should be made aware that if the case goes for prosecution and the authorities seek details for indictment, then his /her name would have to be disclosed. However, if a personnel from the management such as board of director or the CXO makes any attempt to identify the whistle-blower, the Ethics and Compliance function must make it a point to say “STOP”. The biggest problem is, if it is not written it is not true, so put it in the policy. 6. Identify the essence of an investigation. The aim of an investigation is not to focus on a single employee but take in the entire gamut of the case and identify who all are involved. The key is to identify, interpret and resolve various scenarios arising from the allegation.
How do you avoid this? Consider creating a linked analysis and though job descriptions of the alleged (whom you have received direct evidence about) and try to see whom all can be encompassed. A wide horizon, reference to previous complaints, advice from Legal Counsel is essential while evaluating the case / report (not the person!) 7. Who should control the interview? Letting the witness or reporter lead the interview can greatly twist the facts and the scope of an investigation.
How do you avoid this? Determine the objective of the interview; Define guidelines (A one-pager) to define boundaries in an admission seeking or Information gathering interviews. Make it a point to have a clear picture of the case and identify the role of the cogs (confidants and others) in the larger picture of the crime. Unless you are able to join all the dots with appropriate and adequate evidence the alleged is “INNOCENT”.
How do you avoid this? No promises should be made to any of the parties. In a conflict of Interests case, an information leak can be damaging to a person’s reputation, specially “In case” it turns out that a perceived conflict does not exist. Place a comprehensive chapter in Compliance Program Manual on Investigation, the methodology, basis for disclosing information, etc. to safeguard a compliance officer / investigator and their rights. Lately, with the issuance of the Yates Memo in the United States, it is clear that governments are defining mechanisms to hold individuals accountable for a corporate wrong doing, which was never the case earlier. This can go to the extent of prosecuting a person administering a compliance program.
Conclusion A hotline is single most important contact of Compliance officer with all the employees. The analysis of the data and the types of concerns recorded give a tremendous insight into what is happening within the organization, what are the pain points and what type of support is needed at the bottom of the organizational pyramid. It is imperative that a compliance officer never stops employees from reporting other side concerns (such as regulatory reporting, etc.) but at the same time it should not stretch out to the spectrum of useless concerns. Thus, mature management across the world are naming it as “Helpline” rather than just “Hotline”. Useless concerns can dilute the analysis, final outcome and impair the management’s sight to take diligent decisions. Keep an eye on the same. Lastly, For a Ethics / Compliance or a Fraud Examiner, the buck doesn’t stop with the implementation of the hotline but the core work starts after the implementation of the hotline ROBIN SINGH, MSc.– LAW, MBA, MIT, CFE, CFAP is Senior Ethics / Fraud Control Officer at Abu Dhabi Health Services Company (SEHA). INTERNAL AUDITOR - MIDDLE EAST
21