31. Reducing the Risk of Fraud in your Finance Team - with Robert Brooker

31. Reducing the Risk of Fraud in your Finance Team - with Robert Brooker

Hannah Munro: 0:48 

So, hello everybody and welcome to this episode of CFO 4.0. As usual I'm your host Hannah Munro and today we're going to be talking about a rather interesting topic at the moment which is fraud. So, with me today I have Robert Brooker who is the Head of Fraud and Forensics at PKF LLP. He's also the Chairman of the London Fraud Forum, a not-for-profit helping to bring together both corporate and also public in search of reducing the fraud across the UK. So, welcome Robert, it's fun fantastic to have you on the show. 

Robert Brooker: 1:20 

Hannah, thank you very much indeed for inviting me. It's an absolute honour and a privilege to be able to talk fraud and to be able to share it to your audience because unfortunately, as you've just alluded to, it's a hot topic at the moment, so, to speak. 

Hannah Munro: 1:35 

And is it that, so, let's, hey, let's just jump straight into it. So, is it that fraud is increasing at the moment or is it that we're just, we're noticing and more aware of it? 

Robert Brooker: 1:46 

Ah, what a great point that is. It's increasing. and hopefully people are becoming aware of it. I don't think, depending on whether you pick up a newspaper, whether you read the internet, even watching the soaps on TV, I don't think you can escape fraud at the moment. Fraud was always around before COVID and before the last year, but actually as we all start to return to normality and we've been kind of mobilised at home for 12 months, people are realising the fraud that's hit them within their organisations. If I tell you, fraud is the crime of choice. So, if you have a look at statistics at the moment throughout the UK, fraud is up there as one of the highest, if not the highest, in all areas of crime that's occurring at the moment. People then say, why is that? And there's a couple of reasons for it, really and truthfully. Fraud is a crime of choice because I don't have to get my hands dirty. I can sit in my own room with a laptop in front of me and I can commit fraud. Simple as that. Secondly, what's the penalties? What's the sanction? What am I going to get for committing fraud? The maximum sentence under the Fraud Act 2006 is 10 years. So, the most I'll serve inside is five years. Can you imagine getting caught with two million pounds worth of cocaine? How long are you going to get in prison for that? Where's the deterrent? Fraud is the crime of choice. A, it's so, easy. B, the sentencing, unfortunately, in this day and age doesn't match the crime. And secondly, it's so, so, simple. I can sit at home. I don't have to go anywhere to do it. 

Hannah Munro: 3:15 

And do you think it's also because it's in some ways seen as a victimless crime because it's the corporates that are paying for it? Is there like a lack of awareness of the impact that that fraud is happening? 

Robert Brooker: 3:26 

Totally agree with you. It's still seen by many, both fraudsters and those in just general public. that fraud is a victimless crime. How can that be, as you say? What they say is you go back to something called the fraud triangle. Donald Cressy created this back in many, many years ago, now in the 50s. And ultimately, Donald Cressy has a fraud triangle that's motivation, opportunity, and rationalization. And the guys, the ladies that commit fraud, everybody doesn't see their rationalization is, well, they're a big company, they won't miss it. Let's have a look back through COVID. Let's have a look at all the frauds that people are committing. It's either against HMRC or the banks. That's how people see it generally. Or it's the government, and they don't see that they are a victim. That's just one big organization. The banks, they can afford it. Government, oh, that's just a little blip in their budget. But you and I and the rest of us in the public eye and corporates, we all pay for that. Whether it be through extra taxes, we all know insurance fraud, it means we all pay extra premiums. But ultimately, we all pay for it. But you're quite right. It is still seen as a victimless crime. And that's awareness and education. We can't do enough awareness and education. It's really interesting you bring that up. Because speak to anybody, and you speak to FDs in many corporates or small and medium enterprises, wherever it might be, and you ask the question about how much fraud you have going on in your business, and they will say, I don't. The ones who say I don't, there's a follow-up question to that straight away. And that is how much awareness and education do you do? Because to me, everybody's got fraud. It's just a case of whether you find it or not. You proactively find it, or you advertise it. How would I report a fraud if I've never been told about it? A, I don't know what fraud is. B, I don't know how to report it. Why would you? You've got nothing to go by at all. All I do is encourage people. Please, please look at education and awareness. Look at being proactive. And there's some real simple stuff you could do about being proactive. As simple as looking at your supply chain compared to your employees. And let's have a look at addresses and let's have a look at bank account details and make sure you haven't got it. Make sure there are no matches. If there are and you're aware of it because somebody's spouse happens to work elsewhere and they're paid into the same account and they live at the same address, fine. You can easily tick that off. But unfortunately, there might be others. Why do I mention that even? But the reason being, what is the biggest risk? What is the biggest threat to your business? Once again, whether you're a corporate or an SME, it doesn't matter. Biggest threat to your business is the insider threat. Your employees, your contractors, your staff, which is the biggest risk. Why? They're in your business. They understand your business. They know how it works. They know the control mechanisms. They know the mitigations. They know what to do. They know how to defraud. It's an exercise we do. Get everybody in the classroom together, or even on Zoom or Teams nowadays has become the norm as we talk about COVID, and actually ask them, scribble down where you would commit fraud. The reason I say this, it's really interesting because operationally, that really differs from where they would commit fraud to the perception of the board or the senior leadership team with regards to where you think fraud is. And then once you've defined exactly where they would commit fraud, what mitigations do we have in place? So, what controls do we have in place? What control mechanisms, whether it be software, whether it be policy procedure? Doesn't matter what it is. What controls do you have in place to prevent that fraud from occurring? They will tell you how to circumvent it. But at least we know there are some controls. And then what we're left with is many areas, unfortunately, whereby people can commit fraud. And those on the inside also can bring people in from the outside to commit fraud. Advise others how to do it. Advise others this is what you do. And unfortunately, that's exactly where it is. As an FD, your risk is your staff. Might not be an easy conversation, but if you're educating and making them aware, A, they will know what fraud is, B, they'll know how to report it, and you'll be keeping a complete eye on it as well. You'll have complete control over it then. Whereas if you don't do anything about it, you've lost it. And I refer to a case that I know, and I've been... involved with myself and he worked in a professional services firm okay they'll remain anonymous but he worked in a professional services firm in accounts and he had autonomy for accounts payable and accounts receivable which okay we can all question but once again we're back to the we're back to the control mechanisms and he raised it as a risk on his first couple of days during his first week and said I really don't like this I really don't feel comfortable with it and he was told by the financial controller just carry on. We've got a big backlog at the moment because we've had nobody in post. Please just clear that backlog and we will then sort out. So, we've got the risk, and we've got the control mechanism in place. So, he carried on. And after a few months, he cleared the backlog, he thought, and asked the question, look, what are we going to do about this? Yeah, we know, we know. We need to get a couple of other people on board now so, that we've got some other staff and we can then split that responsibility. To cut a long story short, over a 17-month period, he committed fraud by creating invoices of a company that didn't exist. But where did the money go? Into his own bank account, exactly the same place as his salary was paid into. And ultimately, over that 17 months, he created invoices to the tune of £250,000. The interesting point about this is when he was caught, and by the way, this is really quite common. When he was caught, he said it was a relief to be caught because it was a charade that he was living. It didn't stop him getting three years imprisonment, I hasten to add. But when he was arrested, he still had £250,000 in his account because he could. That was his answer. But ultimately, he shouldn't have been able to do that. And if I let you know that company... on the day he was arrested, still weren't aware. It's only because the banks raised an SAR, a suspicious activity report, because of the volume of money going into that account. Otherwise, they'd still be sat there now with him still helping himself. There's the control mechanism. There's your staff worry. And by the way, he's a very well-educated, well-spoken guy. It wasn't what you would expect as a fraudster at all and had that responsibility within accounts. 

Hannah Munro: 9:54 

Now, that's an interesting point, isn't it? Is that that is what we call the traditional definition of fraud within finance. But aren't there different types of fraud that could occur within a business? 

Robert Brooker: 10:07 

Yeah, of course, there are many types of fraud that can occur in a business and just take accountancy and take finance overall. And there's obviously the aggregating of invoices. There's obviously false invoices that we just alluded to. There's obviously fraud. Fake addresses, fake invoicing, the whole thing around invoicing is normal. But actually, there are many other areas of fraud, depending on what your basis, your business is. And nowadays, we're all looking at computers. It used to be called cyber-enabled crime, okay? Cyber-enabled fraud is now just called cyber fraud. And we're being targeted by those on the outside. And in some instances, we are actually creating that from the inside, as I spoke about earlier. But actually, what we were receiving, do you remember bank diversion fraud or bank mandate fraud? You may remember that which is whereby you receive notification, it used to be a letter on fake-headed paper from a supplier. It then turned into an email. It's now that they spoofed the email or they've actually got account takeover of your whole account. And basically, you receive this letter notifying you that your supplier has changed bank account details. Back in the day, we'd have just changed that bank account details. Unfortunately, those bank account details don't belong to your supplier. Those bank account details belong to the fraudster. And the only time you realize as an organization is when your supplier contacts you and says, sorry, we've not been paid for the last invoice for the month of March or April, whatever it might be. Well, you have. We've sent it to this supplier. Well, that's not our account. We've not changed account. And before you know it, the money's also dispersed, okay? The money's dissipated to countries we have no control over, no jurisdiction whatsoever, and the chances of recovery are really quite remote because it all happens on the same day. The fraudsters are set up for that money to hit one account, and then there's automatic transfers from that account elsewhere to go throughout the world. And that account is only used for fraudulent transactions. transactions. It's not you for any other reason. And that is one of the most common, unfortunately, even in this day and age. So, you might say, what can you do to stop it? Please, please, don't just take it for granted when you receive an email. Right-click on it. Make sure that it is actually from who you think it is. Would a CFO in your business or would a supplier really speak like that? Is there spelling errors in it? Is there some grammatical errors? Just have a look at it. But also, they do it internally. So, you might be, as the FD, you might well find your staff are receiving emails saying, could you pay this invoice immediately, please? Generally speaking, you're not going to ever send an email like that. And hopefully that would trigger an alert, a red flag to that member of staff. But it still happens. People still pay it. And that's a real common. Sorry, Hannah, go on. 

Hannah Munro: 13:05 

No, no, it's all right. And I think it's quite interesting because I actually have this conversation with customers quite a bit because actually technology can really help with that. So, if you move away from using things like emails, which can be replicated to using more secure and digital forms of sort of authorization and have multiple layers that, you know, for instance, you can put like authorizations on or alerts when bank details change and limit who can change them, etc. So, there's all sorts of things that I guess can go into systems. But if you if everyone takes that email at face value, I guess that's where the challenge is, isn't it really? 

Robert Brooker: 13:43 

Of course, yes, exactly. Because we all live in a world and a society where we want to believe what we're told. But unfortunately, unless you've been in fraud for 20 odd years like I have and you become a complete cynic, then we should do. We should believe some people, shouldn't we? Surely. But you're quite right. Automation plays a big part in it. Automation plays a big part in it. If you're automating your account system, whether you're using Oracle or SAP or whatever it may be, then obviously there are controls in there that you can put in place. that will help. And on top of that, continuous monitoring tools. If you can run continuous monitoring that would always spot it and you look for the patterns and trends, you would stop a lot of fraud that way. But not everyone, unfortunately, is that advanced or has that luxury, if you like, of actually having that SWAS software as it may be, as you alluded to. 

Hannah Munro: 14:34 

And I guess, so, you've mentioned sort of obviously fake invoices. We talked about changing bank accounts. We've talked about false requests for payment of invoices that don't exist. What other types of fraud have you seen in the many years that you've been doing this? 

Robert Brooker: 14:54 

It varied greatly, obviously. Fraud is a wide, wide open, this kind of like the three main elements of the Fraud Act 2006 of legislation. One is fraud by false representation, which basically just means a lie, means driving a bus through it. And anything you can imagine, there's many, many frauds out there. You'll notice if you join me on LinkedIn or you have a look at my account, I've spent the last 10 years prior to the last two and a half where I've been head of fraud and forensics at PKF. I was head of fraud at Transport for London, TFL, responsible for the underground, obviously responsible for buses, responsible for rivers. Many, many things. And everyone always thinks, oh, what's the main fraud? Is that Oyster card? Yeah, we suffered with Oyster card fraud, of course. And that included cloning, believe it or not. And then counterfeiting. There's another large area. Counterfeiting of the ticket. We all get a train ticket if you live outside of London. They're kind of like a yellowy and orange kind of normal train ticket with a mag stripe ticket on the back, a magnetic stripe. Then people have cloned those as well. We dealt with that. But our main threat and our main risk was procurement. The whole procurement cycle from the moment you get a tender through to the moment you pay, the procure to pay, which obviously you guys as FDs really are involved in the sit-in, and the whole procure to pay piece. Because when you're sending out a tender, as you can imagine TFL, and let's take Crossrail as an example, the largest multi-billion-pound project in Europe over the last goodness knows how long, if not ever. And you'd look at the procurement process to get those services provided. People with, it's about capability and capacity to deliver that work. People are prepared to tell any lies that they wish on that tender application. They really are because they really think they get the foot in the door. They've got a job for life and also the value of that tender. So, that was a large area that I dealt with. Since I've been here, within PKF and working for various clients in small, medium enterprises and large corporates, as well as the public sector, charities, etc. You see many different frauds and a lot of them, unfortunately, are staff orientated. Let's not forget those who are coming into the world of finance. Let's not forget the basics around your staff as well. We still have timesheets. People still fraudulently claim money via timesheets. I know it sounds odd. I know we haven't had any for the last year. People still fraudulently claim expenses. Let's look at governance of gifts and hospitality. Let's look at segregation of duties. So, let's look at gifts and hospitality. First of all, you have a gifts register. Do people actually declare what they received? The most important and the most one, the most important gifts and hospitality declaration for me is where people put nil and actually, they've received something. Yes, they've committed themselves then, but actually you'd be amazed at how many people do that. You will actually be amazed at how many people do it. And it doesn't fall within your policy. We're back to governance here as well. So, what does the policy for gifts and hospitality look like? You probably have a £25, £50 limit. Do people exaggerate that? Do people take it? Do people spread that around to ensure that it doesn't reach it? So, once again, the equivalent of aggregating, if you like. People spread the cost. So, they say, oh yeah, it's below £25. And then we look at segregation of duties, really quite apt during the COVID period and a case I've dealt with, whereby people felt that everybody, segregation of duties for those that you've not known, and obviously ensuring that different people are doing different roles, often set up on SAP or Oracle. But equally, it's not always. There aren't always segregation of duties. What reason? People were furloughed. People were made redundant. It wasn't always updated. And unfortunately, that person was asked, could you do this? Could you do that? So, they are signing off an invoice or a purchase order. And they're also obviously creating that purchase order as well. Or you might notice it unless you have continuous monitoring software. It could be at a weekend. It could be out of work hours. It could be a bank holiday that they're signing off this stuff. There's many ways if you're that way inclined to commit fraud. The other, and it still touches on many organizations and corporates, is contact centres, stroke call centres. During the, obviously prior to lockdown, you're all aware, I'm sure, of PCI DSS, payment card industry data security standards. And this really is now getting into where a lot of fraud is around data because the data is worth fortunes externally. So, under payment card industry data security standards, inside that call centre, contact centre, you're not allowed a pen and paper. You're not allowed a mobile phone. How do we stop that working at home? We've got no control over that whatsoever. And people have been working at home, enabling them to do that. They've worked at home, and they are writing down, whether it be bank account details, whether it be names and addresses, to create identities of other people, to steal those bank account details, get on the dark net, sell those on to the fraudsters. And basically, that's what's now known, unfortunately, we all know, as sucker lists. And those sucker lists are those vulnerable people whereby they share those names and those details around. And they're the people you all hear about, and we read about regularly. They receive a call or an email about investment fraud it might be wine it might be gold it might be whatever it may be the next day they're receiving a call about a courier fraud and then a mobile phone fraud whatever it might be unfortunately this is what the fraudsters do they glean all of that information from the dark net but they've got people in these call centres providing them that detail and that data and data is obviously huge 

Hannah Munro: 20:57 

So, we talk a lot about sort of, you know, the different types. So, we've talked about, obviously, financial fraud, talked about data fraud. So, if we are trying to, if we, what are the sort of red flags that we might see? And what are the reasons that people actually commit fraud in the first place? 

Robert Brooker: 21:19 

Right, let's go back to Donald Cressy's triangle, if we may. And we look at Cressy's triangle, and we talked about the three areas. And the three areas that we had were obviously motivation, opportunity, and rationalization. So, we talked about providing a fraudster with the opportunity. The motivation for them might be a habit, gambling, addiction, alcohol, drugs, extramarital affair. I've come across all of those. And ultimately, they need the motivation for that extra money. They can't live the normal life. Quite often you find a frost that does have a job. but it's not enough money to enable them to do what they want to do. So, they can live their normal life and pay the bills, but they can't have their drug habits, or they can't have their gambling addiction. And let's look during the last 12 months of COVID. Unfortunately, gambling addictions have gone through the roof because people are able to sit on their laptops at home with nothing else to do. So, that becomes their motivation for wanting to steal the money and get the money. The rationalization, as we heard earlier, well, it's a victimless crime. The big corporate's not going to miss a few quid of this. the government whoever it might be they aren't going to miss it they've got the opportunity they've got the motivation they've got the rationalisation now when we look at finance and let's look at as you say let's look at finance risks Hannah and red flags what do we really mean so, let's talk about we've talked about expenses claims and suspicious amounts unusual items delegations of authority that's another one who actually is authorized to do it so, who has that delegated authority apart from the segregation of duties actually who is that are they up to date all the time do we make sure they're up to date because these are all red flags that if you haven't got them in place could be Problematic. Transactions initiated without appropriate authority. Purchase orders consistently posting dates and invoices. Obviously, inappropriate or unusual journal entries. Manual adjustments to accounts. There are many, many areas like that that are warning signs for you to look at. And then where are the red flags? What are the risks? We talked about forced expense claims, duplicate inflated claims. Bonuses where there's a financial incentive to achieve. Massaging figures to improve final accounts. I dealt with the case of a project manager from a supplier to, I don't mind admitting to TFL at that time. And ultimately, they were on a bonus scheme depending on how much work was delivered on the project. And they had subcontractors working on other projects but actually were billing the time to that project because the other projects were up to date. They were okay with that. And they were falling behind on the TFL project. So, what they ensured was all of the invoicing related to that case and related to that piece of work. And the guy said to me, I've never been, I remember interviewing him. And this is the thing about fraud. You have to admit the interviews. Don't follow your nose. You can only go look for the evidence. Don't just take it. And there's a prime example in the press as we speak today, Friday, the 23rd of April, with regards to the post office fraud. absolute travesty of people that have been served prison sentences in respect of cheating the post office and unfortunately it's all down to problems with their software and obviously a lack of real innovation in an investigation if I'm honest it's just basics you shouldn't just be told acting upon what you're told. You have to go and find that evidence. And that's a prime example of it. You have to do that. So, basically, and then asset depreciation, improper asset valuations, overstatements, liabilities, false journal entries to cover people's back tracks. So, there's many areas and many red flags, as you say. How about red flags of staff? How about red flags of employees? Are people living beyond their means? Do you have somebody in their senior role, mid-senior role, that's got the best car in the car park? Do you have somebody at a lower junior level who's probably having the best holidays that any of you have amongst your staff? Do they have the flash rings on or the flash jewellery? Although watch nowadays, everybody seems to have a nice watch, but actually, does it really match? And look, I'm not for one moment. I said earlier, I'm cynical. I'm not for one moment saying that everybody's fraudulent. I appreciate they have wealthy partners, wealthy families, but actually, does it all add up? There is a red flag to have a look at your staff. How about those that work late? Those who stay, come in early, work late, never have annual leave. Why is that? Is it because actually it's, it's leading a doubled life. They are committing fraud Monday to Friday, but they want to be the first one in the last one out. They want to have access to everything and control. Are they over controlling? That's the reason they don't take their annual leave because the minute they're away, somebody finds out really what's going on. 

Ad 2: 26:18 

Raise your game with Sage Intact. Bring down your close time by up to 79%. Use agile real-time reporting for instant visibility. Land an average ROI of 250%. with the heavyweight cloud software rated number one for customer satisfaction. Finance that packs a punch. Find out more from ITAS, the UK sage and tech partner of the year at itassolutions.co.uk. 

Hannah Munro: 26:47 

So, that's quite interesting when you're talking about sort of red flags. Do these kind of fraud cases normally escalate? Do people start small and then it gets bigger or is it normally people go, you know, for the end goal straight? 

Robert Brooker: 27:02 

away. Yeah, that's great, Hannah. And you've done quite a bit of background, or you know quite a lot about fraud. Being a cynic, I'm not going to say another word. No, that's a really interesting point. There's two types of fraud. So, there's high value, low volume. 

Hannah Munro: 27:20 

Yeah. 

Robert Brooker: 27:20 

Okay. But the chances are we've got controls in place to prevent that. The flip side of that is the high volume, low value. And actually, do we just let that go and we don't spot it? And that's the interesting aside from this. Generally speaking, we would have controls in place for high value items, but not for low. Now that leads us into the fraudsters and the way fraudsters work. And you're quite right. Absolutely spot on. Generally speaking, they start small. Why is that? They want to make sure it works first, don't they? You don't want to go in with a big one and get caught straight away. Let's start small and hope nobody notices. And let's be honest, the volume of transactions going through the majority of US finance directors, the amount of transactions going through on a daily basis, even weekly, monthly, whatever it may be, you're not going to miss the odd payment hidden amongst it. You really aren't. And that's why they do it. So, they start small. And then I think, well, that worked. That was easy enough. Let me try a little bit more. So, they'll up it to, let's say, four figures instead of three. Well, actually, nobody's battered an eyelid with that. And then it becomes, as I said earlier on, about the guy in the financial services and the 250 grand. Basically, they get a buzz out of this, the fraudsters. Not as big a buzz as we get finding it ice and twat, but they get a buzz out of it. They really do. They really enjoy it. But they start small. They get bigger. All of a sudden, that four-figure sum becomes a five-figure sum. So, we're now taking 10,000 plus. And they're really getting that buzz now. And nobody's still spotted it. And before you know it, that's escalated. We started off perhaps monthly. We've then got that to three-weekly, two-weekly. They're now doing it daily. And all of a sudden, that's when you potentially could get caught. But as in that case, I relate to many others, organizations don't miss that money. They don't realize it until it's too late. Unless, as you say, you have the automation in place, you have proper processes, controls, governance in place to spot these red flags and to spot this missing money. Because many, many organizations don't. It's so, so, sad. And I post an awful lot on LinkedIn about cases where it's reported in the press. And there are often, it's all easy to read it and say, crikey, that was a lot of money. But actually, what had that company done? What had that business done about trying to prevent that money? There was one just in the press recently down in the Southwest. And the company basically almost took it to the wall. Staff were laid off and everything to cut their... What were they doing about it? It was 900 grand over a very short space of time. 900,000 pound. You're not telling me nobody missed that at the time. It's only afterwards that they realized. And that's the sad point. The impact, as we said earlier about fraud, isn't just money. There's the impact, that loss of confidence in your product or your service that you build years to build, and it takes a long, long time to build. It's just gone overnight the minute you've had that fraud. What do shareholders make of that? Your shares plummet, obviously. But also, how do you go for more investment at a later date? How do you provide assurance to other staff that actually it's all okay? Because they sit there thinking, this is horrid. This is horrid. We're all being tarred with the same brush here. But it is so, simple. So, so, simple. And I dealt with at TFL a little gang that were targeted to and targeted TFL. They got themselves in there as contractors. And one mentioned it to the other of how to commit fraud. It was around some payments. And ultimately, he taught the others. And before you know it, they were all taking money out. And they weren't there any time at all. And it wasn't realized until they'd left. Because at the time, they didn't have the controls in place. So, you're quite right. Yes, they get greedy. And that's how they get caught nine out of ten. And as I said earlier, they're actually... delighted they've been caught because they can't continue to live that fake life that false life but equally, they can't stop doing it either because they think it might flag up if you stop making a certain payment or a transaction. And that's the interesting part as well, the flip side of it. 

Hannah Munro: 31:32 

Yeah, so, we were making a joke about how much I know about fraud, but if we put this into context for those that are listening. So, obviously, we do a lot with financial transformation and financial systems with Sage. And actually, I find it fascinating to see the variety of controls across businesses because it varies so, dramatically. You get some where everything is minutely controlled and then you get to others and there's very little controls around it. And actually, you know, so, I spend a lot of time asking about what controls people have in place and, you know, Luckily, I've not had any issues or known about any issues with it, but it's amazing how much opportunity there can be if you haven't had this conversation within the organisation. And I guess that's the point, isn't it? It's that triangle you keep referring to, is they can have all the motivation in the world, but if you haven't given the opportunity and you have the controls in place, then actually, you know, you can stop it before it starts. 

Robert Brooker: 32:37 

You can indeed. And that's part of the interesting point. And the question I would ask, and I'm sure you do, Hannah, when you're having these conversations, is, is that a risk-based approach to end up with controls in place in certain areas and not in others? How do they come up with the fact that how do these organizations vary so, much? And I'm aware, like you, that they can organize, sorry, they can alter, and it can change across the organization from one service line to another. And you will find that some areas of an organization are great. I refer a case that I've been, a company I've been working with, a very, very large organization, very well known, publicly known, straight away, outward facing, you and I purchasing something from them online, absolutely fantastic it looks great it's really quite secure it really is and that's where they concentrated their efforts and to be fair it's a risk-based approach because that's where the majority of their transactions come underneath it and internally facing there's nothing there at all so, they suffered a staff fraud because of exactly that reason and it was quite large but ultimately there was nothing internally Hannah whatsoever 

Hannah Munro: 33:45 

And that's really interesting. So, if we think about, so, there might be a few FDs and CFOs sitting here going, yeah, I know we've been needing to do it. We're really strong with externals and worry about that, but perhaps our internal controls aren't as strong as they could be. Sort of what is your recommendation for how people approach putting together authorization rules and structures within the business. Yeah. 

Robert Brooker: 34:11 

First of all, contact you and me by the sounds of it, Hannah, and we can help them do it. But that's it, isn't it? It's do you know how to do it? Do you have the resources? Do you have the right staff? Because it's all very well. You and I can smile about it because it's stuff we're working with all the time. But people don't actually know what to do in terms of control. And for me, and from a fraud perspective, it's got to be risk-based. Have you carried out a risk assessment? Because let’s look at risk and likelihood and impact, okay? I really understand some of these organizations, as I just alluded to there. They didn't consider that the insider risk was anything at all compared to the outside risk, because the majority of their transactions, and obviously financially, that was huge. But internally, there was very little in their eyes that you could take. But as I said earlier, you look at a supply chain, there's actually quite a lot of money. So, anyway, so, they'd use that. organization as an example so, let's look at the risk and I said you just haven't really looked at the risk of staff or you haven't looked at the general risk internally what do people have that capability of doing and that capacity to do and for me that's exactly where it has to be risk-based approach across the business not just top to bottom but left to right as well across all at levels because you don't know who's going to commit fraud one time going back during my 20-odd years of being in fraud, the profile of a fraudster, I fit it perfectly. Senior management, middle-aged, been in the firm a long time, knows how it all works, that would be a fraudster. Nowadays, that's completely changed. It could be anybody. And I don't just mean internally, I mean externally too. But you'd always look internally at what that could look like. So, for me, a risk-based approach needs to be taken. And you need to weigh up that risk across both transactional around as we just described opportunity controls and who has access what are the access controls like as well is there privilege rights within certain areas we all know that within systems and you talked about automation people have special privileges do we actually monitor those privileges do we actually look at who's got access management and identity a great example I spoke to somebody earlier today, funnily enough, and we were talking about social engineering. Now we're all returning to work. And we've had a lot of people; new people start in all of our organizations. And they stand outside and have a cigarette, don't they? As a social engineer, it's easy enough to stand on the shoulder of people, start talking to them while you have a fag. Nobody knows who's outside there at the moment because none of us have worked together. We've got people in our business, and I'm sure others listening to us now have got the same thing. They haven't actually met half their staff over the last 12 months. And then ultimately, when we return to the office, that person's just walked in last week with everybody else, walked into the offices and done exactly what they wanted set up a laptop and downloaded their system onto their laptop utilising I hasten to add it as a cyber fraud but utilising some tools and that that she had available to her but she was able to download their account system onto her laptop that's pen testing it worked in a good way and social engineering We don't know who we have. We don't know what our risks are until you actually face up to them. So, I would say it's risk based. We need to understand how our business works internally facing and outwardly facing. And then I think you can start to approach it and approach it in exactly that manner. What is the risk? What is the threat? And what would be the likelihood or the impact if something like this happened? And please don't underestimate anybody in terms of their capability of committing fraud and what impact that can have on your business. 

Hannah Munro: 38:00 

And is there– how much of an impact does things like culture have on the– I won't say the prevalence of fraud, but maybe that's the way to say it. How often is culture a contributor to the opportunity for fraud? 

Robert Brooker: 38:17 

Yeah, totally agree with you, Hannah. Totally, totally agree with you. It's one of the big areas I work within is fraud risk management, culture, behaviours and consequences. You're sitting there as an FD or a CFO today and we're having this conversation or you're just entering this world and thinking, crikey, this guy's a bit scary. What's this all about? You could do a lot yourself. You can really make a difference. Hannah's alluded to the fact of risk. We've alluded to the fact of obviously warning signs and red flags and what to do, and one of them is about creating the tone from the top. What does that tone from the top look like? You as a senior leadership team, what do you do about fraud, bribery, corruption? There's a prime example of anyone who says to me, and I'd ask the question of FDs or CEOs, how much fraud do you have in your organization? And they almost laugh at you and say, none. Well, I'm afraid that gives me real concern. Anybody who says they have nil fraud; I question straight away how much education and awareness you do. How do I report a fraud if I don't know what fraud looks like? I don't know where to report it. Who's got that responsibility? I haven't got a clue. So, that for me is a real, real top point, tone from the top. The other is many organizations brag, like to say we have zero tolerance towards fraud. Just have a little think about that for a moment. Many do it. Many say it. I'm afraid I don't sign up to it. I'm not being controversial. Is it really possible to have zero tolerance towards fraud? What I mean is, tone from the top, you have to do something about that if you have zero tolerance about fraud. If somebody defrauds you of £10, petty cash, for instance. Let's have a look at Christmas. How many more? If you looked at stationary lists, how many more pairs of scissors or sellotape are ordered between the 1st of December and the 24th when you break up? And you should do something about it if you've got zero tolerance. But why is that? What does that mean if you've got zero tolerance? Why am I saying this? Because you're sending out the message internally to your other staff. We're not standing for it. I'm not for one moment suggesting anybody should be disciplined or otherwise or even further disciplined. for the fact of taking a sellotape or scissors or for £10 out of petty cash. But if you have zero tolerance, you have to follow that through. Otherwise, it gets swept under the carpet and people think nothing of it. So, that's tone from the top a little bit. Behaviour and culture. So, what is the behaviour? You're creating those behaviours. Those behaviours are created from that top table, from the senior leadership team. the behaviours of other staff. If they see that somebody's allowed to get away with fraud, you don't publicise internally. You don't have to do it externally. I fully understand that. Although you can flip that around to a positive and not a negative. But there's some great learning from publicising internally about fraud. It's a great deterrence to let other people know that you dealt with it. You don't have to name the staff if you don't wish to. A lot of people would already know it. But internally... You just need to look at it and think, yes, let's tell people we've dealt with it. You might only, look, you have three options. And the first question you ask is an investigation of senior management and leadership when they're asked you to come in and investigate. What do you want out of this? Do you want disciplinary? Do you want prosecution? Or do you want to get your money back? And that's where it works. So, you look at the, we're looking at tone from the top. We're looking at behaviours. And the behaviours of those staffs are dictated by the tone at the top and they're dictated by the culture. And the culture is created by you not standing for the fraud, not allowing it to happen. If it happens and you haven't got anything in place, because you do the education, you do the awareness, you make sure everybody knows what fraud is, you publicize when you're a victim, you publicize others within peer groups or peers, you publicize what else is going on in the market. I'll give you a great example there where I had competitors all sat around the table. And for the first three months or so, they wouldn't ever talk about what went on in their own business until they realized they could learn from each other. And this is the big thing about tone from the top. You have to then ensure that you're learning from others. Why have they become a victim of fraud? And we talked earlier about bank diversion fraud, bank mandate fraud. That was a big area for people to learn from. What have you done to prevent that? What tools are you using to stop it? What software? And then the other is consequences. If you don't implement consequences for those people that commit fraud, it sends out completely the wrong message. The behaviours and the culture will never, ever change if you don't deal with those people. And by dealing with them, I do mean dismissing. I do mean prosecuting. I do mean recovering the loss. I just worked with a client at the back end of last year, and ultimately, they still let the person walk out the door with a reference. Okay, you might say there is some legislation around that. You can just still say that that person worked for you from X date to Y date. But actually, not only did they walk out of there with a reference, but they also walked out of there with a final pay salary as well. As a minimum, guys, please, please, let's make sure with our HR and our wages departments, et cetera, that we don't let these people walk out of there with the wages when they owe you money. And there's the whole tone from the top, behaviour culture. And I'm a firm believer in it makes a real difference. And that comes with education and awareness to governance. Make sure you've got policies and procedures in place. Make sure all of your other policies and procedures reference and refer to your fraud policy. Do you have a response plan? I could pick it up and I know exactly what will happen if I am a victim of the fraud. I find a fraud or even I am the perpetrator. I know what happens in the business. Everybody should know. But we don't necessarily have that. We don't necessarily have exactly what is required in our organizations. And the governance piece is really, really important. Do you have a gifts and hospitality register? Yes. Do you have a policy that goes with it? Do you refer to its gross misconduct if you fall foul of it? And then do you refer to the fraud policy or strategy, whatever it might be you have? So, it's really, really important the whole way through. Governance really does roll into behaviours, culture, and it sends out the right message. And do you know what? it's a more of a positive than it is a negative. Unfortunately, that's how people see it sometimes. 

Hannah Munro: 44:43 

Brilliant. And do you know what, for any CFOs listening, I think there's some great points in there. So, so, from what you're saying there, a couple of things that people should be considering. So, firstly, is doing a risk assessment to understand where their risk is and what their exposure is at the moment. You know, understanding, are you giving people the opportunity to commit fraud? And I guess secondly, it's then working with your team as well to make sure that they are aware that fraud can occur. They know what opportunities there are for fraud and how, you know, and I guess how to report it as well was a really good one, I think you pulled out. And 

Robert Brooker: 45:20 

whistleblowing, do you have the whistleblowing? Do you have an internal team or an external team? People take a... People are loathe to report internally because they feel that it will just get swept under the carpet. If you have an external reporting line, the chances are people will be more confident in reporting. And it's knowing what to do and how to go about it and making that as easy as possible for people. It's just simple things like on the back of a toilet door; you have a poster. On your intranet, you put some regular stuff on about fraud. It doesn't have to be about your business. It doesn't have to be about your industry. It could be just generically. I'll tell you why. If you get people thinking about fraud in their day life they will think about it in their work life how many of us were have been a victim of fraud start off with many of us or we know somebody that has and actually what do we do about trying to help them what do we do about it if I've been a victim of fraud I promise I then bring into the workplace my own experience I'm a little bit more careful a little bit more um stringent around what I do and how I just sign off stuff or whatever my role might be so, if you can just get them thinking about fraud in their general day-to-day life by posting on the internet action fraud is a great source of um information city of London police um website action fraud is where all fraud should be reported to ultimately um because unfortunately it won't get dealt with just by your local bobby on the beats but please bring in a corporate or however you wish to do it but they have some great stuff on there about fraud prevention as well as cases and what's going on in the world. So, yeah, completely agree with you, Hannah, entirely. That is the way forward is to make sure we're educating people, making them aware, make sure we've got policies and procedures and make sure everybody knows how to report it and what's expected of them. What is expected of me as a member of staff with regards to fraud? What should I do about it? Because a lot of people might be a little bit conscious. I don't really want to report that. I could get in trouble myself. It could backfire. Give them the confidence to report because that's the only way you'll find it. If you don't do anything, as I said earlier, if you don't do any education awareness, it could all be happening around you and you wouldn't ever be aware of it. 

Hannah Munro: 47:32 

That's the scary thing, isn't it? Is that it, It sounds like things are going, it's just from the conversations we've had to say that a lot of things are going on and people just aren't even aware that it is either a possibility or that it's happening until it's too late or something random happens to identify it. And that's, yeah, that's a scary thing. 

Robert Brooker: 47:54 

I can scare a little bit more. I don't want to scare because that's the wrong word. But as CFOs or as FDs, the Association of Counter Fraud Examiners, ACFE, an American group, quote, 5% of spend. Just think about this. Spend is lost to fraud per annum in every organization. You might say we've done lose 5%. How would you know? How many of us on here now listening to us actually go and find that 5% or try and find that 5%? Because you're not telling me that we're all X amount of times better that we don't find it. So, once we've got those fundamentals in place that we've alluded to so, far during our chat, once we've got those in place, let's then be proactive about it. Let's go looking for that fraud, data analytics, analytics. AI, whatever it might be. Let's go looking for it and see if we can find it. Because actually, it really does you a favour. You find more than you expect. Or you provide assurance to the board or the audit and assurance committee that actually everything in here is good. And you as CFO stroke FD, you're the one that's ultimately responsible. I realize that and appreciate it. 

Hannah Munro: 49:03 

Yeah, that's and that's a scary responsibility. I think we can focus too much sometimes on just getting the numbers and doing our due diligence. And there has to be, you know, time set aside for the protection and the reduction of risk. So, if there are any CFOs listening or FDs listening to this and going, I might need some help with this. What is the, you know, if they want to reach out to you, what's the best way to get hold of you, Robert? 

Unknown: 49:29 

Yeah. 

Robert Brooker: 49:29 

And by yourself or me, Hannah, I'm on LinkedIn. By all means, it's rbrooker@pkf-l.com. Or telephone number is 07917 00182. And I will share that with Hannah afterwards. Hannah's got my details. But if any of you know Hannah better, or you want Hannah to bring it to me because you find it all a bit difficult, a bit awkward, please don't hesitate. I don't mind that at all. I fully understand. If some of you want to ask or run stuff by me, I'm more than happy to work with you to try and help you get an understanding of exactly what that fraud landscape looks like in your business. And let's have a look at others. How do you compare with other organizations within your particular group of companies, families, etc. etc and yes please do and the more the merrier and if people want to just run stuff by me or just have a conversation with Hannah and I think we complement each other perfectly whereby we can help you 

Hannah Munro: 50:32 

Absolutely. And I think there's, so, for anyone that's listening that is, obviously wants to reach out, just so, you know, I'll pop in a link to Robert's profile and obviously the website as well. And, you know, there is, it's amazing. And if you just step back and think, and I think that's the piece, isn't it? It's that step back and actually take the time to understand your exposure. It's amazing. But, you know, thank you, Robert. This has been a fascinating conversation and hopefully food for thought for a lot of those working in finance at the moment. I'm certainly, I must admit, even I learned quite a bit actually from today. So, thank you, Robert. It's been a really interesting session. And thank you for sharing your stories. 

Robert Brooker: 51:13 

Anna, the pleasure has been all mine. I've really enjoyed it. Privileged to get on here. Absolutely honoured to be asked. So, thank you very much indeed for inviting me. It's been great. And if others can learn from it too, we've had a great time. 

Hannah Munro: 51:27 

Absolutely. Let's hope, you know, we never know this podcast might have stopped somebody from doing something or caught somebody from doing something they shouldn't. Hey, that's not a bad aim. 

Robert Brooker: 51:38 

No, not at all. And that's all we're aiming to do, isn’t. 

Hannah Munro: 51:41 

it? Absolutely. 

Robert Brooker: 51:43 

Thank you very much indeed for your time all.