Should We Respect Pro Wrestling and Pro Wrestlers? Essay -- Expository

Pro Wrestlers – Why Can’t They Get Any Respect? Time to point out the obvious: pro-wrestling is not a sport. Why? Because pro-wrestling involves no sport[ing]. Wrestlers do not show up to work every day trying to do all they can to win; they show up to work trying to do all they can to do their job, which is entertain the fans. However, this line of thinking often leads to another conclusion: If pro wrestling is not a sport, then wrestlers are not athletes. This could not be further from the truth. What pro wrestlers do in the ring day in and day out may not be sport, but it is athletic activity on the most demanding level. It is high time that the men and women who work harder than any other professional athletes got a little respect. Think about the four major sports in America: football, baseball, basketball, and hockey. Football players perform once a week. Hockey and basketball players work from 2-4 times a week. Baseball players may play up to five games a week, but the physicality of that sport is much lower than the other three (especially football and hockey). Now, how often do professional wrestlers perform? Well, for example, the World Wrestling Federation performs three weekly shows: Raw on Mondays, Smackdown! on Thursdays, and Heat on Sundays. In addition, each month there is a Pay-Per-View event on a single Sunday. Now, that means 3-4 times per week, already even with hockey and basketball players. However, wrestlers also work what are called House Shows: non-televised "events-between-events." They can do up to 3 a week in addition to their already[-] busy schedules. Not wrestling today? Get on the bus and travel to the next town. Not travelling today? Get in the gym and train. The work never ends. Take ... ... millions watching around the world. Hart fell from rafters 40 feet above the ring, hitting his head on a turnbuckle on the way down and snapping his neck. He died on impact, during what was a common way for him to enter the ring as his "Blue Blazer" persona. Knee and back injuries plague wrestlers from Hulk Hogan to Steve Austin and all the way down, and always have. Pro wrestling is just as dangerous as pro football. And wrestlers get paid a whole lot less, on average. Pro wrestling is not for everyone, and I would be naive to think I could change a lot of minds with this piece. However, I hope I have given sufficient examples as to why pro wrestlers should be given more respect as athletes. A final thought: many pro athletes cannot speak straight when interviewed after a game, but pro wrestlers have to be passable actors, in addition to their athletic prowess.

Health Care System :: Health, Nursing, Denial of Coverage

Today's healthcare environment is increasingly complex, as issues compete for importance. As a consequence of this, nurses frequently face ethical dilemmas. In deciding the best course of action in such dilemmas, nurses can look for guidance to professional standards of conduct, such as those enumerated in the Code of Ethics of the American Nursing Association (ANA). According to Mahlmeister (1996), each nurse should own a copy of the ANA code, as this document can provide guidance on situations that nurses face on an almost daily basis. For example, consider a situation that may result from one hospital trying to institute policies concerning cost containment. In order to keep the cost down, the nurse in charge of a 7 bed unit (without a nurse's assistance) is expected under a restructuring plan to also work a second adult ward if there are fewer than three children on the pediatric unit during the night shift (Mahlmeister, 1996). This split shift leaves these pediatric patients unattended while the nurse is in the adult ward. The ANA Code of Ethics states that it is the nurse's responsibility "to safeguard the client and the public when health care and safety are affected by incompetent, unethical or illegal practice of any person" (Mahlmeister, 1996, p. 130). Even though this nurse was ordered by a manager to leave the pediatric setting, the nurse is personally accountable for his or her actions for any situation that may arise during this absence. Not only is this practice unacceptable professionally, but it is also problematic legalistically, as the nurse could be personally sued for any negative consequences to these patients (Mahlmeister, 1996). Therefore, it is the nurse's duty to recognize these unacceptable risks and exhaust all avenues available within the hospital to correct this requirement (Mahlmeister, 1996). Another problematic area of nursing concerns the denial of coverage that often ensues due to the advent of managed care organizations (MCOs). It is becoming increasingly more difficult to reconcile the needs of the patient in terms of quality care with what insurers are willing to pay for (Rushton, 1996). For example, Maria, a 10-year-old, is hit by a car while riding her bike. She is taken to the closest emergency room, which happens to be the Children's Hospital. She has a concussion, an open fracture of the left femur, a simple fracture of the left arm, and multiple abrasions (Rushton, 1996). The closest hospital that is part of Maria's MCO plan is an adult hospital without pediatric specialists, which is located more than 25 miles from present location. Health Care System :: Health, Nursing, Denial of Coverage Today's healthcare environment is increasingly complex, as issues compete for importance. As a consequence of this, nurses frequently face ethical dilemmas. In deciding the best course of action in such dilemmas, nurses can look for guidance to professional standards of conduct, such as those enumerated in the Code of Ethics of the American Nursing Association (ANA). According to Mahlmeister (1996), each nurse should own a copy of the ANA code, as this document can provide guidance on situations that nurses face on an almost daily basis. For example, consider a situation that may result from one hospital trying to institute policies concerning cost containment. In order to keep the cost down, the nurse in charge of a 7 bed unit (without a nurse's assistance) is expected under a restructuring plan to also work a second adult ward if there are fewer than three children on the pediatric unit during the night shift (Mahlmeister, 1996). This split shift leaves these pediatric patients unattended while the nurse is in the adult ward. The ANA Code of Ethics states that it is the nurse's responsibility "to safeguard the client and the public when health care and safety are affected by incompetent, unethical or illegal practice of any person" (Mahlmeister, 1996, p. 130). Even though this nurse was ordered by a manager to leave the pediatric setting, the nurse is personally accountable for his or her actions for any situation that may arise during this absence. Not only is this practice unacceptable professionally, but it is also problematic legalistically, as the nurse could be personally sued for any negative consequences to these patients (Mahlmeister, 1996). Therefore, it is the nurse's duty to recognize these unacceptable risks and exhaust all avenues available within the hospital to correct this requirement (Mahlmeister, 1996). Another problematic area of nursing concerns the denial of coverage that often ensues due to the advent of managed care organizations (MCOs). It is becoming increasingly more difficult to reconcile the needs of the patient in terms of quality care with what insurers are willing to pay for (Rushton, 1996). For example, Maria, a 10-year-old, is hit by a car while riding her bike. She is taken to the closest emergency room, which happens to be the Children's Hospital. She has a concussion, an open fracture of the left femur, a simple fracture of the left arm, and multiple abrasions (Rushton, 1996). The closest hospital that is part of Maria's MCO plan is an adult hospital without pediatric specialists, which is located more than 25 miles from present location.

Social Perception, and Attribution, and Individual Decision Making

Social Perception, and Attribution, and Individual Decision Making Perception is the process of receiving information about and making sense of world around us. It involves deciding which information notice, how to categorize this information and how to interpret it within the framework of existing knowledge. Another definition of perception is â€Å"A process by which individuals organize and interpret their sensory impressions in order to give meaning to their environment†.We can summarize the perception with this sentence â€Å"We don’t see the things as they are, we see things as we are†. Why is perception important in the study of Organizational Behaviour? Simply because people’s behaviour is based on their perception of what reality is, not on reality itself. Virtually all management activities rely on perception.In appraising performance, managers use their perceptions of an employee’s behaviour as a basis for evaluation. Factors that influen ce perception are categorized to three groups; 1)Factors in the perceiver: Attitudes, Motives, Interests, Experience, Expectations 2)Factors in the situation: Time, Work Setting, Social Setting 3)Factors in the target: Novelty, Motion, Sounds, Size, Background, Proximity, Similarity Shortcuts used in judging others; )Selective Perception: a characteristic that make someone stand out in our mind will increase the probability that it will be perceived 2)Halo Effect: drawing a general impression based on a single characteristic 3)Contrast Effects: our reaction is influenced by others we have recently encountered 4)Projection: the tendency to attribute our own characteristics to other people 5)Stereotyping: judging someone on the basis of our perception of the group to which they belong Attribution in OrganizationsAttribution simply refers to how a person explains the cause of another’s or his or her own behaviour. Attribution thus is the most relevant application of perception c oncepts of organizational behaviour-the issue of person perception. The attributions or inferred causes we provide for behaviour have important implications in organizations. In explaining the causes of employee performance, good or bad, we are asked to explain the behaviour that was the basis for the performance.Attribution Theory suggests that when we observe an individual’s behaviour, we attempt to determine whether it was internally or externally caused: Internally; believed to be under the personal control of the individual Externally; resulting from outside causes. Determinants of Attribution Distinctiveness; whether an individual displays different behaviors in different situations. Consensus; if everyone who faces a similar situation responds in the same way. Consistency; does the person respond the same way over time.Individual Decision Making Individuals in organizations make decisions. That is, they make choices from among two or more alternatives. Decision-making is almost universally defined as choosing between alternatives. Decision-making is a critical activity in the lives of managers. The decisions a manager faces can range from very simple, routine matters for which the manager has an established decision rule(programmed decisions) to new and complex decisions that require creative solutions(non-programmed decisions). Decision-Making ProcessManagers have to make decisions whether they are simple or extremely complex. Making a good decision is a difficult exercise. It is the product of deliberation, evaluation and thought. To make good decisions, managers should invariably follow a sequential set of steps. 1)recognize the problem and need for a decision 2)identify the objective of the decision 3)gather and evaluate data and diagnose the situation 4)list and evaluate alternatives 5)select the best course of action 6)implement the decision 7)gather feedback 8)follow up

History of the Fbi and Women

OUTLINE FOR PARAGRAPH 1 When J. Edgar Hoover took over the Bureau in 1924, he inherited two female agents: Jessie B. Duckstein and Alaska P. Davidson, who both resigned within a few months as part of the Bureau’s reduction of force. In 1972, JoAnne Misko and Susan Malone were the first two women to enter the FBI Academy. In 1978, Special Agent Christine Karpoch (Jung) would become the first female firearms instructor—and she would shoot the coveted â€Å"possible,† a perfect score on the FBI’s Practical Pistol Range.In 1990, Special Agents Susan Sprengel and Helen Bachor were sent to London and Montevideo, Uruguay to serve as the FBI’s first female assistant legal attaches. In 2001, Special Agent Kathleen McChesney became the first woman to attain the rank of executive assistant director. Up until 1972 the FBI did not accept applications from women to become special agents. More than 2,600 women special agents currently serve and lead in all roles i n the FBI. The FBI originated from a force of special agents created in 1908 by Attorney General Charles Bonaparte during the presidency of Theodore Roosevelt.Martha Dixon Martinez was the first female agent in the field office to be certified as a SWAT team member. In the four decades since women have served as FBI agents, they’ve taken on one of the most difficult—yet vitally important—roles in the Bureau: going undercover. It was in 1972—40 years ago this year—that women were allowed to join the ranks of FBI agents, reversing a policy that had been in place since the 1920s. The first major expansion in Bureau jurisdiction came in June 1910 when the Mann (â€Å"White Slave†) Act was passed, making it a crime to transport women over state lines for immoral purpose.William J. Flynn, former head of the Secret Service, became Director of the Bureau of Investigation in July 1919 and was the first to use that title. From 2010 to 2012, the FBI di sciplined 1,045 employees for a variety of violations, according to the agency. Eighty-five were fired. June 29, 1908 Attorney General Bonaparte begins hiring special agent force. March 1909 Named Bureau of Investigation. April 30, 1912 Alexander Bruce Bielaski appointed Chief of the Bureau. They were pioneers, the first trio of women known to serve as Bureau special agents and among the first women in federal law enforcement.All three women did well in training at the New York office and, in general, performed up to standard. Alaska Davidson and Jessie Duckstein were assigned to the Bureau’s Washington field office. Both were dismissed when newly appointed Director J. Edgar Hoover dramatically cut the Bureau rolls in the spring of 1924 to clean house following the Teapot Dome scandals. Lenore Houston was hired after these initial cuts and served the longest of the three. She, too, was assigned to the Washington office. She was asked to resign in 1928.It would be nearly anoth er half century—May 1972– before social mores would change and women special agents would become a regular and vital part of the FBI. October 11, 1925 First special agent killed in line of duty. January 1, 1928 Instituted formal training program for new agents. March 14, 1950 â€Å"Ten Most Wanted Fugitives† program launched. May 8, 1972 New, modern FBI Academy training facility opened at Quantico, Virginia. October 10, 2001 Most Wanted Terrorists list created. OUTLINE FOR PARAGRAPH 2-4?Cassandra Chandler Cassandra Chandler is a graduate of Louisiana State University, where she received a Bachelor of Arts in Journalism and English. She earned her Juris Doctorate from the Loyola University School of Law and became a member of the Louisiana State Bar. Prior to joining the FBI, Mrs. Chandler enjoyed a career as a television news anchorperson, reporter, and talk show host for a major network affiliate in Baton Rouge, Louisiana. She also practiced law with the U. S. Army Corps of Engineers in New Orleans, Louisiana. Mrs. Chandler began her investigative career as a Special Agent in 1985.She first served in the FBI’s New Orleans and Los Angeles Field Offices, where she investigated white-collar crimes, violent crimes, and civil rights violations. Mrs. Chandler has held numerous managerial positions throughout her career with the FBI, both in the field and at FBI Headquarters. In 1991 Mrs. Chandler was promoted to Supervisory Special Agent in the Legal Counsel Division at FBI Headquarters to support the defense of the Bureau and its personnel in civil litigation matters. She was later assigned as a manager in the Criminal Investigative Division, where she assisted with the creation of the FBI’s Health Care Fraud Program.Following a promotion to supervisor of white-collar crimes in the San Diego Field Office, Mrs. Chandler oversaw numerous joint agency operations, including one of the country’s first international health care fraud undercover operations. She also managed the El Centro Resident Agency, which investigated violent crimes, including cross border kidnappings, and environmental crimes. In 1997 she was promoted to Assistant Special Agent in Charge in the San Francisco Field Office where she oversaw the office’s White-Collar Crime Program, National Foreign Intelligence Program, and Terrorism Program.She also managed the division’s largest Resident Agency in Oakland, California. Her next promotion was to Section Chief in the Investigative Services Division, where she oversaw the FBI's Analytical Intelligence Program for Criminal and Domestic Terrorism. She then was appointed Assistant Director of the Training Division, where she was responsible for managing the FBI Academy and the FBI’s other training and career development programs. In 2002, Mrs. Chandler was appointed Assistant Director of the Office of Public Affairs.In that capacity she was responsible for managing all of the FBI’s public affairs operations and serving as the FBI’s National Spokesperson. In 2005 Mrs. Chandler was appointed Special Agent in Charge of the Norfolk Field Office. In that role, she is responsible for managing and leading all of the FBI’s investigations and operations in Norfolk, VA and the 17 surrounding counties. Charlene B. Thornton Charlene Thornton is a graduate of Marion College, Marion, Indiana, where she received a Bachelor of Arts degree in Economics and Political Science.She later received a Juris Doctorate degree from Indiana University’s School of Law, and a Master's from the University of San Diego’s School of Law. Prior to joining the FBI, she worked as an Intern in the Marion County Prosecutors office. Mrs. Thornton's first assignment with the FBI was to the Indianapolis Field Office, where she was responsible for investigating bank robberies and property crimes. Next, she transferred to the Los Angeles Field Office, where she investigated white-collar crime, counterterrorism, and drug matters. Mrs.Thornton has held numerous managerial positions throughout her career with the FBI, both in the field and at FBI Headquarters. She began her managerial career as a Supervisory Special Agent in the Legal Research Unit at Headquarters, and was later promoted to Chief of this unit. She then served as an Assistant Inspector in the Inspection Division, and as a Supervisor in the Baltimore Field Office and in the Southern Maryland Metropolitan Resident Agency. Her next promotion was to Assistant Special Agent in Charge of the Honolulu Division, where she oversaw the FBI’s extraterritorial investigations throughout Asia nd the Pacific. In 1997 Mrs. Thornton was promoted to Deputy General Counsel, where she oversaw the FBI's Legal Training, Legal Forfeiture, and Legal Advice programs. Next, she became an Inspector in the Inspection Division and in 1999 she was named Special Agent in Charge of the Birmingham Field Office, where she was responsible for managing all FBI operations and investigations in northern Alabama. In 2002 Mrs. Thornton became Special Agent in Charge of the Phoenix Field Office, where she was responsible for managing all FBI operations and investigations in the state of Arizona.In 2004, Mrs. Thornton was promoted to Assistant Director of the FBI’s Inspection Division. In that capacity she was responsible for managing all Inspection Division operations and providing independent, evaluative oversight of all FBI investigative and administrative operations. In August 2006, Mrs. Thornton was appointed Special Agent in Charge of our San Francisco field office, where she manages investigations and operations for the northern and central coast regions of California. Kimberly K.Mertz Kimberly Mertz is a graduate of Creighton University in Omaha, Nebraska, where she earned a Bachelor of Science in Business Administration and a Juris Doctorate degree. Ms. Mertz became an FBI Special Agent in 1989, and her first assignment was to the San Diego Field Office. She later served as the Supervisory Senior Resident Agent of the El Centro Resident Agency, San Diego Field Office. Ms. Mertz has held numerous managerial positions throughout her career with the FBI, both in the field and at FBI Headquarters. In 1999, Ms.Mertz was promoted to the Public Corruption Unit at FBI Headquarters, where she served as a Supervisory Special Agent. She was later promoted to Chief of the Public Corruption Unit. In 2001, Ms. Mertz was appointed Assistant Special Agent in Charge of the Honolulu Division. In 2003 Ms. Mertz became an Inspector in the Inspection Division, and in early 2005 she was designated as the Chief Inspector. In November 2005, Ms. Mertz was appointed to serve as the Special Agent in Charge of the New Haven Field Office. In that capacity she is responsible for managing all FBI operations and investigations in the state of Connecticut.

Case: Grupo Bimbo Essay

Grupo Bimbo continuous expansion with an ambition to become one of the five-largest bakers in the world, while the company’s performance in existing foreign markets should be improved so fore made profitable and keep company away from financial hazard due to acquiring losses and lack of substantial profit from foreign markets. Almost 70% of Grupo Bimbo’s sales came from Mexico, where the company had built a 90% market share in the packaged bread segment, the business was very profitable and the company operated in growing market. However, the investments in U.S. and Latin America, where markets were highly competitive, have not been profitable. According Grupo Bimbo’s global strategy – to become one of the five-largest bakers in the world – it had launched a series of strategic initiatives to make foreign operations successful. In March/April, it had purchased the Beijing Panrico Food Processing Center that had already established operations in China. Sub-problems†¢Grupo Bimbo should adapt its distribution networks to each country’s differences (union’s pressure in U.S., inexperienced independent operators in Brazil, modifying China’s distribution structure to rely on bicycles). Because of nature of the products (fresh bread), Grupo Bimbo must service stores directly, on a daily basis. This places tremendous demands on the distribution network to guarantee uninterrupted, fresh product deliveries. The wide geographical spread of the business created by Bimbo’s rapid international expansion called for complicated logistical planning to keep the business functioning efficiently. †¢Very different markets in Mexico, the United States, Latin America and China required distinct ways of operating activities and price setting standards. While 80% of Mexico sales still were through ‘mom and pop’ stores, allowing to control where, when, how and for what price products were sold, 80% of the sales in U.S. and 70% in Latin America transpire through large supermarkets. The power of supermarkets as a main chain of the product distribution in domestic Mexica`s, as well as Brazil and Argentina markets increases their bargaining power was very high. The company should find the  best practices how to customize the relationships with these large chains in newly established market in China. †¢Differences in cultures and in markets among multinational Bimbo divisions. One of them is a cultural difference in human resource management in South America- â€Å"even basic phrases such as -I’ll do it right way- in Spanish needed to be adjusted based on individual countries†. Even in Latin America countries in addition to the language differences there are differences in their consumption of manufactured-produced bread- â€Å"Artisanal bread is king, with neighborhood bakeries making baguettes and French bread†. In U.S. very important difference in bread consumption is based on popularity the fad and low- carbohydrates diets. Grupo Bimbo should adapt its product assortment to these differences through new products launches, favorable and efficient sales mix and strong volumes. â€Å"In Mexico, our company has been very successful, and success typically leads to rigidity and makes it difficult to see changes in the environment. We should reflect on our current situation while keeping everything open for change.†Three Dimensions of Distance:Three Dimensions of Distance according Bimbo’s operations in Chinese market:†¢Cultural Distance – The Chinese language is a very important issue what should be taken into account. The different local needs and tastes of Chinese’s customers. Grupo Bimbo should develop products for local tastes. Bimbo has very successful product position- tortillas, which is not chosen by Chinese experts for Chinese markets. Grupo Bimbo saw promise in the Chinese market for ongoing expansion of its packaged breads, buns, croissants, and sweet rolls, using store promotion and university and school road shows. The way of doing business – focus on achieving trust with people, including how you can be trusted by them. However, the two years studies of China in the pre-acquisition research phase was done by hired team of Chinese immigrants living in Mexico, but not local Chinese residents. It could result in the wrong understanding off Chinese market. †¢Geographic Distance – China is geographically far from Mexico, what could influence such business sides: control and strategic business development.  Different infrastructure approaches, for example employees in China were riding bicycles to transport the products and manage the shelf space, for example, in the America products were transported by trucks. Speaking about the size of the market – The Grupo Bimbo overestimated the size of the market, as says in the case, the large proximate market the company could serve. The size doesn’t’ guarantee the prognoses sales. †¢Economic Distance – diverse work organization approaches. Human resources side, the 775 employees acquired with the purchase of Beijing Panrico, their different work style. Bimbo successes in improving the manufacturing productivity – they made the operational upgrades in standards. Economic Distances: Chinese Bimbo Company served a regional area of 40 million people, its 186 routes were linked by a combination of trucks and bicycles and all that is maintained by only 775 employees. It was able to access over 4000 points of sale, what was too small figure for the served population number. Grupo Bimbo should expand the distribution network and improve efficiencies. Previously the Chinese plant’s company had left the local employees â€Å"largely on their own†. Grupo Bimbo should improve productivity of the plant by operational changes. If Grupo Bimbo would like to become a leader in Chinese market, the priority should be Cultural Distances. As the company acquired the plant in order to make the production process locally and already established changes in production process to make it more efficient- that’s mean The Grupo Bimbo goes for Multi-domestic strategy (low costs, high localization). As we see from the Exhibit 7, the Panrico Group, bought by Grupo Bimbo, market share was only 0,1%. But in the same time the artisanal bread has 53,8% of market share. Such a high figure shows us that Chinese do not like the industrial- manufacturing bread. It is similar to people preference in South America. To realize this strategy successfully, it has to set the priority for dealing with cultural differences due to it is most important as it served the bases for choosing the right products based on the Chinese consumer demands and  tastes, as well as language barriers according local employees and suppliers. REFERENCES: harward business school. by jordan siegel march 23 2007

A Rose for Emily. Analysis

Jack Wu English 1B – Professor Meehan 03/05/13 â€Å"Rose for Emily† Analysis In â€Å"A Rose for Emily†; William Faulkner details the loneliness and selfishness of peculiar woman, Miss Emily. Miss Emily is unable to grip the idea of death and suffers great deals of denial. After the death of her father, the townspeople expected her to be in a state of grief but alas she is not. Instead she proceeds to say that her father is very well with her, alive. William Faulkner’s idea of grieving is clear in this story because he shows his audience that it is better to accept death than to ignore it through the accounts of Miss Emily’s journey.William Faulkner’s story takes place in the South, during a time period of racial discrimination and major political change. By using reader response criticism, a reader can analyze â€Å"A Rose for Emily† through the aspects of the secret held within the story, race found through anthropology, and gender found through anthropology. To begin with, one can analyze â€Å"A Rose for Emily† by examining the underlying hidden message found within the story. The hidden message that William Faulkner tried to convey in his story was the themes of death and change.Death looms through the story from the beginning right on through to the end as the narrator begins describing the beginning of Miss Emily’s funeral. Miss Emily herself chooses not to accept the fate of death when her extremely controlling father passes away. Miss. Emily later killed Homer to ensure that he would never leave her. This is Miss Emily’s most severe attempt to preserve her life and the time period in which she lived. Miss. Emily believes that having nothing is less painful than grief over something lost. To further examine â€Å"A Rose for Emily† is by analyzing gender, Mr.Faulkner explains the roles of women in the South and how they were seen through the eyes of men. One can clearly see tha t through the opening sentence of the story, the narrator is stating that women gossip while men are caring and serious. This is only one of many passages that show that Mr. Faulkner is attempting to make men the stronger gender. â€Å"Only a man of Colonel Satoris’s generation could have invented it and only a women could have believed it† Faulkner. Colonel Satoris is described as being an ingenious man but in this sentence, Miss Emily’s name isn’t even mentioned when the two are compared.The statement made in this story is that men are the better gender. There are many aspects that were incorporated into â€Å"A Rose for Emily†. William Faulkner was able to create a story involving many ideas about society and how it functioned in a specific time period in the South. To further examine â€Å"A Rose for Emily†, one can use the reader response criticism and analyze the aspects of the hidden message found within the story, gender and race fou nd through anthropology. â€Å"A Rose for Emily† is an important element in literature due to examination of the effects of change created in the olden South.

Fraud Risk Management

Fraud risk management A guide to good practice 1 This guide is based on the fi rst edition of Fraud Risk Management: A Guide to Good Practice. The fi rst edition was prepared by a Fraud and Risk Management Working Group, which was established to look at ways of helping management accountants to be more effective in countering fraud and managing risk in their organisations. This second edition of Fraud Risk Management: A Guide to Good Practice has been updated by Helenne Doody, a specialist within CIMA Innovation and Development.Helenne specialises in Fraud Risk Management, having worked in related fi elds for the past nine years, both in the UK and other countries. Helenne also has a graduate certifi cate in Fraud Investigation through La Trobe University in Australia and a graduate certifi cate in Fraud Management through the University of Teeside in the UK. For their contributions in updating the guide to produce this second edition, CIMA would like to thank: Martin Birch FCMA, MBA Director – Finance and Information Management, Christian Aid.Roy Katzenberg Chief Financial Offi cer, RITC Syndicate Management Limited. Judy Finn Senior Lecturer, Southampton Solent University. Dr Stephen Hill E-crime and Fraud Manager, Chantrey Vellacott DFK. Richard Sharp BSc, FCMA, MBA Assistant Finance Director (Governance), Kingston Hospital NHS Trust. Allan McDonagh Managing Director, Hibis Europe Ltd. Martin Robinson and Mia Campbell on behalf of the Fraud Advisory Panel. CIMA would like also to thank those who contributed to the fi rst edition of the guide. About CIMACIMA, the Chartered Institute of Management Accountants, is the only international accountancy body with a key focus on business. It is a world leading professional institute that offers an internationally recognised qualifi cation in management accounting, with a full focus on business, in both the private and public sectors. With 164,000 members and students in 161 countries, CIMA is committed to upho lding the highest ethical and professional standards of its members and students.  © CIMA 2008. All rights reserved.This booklet does not necessarily represent the views of the Council of the Institute and no responsibility for loss associated to any person acting or refraining from acting as a result of any material in this publication can be accepted by the authors or publishers. Acknowledgements Fraud risk management: a guide to good practice 2 Contents Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Fraud – its extent, patterns and causes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1. 1 What is fraud? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1. 2 The scale of the problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1. 3 Which businesses are affected? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1. 4 Why do people commit fraud? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1. 5 Who commits fraud? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1. 6 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Risk management – an overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 2. 1 Wh at is risk management? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 2. 2 Corporate governance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 2. 3 The risk management cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 2. 4 Establish a risk management group and set goals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2. 5 Identify risk areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2. 6 Understand and assess the scale of risk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2. 7 Develop a risk response strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2. 8 Implement the strategy and allocate responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2. 9 Implement and monitor suggested controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2. 10 Review and refi ne and do it again . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2. 11 Information for decision making . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2. 12 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Fraud prevention . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 3. 1 A strategy to combat fraud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 3. 2 Developing a sound ethical culture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 3. 3 Sound internal control systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 3. 4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Fraud detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 4. 1 Detection methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 4. 2 Indicators and warnings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 4. 3 Tools and techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 4. 4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Responding to fraud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 5. 1 Purpose of the fraud response plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 5. 2 Corpor ate policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 5. 3 Defi nition of fraud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 5. 4 Roles and responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 5. 5 The response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 5. 6 The investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 5. 7 Organisation’s objectives with respect to dealing with fraud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 5. 8 Follow-up action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 5. 9 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 1 2 3 4 5 3 Appendices Appendix 1 Fraud and the law . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Appendix 2 Examples of common types of internal fraud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Appendix 3 Example of a risk analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Appendix 4 A sample fraud policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Appendix 5 Sample whistleblowing policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Appendix 6 Examples of fraud indicators, risks and controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Appendix 7 A 16 step fraud prevention plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 Appendix 8 Outline fraud response plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Appendix 9 Example of a fraud response plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Appendix 10 References and further reading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Appendix 11 Listed abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Figures Figure 1 Types of internal fraud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Figure 2 The fraud triangle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Figure 3 The CIMA risk management cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Figure 4 Anti-fraud strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Figure 5 Ethics advice/services provided . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Figure 6 Meth ods of fraud detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Case Studies Case study 1 Fraud doesn’t involve just money . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Case study 2 Size really doesn’t matter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Case study 3 A breach of trust . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Case study 4 Management risk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Case study 5 A fi ne warning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Case study 6 Vet or regret? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Case study 7 Tipped off . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Case study 8 Risk or returns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Case study 9 Reporting fraud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Case study 10 TNT roots our fraud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 4 5 Periodically, the latest major fraud hits the headlines as other organisations sit back and watch, telling themselves that ‘it couldn’t happen here. ’ But the reality is that fraud can happen anywhere. While only relatively few major frauds are picked up by the media, huge sums are lost by all kinds of businesses as result of the high number of smaller frauds that are committed. Surveys are regularly carried out in an attempt to estimate the true scale and cost of fraud to business and society. Findings vary, and it is diffi cult to obtain a complete picture as to the full extent of the issue, but these surveys all indicate that fraud is prevalent within organisations and remains a serious and costly problem. The risks of fraud may only be increasing, as we see growing globalisation, more competitive markets, rapid developments in technology, and periods of economic diffi culty. Among other fi ndings, the various surveys highlight that: organisations may be losing as much as 7% of their annual turnover as a result of fraud †¢ corruption is esti mated to cost the global economy about $1. 5 trillion each year †¢ only a small percentage of losses from fraud are recovered by organisations †¢ a high percentage of frauds are committed by senior management and executives †¢ greed is one of the main motivators for committing fraud †¢ fraudsters often work in the fi nance function †¢ fraud losses are not restricted to a particular sector or country †¢ the prevalence of fraud is increasing in emerging markets. Introduction Despite the serious risk that fraud presents to business, any organisations still do not have formal systems and procedures in place to prevent, detect and respond to fraud. While no system is completely foolproof, there are steps which can be taken to deter fraud and make it much less attractive to commit. It is in assisting organisations in taking such steps that this guide should prove valuable. The original guide to good practice was based on the work of CIMA’s Fraud and Ri sk Management Working Group that was established as part of the Institute’s response to the problem of fraud. Since the publication of the original guide, we have continued to see high rofi le accounting scandals and unacceptable levels of fraudulent behaviour. This second edition of the guide includes updates to refl ect the many changes in the legal environment and governance agenda in recent years, aimed at tackling the ongoing problem of fraud. The guide starts by defi ning fraud and giving an overview of the extent of fraud, its causes and its effects. The initial chapters of the guide also set out the legal environment with respect to fraud, corporate governance requirements and general risk management principles. The guide goes on to discuss the key components of an anti-fraud strategy nd outlines methods for preventing, detecting and responding to fraud. A number of case studies are included throughout the guide to support the text, demonstrating real life problems th at fraud presents and giving examples of actions organisations are taking to fi ght fraud. Fraud risk management: a guide to good practice Management accountants, whose professional training includes the analysis of information and systems, can have a signifi cant role to play in the development and implementation of anti-fraud measures within their organisations. This guide is intended to help management accountants in that role and will also be seful to others with an interest in tackling fraud in their organisation. The law relating to fraud varies from country to country. Where it is necessary for this guide to make reference to specifi c legal measures, this is generally to UK law, as it would be impossible to include references to the laws of all countries where this guide will be read. It is strongly advised that readers ensure they are familiar with the law relating to fraud in their own jurisdiction. Although some references may therefore not be relevant to all readers, the general principles of fraud risk management will still apply and rganisations around the world are encouraged to take a more stringent approach to preventing, detecting and responding to fraud. 6 7 Defi nition of fraud The term ‘fraud’ commonly includes activities such as theft, corruption, conspiracy, embezzlement, money laundering, bribery and extortion. The legal defi nition varies from country to country, and it is only since the introduction of the Fraud Act in 2006, that there has been a legal defi nition of fraud in England and Wales. Fraud essentially involves using deception to dishonestly make a personal gain for oneself and/or create a loss for another. Although defi nitions vary, ost are based around these general themes. Fraud and the law Before the Fraud Act came into force, related offences were scattered about in many areas of the law. The Theft Acts of 1968 and 1978 created offences of false accounting, and obtaining goods, money and services by decept ion, and the Companies Act 1985 included the offence of fraudulent trading. This remains part of the Companies Act 2006. There are also offences of fraud under income tax and value-added tax legislation, insolvency legislation, and the common law offence of conspiracy to defraud. The Fraud Act is not the only new piece of legislation.Over the last few years there have been many changes to the legal system with regard to fraud, both in the UK and internationally. This guide focuses mainly on UK requirements, but touches on international requirements that impact UK organisations. In the UK, the Companies Act and the Public Interest Disclosure Act (PIDA) have been amended and legislation such as the Serious Crimes Act 2007 and the Proceeds of Crime Act 2002 (POCA) have been introduced. Internationally the Sarbanes-Oxley Act 2002 (Sarbox) has been introduced in the United States (US), a major piece of legislation that affects not only companies in the US ut also those in the UK and othe rs based all over the globe. Further information on these pieces of legislation can be found in Appendix 1. As well as updating the legislation in the UK, there have been, and will continue to be, signifi cant developments in the national approach to combating fraud, particularly as we see implementation of actions resulting from the national Fraud Review. Appendix 1 gives further information on the Fraud Review. There are also many law enforcement agencies involved in the fi ght against fraud in the UK, including the Serious Fraud Offi ce, the Serious Organised Crime Agency SOCA), the Financial Services Authority (FSA), and Economic Crime Units within the police force. Different types of fraud Fraud can mean many things and result from many varied relationships between offenders and victims. Examples of fraud include: †¢ crimes by individuals against consumers, clients or other business people, e. g. misrepresentation of the quality of goods; pyramid trading schemes †¢ em ployee fraud against employers, e. g. payroll fraud; falsifying expense claims; thefts of cash, assets or intellectual property (IP); false accounting †¢ crimes by businesses against investors, consumers and employees, e. g. i nancial statement fraud; selling counterfeit goods as genuine ones; not paying over tax or National Insurance contributions paid by staff †¢ crimes against fi nancial institutions, e. g. using lost and stolen credit cards; cheque frauds; fraudulent insurance claims †¢ crimes by individuals or businesses against government, e. g. grant fraud; social security benefi t claim frauds; tax evasion †¢ crimes by professional criminals against major organisations, e. g. major counterfeiting rings; mortgage frauds; ‘advance fee’ frauds; corporate identity fraud; money laundering †¢ e-crime by people using computers and technology to commit crimes, e. . phishing; spamming; copyright crimes; hacking; social engineering frauds. 1. 1 Wh at is fraud? 1 Fraud: its extent, patterns and causes Figure 1 Types of internal fraud Cash Non-cash Financial Non-fi nancial Confl icts of interest Bribery and extortion Asset misappropriation Fraudulent statements Corruption Internal fraud Fraud risk management: a guide to good practice 8 The fi nal of the three fraud categories is corruption. This includes activities such as the use of bribes or acceptance of ‘kickbacks’, improper use of confi dential information, confl icts of interest and collusive tendering. These types of internal fraud are summarised n Figure 1. Surveys have shown that asset misappropriation is the most widely reported type of fraud in UK, although corruption and bribery are growing the most rapidly. Further information on common types of internal fraud, and methods by which they may be perpetrated, is included in Appendix 2. This guide focuses on fraud against businesses, typically by those internal to the organisation. According to the Associa tion of Certifi ed Fraud Examiners (ACFE), there are three main categories of fraud that affect organisations. The fi rst of these is asset misappropriations, which involves the theft or misuse f an organisation’s assets. Examples include theft of plant, inventory or cash, false invoicing, accounts receivable fraud, and payroll fraud. The second category of fraud is fraudulent statements. This is usually in the form of falsifi cation of fi nancial statements in order to obtain some form of improper benefi t. It also includes falsifying documents such as employee credentials. 9 1. 2 The scale of the problem There have been many attempts to measure the true extent of fraud, but compiling reliable statistics around fraud is not easy. As one of the key aspects of fraud is deception, it can be diffi cult to identify and urvey results often only refl ect the instances of fraud that have actually been discovered. It is estimated that the majority of frauds go undetected and, even wh en a fraud has been found, it may not be reported. One reason for this may be that a company that has been a victim of fraud does not want to risk negative publicity. Also, it is often hard to distinguish fraud from carelessness and poor record keeping. Although survey results and research may not give a complete picture, the various statistics do offer a useful indication as to the extend of the problem. There can be no doubt that fraud is prevalent within organisations nd remains a serious issue. PricewaterhouseCooper’s Global Economic Crime Survey (PwC’s survey) in 2007 found that over 43% of international businesses were victims of fraud during the previous two years. In the UK, the fi gures were higher than the global average, with 48% of companies having fallen victim to fraud. Some surveys put the fi gures much higher. For example, during 2008, Kroll commissioned the Economist Intelligence Unit (EIU) to poll nearly 900 senior executives across the world. The EIU found that 85% of companies had suffered from at least one fraud in the past three years1. This fi gure had risen from 80% in a imilar poll in 2007. KPMG’s Fraud Barometer, which has been running since 1987, has also shown a considerable increase in the number of frauds committed in the UK in recent years, including a 50% rise in fraud cases in the fi rst half of 2008. According to the UK report of PwC’s survey, the average direct loss per company over a two year period as a result of fraud has risen to ? 1. 75 million, increasing from ? 0. 8 million in the equivalent 2005 survey. These fi gures exclude undetected losses and indirect costs to the business such as management costs or damage to reputation, which can be signifi cant. Management costs lone were estimated to be on average another ? 0. 75 million. Participants of the ACFE Report to the Nation 2008 (ACFE report) estimated that organisations lose 7% of their annual revenues to fraud. It is diffi cult to put a total cost on fraud, although many studies have tried to. For example an independent report by the Association of Chief Police Offi cers (the ACPO) in 2007 revealed that fraud results in losses of ? 20 billion each year in the UK. The World Bank has estimated that the global cost of corruption and bribery is about 5% of the value of the world economy or about $1. 5 trillion per year. It is thought that these stimates are conservative, and they also exclude other types of fraud such as misappropriation of assets. While it may be impossible to calculate the total cost of fraud, it is said to be more signifi cant than the total cost of most other crimes. According to the Attorney General in the UK, fraud is an area of crime which is second only to drug traffi cking in terms of causing harm to the economy and society2. 1 Kroll Global Fraud Report, Annual Edition 2008/2009 2 Attorney General’s interim report on the government’s Fraud Review, March 2006 Fraud risk managemen t: a guide to good practice 10 Case study 1 Fraud doesn’t just involve moneyCounterfeiting is one example of fraud that can have extremely serious consequences. Technology is ever improving, making it easier for counterfeiters to produce realistic looking packaging and fool legitimate wholesalers and retailers. Counterfeiting is a potentially lucrative business for the fraudster, with possibilities of large commercial profi ts, and it is a problem affecting a wide range of industries including wines and spirits, pharmaceuticals, electrical goods, and fashion. However, there are often many victims affected by such a fraud and not just the business that has been duped or had their brand exploited.For some, the outcome of counterfeiting goes way beyond fi nancial losses and can even be fatal: †¢ In late 2006, 14 Siberian towns declared a state of emergency due to mass poisonings caused by fake vodka. Around 900 people were hospitalised with liver failure after drinking indu strial solvent that was being sold as vodka. This is not a one off problem and sales of fake alcohol have been known to kill people. †¢ Also in 2006, a counterfeit product did result in more tragic consequences. At least 100 children died after ingesting cough syrup that had been mixed with counterfeit glycerine.The counterfeit compound, actually a dangerous solvent, had been used in place of more expensive glycerine. The manufacturing process had been sourced to China and the syrup passed through trading companies in Beijing and Barcelona before reaching its fi nal destination in Panama. The certifi cate attesting to the product’s purity was falsifi ed and not one of the trading companies tested the syrup to confi rm its contents along the way. It is thought that the number of deaths is likely to be much higher than the 100 cases that have been confi rmed. Fraud is often mistakenly considered a victimless rime. However, fraud can have considerable social and psychologic al effects on individuals, businesses and society. For example, when a fraud causes the collapse of a major company, numerous individuals and businesses can be affected. In addition to the company’s own employees, employees of suppliers can be affected by the loss of large orders, and other creditors, such as banks, can be indirectly affected by huge losses on loans. Consumers have to pay a premium for goods and services, in order to compensate for the costs of fraud losses and for money spent on investigations and additional security.Taxpayers also suffer due to reduced payments of corporation tax from businesses that have suffered losses. Fraud drains resources, affects public services and, perhaps of more concern, may fund other criminal and terrorist activity. According to the Fraud Review, fraud is a major and growing threat to public safety and prosperity. Case study 1 demonstrates just how much of a threat fraud can be to public safety and that there truly are victims of fraud. 11 1. 3 Which businesses are affected? Fraud is an issue that all organisations may face regardless of size, industry or country. If the rganisation has valuable property (cash, goods, information or services), then fraud may be attempted. It is often high profi le frauds in large multi-national organisations that are reported on in the media and smaller organisations may feel they are unlikely to be a target of fraudsters. However, according to the ACFE report, small businesses (classifi ed as those with less than 100 employees) suffer fraud more frequently than large organisations and are hit by higher average losses. When small companies are hit by large fraud losses, they are less likely to be able to absorb the damage han a larger company and may even go out of business as a result. The results of PwC’s survey showed that companies reporting fraud were spread across many industries, with at least a quarter of the respondents in any one industry suffering from f raudulent incidents. Industries suffering the highest average losses were insurance and industrial manufacturing. Losses in the fi nancial services industry, a sector frequently in the press and one with which fraud is often associated, were actually below average. Even not-for-profi t organisations are not immune to fraud, with government institutions nd many charities falling victim to unscrupulous fraudsters. As one director working in the international development and aid sector has pointed out, ‘In my sector, fraud is not a possibility, it is a reality and we are always dealing with a number of suspicious incidents on a more or less permanent basis. ’ PwC’s survey also revealed that incidences of fraud were highest in companies in North America, Africa and Central and Eastern Europe (CEE), where more than half of the companies reported fraud. It was lowest in the Western European region, although the UK was uch higher than the average for this region, with l evels of fraud similar to those in CEE. The EIU poll commissioned by Kroll in 2007 found that respondents in countries such as India and China have seen a signifi cant increase in the prevalence of corporate fraud in the last three years and this trend is likely to increase in businesses operating in emerging markets3. Although fraud is prevalent across organisations of all sizes and in all sectors and locations, research shows that certain business models will involve greater levels of fraud risk than others. The control environment hould be adjusted to fi t with the degree of risk exposure. Further guidance on risk assessment and controls is given in later chapters. 3 Kroll Global Fraud Report, Annual Edition 2007/2008 Fraud risk management: a guide to good practice 12 Case study 2 Size really doesn’t matter From a family affair†¦ A member of a small family business in Australia committed a $2m fraud, costing profi ts, jobs and a great deal of trust. The business owner s became suspicious when they realised that their son in law used the company diesel card to buy petrol for his own car.On closer scrutiny, they soon uncovered a company cheque for $80,000 made payable to the son in law’s personal account. BDO’s Brisbane offi ce discovered that the cheque and the fuel were just the tip of a vast iceberg. The company’s complex accounts system allowed the son in law to disguise cheques payable to himself as creditor payments. He then became a signatory and took ever larger cheques. He claimed that the poor cash fl ow was due to losses in one particular division which the family therefore closed, creating redundancies and losing what was in truth a successful business.The costs of ineffi cient accounting systems and undue trust can be massive. Every business should protect itself with thorough controls and vigilance. Adapted from ‘FraudTrack 5 Fraud: A Global Challenge’ published by BDO Stoy Hayward †¦ to a major corporate scandal WorldCom fi led for bankruptcy protection in June 2002. It was the biggest corporate fraud in history, largely a result of treating operating expenses as capital expenditure. WorldCom (now renamed MCI) admitted in March 2004 that the total amount by which it had misled investors over the previous 10 years was almost US$75 billion (? 2 billion) and reduced its stated pre-tax profi ts for 2001 and 2002 by that amount. WorldCom stock began falling in late 1999 as businesses slashed spending on telecom services and equipment. A series of debt downgrades raised borrowing costs for the company, struggling with about US$32 billion in debt. WorldCom used accounting tricks to conceal a deteriorating fi nancial condition and to infl ate profi ts. Former WorldCom chief executive Bernie Ebbers resigned in April 2002 amid questions about US$366 million in personal loans from the company and a federal probe of its accounting practices.Ebbers was subsequently charged with conspir acy to commit securities fraud and fi ling misleading data with the Securities and Exchange Commission (SEC) and was sentenced to 25 years in prison. Scott Sullivan, former Chief Financial Offi cer, pleaded guilty to three criminal charges and was sentenced to fi ve years in prison. Ultimately, losses to WorldCom shareholders were close to US$180 billion and the fraud also resulted in the loss of 17,000 jobs. The SEC said that WorldCom had committed ‘accounting improprieties of unprecedented magnitude’ – proof, it said, of the need for reform in the regulation of corporate ccounting. Adapted from CIMA Offi cial Learning System, Management Accounting Risk and Control Strategy 13 1. 4 Why do people commit fraud? There is no single reason behind fraud and any explanation of it needs to take account of various factors. Looking from the fraudster’s perspective, it is necessary to take account of: †¢ motivation of potential offenders †¢ conditions unde r which people can rationalise their prospective crimes away †¢ opportunities to commit crime(s) †¢ perceived suitability of targets for fraud †¢ technical ability of the fraudster expected and actual risk of discovery after the fraud has been carried out †¢ expectations of consequences of discovery (including non-penal consequences such as job loss and family stigma, proceeds of crime confi scation, and traditional criminal sanctions) †¢ actual consequences of discovery. A common model that brings together a number of these aspects is the Fraud Triangle. This model is built on the premise that fraud is likely to result from a combination of three factors: motivation, opportunity and rationalisation. Motivation In simple terms, motivation is typically based on either reed or need. Stoy Hayward’s (BDO) most recent FraudTrack survey found that greed continues to be the main cause of fraud, resulting in 63% of cases in 2007 where a cause was cited. Other causes cited included problems from debts and gambling. Many people are faced with the opportunity to commit fraud, and only a minority of the greedy and needy do so. Personality and temperament, including how frightened people are about the consequences of taking risks, play a role. Some people with good objective principles can fall into bad company and develop tastes for the fast life, which empts them to fraud. Others are tempted only when faced with ruin anyway. Opportunity In terms of opportunity, fraud is more likely in companies where there is a weak internal control system, poor security over company property, little fear of exposure and likelihood of detection, or unclear policies with regard to acceptable behaviour. Research has shown that some employees are totally honest, some are totally dishonest, but that many are swayed by opportunity. Rationalisation Many people obey the law because they believe in it and/or they are afraid of being shamed or rejected by eople the y care about if they are caught. However, some people may be able to rationalise fraudulent actions as: †¢ necessary – especially when done for the business †¢ harmless – because the victim is large enough to absorb the impact †¢ justifi ed – because ‘the victim deserved it’ or ‘because I was mistreated. ’ Figure 2 The fraud triangle Motivation Opportunity The fraud triangle Rationalisation Fraud risk management: a guide to good practice 14 Case study 3 A breach of trust A good example of the fraud triangle in practice is the highly publicised case of the secretary that stole over ? . 3 million from her bosses at Goldman Sachs. Motivation There were some suggestions that Joyti De-Laurey originally started down her fraudulent path because of fi nancial diffi culties she found herself in before starting work at the investment bank. De-Laurey had previously run her own sandwich bar business, but it was closed down due to ins uffi cient fi nances. According to her defence, De-Laurey’s ‘fi rst bitter experience of fi nancial turmoil coincided with a novel introduction to a Dallas-type world where huge, unthinkable amounts of money stared her in the face, day in and day out. The motive behind the fraud was primarily greed though, with De-Laurey spending her ill gotten gains on a luxury lifestyle, including villas, cars, jewellery, designer clothes and fi rst class holidays. De-Laurey has even admitted that she did not steal because she needed to, but because she could. She explained that she fi rst started taking money simply to fi nd out if she could get away with it. She says that it then became ‘a bit addictive’ and that she ‘got a huge buzz from knowing they had no idea what I was doing. ’ Opportunity In terms of opportunity, De-Laurey’s bosses trusted her and held her in high regard.She had proved herself indispensable, on both business and personal fronts , and was given access to their cheque books in order to settle their domestic bills and personal fi nances. A little over a year after starting at Goldman Sachs, De-Laurey began forging her bosses’ signatures on personal cheques to make payments into her own accounts. Realising she had got away with it, De-Laurey continued to steal money by issuing forged cheques and making false money transfers. Before long she was forging signatures on a string of cash transfer authorities, siphoning off up to ? 2. million at a time from supposedly secure New York investments. Rationalisation De-Laurey was able to rationalise her actions by convincing herself that she had earned the money she stole. De-Laurey believed that she deserved the plundered amounts as a just reward for her dedication, discretion and loyalty, and claims that she had the consent of her bosses to take money in return for her ‘indispensable services’. The fact that they were so rich they did not even noti ce the money was missing, only served to fuel De-Laurey’s fraudulent activities. She justifi ed her actions through the belief that her bosses had cash to spare.According to De-Laurey; ‘They could afford to lose that money. ’ Caught out After four years of siphoning off vast amounts of money, De-Laurey was eventually caught when her boss at the time decided to make a six-fi gure donation to his former college. He took a look at his bank accounts to see if he could cover the donation and was surprised to fi nd the balance on the accounts so low. He investigated further and realised that large sums had been transferred to an unknown account. De-Laurey was the obvious suspect. By this time, De-Laurey had actually stolen around ? 3. 3 million from this particular boss.De-Laurey was the fi rst woman in the UK to be accused of embezzling such a large sum and, after a long and high profi le trial in 2004, she was sentenced to seven years imprisonment. Various sources in cluding The Guardian, The Times, The Independent and the BBC News 15 One of the most effective ways to tackle the problem of fraud is to adopt methods that will decrease motive or opportunity, or preferably both. Rationalisation is personal to the individual and more diffi cult to combat, although ensuring that the company has a strong ethical culture and clear values should help. These methods and principles are developed further in later hapters of this guide. 1. 5 Who commits fraud? Different types of fraudster Fraudsters usually fall into one of three categories: 1 Pre-planned fraudsters, who start out from the beginning intending to commit fraud. These can be short-term players, like many who use stolen credit cards or false social security numbers; or can be longer-term, like bankruptcy fraudsters and those who execute complex money laundering schemes. 2 Intermediate fraudsters, who start off honest but turn to fraud when times get hard or when life events, such as irritation at being passed over for promotion or the need to pay for care for a family ember, change the normal mode. 3 Slippery-slope fraudsters, who simply carry on trading even when, objectively, they are not in a position to pay their debts. This can apply to ordinary traders or to major business people. In 2007, KPMG carried out research on the Profi le of a Fraudster (KPMG survey), using details of fraud cases in Europe, India, the Middle East and South Africa. The ACFE carried out similar research on frauds committed in the US. These surveys highlight the following facts and fi gures in relation to fraudsters: †¢ perpetrators are typically college educated white male most fraudsters are aged between 36 and 55 †¢ the majority of frauds are committed by men †¢ median losses caused by men are twice as great as those caused by women †¢ a high percentage of frauds are committed by senior management (including owners and executives) †¢ losses caused by managers are ge nerally more than double those caused by employees †¢ average losses caused by owners and executives are nearly 12 times those of employees †¢ longer term employees tend to commit much larger frauds †¢ fraudsters most often work in the fi nance department, operations/sales or as the CEO. The ACFE report also found that the type of person ommitting the offence depends on the nature of the fraud being perpetrated. Employees are most likely to be involved in asset misappropriation, whereas owners and executives are responsible for the majority of fi nancial statement frauds. Of the employees, the highest percentage of schemes involved those in the accounting department. These employees are responsible for processing and recording the organisation’s fi nancial transactions and so often have the greatest access to its fi nancial assets and more opportunity to conceal the fraud. Fraud risk management: a guide to good practice 16 Case study 4 Management riskIn 2007, a major British construction fi rm suffered from extensive fraud committed by management at one of its subsidiaries. Accounting irregularities dating back to 2003 were said to include systematic misrepresentation of production volumes and sales by a number of senior fi gures at the division. Management at the subsidiary attempted to cover their behaviour by selling materials at a discounted price and the fraud went undetected for several years despite internal and external audits. The irregularities were eventually uncovered by an internal team sent to investigate a mismatch between orders and sales.Following an initial internal investigation, a team of external experts and the police were brought in to identify the full extent of malpractice. The investigation found that the organisation was defrauded of nearly ? 23 million, but the fraud was said to cost the company closer to ? 40 million due to the written down value of the business and factoring in the cost of the investigation. The managing director of the subsidiary was dismissed, another manager faced disciplinary action and fi ve others left before disciplinary proceedings could be commenced. Civil proceedings were ruled out on the basis that osses were unlikely to be recovered. Operations at the centre of the incident had to be temporarily closed and more than 160 jobs were cut at the business. In addition to individual fraudsters, there has also been an increase in fraud being committed by gangs of organised criminals. Examples include false or stolen identities being used to defraud banks, and forms of e-fraud exploiting the use of internet by commercial businesses. SOCA is responsible for responding to such threats, with the support of the victim organisations. 1. 6 Summary A major reason why people commit fraud is because they are allowed to do so.There are a wide range of threats facing businesses. The threat of fraud can come from inside or outside the organisation, but the likelihood that a frau d will be committed is greatly decreased if the potential fraudster believes that the rewards will be modest, that they will be detected or that the potential punishment will be unacceptably high. The main way of achieving this must be to establish a comprehensive system of control which aims to prevent fraud, and where fraud is not prevented, increases the likelihood of detection and increases the cost to the fraudster. Later chapters of this guide set out some of the easures which can be put in place to minimise fraud risks to the organisation. Before looking specifi cally at fraud risk, the guide considers risk management in general. Risk management is defi ned as the ‘process of understanding and managing risks that the entity is inevitably subject to in attempting to achieve its corporate objectives’ (CIMA Offi cial Terminology, 2005). For an organisation, risks are potential events that could infl uence the achievement of the organisation’s objectives. Risk management is about understanding the nature of such events and, where they represent threats, making positive plans to mitigate them. Fraud s a major risk that threatens the business, not only in terms of fi nancial health but also its image and reputation. This guide is primarily focused on managing the risk of fraud, but fi rst, this chapter looks at more general aspects of risk management and corporate governance. 17 2 Risk management – an overview Risk management is an increasingly important process in many businesses and the process fi ts in well with the precepts of good corporate governance. In recent years, the issue of corporate governance has been a major area for concern in many countries. In the UK, the fi rst corporate governance report and code of best practice s considered to be the Cadbury Report in 1992, which was produced in response to a string of corporate collapses. There have been a number of reports since, covering provisions around areas such as exec utive remuneration, non-executive directors, and audit committees. The principles of these various reports have been brought together to form the Combined Code on Corporate Governance (Combined Code). The Combined Code was fi rst introduced in 1998 and among other matters, calls for boards to establish systems of internal control and to review the effectiveness of these systems on a regular basis. UK isted companies are required to provide a statement in their annual reports confi rming that they comply with the Combined Code, and where they do not, they must provide an explanation for departures from it (the ‘comply or explain’ principle). The assessment of internal controls should be included in the report to shareholders. The Combined Code is reviewed regularly and the most recent version was published in June 2008. Following the original introduction of the Combined Code, the Turnbull Committee was set up to issue guidance to directors on how they should assess and report on their review of internal controls. TheTurnbull Committee made it clear that establishment of embedded risk management practices is key to effective internal control systems. The Turnbull guidance was fi rst published in 1999 and revised in 2005. In the revised report (sometimes referred to as Turnbull 2) there is now a requirement for directors to give explicit confi rmation that any signifi cant failings or weaknesses identifi ed from the review of effectiveness of internal controls have been, or are being, remedied. 2. 1 What is risk management? 2. 2 Corporate governance Fraud risk management: a guide to good practice 18 The Financial Reporting Council is responsible for aintaining and reviewing the Combined Code, although the Combined Code is annexed to the rules of the UK Listing Authority, which is part of the FSA. The FSA is responsible for ensuring that listed companies provide the appropriate ‘comply or explain’ statement in their annual report. While the guidance is generally applicable to listed companies, the principles are relevant to all organisations and have been widely used as a basis for codes of best practice in the public and not-for-profi t sectors. Fraud risk management practices are developing along the same lines. Many other countries have also produced reports on orporate governance, usually accompanied by codes of best practices. For example, South Africa has had the King Report (version I and now II) since 1994, Malaysia has had its Code of Corporate Governance in place since 2000 and Sri Lanka issued the Rules on Corporate Governance as part of its Listing Rules in January 2007. Corporate governance requirements in the US are now largely set out within the Sarbox legislation, further details on which are provided at Appendix 1. As previously mentioned, these requirements extend beyond the US, capturing any company that is SEC listed and its subsidiaries. Some other countries have lso introduced a statutory appr oach to corporate governance, such as that in the US, although none are currently as comprehensive. A number of international organisations have also launched guidelines and initiatives on corporate governance, including the Organisation for Economic Co-operation and Development (OECD) and the European Commission. An example of a growing area of corporate governance is IT governance, which has developed in light of rapid and continuing advances in information technology. The following box gives more information on IT governance. IT Governance IT governance is about ensuring that the rganisation’s IT systems support and enable achievement of the organisation’s strategies and objectives. It encompasses leadership, organisational structures, businesses processes, standards and compliance. There are fi ve specifi c drivers for organisations to adopt IT governance strategies: †¢ regulatory requirements e. g. IT governance is covered by the Combined Code and Turnbull gu idance in the UK †¢ increasing intellectual capital value that the organisation has at risk †¢ alignment of technology with strategic organisational goals †¢ complexity of threats to information security †¢ increase in the compliance requirements of nformation and privacy-related regulation. A key benefi t of an effective, integrated IT governance framework is the integration of IT into the strategic and overall operational approach of an organisation. There are a series of international Information Security (IS) standards that provide guidance on implementing an effective IT governance framework, known as the ISO 27000 series. For example, ISO/IEC 27001 defi nes a set of IS management requirements in order to help organisations establish and maintain an IS management system. The standards apply to all types of organisation regardless of size or sector.They are particularly suitable where the protection of information is critical to the business, for example in t he fi nance, health and public sectors, and for organisations which manage information on behalf of others, such as IT outsourcing companies. ISACA also offers a series of IS standards and certifi cation. ISACA is a leading global association in the IT governance and control fi eld. With a network across more than 160 countries, its IS standards are followed by practitioners worldwide. Figure 3 The CIMA risk management cycle Controls assurance Controls assurance is the process whereby controls are eviewed by management and staff. There are various ways to conduct these exercises, from highly interactive workshops based on behavioural models at one end of the spectrum to pre-packaged self audit internal control questionnaires at the other. These models all include monitoring and risk assessment among their principal components. 19 The risk management cycle is an interactive process of identifying risks, assessing their impact, and prioritising actions to control and reduce risks. A n umber of iterative steps should be taken: 1 Establish a risk management group and set goals. 2 Identify risk areas. Understand and assess the scale of risk. 4 Develop a risk response strategy. 5 Implement the strategy and allocate responsibilities. 6 Implement and monitor the suggested controls. 7 Review and refi ne the process and do it again. 2. 3 The risk management cycle Identify risk areas Review and refi ne process and do it again Implementation and monitoring of controls Implement strategy and allocate responsibilities Understand and assess scale of risk Develop risk response strategy Information for decision making Establish risk management group and set goals Fraud risk management: a guide to good practice 20 2. Establish a risk management group and set goals A risk management group should be established whose task it is to facilitate and co-ordinate the overall risk management process. Possible members of the group could include a chief risk offi cer, a non executive direc tor, fi nance director, internal auditor, heads of planning and sales, treasurer and operational staff. Depending on the size and nature of the organisation, the risk management group may be in the form of a committee who meet from time to time. The risk management group will promote the understanding and assessment of risk, and facilitate the evelopment of a strategy for dealing with the risks identifi ed. They may also be responsible for conducting reviews of systems and procedures to identify and assess risks faced by the business, which include the risk of fraud, and introducing the controls that are best suited to the business unit. However, line managers and their staff may also be involved in the risk identifi cation and assessment process, with the risk management group providing guidance. 2. 5 Identify risk areas Each risk in the overall risk model should be explored to identify how it potentially evolves through the organisation.It is important to ensure that the risk is c arefully defi ned and explained to facilitate further analysis. The techniques of analysis include: †¢ workshops and interviews †¢ brainstorming †¢ questionnaires †¢ process mapping †¢ comparisons with other organisations †¢ discussions with peers. Once risks have been identifi ed, an assessment of possible impact and corresponding likelihood of occurrence should be made using consistent parameters that will enable the development of a prioritised risk analysis. In the planning stage, management should agree on the most appropriate defi nition and number of categories to be used when ssessing both likelihood and impact. The assessment of the impact of the risk should not simply take account of the fi nancial impact but should also consider the organisation’s viability and reputation, and recognise the political and commercial sensitivities involved. The analysis should either be qualitative or quantitative, and should be consistent to allow compa risons. The qualitative approach usually involves grading risks in high, medium and low categories. Impact The assessment of the potential impact of a particular risk may be complicated by the fact that a range of possible outcomes may exist or that the risk may occur number of times in a given period of time. Such complications should be anticipated and a consistent approach adopted which, for example, may seek to estimate a worst case scenario over, say, a 12 month time period. Likelihood of occurrence The likelihood of a risk occurring should be assessed on a gross, a net and a target basis. The gross basis assesses the inherent likelihood of the event occurring in the absence of any processes which the organisation may have in place to reduce that likelihood. The net basis assesses the likelihood, taking into account current conditions and processes to mitigate he chance of the event occurring. The target likelihood of a risk occurring refl ects the risk appetite of the organisa tion. 2. 6 Understand and assess the scale of risk 21 Where the net likelihood and the target likelihood for a particular risk differ, this would indicate the need to alter the risk profi le accordingly. It is common practice to assess likelihood in terms of: †¢ high – probable †¢ moderate – possible †¢ low – remote. An example of a risk analysis is contained in Appendix 3. The resulting document is often referred to as a risk register. The overall risk registers at organisational nd operational levels should include the risk of fraud being perpetrated. Some organisations also prepare detailed fraud risk registers that consider possible fraudulent activity. The fraud risk register often directs the majority of proactive fraud risk management work undertaken by an organisation. Analysing fraud risks Fraud risk is one component of operational risk. Operational risk focuses on the risks associated with errors or events in transaction processing or ot her business operations. A fraud risk review considers whether these errors or events could be the result of a deliberate act designed to benefi t the perpetrator.As a result, fraud risk reviews should be detailed exercises conducted by teams combining in depth knowledge of the business and market with detailed knowledge and experience of fraud. Risks such as false accounting or the theft of cash or assets need to be considered for each part of the organisation’s business. Frequently, businesses focus on a limited number of risks, most commonly on thirdparty thefts. To avoid this, the risks should be classifi ed by reference to the possible type of offence and the potential perpetrator(s). Fraud risks need to be assessed for each area and process of the business, for example, cash payments, ash receipts, sales, purchasing, expenses, inventory, payroll, fi xed assets and loans. Fraud risk management: a guide to good practice 22 2. 7 Develop a risk response strategy Once the ri sks have been identifi ed and assessed, strategies to deal with each risk identifi ed can be developed by line management, with guidance from the risk management group. Strategies for responding to risk generally fall into one of the following categories: †¢ risk retention (e. g. choosing to accept small risks) †¢ risk avoidance (e. g. stopping sale of certain products to avoid the risk to occurring) †¢ risk reduction (e. g. hrough implementing controls and procedures) †¢ risk transfer (e. g. contractual transfer of risk; transferring risks to insurers). Before strategies are developed, it is necessary to establish the risk appetite of the organisation. Risk appetite is the level of risk that the organisation is prepared to accept and this should be determined by the board. The appetite for risk will infl uence the strategies to be developed for managing risk. It is worth noting that a board’s risk appetite may vary for different types of risk and over tim e. For example, the board may have a low risk tolerance on compliance and egulatory issues, but be prepared to take signifi cant strategic risks. The board may also reduce their risk appetite as the external environment changes, such as in times of recession. 2. 8 Implement the strategy and allocate responsibilities The chosen strategy should be allocated and communicated to those responsible for implementation. For the plan to be effective it is essential that responsibility for each specifi c action is assigned to the appropriate operational manager and that clear target dates are established for each action. It is also important to obtain the co-operation of those esponsible for the strategy, by formal communication, seminars, action plans and adjustments to budgets. The chosen strategy may require the implementation of new controls or the modifi cation of existing controls. Businesses are dynamic and the controls that are in place will need to be monitored to assess whether or n ot they are succeeding in their objectives. The risk management group should be empowered to monitor the effectiveness of the actions being taken in each specifi c area, as these can be affected by internal and external factors, such as changes in the marketplace or the introduction of new computer systems. . 10 Review and refi ne and do it again All of the elements outlined above form part of an iterative cycle where risk management is continually reviewed and developed. As the cycle continues, risk management should increasingly become embedded in the organisation so that it really becomes part of everyone’s job. 2. 11 Information for decision making Risk management should form a key part of the organisation’s decision-making process. Information is gathered at all stages of the risk management cycle and this information should be fed into the decision-making mechanisms. For more information on risk management, please refer o CIMA’s publication Risk Management : A guide to good practice. 2. 9 Implement and monitor suggested controls 23 There are risks in most situations. Risk management is an important element of corporate governance and every organisation should review their risk status and develop their approach as described in the CIMA Risk Management Cycle in 2. 3 to 2. 11 above. Managing the risk of fraud is the same in principle as managing any other business risk. First, the potential consequences of fraud on the organisation need to be understood, using the principles set out in this chapter. The risks should then be reduced by developing nd implementing an anti-fraud strategy across the organisation. This is best approached systematically, both at the organisational level, for example by using ethics policies and anti-fraud policies, and at the operational level, through introduction of controls and procedures. The following chapters expand on the fraud risk management process in the context of an antifraud strategy. 2. 12 Summar y Fraud risk management: a guide to good practice Given the prevalence of fraud and the negative consequences associated with it, there is a compelling argument that organisations should invest time and resources towards tackling fraud.There is, however, sometimes debate as to whether these resources should be committed to fraud prevention or fraud detection. Fraud prevention Based on the earlier discussion aroun